CAS-004 Practice Test 2 — 10 Questions

Question 1

During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a memory capture using a tool like DumpIt or winpmem. In digital forensics, the order of volatility dictates that volatile data (e.g., running processes, network connections) should be collected first because it is lost when the system is powered down. Memory capture preserves this data, including process information and active network connections.

Answer

Export the Windows event logs related to network activity

Answer

Execute a network scan from the compromised host to identify active connections

Answer

Capture a full disk image using FTK Imager

Question 2

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

Accepted Answer

Use selective authentication and restrict the authorized accounts. Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint. Disabling the trust is not practical.

Answer

Remove the trust entirely and use individual local accounts

Answer

Configure the trust to use forest-wide authentication instead of selective

Answer

Enable SID filtering on both forest trusts

Question 3

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 4

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 5

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

Question 6

A security team wants to implement a certificate pinning strategy for their mobile application to prevent man-in-the-middle attacks. Which of the following should be pinned in the application code?

Accepted Answer

The server's public key. Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Answer

The intermediate CA certificate

Answer

The server's IP address

Answer

The root CA certificate

Question 7

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Accepted Answer

Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes. The database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Answer

Immediately block the external IP address at the perimeter firewall

Answer

Disable the database server's network interface

Answer

Review the database server's recent application logs for any anomalies

Question 8

An organization is implementing a vulnerability management program and needs to prioritize patching based on risk. The team has identified multiple vulnerabilities with different CVSS scores. Which THREE factors should be considered when prioritizing patches according to CVSS environmental metrics? (Choose THREE.)

Accepted Answer

Confidentiality, integrity, and availability requirements of the affected system. Environmental metrics in CVSS allow customization of the score based on the organization's environment. Key factors include security requirements (confidentiality, integrity, availability), which affect the overall severity. Asset criticality and compliance requirements are also considered. Patch availability and exploit maturity are temporal metrics, not environmental.

Answer

Availability of a patch or workaround

Answer

Exploit code maturity and remediation level

Question 9

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 10

A security analyst is analyzing a network capture and sees repeated TCP SYN packets to a host but no SYN-ACK responses. Which TWO conclusions are MOST likely? (Choose two.)

Accepted Answer

A firewall is dropping the SYN packets before they reach the host.. Repeated TCP SYN packets without any SYN-ACK responses indicate that the target host is not responding to connection attempts. This can occur if a stateful firewall is blocking the incoming SYN packets before they reach the host (option D). Alternatively, an attacker may be conducting a SYN flood DDoS attack, overwhelming the host with SYN packets so that it cannot send SYN-ACK responses (option E). Options A, B, and C are incorrect because TCP receive window issues (A) do not prevent SYN-ACKs, network loops (B) would still allow responses, and accepted connections (C) would produce SYN-ACKs.

Answer

The host is out of TCP receive window space.

Answer

The network has a loop causing packet duplication.

Answer

The host has accepted the connections.