CAS-004 Practice Test 13 — 15 Questions

Question 1

An organization is evaluating risk treatment options for a critical vulnerability with a CVSS score of 9.8. The cost to remediate is $500,000, and the potential loss if exploited is estimated at $2,000,000. Which risk response is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remediate the vulnerability. With a CVSS score of 9.8 (critical) and a potential loss of $2,000,000, the cost to remediate ($500,000) is significantly lower than the expected loss. Remediation reduces the risk to an acceptable residual level, making it the most cost-effective response. This aligns with the principle that when the cost of remediation is less than the potential loss, the organization should directly fix the vulnerability.

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Answer

Avoid the risk by decommissioning the affected system

Question 2

During a security assessment, a tester finds that a web application accepts user input and directly uses it in an LDAP query without sanitization. Which of the following attacks is most likely to be successful?

Accepted Answer

LDAP injection. The scenario explicitly describes unsanitized user input being used directly in an LDAP query. LDAP injection occurs when an attacker manipulates LDAP statements by injecting special characters (e.g., *, (, ), &, |, !) to alter the query logic, potentially bypassing authentication or extracting unauthorized directory information. This is a direct injection attack against the LDAP protocol (RFC 4511), not against a database or web client.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote file inclusion

Question 3

A PKI administrator is concerned about the risk of a compromised issuing CA. Which certificate transparency feature helps detect unauthorized certificate issuance?

Accepted Answer

Certificate Transparency logs. Certificate Transparency (CT) logs are append-only, publicly auditable logs where CAs must record every certificate they issue (per RFC 6962). Because monitors and browsers can detect certificates that appear in logs without a corresponding legitimate request, unauthorized or mis-issued certificates from a compromised issuing CA become visible. This is the specific mechanism designed to detect rogue issuance, not just validate or revoke certificates.

Answer

CRL distribution points

Answer

OCSP stapling

Answer

Key usage extensions

Question 4

Refer to the exhibit. A security architect is reviewing this S3 bucket policy. Which of the following security concerns is MOST evident?

Accepted Answer

The policy allows public read access. The policy statement includes an `Effect: Allow` with a `Principal: "*"` and an action of `s3:GetObject`, which grants public read access to all objects in the bucket. This is the most evident security concern because it allows any anonymous user on the internet to read data from the bucket, potentially exposing sensitive information.

Answer

The policy denies all write access

Answer

The policy uses an outdated version

Answer

The policy lacks encryption

Question 5

A security team is evaluating endpoint detection and response (EDR) solutions. They want a solution that can detect fileless malware and malicious PowerShell scripts. Which TWO capabilities should the team prioritize? (Choose TWO.)

Accepted Answer

Behavioral monitoring of script execution (e.g., PowerShell). Option C is correct because behavioral monitoring of script execution detects malicious PowerShell activity by analyzing command-line arguments, script block logging (Event ID 4104), and suspicious behaviors like encoded commands or download cradles, which is essential for catching script-based attacks that evade static signatures. Option E is correct because fileless malware resides in memory (e.g., injected into processes like powershell.exe or wmic.exe) rather than on disk, so memory scanning is required to detect these in-memory artifacts, reflective DLL injections, and shellcode that leave no file footprint. Option A is not the priority because signature-based detection relies on known file hashes and patterns, which fileless and obfuscated PowerShell threats typically avoid. Option B, while useful for identifying command-and-control traffic, addresses network-level detection rather than the endpoint fileless/script execution behaviors the team specifically wants. Option D is unrelated to detection, as automated firewall rule creation is a response/containment action, not a detection capability for fileless malware or malicious scripts.

Answer

Signature-based detection of known malware

Answer

Network traffic analysis for C2 communication

Answer

Automated firewall rule creation

Question 6

A financial institution must ensure that its data classification policy aligns with regulatory requirements for customer financial information. Which of the following actions best demonstrates governance in this context?

Accepted Answer

Implement a formal data classification policy that maps data types to regulatory categories and enforce it via technical controls.. It directly implements governance by establishing a formal data classification policy that maps data types to specific regulatory categories (e.g., PCI DSS, GLBA, SOX) and enforces compliance through technical controls such as Data Loss Prevention (DLP) rules, access control lists (ACLs), and encryption policies. This structured approach ensures that customer financial information is consistently protected according to legal requirements, rather than relying on ad-hoc or incomplete measures.

Answer

Restrict all customer financial data to a single secure server without labeling.

Answer

Allow data owners to classify data on an ad-hoc basis as needed.

Answer

Encrypt all customer data at rest and in transit regardless of classification.

Question 7

A company is migrating critical workloads to AWS and must secure data at rest. They need to maintain control over the encryption keys. Which service should they use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated hardware security modules that give the customer full control over encryption keys, including key generation, storage, and management. It meets the requirement of maintaining control over keys for data at rest because the keys are stored in tamper-resistant hardware and are not accessible to AWS. Other services like Secrets Manager and ACM manage keys but do not offer the same level of customer-controlled key custody.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Question 8

A developer is creating a REST API that handles sensitive data. Which HTTP method should be used for updates that are not idempotent?

Accepted Answer

POST. POST is correct because it is not idempotent, meaning multiple identical requests can result in different outcomes (e.g., creating a new resource each time). For updates that are not idempotent, POST is the appropriate HTTP method as it allows side effects such as appending data or triggering a process, unlike PUT which is idempotent and replaces the entire resource.

Answer

DELETE

Answer

GET

Answer

PUT

Question 9

A network administrator is configuring a firewall rule set. The requirement is to allow inbound HTTPS traffic from the internet to a web server at 10.1.1.10, and to allow the web server to respond. All other inbound traffic should be blocked. Which rule set accomplishes this?

Accepted Answer

Allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound. HTTPS uses TCP port 443, and the rule set correctly allows inbound TCP 443 to the web server at 10.1.1.10, permits the server's outbound responses (stateful or explicit), and then denies all other inbound traffic. This matches the requirement to allow only HTTPS traffic from the internet while blocking everything else.

Answer

Allow inbound TCP 80 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Answer

Deny all inbound; allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10

Answer

Allow inbound TCP 22 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Question 10

Which key exchange algorithm provides perfect forward secrecy (PFS) and is recommended for use in TLS 1.3?

Accepted Answer

ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides PFS as session keys are ephemeral.

Answer

RSA key exchange

Answer

Pre-shared key (PSK)

Answer

Diffie-Hellman (DH)

Question 11

Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?

Accepted Answer

Configure fail2ban to block the IP address after a threshold of failed attempts.. Configuring fail2ban to block the IP address after a threshold of failed attempts is the most appropriate immediate action because it dynamically mitigates brute-force attacks by temporarily banning offending IPs. This approach is targeted and automated, reducing the attack surface without disrupting legitimate users. It directly addresses the observed repeated failed login attempts in the auth.log.

Answer

Disable root login and remove the admin account.

Answer

Block the entire 192.168.1.0/24 subnet at the firewall.

Answer

Change the SSH port to a non-standard port.

Question 12

An analyst needs to automate the extraction of indicators of compromise (IOCs) from log files generated by various systems. Which scripting language is most commonly used for cross-platform log parsing and automation due to its extensive library support?

Accepted Answer

Python. Python is the correct answer because it is a cross-platform scripting language with extensive standard libraries (e.g., `re` for regex, `json`, `csv`, `logging`) and third-party packages (e.g., `pandas`, `yara-python`, `stix2`) that simplify parsing diverse log formats and automating IOC extraction. Its portability across Windows, Linux, and macOS makes it ideal for environments with heterogeneous systems, unlike platform-specific alternatives.

Answer

PowerShell

Answer

Bash

Answer

JavaScript

Question 13

An organization wants to detect and respond to advanced threats that may evade traditional endpoint security solutions. They deploy an EDR solution that provides real-time visibility into endpoint activities. However, the security team is overwhelmed by alerts. Which technology can be integrated with EDR to automate response actions and reduce alert fatigue?

Accepted Answer

SOAR platform. A SOAR (Security Orchestration, Automation, and Response) platform integrates with EDR and other security tools to automate response actions such as isolating endpoints, blocking IPs, and enriching alerts, which directly reduces alert fatigue by handling repetitive triage tasks. SOAR playbooks codify response procedures and can execute them at machine speed, freeing analysts for higher-value work.

Answer

SIEM with correlation rules

Answer

Network traffic analysis (NTA)

Answer

Deception technology

Question 14

Which component of the MITRE ATT&CK framework categorizes the 'why' of an adversary's action, such as initial access or credential access?

Accepted Answer

Tactics. In MITRE ATT&CK, tactics represent the adversary's tactical goal — the 'why' behind an action — such as Initial Access, Execution, Persistence, or Credential Access. Techniques describe the 'how' (specific methods), and procedures describe the specific implementation. The question explicitly asks for the 'why,' which maps to tactics.

Answer

Mitigations

Answer

Procedures

Answer

Techniques

Question 15

During a red team exercise, the team gains access to a workstation and needs to maintain persistence. They modify a registry run key to execute a payload. However, the organization uses EDR that monitors registry changes. Which technique could the red team use to avoid detection?

Accepted Answer

Use a LOLBin to execute the payload via a scheduled task. Using a LOLBin (Living Off the Land Binary) such as schtasks.exe, regsvr32.exe, or mshta.exe to trigger the payload via a scheduled task avoids writing to the classic Run/RunOnce registry keys that EDR products heavily monitor. Scheduled tasks are a native Windows persistence mechanism, and when invoked through signed Microsoft binaries, the activity blends into legitimate administrative behavior. This reduces the registry-change telemetry that would otherwise flag the Run key modification.

Answer

Delete the registry key after execution

Answer

Change the registry key to a less suspicious name

Answer

Encrypt the registry key value