CAS-004 Practice Test 16 — 15 Questions

Question 1

An organization is moving to a passwordless authentication approach. They require a solution that supports hardware-based cryptographic authentication and is resistant to phishing. Which standard should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn uses public-key cryptography and hardware authenticators to provide phishing-resistant, passwordless authentication. TOTP is not passwordless and can be phished.

Answer

TOTP (Time-based One-Time Password)

Answer

SMS-based one-time codes

Answer

Password manager with autofill

Question 2

Drag and drop the steps to perform a vulnerability scan using Nessus into the correct order.

Accepted Answer

Configure policy, then set targets, then run scan, then review results, then report.. Vulnerability scanning: configure policy, set targets, run scan, review results, and report.

Answer

Set targets, then configure policy, then run scan, then review results, then report.

Answer

Configure policy, then run scan, then set targets, then review results, then report.

Answer

Configure policy, then set targets, then review results, then run scan, then report.

Question 3

An organization has identified a vulnerability in a legacy system that cannot be patched. The system is critical for operations, and the cost of mitigating the vulnerability exceeds the potential loss. Which risk treatment option is most appropriate?

Accepted Answer

Risk acceptance. Risk acceptance is the appropriate treatment when a vulnerability cannot be mitigated (legacy system, no patch available), the system is critical to operations (so avoidance is not feasible), and the cost of mitigation exceeds the potential loss. The organization formally acknowledges the residual risk and documents the decision, often with compensating controls and management sign-off. This is a deliberate, documented business decision rather than neglect.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 4

A virtualization administrator needs to ensure that virtual machines (VMs) from different customers cannot communicate with each other unless explicitly allowed. Which network security control should be implemented on the hypervisor?

Accepted Answer

Use a virtual firewall to create per-VM security groups. A virtual firewall applied at the hypervisor level can enforce per-VM security groups, micro-segmentation, and explicit allow rules between VMs, which is exactly what is needed to prevent cross-customer communication unless permitted. This is the standard control for multi-tenant isolation at the virtualization layer.

Answer

Patch the hypervisor regularly

Answer

Assign each VM to a different physical server

Answer

Enable hypervisor memory overcommitment

Question 5

An organization deploys honeypots to detect attackers. Which type of deception technology is being used?

Accepted Answer

Honeypots. Honeypots are decoy systems designed to lure attackers and detect unauthorized activity.

Answer

Honeytokens

Answer

Bait networks

Answer

Honeynets

Question 6

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

Accepted Answer

Lack of visibility into vendor security practices. A is correct because organizations often lack visibility into vendor security practices, meaning they cannot verify whether vendors comply with security policies or contractual obligations. This challenge arises when vendors do not provide access to their security controls, audit reports, or real-time monitoring data, leaving gaps in the risk assessment process.

Answer

Over-automation of risk scoring

Answer

Excessive cooperation from vendors

Question 7

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

Accepted Answer

Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.. A Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Answer

Store the private keys in an encrypted database on a separate database server.

Answer

Use a software-based key vault that runs on the same operating system as the web server.

Answer

Store the private keys in a local file with restricted permissions on the application server.

Question 8

A security administrator needs to secure remote access for employees using personal devices. The company requires that company data be encrypted and that the device be wiped if lost. Which solution best meets these requirements?

Accepted Answer

Deploy a mobile device management (MDM) solution that enforces device encryption and supports remote wipe.. Mobile device management (MDM) solutions are specifically designed to enforce security policies on personal devices, including mandatory device encryption (e.g., AES-256 for data at rest) and the ability to perform a remote wipe (factory reset) to destroy company data if the device is lost or stolen. This directly addresses the requirement to protect company data on unmanaged, employee-owned devices.

Answer

Use network access control (NAC) to allow only compliant devices onto the network.

Answer

Require employees to connect via a corporate VPN and use two-factor authentication.

Answer

Implement remote desktop protocol (RDP) gateways for all remote access.

Question 9

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. The most significant security concern is that multiple services share the same symmetric key. With a shared symmetric key, any service can forge tokens that are accepted by other services, leading to a lack of non-repudiation and increased blast radius if one service is compromised. This violates the principle of least privilege and increases the risk of token forgery.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set

Question 10

An organization wants to deploy a technology that lures attackers into a controlled environment to observe their tactics, techniques, and procedures (TTPs). Which deception technology should the organization implement?

Accepted Answer

Honeypot. A honeypot is a decoy system intentionally designed to attract and deceive attackers, allowing defenders to observe their tactics, techniques, and procedures (TTPs) in a controlled environment. It mimics vulnerable services or entire networks, and any interaction with it is inherently suspicious, providing high-fidelity threat intelligence with minimal false positives. This matches the requirement to 'lure attackers into a controlled environment' for TTP observation.

Answer

Honeytoken

Answer

EDR

Answer

SIEM

Question 11

Which risk management framework is specifically designed for U.S. federal agencies and includes a six-step process: Categorize, Select, Implement, Assess, Authorize, and Monitor?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) is the framework specifically designed for U.S. federal agencies and is defined by NIST SP 800-37. It prescribes exactly the six-step process named in the question: Categorize, Select, Implement, Assess, Authorize, and Monitor. This lifecycle aligns with FISMA requirements for federal information systems.

Answer

ISO 27005

Answer

COBIT

Answer

FAIR

Question 12

Which technology is used to discover and control cloud applications, enforce security policies, and provide visibility into cloud usage?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) is specifically designed to discover cloud applications in use (shadow IT), enforce security policies, and provide visibility and governance over cloud service usage. It sits between users and cloud providers, applying policy via inline proxies or API integrations. This matches the question's three requirements — discovery, policy enforcement, and visibility — which are CASB's core functions.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 13

During a security assessment, a penetration tester discovers that a web application fails to validate the size of user input, leading to a buffer overflow. Which application security control would have BEST prevented this vulnerability?

Accepted Answer

Input validation. Input validation is the application security control that directly prevents buffer overflow by ensuring that user-supplied data does not exceed the allocated buffer size. It checks the length, type, and format of input before processing, thereby mitigating the vulnerability at its source.

Answer

Static application security testing (SAST)

Answer

Web application firewall (WAF)

Answer

Rate limiting

Question 14

An organization wants to protect cryptographic keys used for TLS termination. Which hardware solution should be deployed to prevent key extraction?

Accepted Answer

HSM. A Hardware Security Module (HSM) is a dedicated tamper-resistant hardware appliance designed to generate, store, and manage cryptographic keys, with physical and logical protections that prevent key extraction. For TLS termination, HSMs provide FIPS 140-2/3 validated key storage and can perform cryptographic operations without exposing private keys. This directly addresses the requirement to prevent key extraction.

Answer

KMS

Answer

TPM

Answer

UEFI

Question 15

A security manager is reviewing the company's vendor risk management program. Which of the following should be included as a mandatory step BEFORE entering into a contract with a new cloud service provider?

Accepted Answer

Conducting a third-party security assessment. A third-party security assessment is a mandatory due diligence step before entering into a contract with a new cloud service provider. This assessment evaluates the vendor's security controls, compliance posture, and risk profile against the organization's requirements, ensuring that the vendor meets minimum security standards before any data or systems are entrusted to them. Without this pre-contract assessment, the organization would be accepting unknown risks that could lead to data breaches or compliance violations.

Answer

Establishing an incident response plan

Answer

Performing a penetration test of the vendor's infrastructure

Answer

Requesting monthly vulnerability reports