CAS-004 Practice Test 19 — 15 Questions

Question 1

A security engineer is hardening a container image. Which practice is MOST effective in reducing the attack surface?

Accepted Answer

Using a minimal base image. Using a minimal base image (e.g., Alpine, Distroless) removes unnecessary packages and binaries, significantly reducing the attack surface. Running as root increases risk. Antivirus is not typical in containers. Latest packages are good but do not reduce surface.

Answer

Running containers as root

Answer

Adding antivirus software

Answer

Using the latest version of all packages

Question 2

A security engineer is implementing a solution to securely store and manage cryptographic keys for a fleet of IoT devices. The devices have limited processing power and cannot perform asymmetric operations. Which of the following is the BEST approach?

Accepted Answer

Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.. IoT devices with limited processing power cannot efficiently perform asymmetric operations, so pre-provisioning keys from a cloud-based HSM during manufacturing ensures secure key generation and storage without burdening the device. The HSM provides tamper-resistant key generation and lifecycle management, and the keys are injected into the device's secure storage (e.g., eFuse or secure element) before deployment, eliminating the need for on-device asymmetric cryptography.

Answer

Install a Trusted Platform Module (TPM) in each device to store keys on the device.

Answer

Use a cloud KMS to generate and wrap keys, then store the wrapped key in the device.

Answer

Store keys in obfuscated form in the device firmware and use a custom algorithm for encryption.

Question 3

Which of the following is the primary purpose of implementing a public key infrastructure (PKI)?

Accepted Answer

To bind public keys to identities through certificates for authentication and encryption.. The primary purpose of a Public Key Infrastructure (PKI) is to bind public keys to identities through digital certificates, enabling authentication, non-repudiation, and encryption. PKI uses Certificate Authorities (CAs) to issue and manage X.509 certificates, which associate a public key with a specific entity (e.g., a user or server) and are validated via certificate chains. This binding is essential for secure communications, such as TLS/SSL, where certificates authenticate the server and establish encrypted sessions.

Answer

To store and verify password hashes for user authentication.

Answer

To sign software and files to verify integrity and origin.

Answer

To provide a secure method for remote access via VPN.

Question 4

An organization is migrating sensitive customer data to a public cloud. Which of the following actions best demonstrates due diligence for compliance with GDPR?

Accepted Answer

Conducting a data protection impact assessment (DPIA).. A Data Protection Impact Assessment (DPIA) is a mandatory requirement under GDPR Article 35 for processing activities that are likely to result in high risk to individuals' rights and freedoms, such as migrating sensitive customer data to a public cloud. Conducting a DPIA demonstrates due diligence by systematically identifying, assessing, and mitigating privacy risks before the migration begins, ensuring compliance with GDPR's accountability principle.

Answer

Enabling server-side encryption on the cloud storage.

Answer

Obtaining explicit consent from all data subjects.

Answer

Signing a data processing agreement (DPA) with the cloud provider.

Question 5

An organization is evaluating its cloud service provider's security posture as part of third-party risk management. Which regulatory framework requires the organization to ensure that the provider has appropriate technical and organizational measures to protect personal data?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) explicitly requires that data controllers (the organization) ensure that data processors (the cloud service provider) implement appropriate technical and organizational measures to protect personal data. This is mandated under Article 28 of the GDPR, which governs the relationship between controllers and processors, including contractual obligations for security measures. The regulation applies to any organization handling personal data of EU residents, regardless of where the cloud provider is located.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 6

During an incident response, a forensic examiner is collecting evidence from a compromised Windows workstation. The examiner must follow proper order of volatility to preserve potential evidence. Which THREE of the following items should be collected first, before the others? (Choose THREE.)

Accepted Answer

List of active network connections. The order of volatility dictates that the most perishable evidence must be captured first, and E (contents of RAM / memory dump) is the most volatile item because RAM contents are lost the instant the system is powered off or rebooted, so it must be acquired before anything else. C (list of active network connections) is also highly volatile, since TCP/UDP sessions, ephemeral ports, and established connections change or disappear within seconds as processes terminate or time out, making it a top-priority live acquisition. D (list of running processes) is likewise volatile because process tables, PIDs, and in-memory process state change continuously and vanish on shutdown, so it must be captured early alongside memory and network state. By contrast, A (the Master File Table from the hard drive) is far less volatile because it persists on disk until modified or overwritten, and B (Security event logs) are stored on disk and remain available after collection, so both belong to later, less volatile tiers of the order of volatility.

Answer

Master File Table (MFT) from the hard drive

Answer

Event logs from the Security log

Question 7

An organization is implementing a third-party risk management program. Which of the following is the FIRST step in the vendor risk assessment process?

Accepted Answer

Identify the vendor and the type of data it will handle. The first step in a vendor risk assessment is to identify the vendor and the type of data it will handle. This foundational step determines the scope and criticality of the assessment, as the data classification (e.g., PII, PHI, PCI-DSS) directly dictates the required security controls and regulatory compliance obligations. Without this identification, subsequent steps like audits or contract reviews lack context and may miss key risk areas.

Answer

Conduct an on-site audit of the vendor's facilities

Answer

Review the vendor's contractual security clauses

Answer

Determine risk treatment options

Question 8

Match each security tool to its purpose.

Accepted Answer

SIEM: Centralized log management and real-time event correlation. Correct matches: SIEM provides centralized log analysis, IDS monitors for malicious activity, and firewalls enforce traffic rules. Common confusions include mixing SIEM and firewall functions.

Answer

SIEM: Blocks malicious traffic by inspecting packet headers

Answer

IDS: Scans systems for known vulnerabilities

Answer

Firewall: Collects logs from multiple sources for analysis

Question 9

A security analyst is performing incident response and needs to collect evidence from a live system. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory (RAM). Memory (RAM) is the most volatile evidence on a live system — it contains running processes, encryption keys, network connections, and uncommitted data that vanish the moment the system is powered off or rebooted. Collecting RAM first preserves this ephemeral state before it is lost. This follows the order of volatility principle in digital forensics.

Answer

Network connections

Answer

Hard drive contents

Answer

System logs

Question 10

Which TWO of the following are examples of administrative controls? (Select TWO)

Accepted Answer

Security awareness training. Security awareness training (C) is an administrative control because it involves policies, procedures, and human behavior management rather than technical mechanisms. It educates users on security risks and compliance requirements, reducing the likelihood of social engineering or policy violations. This aligns with the administrative domain of the CIA triad's governance framework.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Intrusion detection system

Question 11

During a merger, two companies need to integrate their networks securely. Company A uses RFC 1918 addresses (10.0.0.0/8) and Company B also uses 10.0.0.0/8. Which architectural solution prevents routing conflicts and maintains security?

Accepted Answer

Deploy network address translation (NAT) on the border routers to translate one company's addresses to a unique range. Both companies use the same RFC 1918 address space (10.0.0.0/8), which would cause routing conflicts if directly connected. Deploying NAT on the border routers translates one company's overlapping addresses to a unique range (e.g., 172.16.0.0/12 or a public IP block), eliminating IP collisions while maintaining security through stateful inspection or ACLs. This allows the merged networks to communicate without renumbering either company's internal infrastructure.

Answer

Configure a site-to-site VPN with no address translation

Answer

Enable direct BGP peering between the two networks

Answer

Implement a firewall between the networks and allow all traffic

Question 12

Which TWO of the following are essential characteristics of a hardware security module (HSM)? (Select TWO.)

Accepted Answer

Hardware acceleration of cryptographic operations.. HSMs are dedicated hardware appliances that offload cryptographic operations from the main CPU, providing hardware acceleration for algorithms such as AES, RSA, and ECC. This acceleration is critical for high-throughput environments like TLS termination or code signing, where software-based cryptography would create a performance bottleneck.

Answer

Virtualization of the hardware root of trust.

Answer

Integration with public key infrastructure (PKI) to replace certificate authorities.

Answer

User authentication and authorization.

Question 13

A financial institution is implementing a privacy program based on GDPR principles. Which of the following best describes the concept of 'privacy by design'?

Accepted Answer

Embedding privacy controls into the design and architecture of systems and processes. Privacy by design is a foundational GDPR principle (Article 25) that requires data protection measures to be integrated into the design and architecture of systems and business processes from the outset, rather than added as an afterthought. This means embedding privacy controls such as data minimization, pseudonymization, and access controls into the very structure of applications and workflows. Option C accurately captures this proactive, architecture-level approach.

Answer

Ensuring that data subjects can exercise their rights upon request

Answer

Appointing a Data Protection Officer to oversee all privacy matters

Answer

Conducting a privacy impact assessment after a data breach

Question 14

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

Accepted Answer

Enable content trust and require signatures on all images. Enabling content trust (e.g., Docker Content Trust or Notary) cryptographically signs container images, ensuring that only images signed by a trusted publisher can be deployed. This directly enforces integrity and authenticity in the CI/CD pipeline, preventing unauthorized or tampered images from reaching production.

Answer

Implement a private container registry with access controls

Answer

Run vulnerability scanning on all images before deployment

Answer

Use an admission controller that checks image labels

Question 15

Refer to the exhibit. A cloud security engineer is reviewing an AWS S3 bucket policy. What security issue does the policy contain?

Accepted Answer

Public read access is allowed. The S3 bucket policy grants read access to all principals, typically via a Principal of "*" combined with an s3:GetObject action, which exposes every object in the bucket to anonymous or any AWS account. This is the classic public-read misconfiguration that has caused numerous high-profile data breaches, so the identified security issue is public read access.

Answer

No server-side encryption is specified

Answer

No version ID is specified in the resource

Answer

No logging is enabled for the bucket