CAS-004 Practice Test 14 — 15 Questions

Question 1

A security analyst is reviewing a malware sample in a sandbox environment. The analyst notes that the malware attempts to check for the presence of a debugger and modifies its behavior if one is detected. Additionally, the malware uses encrypted strings and resolves API calls dynamically. Which THREE analysis techniques would be most effective for understanding this malware's capabilities? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static analysis using a disassembler like IDA Pro to examine the code for anti-debugging and obfuscation techniques. Option A is correct because static analysis with a disassembler such as IDA Pro lets the analyst inspect the binary's code directly, revealing the anti-debugging checks (e.g., IsDebuggerPresent, PEB BeingDebugged flag) and the obfuscation/encrypted-string routines without executing the sample. Option D is correct because dynamic analysis in a sandbox observes the malware's actual runtime behavior, and since the sample alters its behavior when a debugger is detected, running it in an instrumented sandbox (without an attached debugger) exposes the alternate execution path and its true capabilities. Option E is correct because memory analysis with Volatility captures the malware's process memory, allowing recovery of dynamically resolved API addresses, decrypted strings, and unpacked code that never appear on disk. Option B is not among the correct answers because Wireshark packet capture only shows network traffic and cannot reveal the anti-debugging logic, encrypted strings, or dynamic API resolution central to this sample. Option C is not among the correct answers because VirusTotal hash lookups only provide reputation and prior detection data, not an understanding of the malware's internal capabilities.

Answer

Network analysis using Wireshark to capture packets from the sandbox

Answer

Hash analysis by submitting the malware to VirusTotal

Question 2

Which three measures should be implemented to secure a RESTful API? (Select THREE.)

Accepted Answer

Implement proper error handling that does not expose stack traces. Proper error handling in a RESTful API must never expose stack traces or internal implementation details to the client. Stack traces can reveal file paths, database schemas, library versions, and logic flows that attackers can exploit to craft targeted attacks. Instead, the API should return generic error messages (e.g., '500 Internal Server Error') while logging full details server-side for debugging.

Answer

Use JSONP for cross-origin requests

Answer

Disable rate limiting to ensure availability

Question 3

A security architect is evaluating a new SIEM solution for a large enterprise. Which THREE of the following capabilities are CRITICAL for effective threat detection and response? (Choose three.)

Accepted Answer

Real-time correlation of events from multiple sources. Real-time correlation of events from multiple sources is critical because it enables the SIEM to aggregate and analyze logs from diverse systems (firewalls, endpoints, servers) simultaneously, identifying complex attack patterns like lateral movement or multi-stage exploits that would be invisible in isolated logs. This capability directly supports timely detection and automated response, which is the core function of a SIEM in a large enterprise.

Answer

Scheduled vulnerability scanning

Answer

Automated patch management

Question 4

An organization wants to implement infrastructure as code (IaC) with immutable infrastructure. Which security benefit does immutable infrastructure provide?

Accepted Answer

Reduced attack surface due to consistent configurations. Immutable infrastructure means servers and components are never modified after deployment — instead, changes require replacing the entire instance with a newly built, tested image. This eliminates configuration drift, ensures every instance matches a known-good baseline, and removes the accumulated patches, leftover packages, and ad-hoc changes that attackers exploit, thereby reducing the attack surface. The other options describe operational or performance benefits, not the core security advantage.

Answer

Better performance through caching

Answer

Simpler network segmentation

Answer

Easier patch management

Question 5

A security architect is designing a secure boot chain for an IoT device. Which THREE components are essential to ensure the integrity of the firmware update process? (Select THREE.)

Accepted Answer

Firmware update files signed with a private key. Option A is correct because signing firmware update files with a private key lets the device verify authenticity and integrity using the corresponding public key, ensuring only authorized firmware is installed. Option D is correct because a secure OTA delivery mechanism such as TLS protects the update in transit against interception, tampering, and man-in-the-middle modification before it reaches the device. Option E is correct because a hardware root of trust, such as read-only memory storing the public key, provides an immutable anchor that validates the signature and boot chain, preventing attackers from substituting keys or firmware. Option B is not essential to integrity itself; rollback prevention is an anti-downgrade control that addresses version freshness rather than cryptographic integrity. Option C is also not essential, since encryption of firmware at rest protects confidentiality, not the integrity of the update process.

Answer

A mechanism to prevent firmware rollback to older versions

Answer

Encryption of firmware at rest on the device

Question 6

A SOC wants to improve detection of advanced persistent threats (APTs) that evade traditional signature-based tools. Which TWO approaches are most effective? (Select exactly 2.)

Accepted Answer

Deploy honeypots and deception technology. Option D is correct because honeypots and deception technology create decoy assets and fake credentials that have no legitimate production purpose, so any interaction with them is high-fidelity evidence of adversary reconnaissance or lateral movement, which is exactly the kind of stealthy, low-signature behavior APTs exhibit. Option E is correct because integrating external threat intelligence feeds (e.g., STIX/TAXII indicators such as malicious IPs, domains, and file hashes) into the SIEM enriches correlation rules and enables detection of known APT infrastructure and TTPs that signature-based tools miss. Option A is not the best fit because lowering SIEM false positives improves analyst efficiency and alert quality but does not by itself add new detection capability against evasive APTs. Option B is not the best fit because extending log retention to 12 months supports retroactive hunting and forensic timelines but does not directly improve detection of threats that evade signatures. Option C is not the best fit because hiring more analysts adds human capacity for triage and hunting but is not a technical detection approach and scales poorly against advanced threats without supporting tooling.

Answer

Reduce the false positive rate of the SIEM

Answer

Increase log retention period to 12 months

Answer

Hire additional security analysts

Question 7

A security administrator is hardening SSH access to a jump host. The requirement is to allow only key-based authentication and restrict the use of weak cryptographic algorithms. Which of the following configurations accomplishes this?

Accepted Answer

Set PubkeyAuthentication yes, PasswordAuthentication no, and configure Ciphers and MACs to strong algorithms only. It explicitly enables public key authentication (PubkeyAuthentication yes), disables password-based authentication (PasswordAuthentication no), and restricts cryptographic algorithms by configuring the Ciphers and MACs directives to only strong algorithms. This directly satisfies both requirements: key-only authentication and elimination of weak crypto. The other options either leave password authentication enabled or do not address weak algorithms.

Answer

Set PermitRootLogin prohibit-password and PasswordAuthentication yes

Answer

Set PasswordAuthentication yes and use a strong password policy

Answer

Set AuthenticationMethods publickey,keyboard-interactive

Question 8

An organization wants to implement a zero-trust architecture for remote access. Which component is most critical for enforcing least-privilege access to internal applications?

Accepted Answer

Software-defined perimeter (SDP). A Software-Defined Perimeter (SDP) is the most critical component for enforcing least-privilege access in a zero-trust architecture because it implements a 'need-to-know' model where resources are hidden (black cloud) until the user and device are authenticated and authorized. SDP uses a controller to broker connections, dynamically creating single-packet authorization (SPA) and mutual TLS tunnels, ensuring that only authorized users can even see the internal applications. This directly supports zero-trust principles of never trust, always verify, and least-privilege access.

Answer

Virtual private network (VPN) concentrator

Answer

Next-generation firewall (NGFW)

Answer

Intrusion detection system (IDS)

Question 9

Match each acronym to its definition.

Accepted Answer

SIEM: Security Information and Event Management. The correct matches are: SIEM - Security Information and Event Management, SOAR - Security Orchestration, Automation and Response, DLP - Data Loss Prevention, IAM - Identity and Access Management, PAM - Privileged Access Management. Option F is incorrect because it incorrectly pairs SIEM with the definition for SOAR.

Answer

SIEM: Security Orchestration, Automation and Response

Question 10

A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the correct choice because it provides an independent auditor's opinion on the design AND operating effectiveness of a service provider's controls over a period of time (typically 3-12 months). This directly addresses the financial institution's need to assess the provider's control environment and SOC 2 compliance. Type II is specifically designed for vendor due diligence where evidence of sustained control operation is required.

Answer

ISO 27001 certificate

Answer

Penetration test report

Answer

Vulnerability scan results

Question 11

Drag and drop the steps to set up a SIEM alert for a failed login threshold into the correct order.

Accepted Answer

Identify log source, then create rule, then set threshold, then configure response, then enable and test. SIEM rule creation: identify log source, create rule, set threshold, configure response, then enable and test.

Answer

Set threshold, then create rule, then identify log source, then configure response, then enable and test

Answer

Identify log source, then set threshold, then create rule, then configure response, then enable and test

Answer

Create rule, then identify log source, then set threshold, then enable and test, then configure response

Question 12

A DevOps engineer is automating container orchestration using Kubernetes. Which of the following are security best practices to include in the automation? (Choose two.)

Accepted Answer

Enforce Pod Security Policies to restrict privileged containers. Enforcing Pod Security Policies (PSPs) is a critical security best practice in Kubernetes because it restricts the creation of privileged containers, prevents host namespace sharing, and enforces read-only root filesystems. This reduces the attack surface by ensuring that containers run with the least privilege necessary, mitigating risks of container breakout or host compromise. Disabling PSPs or failing to enforce them would allow developers to deploy containers with excessive capabilities, violating the principle of least privilege.

Answer

Disable RBAC to simplify automation scripts

Answer

Allow all network traffic between pods for simplicity

Question 13

A DevOps team uses Ansible to automate server configuration. They need to ensure that sensitive variables like passwords are not exposed in playbook logs or version control. What is the recommended approach?

Accepted Answer

Use Ansible Vault to encrypt sensitive variables. Ansible Vault is the built-in mechanism for encrypting sensitive data such as passwords, API keys, and certificates within Ansible projects. It encrypts variables or files at rest using AES-256, and the vault password is provided at runtime (e.g., via --ask-vault-pass or a vault password file), ensuring secrets are never stored in plaintext in playbook logs or version control. This approach integrates seamlessly with Ansible's workflow without requiring external tools or compromising automation.

Answer

Use environment variables only

Answer

Store secrets in plain text within the playbook

Answer

Encrypt the entire playbook file

Question 14

A company is deploying a just-in-time (JIT) privileged access management solution. Which of the following BEST describes a key security benefit of JIT access?

Accepted Answer

It reduces the risk of lateral movement by limiting the duration of elevated privileges. JIT access grants temporary privileges only when needed, reducing the attack surface and the risk of standing privileges being misused.

Answer

It eliminates the need for multi-factor authentication

Answer

It replaces the need for a break-glass account

Answer

It provides continuous monitoring of all user actions

Question 15

An organization uses a SIEM to collect logs from multiple sources. The security team wants to identify users who are accessing resources outside of normal business hours and exhibiting unusual data transfer patterns. Which advanced SIEM capability would be most effective?

Accepted Answer

User and Entity Behavior Analytics (UEBA). UEBA (User and Entity Behavior Analytics) is designed to baseline normal behavior for users and entities, then detect statistical deviations such as off-hours access and anomalous data transfer volumes. Unlike static rules, UEBA uses machine learning to model each user's typical login times, peer group activity, and data movement patterns, flagging outliers that would otherwise go unnoticed. This makes it the most effective capability for identifying subtle insider-threat or compromised-account behavior described in the scenario.

Answer

Threat intelligence feed integration

Answer

Log normalization and aggregation

Answer

Correlation rules with threshold-based alerts