CAS-004 Practice Test 2 — 10 Questions

Question 1

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement just-in-time (JIT) temporary privilege elevation. Just-in-time (JIT) temporary privilege elevation ensures contractors only receive the minimum necessary permissions for a limited duration, reducing the attack surface and preventing standing privileges. This aligns with the principle of least privilege and zero-trust architectures, often implemented via tools like Microsoft Entra PIM or AWS IAM Access Analyzer with time-bound policies.

Answer

Allow contractors to use a shared account for simplicity

Answer

Provide full network-level VPN access

Question 2

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 3

An enterprise is deploying a multi-factor authentication (MFA) solution. The security team requires a factor that is resistant to phishing and does not rely on shared secrets. Which of the following MFA types BEST meets this requirement?

Accepted Answer

FIDO2/WebAuthn security keys. FIDO2/WebAuthn uses public-key cryptography, with the private key stored on the device, and the protocol is designed to be phishing-resistant by binding credentials to the origin. TOTP/HOTP rely on shared secrets and are vulnerable to phishing. Hardware tokens like YubiKey can implement FIDO2. Biometrics are a factor but not inherently phishing-resistant alone.

Answer

Biometric fingerprint scanner

Answer

SMS one-time passcodes

Answer

TOTP via authenticator app

Question 4

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 5

A security team wants to implement a certificate pinning strategy for their mobile application to prevent man-in-the-middle attacks. Which of the following should be pinned in the application code?

Accepted Answer

The server's public key. Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Answer

The intermediate CA certificate

Answer

The server's IP address

Answer

The root CA certificate

Question 6

During an incident response, the team identifies that an attacker gained initial access via a phishing email containing a malicious macro. The macro downloaded a payload from a remote server. Which phase of the incident response lifecycle is currently being executed when the team identifies the phishing email as the attack vector?

Accepted Answer

Detection and analysis. Detection and analysis is the phase where the IR team identifies and validates the incident, determines its scope, and identifies the attack vector (e.g., phishing email with malicious macro). Identifying the phishing email as the initial access vector is a classic detection-and-analysis activity, occurring before containment or eradication.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Lessons learned

Question 7

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify a digital signature on the kernel using a public key stored in the boot ROM. The bootloader should verify a digital signature on the kernel image using a public key embedded in the boot ROM or bootloader. This ensures both integrity and authenticity of the kernel.

Answer

Decrypt the kernel using a symmetric key stored in the boot ROM

Answer

Check that the kernel file size matches the expected value

Answer

Compare the kernel hash against a list of known good hashes stored in the bootloader

Question 8

A healthcare organization is required to comply with HIPAA. During an audit, the auditor requests evidence of access controls for electronic protected health information (ePHI). Which of the following would be the BEST evidence to provide?

Accepted Answer

Access review logs showing periodic reviews of user permissions. Access review logs showing periodic reviews of user permissions provide direct evidence that access controls are being enforced and monitored over time. HIPAA requires covered entities to implement policies and procedures to authorize and supervise access to ePHI, and periodic reviews demonstrate ongoing compliance. A policy alone does not prove implementation, and training or network diagrams do not show actual access control effectiveness.

Answer

A report of employee security training completion

Answer

A signed copy of the access control policy

Answer

A network diagram of the IT infrastructure

Question 9

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 10

A security analyst is investigating a malware sample found on a workstation. The analyst wants to determine the malware's capabilities without executing it. Which type of malware analysis involves examining the binary's strings, headers, and structure?

Accepted Answer

Static analysis. Static analysis involves examining the malware binary without executing it, focusing on its structure, strings, headers, and other static properties. This allows the analyst to extract indicators like embedded URLs, IP addresses, and function calls without risking infection or triggering malicious behavior.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory forensics