CAS-004 Practice Exam 1 — 20 Questions

Question 1

An organization is implementing a zero trust architecture (ZTA). The security architect proposes using a software-defined perimeter (SDP) to replace the traditional VPN for remote access. Which of the following best describes the primary security benefit of SDP over VPN in a zero trust model?

Accepted Answer

It prevents unauthorized users from discovering the application infrastructure.. In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

Answer

It provides deep packet inspection to detect malicious traffic.

Answer

It enforces multi-factor authentication for every session.

Answer

It reduces latency by establishing direct peer-to-peer connections.

Question 2

A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)

Accepted Answer

Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.. Option A is correct because a TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.

Answer

Apply Kubernetes network policies to restrict pod-to-pod communication.

Answer

Configure RPM package signing for all container images.

Question 3

An organization is deploying a new wireless network for employees and guests. The security policy requires that all wireless traffic be encrypted using AES-CCMP, and that clients must authenticate using 802.1X with EAP-TLS. Which of the following wireless security standards should be implemented?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (D) is the correct choice because it supports AES-CCMP encryption and 802.1X authentication with EAP-TLS. WPA2-Enterprise uses a RADIUS server for centralized authentication, allowing per-user credentials via EAP methods, and mandates CCMP (AES-based) for data confidentiality and integrity, meeting all stated security policy requirements.

Answer

WPA2-Personal

Answer

WEP

Answer

WPA3-Enterprise

Question 4

A security architect is evaluating cloud security architectures. The company requires that all data at rest in a public cloud object storage bucket be encrypted with a key that is managed by the company's own hardware security module (HSM) on-premises. Which encryption approach should the architect recommend?

Accepted Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.. Option D is correct because client-side encryption ensures the data is encrypted by the application before it is sent to the cloud, using a key managed by the company's own on-premises HSM. This approach guarantees that the cloud provider never has access to the encryption key or the plaintext data, meeting the requirement that all data at rest in the public cloud object storage bucket be encrypted with a key managed by the company's own HSM.

Answer

Use envelope encryption where a cloud KMS wraps a data key, and the data key is used to encrypt the data.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Question 5

A security architect is designing a zero-trust network architecture for a hybrid cloud environment. The company uses on-premises servers and AWS. Which of the following best implements the principle of least privilege for inter-component communication?

Accepted Answer

Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.. Option B is correct because micro-segmentation with stateful firewalls and explicit allow rules enforces least privilege at the workload level, ensuring that only explicitly permitted inter-component traffic is allowed. This approach is fundamental to zero-trust architectures, as it reduces the attack surface by preventing lateral movement, even within the same subnet or VPC.

Answer

Deploy an SD-WAN with dynamic path selection and encryption for all inter-site traffic.

Answer

Use network ACLs on the cloud VPC and on-premises routers to deny all traffic by default, then allow required ports.

Answer

Deploy a site-to-site VPN and route all inter-component traffic through a VPN concentrator.

Question 6

A security architect is reviewing the network security controls for a critical industrial control system (ICS) environment. The architect must select two controls that are most effective at preventing unauthorized access to the ICS network from the corporate IT network, while still allowing necessary monitoring traffic. Which TWO controls should be implemented? (Choose two.)

Accepted Answer

Deploy a unidirectional gateway (data diode) between the networks. A unidirectional gateway (data diode) physically enforces one-way data flow, ensuring that no traffic can originate from the corporate IT network into the ICS network. This prevents unauthorized access while allowing monitoring data (e.g., syslog, SNMP traps) to be sent out from the ICS side. It is the most effective control for preventing any inbound attack vectors while preserving outbound monitoring traffic.

Answer

Configure a site-to-site VPN from the corporate network to the ICS network

Answer

Implement a network-based intrusion prevention system (IPS) on the ICS network

Answer

Segment the networks using VLANs only

Question 7

A security architect is designing a secure remote access solution for a global workforce. The company requires that all remote connections be authenticated using certificates issued by the company's internal PKI, and that the connection be encrypted and integrity-protected. Additionally, the solution must support IP-based network access control to restrict access to specific internal subnets based on the user's role. Which of the following should the architect recommend?

Accepted Answer

Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.. Option D is correct because an IPsec VPN with certificate-based authentication satisfies the requirement for encrypted, integrity-protected connections using the company's internal PKI. Integrating with a RADIUS server enables role-based IP access control, allowing the VPN gateway to restrict access to specific internal subnets based on the user's role, which aligns with the need for IP-based network access control.

Answer

Deploy SSH tunneling with certificate-based authentication and configure iptables rules on the bastion host.

Answer

Deploy an SSL/TLS VPN using client certificates and rely on the VPN client to enforce access policies.

Answer

Deploy a RDP gateway with certificate authentication and restrict access via group policies.

Question 8

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 9

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Accepted Answer

Adopt a unified control framework such as NIST SP 800-53. Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Answer

Focus only on the most stringent regulation

Answer

Implement automated GRC tools without changing controls

Answer

Maintain separate control sets for each regulation

Question 10

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. Option B is correct because conducting a single PIA that addresses both regulations is efficient. Option A is wrong because separate PIAs are redundant. Option C is wrong because PIAs should be conducted before processing. Option D is wrong because only high-risk processing is not sufficient for all processing.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data

Question 11

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Option B is correct because a BA agreement is required under HIPAA to ensure the provider contractually agrees to safeguard ePHI. Option A is wrong because the risk assessment should drive decisions, not just acceptance. Option C is wrong because encryption does not eliminate the need for contractual protections. Option D is wrong because a SOC 2 report without HIPAA coverage does not suffice.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 12

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

Accepted Answer

Avoid the risk by not collecting unnecessary personal data. With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

Answer

Transfer the risk through cyber insurance

Answer

Mitigate the risk by encrypting personal data

Answer

Accept the risk and self-insure

Question 13

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

Accepted Answer

Include security requirements in contracts and conduct periodic audits. Including security requirements in contracts and conducting periodic audits is the most effective method because it creates a legally binding obligation for vendors to adhere to the organization's security policies, and audits provide direct, verifiable evidence of compliance. Unlike self-assessments or certifications, audits allow the organization to actively inspect controls, configurations, and processes, ensuring ongoing adherence rather than relying on a point-in-time assertion. This approach aligns with the NIST SP 800-53 continuous monitoring framework and is a core principle of third-party risk management (TPRM) in the CAS-004 domain.

Answer

Require vendors to obtain ISO 27001 certification

Answer

Send annual self-assessment questionnaires

Answer

Perform quarterly penetration tests on vendor networks

Question 14

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 15

A company's data classification policy labels all financial data as 'Confidential.' An employee accidentally emails a spreadsheet containing customer payment information to an unauthorized external party. Which type of control failure occurred?

Accepted Answer

Preventive control failure. A preventive control failure occurred because the organization lacked a technical safeguard—such as Data Loss Prevention (DLP) rules, email content filtering, or mandatory access controls—to block the outbound transmission of confidential financial data. Preventive controls are designed to stop unauthorized actions before they happen, and the absence of such a mechanism allowed the accidental email to be sent. The failure is not in detection or correction, but in the inability to prevent the data exfiltration at the point of transmission.

Answer

Corrective control failure

Answer

Administrative control failure

Answer

Detective control failure

Question 16

Which TWO of the following are examples of administrative controls? (Select TWO)

Accepted Answer

Security awareness training. Security awareness training (C) is an administrative control because it involves policies, procedures, and human behavior management rather than technical mechanisms. It educates users on security risks and compliance requirements, reducing the likelihood of social engineering or policy violations. This aligns with the administrative domain of the CIA triad's governance framework.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Intrusion detection system

Question 17

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 18

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

Accepted Answer

Lack of visibility into vendor security practices. A is correct because organizations often lack visibility into vendor security practices, meaning they cannot verify whether vendors comply with security policies or contractual obligations. This challenge arises when vendors do not provide access to their security controls, audit reports, or real-time monitoring data, leaving gaps in the risk assessment process.

Answer

Over-automation of risk scoring

Answer

Excessive cooperation from vendors

Question 19

You are the security architect for a mid-sized e-commerce company that processes credit card payments. The company must comply with PCI DSS. Currently, the cardholder data environment (CDE) includes a web server, an application server, and a database server, all on the same flat network segment. The QSA has identified that the CDE is not properly segmented, and network access controls are insufficient. The company wants to minimize the scope of PCI compliance by reducing the number of systems that handle cardholder data. You propose implementing network segmentation to isolate the CDE. Which of the following is the most effective approach to reduce PCI scope while maintaining business functionality?

Accepted Answer

Deploy a firewall between the CDE and corporate network, allowing only necessary traffic. Option D is correct because deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.

Answer

Encrypt all cardholder data at rest and in transit

Answer

Replace the database with a tokenization service and remove the database from the CDE

Answer

Move all servers to a DMZ and implement host-based firewalls

Question 20

A security architect is evaluating a new cloud-based application that will process sensitive customer data. The architect must ensure compliance with GDPR and PCI DSS. Which THREE of the following controls should be implemented? (Select THREE.)

Accepted Answer

Implement a process for customers to request deletion of their personal data.. Option B is correct because GDPR grants data subjects the right to erasure (Article 17), also known as the 'right to be forgotten.' Implementing a process for customers to request deletion of their personal data is a mandatory control for GDPR compliance, directly addressing this regulatory requirement.

Answer

Deploy geo-fencing to block access from non-EU countries.

Answer

Retain all access logs for a minimum of 7 years.