CAS-004 Practice Test 20 — 15 Questions

Question 1

An organization is merging with another company and needs to ensure that the combined entity's security policies are aligned. Which document type should the security team prioritize to harmonize security expectations and responsibilities?

Accepted Answer

Acceptable Use Policy (AUP). An Acceptable Use Policy (AUP) defines acceptable behavior and responsibilities for users, making it key for harmonizing expectations. BCP focuses on continuity, DRP on recovery, and NDA on confidentiality.

Answer

Disaster Recovery Plan (DRP)

Answer

Non-Disclosure Agreement (NDA)

Answer

Business Continuity Plan (BCP)

Question 2

A security manager is reviewing business continuity plans. Which element is MOST critical to test regularly?

Accepted Answer

Failover capability of critical systems. Option A is correct because failover capability ensures systems can be restored. Option B is wrong contact lists need updates but are not the most critical to test. Option C is wrong backup media must be tested but failover tests the whole process. Option D is wrong alternate site readiness is part of failover testing.

Answer

Updated contact lists

Answer

Alternate site readiness

Answer

Backup media integrity

Question 3

Which TWO of the following are key components of a risk assessment methodology?

Accepted Answer

Threat identification.. Threat identification and asset inventory are core components of a risk assessment, while risk appetite is a guiding parameter.

Answer

Disaster recovery.

Answer

Risk appetite.

Answer

Incident response.

Question 4

An organization wants to ensure that its supply chain vendors are compliant with its security policies. Which of the following is the MOST effective approach?

Accepted Answer

Implement a continuous monitoring program using automated tools.. Option C is correct because continuous monitoring offers real-time visibility and is scalable for a large vendor base, aligning with best practices for third-party risk management.

Answer

Conduct on-site audits of all vendors.

Answer

Include security requirements in contracts and rely on legal remedies.

Answer

Require vendors to complete a self-assessment questionnaire.

Question 5

A security auditor finds that a company's backup tapes are stored in the same building as the primary data center. Which risk treatment strategy does this lack represent?

Accepted Answer

Risk mitigation. Storing backups at a separate site is risk mitigation through redundancy. The current practice increases risk due to common physical location. Acceptance, transference, and avoidance are not directly addressed here.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transference

Question 6

A security team discovers a misconfiguration that exposes sensitive data. The operations team wants to wait until the next maintenance window. What is the BEST course of action?

Accepted Answer

Immediately fix the misconfiguration. Immediate remediation minimizes exposure. Options B, C, and D are unacceptable delays given the severity.

Answer

Document the risk and accept it

Answer

Notify the data protection authority

Answer

Implement a temporary workaround

Question 7

Refer to the exhibit. A security analyst reviews the firewall logs and sees traffic from 192.168.1.200 to the database server 10.0.0.10 on TCP port 1433. 192.168.1.200 is not in the approved IP list for database access. What is the BEST immediate action?

Accepted Answer

Block the source IP on the firewall. Blocking the source IP on the firewall immediately contains the potential threat. Investigation is important but secondary; reviewing rules is not immediate; disabling the server is too drastic.

Answer

Investigate the source host for malware

Answer

Disable the database server

Answer

Review the database access rules

Question 8

A company is implementing a new vendor risk management program. Which of the following is the BEST approach to assess third-party security controls?

Accepted Answer

Use a standardized security questionnaire and conduct on-site audits. Option C is correct because a standardized questionnaire and on-site audits provide a comprehensive assessment of vendor security practices. Option A is wrong because relying solely on vendor self-assessments may be biased and incomplete. Option B is wrong because financial stability does not guarantee security. Option D is wrong because checking only public breaches is reactive and insufficient.

Answer

Check the vendor’s financial stability

Answer

Rely on the vendor’s self-assessment questionnaire

Answer

Review only public breach reports about the vendor

Question 9

Which THREE are key elements of a security policy?

Accepted Answer

Roles and responsibilities. Options A, B, and C are correct. Scope defines applicability, roles and responsibilities assign accountability, and enforcement actions ensure compliance. Vendor names are not typical policy elements, and review date is part of document control but not a core element.

Answer

Vendor names

Answer

Review date

Question 10

Refer to the exhibit. Which of the following best describes the effect of this ACL?

Accepted Answer

Blocks all traffic to the 10.0.0.0/24 network.. Option B is correct because the ACL explicitly denies all traffic destined to the 10.0.0.0/24 network.

Answer

Blocks all traffic from the 10.0.0.0/24 network.

Answer

Permits all traffic to the 10.0.0.0/24 network.

Answer

Permits all traffic from the 10.0.0.0/24 network.

Question 11

A company is implementing a risk management framework to comply with PCI DSS. Which type of control is a firewall rule that blocks all inbound traffic except HTTP and HTTPS?

Accepted Answer

Preventive. A firewall rule that blocks traffic is a preventive control because it prevents unauthorized access. Detective controls identify incidents after they occur, corrective controls fix issues, and compensating controls provide alternative security.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 12

An organization is required to retain logs for seven years per regulatory requirement. Which of the following should be considered to ensure the integrity of these logs?

Accepted Answer

Write-once, read-many (WORM) storage. Write-once, read-many (WORM) storage ensures logs cannot be altered or deleted. Encryption, compression, and hashing provide security or validation but not immutable storage.

Answer

Hashing each log entry

Answer

Encryption of the logs

Answer

Compression to reduce storage space

Question 13

Refer to the exhibit. The data classification policy defines levels and rules. During an audit, a database containing both PII and credit card numbers is found labeled as 'Internal'. Which of the following is the BEST first action?

Accepted Answer

Reclassify the database as 'Critical' to reflect the highest required level. The database should be reclassified to 'Critical' because it contains PCI data, which requires the highest level. Creating a new level is unnecessary; accepting risk violates policy; removing data is not the first step.

Answer

Accept the risk as the data is not public

Answer

Remove the credit card numbers from the database

Answer

Create a new classification level for mixed data

Question 14

A company is evaluating its disaster recovery plan. Which metric indicates the maximum acceptable downtime?

Accepted Answer

Recovery Time Objective (RTO). Option B is correct because Recovery Time Objective (RTO) defines the maximum acceptable downtime. Option A is wrong RPO defines acceptable data loss. Option C is wrong MTBF measures reliability. Option D is wrong MTTR measures repair time.

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Point Objective (RPO)

Answer

Mean Time Between Failures (MTBF)

Question 15

Based on the exhibit, which security issue does this IAM policy represent?

Accepted Answer

Overly permissive resource access. Option B is correct because the policy allows any principal to read all objects in the bucket, making it overly permissive. Option A is wrong encryption is not addressed. Option C is wrong versioning is not relevant. Option D is wrong logging is not mentioned.

Answer

No versioning configured

Answer

Missing server-side encryption

Answer

Insufficient logging and monitoring