CAS-004 Practice Test 20 — 15 Questions

Question 1

During a secure SDLC, a development team wants to identify vulnerabilities in running code. Which type of testing should be performed?

Accepted Answer

DAST. DAST (Dynamic Application Security Testing) tests running applications from the outside by simulating attacks against a live deployment, which is exactly what is needed to identify vulnerabilities in running code. It analyzes the application in its deployed state, including runtime configuration and environment-specific issues.

Answer

IAST

Answer

SAST

Answer

RASP

Question 2

A security analyst is conducting a penetration test for a client. The rules of engagement specify that no social engineering is allowed. Which TWO of the following reconnaissance techniques are permitted under these rules?

Accepted Answer

Scanning the client's external network for open ports. Option B is correct because scanning the client's external network for open ports is a purely technical reconnaissance activity that does not involve deceiving or manipulating people, so it falls outside the prohibition on social engineering. Option C is correct because DNS enumeration using public records relies on openly available registration and name-resolution data (e.g., WHOIS, zone data, public DNS queries) rather than human interaction or deception. Option A is not permitted because calling the help desk to obtain credentials is a pretexting/social-engineering attack that manipulates a person into disclosing sensitive information. Option D is not permitted because phishing emails are a classic social-engineering technique that deceives employees into revealing data or executing actions. Option E is not permitted because tailgating is a physical social-engineering method that exploits human trust to gain unauthorized building access.

Answer

Calling the help desk to obtain credentials

Answer

Sending phishing emails to employees

Answer

Tailgating into the building

Question 3

A company has implemented a hardware security module (HSM) to manage cryptographic keys for a payment processing system. Which of the following best describes an advantage of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant key storage. An HSM is a dedicated hardware device designed to securely generate, store, and manage cryptographic keys, with physical and logical protections that make it tamper-resistant. Unlike software-based key storage, where keys reside in memory or on disk and can be extracted by malware or an attacker with system access, an HSM's keys never leave the device in plaintext and the device zeroizes keys if tampering is detected. This makes tamper-resistant key storage the primary advantage for high-assurance environments like payment processing.

Answer

Easier key rotation

Answer

Faster cryptographic operations

Answer

Lower implementation cost

Question 4

A security team is analyzing a suspicious binary using static analysis. They run the strings command and observe references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique is the binary likely employing?

Accepted Answer

Process injection. The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the strings output strongly indicates process injection. These Windows API functions are commonly used together to inject code into another process: WriteProcessMemory writes the malicious code into the target process's memory, and CreateRemoteThread executes it.

Answer

DLL sideloading

Answer

Reflective DLL loading

Answer

API hooking

Question 5

Which TWO of the following are key benefits of using a software-defined perimeter (SDP) in a zero trust architecture? (Select TWO.)

Accepted Answer

Reduces the attack surface by hiding network resources. Option A is correct because SDP uses a "black cloud" or dark network approach where resources are cloaked and do not respond to unauthenticated probes, so attackers cannot see or scan them, directly shrinking the attack surface. Option D is correct because SDP enforces access decisions based on verified user and device identity (often via mutual TLS, SAML, or OIDC with a controller and gateway), which is the core identity-centric principle of zero trust. Option B is wrong because patch management is a vulnerability/patch lifecycle function, not a benefit of SDP. Option C is wrong because SDP actually depends on strong encryption such as mTLS and IPsec/TLS tunnels rather than eliminating it. Option E is wrong because SDP complements rather than removes firewalls, and it typically adds controller/gateway components instead of simplifying the architecture by deleting firewalls.

Answer

Automates patch management

Answer

Eliminates the need for encryption

Answer

Simplifies network architecture by removing firewalls

Question 6

A security team is measuring the effectiveness of its incident response process. Which of the following metrics would best indicate how quickly the team can contain an incident after it is detected?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time between incident detection and containment/resolution, directly reflecting how quickly the team can act once an incident is identified. It is the standard metric for response and containment speed in incident response frameworks such as NIST SP 800-61. The other options measure detection speed, vulnerability posture, or patch hygiene, not containment speed.

Answer

Vulnerabilities by severity

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 7

A cloud-based application uses serverless functions to process user uploads. Which of the following is the most effective way to limit the attack surface of the function?

Accepted Answer

Minimize the function's dependencies and reduce its code footprint. Minimizing the function's dependencies and reducing its code footprint directly shrinks the attack surface by eliminating unnecessary libraries, packages, and code paths that could contain vulnerabilities. In serverless architectures, the function's runtime environment is ephemeral and stateless, so every added dependency increases the risk of supply-chain attacks or unpatched flaws. This aligns with the principle of least functionality, which is more effective than perimeter controls for serverless compute.

Answer

Encrypt all data at rest using KMS

Answer

Enable detailed logging and monitoring

Answer

Place a web application firewall (WAF) in front of the function

Question 8

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Accepted Answer

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.. The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.

Answer

New connections from the internet to 10.0.1.0/24 are allowed.

Answer

All traffic is allowed by default because the policy is ACCEPT.

Answer

The rules apply to incoming traffic on the firewall itself.

Question 9

An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?

Accepted Answer

Deploy a forward proxy with SSL/TLS inspection. A forward proxy with SSL/TLS inspection decrypts outbound HTTPS traffic, allowing the security team to inspect the payload of connections over TCP 443. This reveals encrypted C2 traffic that would otherwise be hidden within legitimate HTTPS flows, while still permitting authorized business traffic to pass through after inspection.

Answer

Block outbound TCP 443 and require users to use a VPN

Answer

Enable logging on the firewall for all outbound 443 traffic

Answer

Install a network-based IDS on the internal side of the firewall

Question 10

A security analyst is investigating an API that uses JSON Web Tokens (JWT) for authentication. Which field in a JWT contains the token expiration time?

Accepted Answer

exp. The 'exp' (expiration time) claim in a JWT is a NumericDate value representing the UTC time after which the token MUST NOT be accepted, as defined in RFC 7519. Validating 'exp' is the standard mechanism for enforcing token lifetime and limiting the window of abuse if a token is stolen.

Answer

iss

Answer

iat

Answer

sub

Question 11

During a penetration test, the tester gains access to a web server and wants to escalate privileges to root. The tester discovers that the web application runs with a service account that has the SeImpersonatePrivilege enabled. Which attack is most likely to succeed for privilege escalation?

Accepted Answer

JuicyPotato attack. SeImpersonatePrivilege allows a process to impersonate a user token. Tools like JuicyPotato exploit this privilege to impersonate SYSTEM by forcing a higher-privileged process to authenticate and then stealing its token. This is a common technique for local privilege escalation on Windows.

Answer

SQL injection

Answer

Pass-the-hash attack

Answer

DLL hijacking

Question 12

Which of the following is a benefit of using an immutable infrastructure approach?

Accepted Answer

Elimination of configuration drift. Immutable infrastructure means servers are never modified in place — instead, new instances are built from a known-good image and old ones are replaced. This eliminates configuration drift because every instance is identical to its image, and any change requires a new image and redeployment. Manual patching and hardware reuse are not benefits of this model.

Answer

Reduced need for configuration management

Answer

Easier manual patching of running servers

Answer

Lower cost due to reusable hardware

Question 13

A regional healthcare provider with 2,000 employees recently acquired a smaller clinic that uses a legacy electronic health record (EHR) system. The provider's security team performed a risk assessment and identified that the legacy system does not support encryption at rest, lacks role-based access controls (RBAC), and stores administrative credentials in plaintext. The system is scheduled to be decommissioned in 18 months, but it must remain operational to support patient care during the transition. The provider is subject to HIPAA and state breach notification laws. The CEO wants to avoid any disruption to patient services but also minimize regulatory risk. Which of the following is the BEST course of action?

Accepted Answer

Implement compensating controls such as network segmentation, storage-level encryption, and strict access monitoring.. The best course of action because it allows the legacy EHR system to remain operational for patient care while reducing regulatory risk. Compensating controls like network segmentation isolate the vulnerable system, storage-level encryption (e.g., BitLocker or LUKS) protects data at rest, and strict access monitoring (e.g., SIEM with real-time alerts) mitigates the lack of RBAC and plaintext credentials. This approach balances the CEO's requirement for no disruption with HIPAA's security rule requirements for reasonable safeguards.

Answer

Accelerate the migration timeline to replace the legacy system within 6 months.

Answer

Immediately disconnect the legacy system from the network and use manual processes.

Answer

Accept the residual risk and document it in the risk register.

Question 14

A company wants to protect its intellectual property stored on a file server. The security architect proposes implementing rights management services (RMS) integrated with Active Directory. Which attack is this architecture primarily designed to mitigate?

Accepted Answer

Unauthorized distribution of sensitive documents outside the organization. Rights Management Services (RMS) integrated with Active Directory enables persistent protection of documents by encrypting them and enforcing usage policies (e.g., who can open, print, or forward) regardless of where the file resides. This architecture is specifically designed to prevent unauthorized distribution of sensitive documents outside the organization because the protection travels with the file and requires authentication to an RMS server for decryption, even if the file is copied or emailed externally.

Answer

Phishing attacks targeting user credentials

Answer

Malware infection on the file server

Answer

Buffer overflow attack on the file server

Question 15

An organization is deploying a just-in-time (JIT) privileged access management solution. What is a key benefit of JIT access compared to standing privileged accounts?

Accepted Answer

It reduces the window of exposure for privileged credentials.. JIT access provides temporary privileges that are automatically revoked after use, reducing the attack surface and limiting lateral movement.

Answer

It allows users to permanently elevate privileges.

Answer

It eliminates the need for multi-factor authentication.

Answer

It requires no audit logging.