CAS-004 Practice Test 10 — 10 Questions

Question 1

Which document in a security policy hierarchy provides specific step-by-step instructions for performing a task?

Accepted Answer

Procedure. A procedure is the only document in a security policy hierarchy that provides detailed, step-by-step instructions for performing a specific task. It translates high-level policies and standards into actionable steps that employees can follow to ensure consistency and compliance. Procedures are operational in nature and answer 'how' to implement the requirements.

Answer

Guideline

Answer

Standard

Answer

Policy

Question 2

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. A SOC 2 report that does not cover HIPAA controls does not satisfy the requirement; the BAA is the contractual mechanism that binds the cloud provider to HIPAA safeguards and breach notification obligations. Therefore, requiring the provider to sign a BAA is the best course of action before migrating PHI.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 3

A penetration tester is performing reconnaissance against a target. Which TWO of the following are examples of active reconnaissance? (Select TWO.)

Accepted Answer

Banner grabbing. Banner grabbing (A) is active reconnaissance because the tester directly connects to target services (e.g., via netcat or telnet to a port) and reads the service's response banner, which generates traffic and can be logged by the target. Port scanning (C) is also active reconnaissance since tools like Nmap send TCP SYN, TCP connect, or UDP probes directly to the target's IP addresses to discover open ports, again interacting with the target's systems. In contrast, social media profiling (B), WHOIS lookup (D), and searching job postings (E) are passive reconnaissance techniques that rely on publicly available third-party information without directly touching the target's infrastructure, so they do not qualify as active reconnaissance.

Answer

Social media profiling

Answer

WHOIS lookup

Answer

Searching job postings for technology details

Question 4

A company is implementing a zero-trust network architecture. Which of the following components is essential for enforcing micro-segmentation?

Accepted Answer

Software-defined networking (SDN) with distributed firewalls. Software-defined networking (SDN) with distributed firewalls is essential for enforcing micro-segmentation because it enables granular, policy-based traffic control at the virtual network layer, independent of physical topology. SDN centralizes policy management and pushes firewall rules to hypervisor-level or host-level enforcement points, allowing east-west traffic to be segmented between individual workloads or application tiers without relying on traditional perimeter firewalls.

Answer

Security information and event management (SIEM) system

Answer

Multi-factor authentication (MFA)

Answer

Network access control (NAC)

Question 5

An organization is implementing continuous compliance monitoring. Which of the following metrics would best indicate whether the organization is maintaining compliance with PCI DSS Requirement 10 (log management)?

Accepted Answer

Percentage of systems with centralized logging enabled. PCI DSS Requirement 10 requires that audit logs be collected, retained, and reviewed, and centralized logging is a key control to ensure logs from all in-scope systems are captured in a tamper-resistant manner. The percentage of systems with centralized logging enabled directly measures coverage of this control. A high percentage indicates the organization is maintaining the log management requirement across its cardholder data environment.

Answer

Number of failed login attempts per day

Answer

Mean time to detect (MTTD) for security incidents

Answer

Vulnerability scan pass rate

Question 6

A security architect is designing a secure coding standard for a web application. Which of the following should be prioritized to mitigate cross-site scripting (XSS) risks?

Accepted Answer

Output encoding. Output encoding is the primary defense against cross-site scripting (XSS) because it neutralizes injected scripts by converting special characters (e.g., <, >, &, ") into their HTML entity equivalents (e.g., < > & ") before the data is rendered in the browser. This ensures that user-supplied data is treated as text, not executable code, regardless of how it entered the application. Input validation alone is insufficient because it can be bypassed via alternate encodings or allowed characters that are still dangerous in certain contexts.

Answer

Input validation

Answer

Secure cookies

Answer

Parameterized queries

Question 7

Which of the following is the BEST definition of a risk register?

Accepted Answer

A list of identified risks with associated attributes such as impact, likelihood, and owner.. A risk register is a foundational document in risk management that systematically catalogs identified risks along with key attributes such as impact, likelihood, risk score, and assigned owner. This structured record enables ongoing tracking, prioritization, and mitigation of risks throughout the system development lifecycle or operational environment. In the context of CAS-004, the risk register is the primary artifact used to support governance and compliance activities, ensuring that risk treatment decisions are documented and auditable.

Answer

A report of audit findings and non-conformities.

Answer

A document that outlines the organization's risk appetite.

Answer

A tool used to automate risk assessment processes.

Question 8

A security assessor is reviewing a containerized application. Which three of the following practices help secure the container runtime environment? (Select the three best options.)

Accepted Answer

Run the container with a read-only root filesystem. Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Answer

Use the latest base image from Docker Hub

Question 9

A security architect is designing a PKI for a large enterprise that issues certificates to thousands of users and devices. The architect wants to implement a mechanism to efficiently check certificate revocation status without requiring clients to download a full CRL. Which TWO technologies should be considered?

Accepted Answer

OCSP stapling. Option C (OCSP stapling) is correct because it lets the server obtain a signed, time-stamped OCSP response from the CA and present it during the TLS handshake, so clients get revocation status without contacting the OCSP responder themselves, reducing latency and load. Option D (Online Certificate Status Protocol, OCSP) is correct because it is the standard protocol for querying a responder about a single certificate's revocation status, returning good, revoked, or unknown, which avoids downloading an entire CRL. Option A (CRL distribution points) is not appropriate here because it points clients to full CRLs, which is exactly the bulk-download behavior the architect wants to avoid. Option B (certificate transparency logs) is unrelated to revocation checking; CT logs provide public auditability of issued certificates, not revocation status. Option E (delta CRL) still relies on CRL downloads (a base CRL plus deltas), so it does not meet the goal of avoiding full CRL retrieval.

Answer

CRL distribution points

Answer

Certificate transparency logs

Answer

Delta CRL

Question 10

A company is implementing a new vendor risk management program. Which of the following is the BEST approach to assess third-party security controls?

Accepted Answer

Use a standardized security questionnaire and conduct on-site audits. The best approach to assess third-party security controls is to use a standardized security questionnaire (e.g., based on ISO 27001, NIST, or SIG) combined with on-site audits. This provides a structured, verifiable assessment that goes beyond self-reported claims and allows the organization to validate the vendor's actual security posture.

Answer

Check the vendor’s financial stability

Answer

Rely on the vendor’s self-assessment questionnaire

Answer

Review only public breach reports about the vendor