CAS-004 Practice Test 12 — 15 Questions

Question 1

A company is implementing a vendor risk management program. Which THREE of the following should be included in the initial vendor assessment?

Accepted Answer

Financial stability. Financial stability (B) is a critical initial vendor assessment factor because it evaluates the vendor's ability to remain solvent and support long-term contractual obligations. A financially unstable vendor poses a direct risk to service continuity and may be unable to invest in necessary security controls, leading to potential data breaches or service disruptions.

Answer

Employee training records

Answer

Marketing collateral

Question 2

A SOC manager is considering implementing a SOAR platform. Which is the primary benefit of SOAR in day-to-day operations?

Accepted Answer

Automated playbook execution and orchestration of response actions. SOAR automates repetitive tasks and orchestrates workflows, enabling faster and consistent incident response. Option B is wrong because SOAR is not primarily for centralized log storage; that's typically a SIEM or log management system. Option C is wrong because SOAR does not replace human analysts; it augments them. Option D is wrong because reducing false positive alerts is primarily a function of SIEM tuning, not SOAR. SOAR can help by automating responses, but it does not directly reduce false positives.

Answer

Centralized storage of all security logs

Answer

Elimination of the need for human analysts

Answer

Reduction in false positive alerts from the SIEM

Question 3

A large enterprise is implementing a SOAR platform to automate incident response. The security team wants to create a playbook for handling phishing emails reported by users. The playbook should: 1) validate the reported email by checking headers and attachments, 2) automatically block the sender's domain at the email gateway if malicious, 3) create a ticket, and 4) send an automated response to the user. Which of the following describes the best approach to design this playbook?

Accepted Answer

Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.. The best approach is to use automated triage to extract indicators and then present the verdict to an analyst for manual approval before executing blocks. This balances automation with human oversight, reducing false positives and ensuring that blocking actions are justified. It also aligns with SOAR best practices of automating repetitive tasks while keeping critical decisions under human control.

Answer

Create a ticket and route it to a junior analyst for manual investigation, then close after user acknowledgement.

Answer

Immediately sandbox the attachment and block the sender's domain if the sandbox reports malicious behavior.

Answer

Automatically delete the email from all users' inboxes and send a warning to the organization.

Question 4

An organization uses Ansible to automate server configuration for a hybrid cloud environment. The security team requires that sensitive data such as API keys and passwords are not exposed in the Ansible playbooks or logs. The Ansible control node is shared among several administrators. What is the best approach to protect these secrets?

Accepted Answer

Use Ansible Vault to encrypt the secret variables and restrict access to the vault password file.. Ansible Vault encrypts sensitive variables and files so secrets are never stored in plaintext in playbooks or logs. Restricting access to the vault password file ensures only authorized administrators on the shared control node can decrypt the secrets. This satisfies the requirement that secrets not be exposed in playbooks or logs.

Answer

Store secrets in plaintext in a separate file and set restrictive file permissions.

Answer

Remove all secrets from automation and require manual entry during each playbook run.

Answer

Define secrets as environment variables on the control node and reference them in playbooks.

Question 5

A small business wants to achieve compliance with the Payment Card Industry Data Security Standard (PCI DSS). Which of the following is an essential requirement they must implement?

Accepted Answer

Implement logging and monitoring of all access to cardholder data. PCI DSS Requirement 10 mandates logging and monitoring of access to cardholder data. Option B is wrong because encryption in transit is required, not at rest by all merchants. Option C is wrong because quarterly scans are required, not monthly. Option D is wrong because penetration testing is required annually, not continuously.

Answer

Encrypt all cardholder data at rest

Answer

Conduct vulnerability scans on a monthly basis

Answer

Perform continuous penetration testing

Question 6

Which of the following is the primary advantage of using STIX and TAXII for threat intelligence sharing?

Accepted Answer

They allow automated sharing of threat intelligence in a standardized format. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol for exchanging that intelligence. Together, they enable automated sharing of threat intelligence in a standardized format, improving interoperability and speed of information exchange.

Answer

They replace the need for a SIEM system

Answer

They perform dynamic analysis of malware samples

Answer

They provide real-time blocking of malicious IPs

Question 7

Which security metric measures the average time it takes to detect a security incident after it has occurred?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the metric that specifically measures the average elapsed time between when a security incident actually occurs and when it is detected by monitoring, alerting, or analyst investigation. It is a core SOC efficiency metric used to evaluate detection capabilities.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Respond (MTTR)

Answer

Mean Time to Recover (MTTR)

Question 8

A vulnerability scanner reports a critical vulnerability with a CVSS base score of 9.8 on a public-facing web server. However, the server has a compensating control: a Web Application Firewall (WAF) that blocks exploit attempts. How should the security team prioritize patching this vulnerability?

Accepted Answer

Immediately patch the vulnerability as soon as possible. The vulnerability has a CVSS base score of 9.8, which is Critical, and the server is public-facing, meaning it is directly exposed to potential attackers. While a WAF provides a compensating control, it is not a foolproof mitigation—WAFs can be bypassed through evasion techniques, misconfigurations, or zero-day exploits. Therefore, the security team should prioritize immediate patching to eliminate the underlying vulnerability, as recommended by risk management frameworks like NIST and CIS. The WAF reduces immediate risk but does not eliminate it, so patching remains urgent.

Answer

Schedule patching during the next maintenance window

Answer

Defer patching indefinitely since the WAF mitigates the risk

Answer

Increase the WAF rule strictness and delay patching

Question 9

A company is designing a new multi-tier web application. The security team recommends placing a web application firewall (WAF) in front of the web servers and a network firewall between the web and application tiers. Which security architecture principle does this represent?

Accepted Answer

Defense in depth. Defense in depth. This architecture implements multiple, overlapping layers of security controls: a WAF at the application layer (Layer 7) to inspect and filter HTTP/HTTPS traffic for web-specific attacks (e.g., SQL injection, XSS), and a network firewall between the web and application tiers to enforce stateful packet inspection and access control at Layers 3/4. This layered approach ensures that if one control fails or is bypassed, another control still provides protection, embodying the core principle of defense in depth.

Answer

Separation of duties

Answer

Least privilege

Answer

Single point of failure

Question 10

A security architect is evaluating web application firewall (WAF) features to protect against common attacks. Which TWO of the following attacks can a WAF most effectively prevent?

Accepted Answer

Cross-site scripting (XSS). A WAF is designed to inspect HTTP/HTTPS request and response payloads and apply rule sets (e.g., OWASP ModSecurity Core Rule Set) to block injection-style attacks, so option B (cross-site scripting, XSS) is correct because a WAF can detect and block malicious script payloads such as <script> tags or event handlers in parameters, headers, and bodies. Option C (SQL injection) is also correct because a WAF can match SQL meta-characters and known injection patterns like ' OR 1=1-- or UNION SELECT to stop malicious queries before they reach the database. Option A (session hijacking) is not primarily a WAF function, since it depends on stealing or predicting session tokens and is better mitigated by TLS, HttpOnly/Secure cookies, and token rotation. Option D (DDoS) is not effectively handled by a WAF alone; volumetric and network-layer floods require scrubbing centers, CDNs, or dedicated DDoS protection. Option E (CSRF) is not reliably prevented by a WAF because it exploits a victim's authenticated browser session, and the proper defenses are anti-CSRF tokens, SameSite cookies, and origin/referer validation.

Answer

Session hijacking

Answer

Distributed denial-of-service (DDoS)

Answer

Cross-site request forgery (CSRF)

Question 11

During a malware analysis, an analyst runs a suspicious binary in a sandbox and observes that it attempts to communicate with a known malicious IP address, modifies registry keys, and creates a service. The analyst then extracts strings from the binary and finds references to a specific C2 server. Which analysis phase does the extraction of strings represent?

Accepted Answer

Static analysis. Extracting strings from a binary is a static analysis technique because it examines the file's contents without executing it. The strings command or similar tools reveal embedded text such as URLs, IP addresses, and error messages, which can provide immediate indicators of compromise like the C2 server address.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory analysis

Question 12

A security team is implementing a threat intelligence program and wants to consume intelligence from various sources. Which TWO of the following are commonly used threat intelligence feeds or sharing mechanisms? (Select TWO.)

Accepted Answer

ISACs. ISACs (Information Sharing and Analysis Centers) are sector-specific organizations that collect, analyze, and share threat intelligence among their members, making them a standard threat intelligence sharing mechanism. STIX/TAXII is also correct: STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the application-layer protocol used to exchange that STIX data over HTTPS. By contrast, DNS, SMTP, and HTTP are general-purpose network protocols used for name resolution, email transport, and web communication respectively; while threat intelligence may traverse them, they are not themselves threat intelligence feeds or sharing mechanisms.

Answer

DNS

Answer

SMTP

Answer

HTTP

Question 13

Which of the following is a secure method for storing secrets (e.g., API keys, passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service. A dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provides encryption at rest and in transit, automatic rotation, fine-grained access control via IAM policies, and audit logging. This prevents secrets from being exposed in configuration files, environment dumps, or version control, which is essential for cloud-native applications that must adhere to the principle of least privilege and compliance standards like SOC 2 or PCI DSS.

Answer

Encode secrets in base64 in configuration files

Answer

Store secrets in environment variables

Answer

Hardcode secrets in the source code

Question 14

Which of the following best describes the primary security benefit of using immutable infrastructure in a containerized environment?

Accepted Answer

It prevents unauthorized modifications to running containers.. Immutable infrastructure ensures that once a container image is built and deployed, it is never modified in place. If a change is needed, a new image is built and deployed, replacing the old container entirely. This prevents unauthorized or unplanned modifications to running containers, which is the primary security benefit because it eliminates configuration drift and reduces the attack surface from runtime tampering.

Answer

It reduces resource consumption by reusing containers.

Answer

It automates patching of container images.

Answer

It eliminates the need for container security scanning.

Question 15

A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?

Accepted Answer

Encrypt the data at rest and in transit, and implement IAM policies. Encrypting data at rest (using AES-256 or similar) and in transit (using TLS 1.2/1.3 or IPsec) ensures confidentiality during migration and after the ERP is hosted in the cloud. Implementing IAM policies with least-privilege access controls prevents unauthorized access to the sensitive financial data, addressing both data protection and access management requirements for a public cloud IaaS environment.

Answer

Leverage the cloud provider's default security groups and disable encryption

Answer

Migrate the ERP without changes and apply encryption after migration

Answer

Use a VPN to connect on-premises and cloud while keeping data unencrypted