CAS-004 Practice Test 18 — 15 Questions

Question 1

An organization is implementing a PKI to issue certificates for internal applications. The security team wants to minimize the risk of compromise to the root CA. Which of the following is the BEST practice to protect the root CA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Keep the root CA offline and store its private key in a hardware security module. Keeping the root CA offline and using a hardware security module (HSM) for key storage ensures its private key is never exposed to network threats. This is a standard best practice.

Answer

Delegate root CA responsibilities to a public CA

Answer

Install the root CA on a VM with strict firewall rules

Answer

Use a self-signed certificate for the root CA and distribute it manually

Question 2

During a security assessment, a penetration tester discovers that a web application's session tokens are predictable. The application uses a custom session management system. Which of the following is the MOST effective remediation to ensure secure session tokens?

Accepted Answer

Generate session tokens using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy.. Predictable session tokens arise from insufficient randomness. Using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy ensures that tokens are statistically unpredictable and resistant to brute-force or guessing attacks, which is the foundational requirement for secure session management per NIST SP 800-63B and OWASP guidelines.

Answer

Regenerate the session token on each page request.

Answer

Implement a short session timeout of 5 minutes.

Answer

Generate tokens using HMAC-SHA256 of a timestamp and a secret key.

Question 3

An enterprise is implementing a cloud security posture management (CSPM) solution. What is the primary function of CSPM?

Accepted Answer

Monitoring and remediating misconfigurations. CSPM tools continuously scan cloud environments for misconfigurations such as publicly exposed storage buckets, overly permissive IAM roles, and disabled logging, then alert or automatically remediate them. This aligns directly with option A. CSPM is a core pillar of cloud-native security alongside CWPP and CIEM.

Answer

Brokering access to cloud apps

Answer

Protecting workloads from malware

Answer

Encrypting data at rest

Question 4

A security architect is designing a risk mitigation strategy for a critical application. Which TWO of the following are examples of risk acceptance? (Select TWO.)

Accepted Answer

Obtaining senior management sign-off to accept the risk without additional controls.. Risk acceptance is a formal decision by management to acknowledge and accept a specific risk without implementing additional controls. This is typically documented in a risk register and signed off by senior leadership, indicating that the cost of mitigation outweighs the potential impact. Option D is correct because formally acknowledging residual risk after controls are implemented is also a form of risk acceptance, as the organization accepts the remaining risk that cannot be fully mitigated.

Answer

Outsourcing the application hosting to a third party.

Answer

Purchasing cyber insurance to cover potential losses.

Answer

Implementing an intrusion prevention system to reduce the likelihood of attacks.

Question 5

Refer to the exhibit. A security analyst notices that users from the internet can reach the web server at 10.0.1.100 on port 443, but they cannot reach it on port 8443. What is the most likely cause?

Accepted Answer

The web server is not listening on port 8443. If users can reach the web server on port 443 but not on 8443, the firewall is clearly permitting traffic to that host, so the most likely cause is that the web server process is not listening on port 8443. A service that is not bound to a port cannot accept connections regardless of firewall rules, which explains why one port works and the other does not.

Answer

The ACL only permits traffic from specific source IPs

Answer

The firewall rule order is incorrect

Answer

The firewall is blocking all traffic on port 8443

Question 6

A company is implementing measured boot using TPM 2.0. What is the primary purpose of storing boot measurements in Platform Configuration Registers (PCRs)?

Accepted Answer

To enable remote attestation of the system's boot state.. PCRs store hashes of boot components; these measurements are used for remote attestation to verify the integrity of the boot process.

Answer

To speed up the boot process.

Answer

To provide a root of trust for storage (sealed storage).

Answer

To encrypt the bootloader.

Question 7

During a secure SDLC, a development team is reviewing code for security flaws early in the development process. Which type of testing is MOST appropriate for identifying vulnerabilities in source code before it is compiled?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without executing the program, making it the correct choice for finding vulnerabilities before compilation. It integrates into the IDE or CI pipeline and can flag issues like hardcoded secrets, injection flaws, and insecure API usage at the code level. Because it works on the code itself, it is the only option that fits the 'before it is compiled' requirement.

Answer

DAST

Answer

IAST

Answer

RASP

Question 8

An incident responder is analyzing a compromised server. Which THREE indicators are MOST likely to confirm a successful attack?

Accepted Answer

Corrupted system files. Corrupted system files (A) are a strong confirmation of a successful attack because malware or an intruder with root/SYSTEM privileges often modifies, replaces, or deletes binaries and configuration files (e.g., tampering with /etc/passwd, system DLLs, or boot files) to persist or disable defenses, which is evidence of actual system compromise rather than mere attempted access. Unusual outbound network connections (B) confirm success because they indicate command-and-control (C2) beaconing, data exfiltration, or reverse shells over non-standard ports or protocols (e.g., DNS tunneling, HTTPS to unknown IPs), which only occur after an attacker has established a foothold and executed code. New unauthorized administrative accounts (E) confirm success because creating accounts with elevated privileges (e.g., adding a user to the Administrators group or /etc/sudoers) requires the attacker to have already gained sufficient access to modify the security database, demonstrating persistence and privilege escalation. Multiple failed login attempts (C) are only an indicator of attempted brute-force or password-guessing activity and do not by themselves prove that any login succeeded, so they are not confirmation of a successful attack. High CPU usage due to legitimate processes (D) is explicitly benign activity and therefore cannot serve as an indicator of compromise at all.

Answer

Multiple failed login attempts

Answer

High CPU usage due to legitimate processes

Question 9

A company is designing a new data center with high availability requirements. The network team proposes using virtualized network functions (VNFs) on commodity hardware to reduce costs. Which security consideration is MOST important when implementing this design?

Accepted Answer

Isolate VNFs to prevent lateral movement if one VNF is compromised. Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Answer

Ensure VNFs are deployed across multiple physical hosts for redundancy

Answer

Encrypt all traffic between VNFs to prevent eavesdropping

Answer

Implement quality of service (QoS) to guarantee bandwidth for critical VNFs

Question 10

During a threat hunting exercise, a hunter uses the MITRE ATT&CK framework to identify a series of behaviors: an attacker used PowerShell to download a payload, then created a scheduled task for persistence, and finally performed credential dumping via LSASS. Which ATT&CK tactic is associated with the credential dumping technique?

Accepted Answer

Credential Access. Credential dumping via LSASS (e.g., Mimikatz reading lsass.exe memory) is classified under the Credential Access tactic in MITRE ATT&CK, specifically technique T1003 OS Credential Dumping. The tactic describes the adversary's goal of stealing account names and passwords to use for lateral movement and privilege escalation. LSASS holds cached credentials and Kerberos tickets, making it a prime target for this tactic.

Answer

Defense Evasion

Answer

Execution

Answer

Persistence

Question 11

A security analyst is reviewing TLS 1.3 configuration for a web server. The analyst wants to ensure that the configuration provides forward secrecy and prevents the reuse of session keys. Which of the following is a characteristic of TLS 1.3 that supports these goals?

Accepted Answer

Use of ephemeral Diffie-Hellman key exchange. TLS 1.3 mandates the use of ephemeral Diffie-Hellman key exchange (DHE or ECDHE) for all handshakes, which provides forward secrecy by generating a unique session key for each session that cannot be derived from the server's long-term private key. This ensures that even if the server's private key is compromised later, past session keys remain secure and cannot be reused.

Answer

0-RTT session resumption

Answer

Support for static RSA key exchange

Answer

Removal of CBC mode cipher suites

Question 12

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

Accepted Answer

Exposure of sensitive credentials in the image layers. Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Answer

Use of untrusted base image

Answer

Privilege escalation via SUID binaries

Answer

Dependency confusion from unpinned packages

Question 13

Which risk treatment option involves reducing the likelihood or impact of a risk through controls?

Accepted Answer

Mitigate. Mitigation involves implementing controls to reduce the likelihood or impact of a risk. This is the definition of risk mitigation in risk management frameworks like NIST and ISO 31000. It is distinct from avoidance (eliminating the activity), acceptance (retaining the risk), and transfer (shifting to a third party).

Answer

Avoid

Answer

Accept

Answer

Transfer

Question 14

An organization is evaluating a third-party vendor that will have access to its customer database. The vendor provides a SOC 2 Type II report dated six months ago. Which of the following is the BEST next step?

Accepted Answer

Conduct a vendor risk assessment using a security questionnaire. Even with a recent SOC 2 Type II report, the organization should still perform its own vendor risk assessment using a security questionnaire to evaluate controls specific to the engagement, scope, and data sensitivity. A SOC 2 report covers the vendor's controls but does not address the organization's specific risk tolerance, contractual requirements, or gaps not in the report's scope. This is the best next step because it validates and contextualizes the report.

Answer

Accept the SOC 2 report as sufficient evidence

Answer

Perform an on-site audit of the vendor

Answer

Request a new penetration test report from the vendor

Question 15

In a CI/CD pipeline, a security gate fails because a high-severity vulnerability is found in the base image of a container. The pipeline is configured to block deployment on such findings. What is the appropriate remediation step?

Accepted Answer

Update the base image to a patched version. Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Answer

Override the security gate and proceed with deployment

Answer

Rebuild the image using the same base image

Answer

Add the vulnerability to an exception list