CAS-004 Practice Test 17 — 15 Questions

Question 1

A small business wants to achieve compliance with PCI DSS. Which approach should they take to minimize the scope of the assessment?

Accepted Answer

Segment the cardholder data environment from the corporate network. Segmenting the cardholder data environment (CDE) from the corporate network using firewalls or VLANs physically or logically isolates systems that store, process, or transmit cardholder data. This reduces the number of systems and network segments that fall under PCI DSS assessment scope, because only devices within the CDE segment must comply with the full set of requirements. By minimizing the attack surface and the number of controls to validate, segmentation directly lowers the cost and complexity of the assessment.

Answer

Implement a tokenization service

Answer

Encrypt all cardholder data at rest

Answer

Train employees on security awareness

Question 2

A SOC analyst is investigating a suspicious process that is making outbound connections to an unknown IP address. The analyst wants to examine the process memory for injected code. Which Volatility plugin is most appropriate for detecting code injection by listing all Virtual Address Descriptors (VADs) that are mapped as executable and writable?

Accepted Answer

malfind. The malfind Volatility plugin is designed to detect code injection by scanning for memory regions that are both executable and writable, which is atypical for legitimate code. It lists Virtual Address Descriptors (VADs) with these permissions and can identify injected code, such as that from malware. This directly addresses the analyst's need to examine process memory for injected code.

Answer

netscan

Answer

pslist

Answer

dlllist

Question 3

A security engineer is configuring SSH for a jump host used to access critical servers. The engineer wants to restrict the cryptographic algorithms to the most secure options. Which of the following should be DISABLED?

Accepted Answer

Diffie-Hellman group-exchange with SHA-1. Diffie-Hellman group exchange with SHA-1 uses the SHA-1 hash for key exchange integrity, and SHA-1 is cryptographically broken (collision attacks demonstrated) and deprecated by NIST. For a hardened jump host, this kex algorithm should be disabled in favor of SHA-2-based groups like diffie-hellman-group-exchange-sha256 or curve25519-sha256.

Answer

AES-256-CTR

Answer

Ed25519 for host keys

Answer

HMAC-SHA2-256

Question 4

A penetration tester is performing a test against a web application. During active reconnaissance, the tester discovers that the application discloses version numbers in HTTP headers. Which phase of the penetration testing lifecycle does this activity belong to?

Accepted Answer

Reconnaissance. Active reconnaissance involves directly interacting with the target to gather information, such as by sending probes and analyzing responses. Discovering version numbers via HTTP headers is a form of active reconnaissance because the tester is making requests and inferring information from the responses.

Answer

Post-exploitation

Answer

Exploitation

Answer

Reporting

Question 5

A security analyst is reviewing a web application's authentication mechanism. Which of the following are best practices to prevent session hijacking? (Select TWO.)

Accepted Answer

Regenerate session ID upon successful login. Regenerating the session ID upon successful login (option A) is a critical defense against session fixation attacks, where an attacker forces a known session ID on a user before authentication. By issuing a new, server-generated session ID after login, the application ensures that any pre-authentication session ID controlled by an attacker becomes invalid. This practice is recommended by OWASP and aligns with RFC 6265 session management guidelines.

Answer

Set the session timeout to 5 minutes

Answer

Use the same session ID before and after authentication

Answer

Store session tokens in localStorage

Question 6

A security analyst is reviewing a suspicious email reported by a user. The email contains an attachment named 'invoice.pdf.exe'. Which type of malware analysis technique should the analyst perform first to determine if the file is malicious?

Accepted Answer

Static analysis. Static analysis examines the file without executing it, inspecting headers, strings, hashes, and embedded indicators (e.g., PE headers, suspicious imports) to quickly determine if it is malicious. For a double-extension file like 'invoice.pdf.exe', static analysis is the safest first step because it avoids any risk of execution and can often reveal known malware signatures or obfuscation. It is faster and less resource-intensive than dynamic analysis or reverse engineering, making it the standard initial triage technique.

Answer

Reverse engineering

Answer

Dynamic analysis in a sandbox

Answer

Memory forensics

Question 7

A container orchestration platform uses secrets management. Which two methods are recommended for injecting secrets into containers? (Choose two.)

Accepted Answer

Use Kubernetes Secrets mounted as files.. Option C is correct because Kubernetes Secrets can be mounted into a pod as files via a volume, keeping the secret data out of the image and source code while making it available at a filesystem path the container can read at runtime. Option E is correct because mounting a volume from an external secret store such as HashiCorp Vault (often via a CSI driver or sidecar injector) delivers secrets dynamically at runtime, supports rotation, and avoids baking credentials into the image or repository. Options A and D are not recommended because storing secrets in environment variables in the image or passing them via command-line arguments in the Dockerfile embeds them in image layers and metadata, where they can be extracted by anyone with image access. Option B is not recommended because hardcoding secrets in application source code exposes them to anyone with repository access and makes rotation and auditing extremely difficult.

Answer

Store secrets in environment variables in the container image.

Answer

Hardcode secrets in the application source code.

Answer

Pass secrets via command-line arguments in the Dockerfile.

Question 8

A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)

Accepted Answer

Dropping all capabilities (CAP_DROP=ALL). Dropping all capabilities with `CAP_DROP=ALL` removes all Linux capabilities from the container, effectively preventing any process inside from performing privileged operations such as changing user IDs, mounting filesystems, or accessing kernel features that could lead to privilege escalation. This is a fundamental container security best practice, as capabilities are the primary mechanism for granting fine-grained privileges to container processes.

Answer

Enabling SELinux

Answer

Using host networking

Answer

Mounting /var/run/docker.sock

Question 9

A DevOps team is automating the deployment of a containerized application to production. Which THREE practices are essential for maintaining security and reliability? (Select THREE.)

Accepted Answer

Use Helm charts to package and deploy Kubernetes applications.. Helm charts are essential for packaging and deploying Kubernetes applications because they provide a standardized, version-controlled way to manage complex Kubernetes manifests. Helm simplifies deployment, rollback, and dependency management, which is critical for maintaining security and reliability in production environments.

Answer

Use Docker Compose files for production deployments.

Answer

Manually configure each environment to handle unique settings.

Question 10

An organization is deploying hardware security modules (HSMs) to protect cryptographic keys used for digital signatures. Which attack vector is most effectively mitigated by using an HSM compared to storing keys in software?

Accepted Answer

Key extraction from memory dumps. HSMs are designed to store cryptographic keys in tamper-resistant hardware, preventing attackers from extracting keys via memory dumps. Unlike software-based storage, where keys reside in volatile or non-volatile memory and can be read through process memory inspection or cold boot attacks, HSMs ensure keys never leave the secure boundary in plaintext form.

Answer

Side-channel attacks on the host CPU

Answer

Man-in-the-middle attacks on cryptographic operations

Answer

Brute-force attacks on key strength

Question 11

An organization's business continuity plan (BCP) includes a recovery time objective (RTO) of 4 hours for its critical ERP system. During a disaster, the system is restored in 5 hours. Which of the following is the MOST significant impact?

Accepted Answer

Unacceptable business downtime and potential contractual penalties. The RTO of 4 hours defines the maximum acceptable downtime for the ERP system. Restoring it in 5 hours exceeds this threshold, resulting in unacceptable business downtime. This can trigger contractual penalties if service-level agreements (SLAs) specify a 4-hour RTO, as the organization failed to meet its recovery commitment.

Answer

Need to reroute network traffic to the DR site

Answer

Higher cost for cyber insurance premiums

Answer

Increased recovery point objective (RPO) for the last backup

Question 12

A security operations team is implementing deception technology to detect lateral movement. Which TWO of the following are examples of deception technologies? (Select TWO.)

Accepted Answer

Honeytoken. Option A (Honeytoken) is correct because a honeytoken is a fake credential, file, or data artifact (such as a dummy AWS key or a planted document) that has no legitimate use; any access or use of it signals unauthorized activity and potential lateral movement, making it a classic deception technology. Option E (Honeypot) is correct because a honeypot is a decoy system or service deliberately exposed to attract attackers, and interactions with it reveal reconnaissance or lateral movement attempts while generating high-fidelity alerts with minimal false positives. Option B (Intrusion prevention system) is not a deception technology; an IPS is a preventive control that inspects traffic inline and blocks malicious activity based on signatures or anomalies. Option C (Endpoint detection and response, EDR) is not deception either; EDR continuously monitors endpoint telemetry and responds to threats but does not rely on decoys. Option D (Security information and event management, SIEM) is a log aggregation, correlation, and alerting platform, not a deception mechanism, so it does not belong.

Answer

Intrusion prevention system

Answer

Endpoint detection and response (EDR)

Answer

Security information and event management (SIEM)

Question 13

A security team needs to implement a CI/CD pipeline that automatically scans container images for vulnerabilities before deployment. Which tool can be integrated into the pipeline for this purpose?

Accepted Answer

Trivy. Trivy is a comprehensive open-source vulnerability scanner specifically designed for container images, filesystems, and Git repositories. It can be integrated directly into a CI/CD pipeline to automatically scan container images for known CVEs before deployment, making it the correct choice for this use case.

Answer

SonarQube

Answer

Prometheus

Answer

Grafana

Question 14

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

Accepted Answer

Block top secret content and allow confidential content with an override requiring a business justification. It aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Answer

Encrypt all emails containing any sensitive data and allow delivery

Answer

Block both top secret and confidential content with no override

Answer

Block top secret content and allow confidential content with an audit log

Question 15

During a digital forensics investigation, an analyst needs to acquire the contents of RAM from a compromised server. Which order of volatility should the analyst follow?

Accepted Answer

Capture RAM first, then the hard drive. The order of volatility (RFC 3227) dictates that the most volatile evidence be collected first: CPU registers and cache, then RAM, then swap/pagefile, then network state, then disk. RAM is far more volatile than disk, so it must be captured before the hard drive image. This preserves evidence like running processes, encryption keys, and network connections that vanish on power-off.

Answer

Capture the swap file first, then RAM

Answer

Capture network connections first, then RAM

Answer

Capture the hard drive image first, then RAM