CAS-004 Practice Exam 1 — 20 Questions

Question 1

A security audit reveals that Docker containers are built with multiple unnecessary layers and utilities. Which practice reduces the attack surface of the container image?

Accepted Answer

Use a base image with only the required packages. Using a base image with only the required packages directly reduces the attack surface by eliminating unnecessary binaries, libraries, and services that could contain vulnerabilities. This practice aligns with the principle of minimalism in container security, where every extra package increases the potential for exploitation. Unlike multi-stage builds or RUN command consolidation, this approach targets the root cause: the contents of the image itself.

Answer

Use multi-stage builds

Answer

Combine multiple RUN commands into one

Answer

Delete the apt cache in the Dockerfile

Question 2

During a threat hunting exercise, a security analyst hypothesizes that adversaries may be using PowerShell to execute commands in memory. Which threat hunting methodology is being employed?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. IoC-driven uses indicators of compromise, and TTP-driven focuses on tactics, techniques, and procedures.

Answer

Signature-based hunting

Answer

TTP-driven hunting

Answer

IoC-driven hunting

Question 3

A compliance officer is reviewing logs from a web application and finds multiple failed login attempts from a single IP address. Which type of control should be implemented to reduce the risk of brute-force attacks?

Accepted Answer

Account lockout policy. An account lockout policy is the correct control because it directly mitigates brute-force attacks by temporarily disabling the account after a predefined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents an attacker from continuously guessing passwords from a single IP address, as the account becomes unavailable for further attempts until the lockout period expires or an administrator intervenes.

Answer

Network firewall

Answer

Password hashing

Answer

Encryption of traffic

Question 4

A security analyst is collecting evidence from a compromised workstation. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory dump. Volatile data such as memory contents, running processes, network connections, and encryption keys are lost when the system is powered off or rebooted. A memory dump must be collected first to preserve this evidence. Hard drive images, network captures, and event logs are either non-volatile or can be collected later without the same urgency.

Answer

Hard drive image

Answer

Network capture

Answer

Event logs

Question 5

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 6

Which of the following is the PRIMARY purpose of a business continuity plan (BCP)?

Accepted Answer

Ensure critical business functions continue during a disruption.. The primary purpose of a Business Continuity Plan (BCP) is to ensure that critical business functions can continue during and after a disruption, such as a natural disaster, cyberattack, or infrastructure failure. Unlike a Disaster Recovery Plan (DRP), which focuses on restoring IT systems and data, the BCP takes a broader organizational view, covering people, processes, facilities, and third-party dependencies to maintain minimum acceptable service levels. This aligns with the governance and compliance domain, where the BCP is a strategic document that addresses operational resilience rather than just technical recovery.

Answer

Assign roles for incident response.

Answer

Restore IT systems after a disaster.

Answer

Establish procedures for data backup.

Question 7

Refer to the exhibit. Which security issue does this cloud storage bucket policy present?

Accepted Answer

The bucket allows anonymous PUT operations from any source. The cloud storage bucket policy shown includes a `Principal: "*"` with `Action: "PutObject"` and no `Condition` block restricting the source IP or requiring authentication. This means any unauthenticated user on the internet can upload objects to the bucket, which is a classic data ingestion vulnerability. Option C correctly identifies this as allowing anonymous PUT operations from any source.

Answer

The bucket allows anonymous GET operations from any IP

Answer

The bucket policy is too restrictive

Answer

The bucket is not encrypted

Question 8

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit

Question 9

Which of the following is the correct order of the security policy hierarchy from highest to lowest?

Accepted Answer

Policy → Standard → Guideline → Procedure. The security policy hierarchy from highest to lowest is Policy, Standard, Guideline, Procedure. Policies are high-level statements of management intent. Standards are mandatory requirements that support policies. Guidelines are recommendations. Procedures are step-by-step instructions for implementing policies and standards. This order reflects the decreasing level of authority and increasing level of detail.

Answer

Standard → Policy → Guideline → Procedure

Answer

Policy → Guideline → Standard → Procedure

Answer

Procedure → Guideline → Standard → Policy

Question 10

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 11

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Accepted Answer

Implement just-in-time (JIT) temporary privilege elevation. Just-in-time (JIT) temporary privilege elevation ensures contractors only receive the minimum necessary permissions for a limited duration, reducing the attack surface and preventing standing privileges. This aligns with the principle of least privilege and zero-trust architectures, often implemented via tools like Microsoft Entra PIM or AWS IAM Access Analyzer with time-bound policies.

Answer

Allow contractors to use a shared account for simplicity

Answer

Provide full network-level VPN access

Question 12

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 13

An enterprise is deploying a multi-factor authentication (MFA) solution. The security team requires a factor that is resistant to phishing and does not rely on shared secrets. Which of the following MFA types BEST meets this requirement?

Accepted Answer

FIDO2/WebAuthn security keys. FIDO2/WebAuthn uses public-key cryptography, with the private key stored on the device, and the protocol is designed to be phishing-resistant by binding credentials to the origin. TOTP/HOTP rely on shared secrets and are vulnerable to phishing. Hardware tokens like YubiKey can implement FIDO2. Biometrics are a factor but not inherently phishing-resistant alone.

Answer

Biometric fingerprint scanner

Answer

SMS one-time passcodes

Answer

TOTP via authenticator app

Question 14

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 15

A security team wants to implement a certificate pinning strategy for their mobile application to prevent man-in-the-middle attacks. Which of the following should be pinned in the application code?

Accepted Answer

The server's public key. Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Answer

The intermediate CA certificate

Answer

The server's IP address

Answer

The root CA certificate

Question 16

During an incident response, the team identifies that an attacker gained initial access via a phishing email containing a malicious macro. The macro downloaded a payload from a remote server. Which phase of the incident response lifecycle is currently being executed when the team identifies the phishing email as the attack vector?

Accepted Answer

Detection and analysis. Detection and analysis is the phase where the IR team identifies and validates the incident, determines its scope, and identifies the attack vector (e.g., phishing email with malicious macro). Identifying the phishing email as the initial access vector is a classic detection-and-analysis activity, occurring before containment or eradication.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Lessons learned

Question 17

A security architect is designing a secure boot process for a new line of embedded devices. The boot ROM loads the bootloader, which then loads the OS kernel. To ensure that only signed code is executed, which mechanism should the bootloader use to verify the kernel?

Accepted Answer

Verify a digital signature on the kernel using a public key stored in the boot ROM. The bootloader should verify a digital signature on the kernel image using a public key embedded in the boot ROM or bootloader. This ensures both integrity and authenticity of the kernel.

Answer

Decrypt the kernel using a symmetric key stored in the boot ROM

Answer

Check that the kernel file size matches the expected value

Answer

Compare the kernel hash against a list of known good hashes stored in the bootloader

Question 18

A healthcare organization is required to comply with HIPAA. During an audit, the auditor requests evidence of access controls for electronic protected health information (ePHI). Which of the following would be the BEST evidence to provide?

Accepted Answer

Access review logs showing periodic reviews of user permissions. Access review logs showing periodic reviews of user permissions provide direct evidence that access controls are being enforced and monitored over time. HIPAA requires covered entities to implement policies and procedures to authorize and supervise access to ePHI, and periodic reviews demonstrate ongoing compliance. A policy alone does not prove implementation, and training or network diagrams do not show actual access control effectiveness.

Answer

A report of employee security training completion

Answer

A signed copy of the access control policy

Answer

A network diagram of the IT infrastructure

Question 19

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 20

A security analyst is investigating a malware sample found on a workstation. The analyst wants to determine the malware's capabilities without executing it. Which type of malware analysis involves examining the binary's strings, headers, and structure?

Accepted Answer

Static analysis. Static analysis involves examining the malware binary without executing it, focusing on its structure, strings, headers, and other static properties. This allows the analyst to extract indicators like embedded URLs, IP addresses, and function calls without risking infection or triggering malicious behavior.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory forensics