CAS-004 Practice Exam 1 — 20 Questions

Question 1

Which TWO of the following are key elements of a data classification policy?

Accepted Answer

Handling and labeling procedures. Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Answer

Acceptable use guidelines for company devices

Answer

Backup frequency and retention periods

Answer

Encryption algorithms and key lengths

Question 2

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 3

A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?

Accepted Answer

SHA-3. SHA-3 is not vulnerable to length extension attacks and offers good performance. SHA-256 is vulnerable to length extension. BLAKE3 is fast but less standardized. MD5 is broken and insecure.

Answer

BLAKE3

Answer

SHA-256

Answer

MD5

Question 4

Which of the following is a primary function of a Cloud Access Security Broker (CASB)?

Accepted Answer

Enforce security policies between users and cloud applications. A CASB acts as an intermediary between users and cloud services, enforcing security policies such as access control, data loss prevention, and visibility into cloud application usage.

Answer

Scan container images for vulnerabilities

Answer

Provide IAM for cloud infrastructure

Answer

Monitor network traffic at the packet level

Question 5

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 6

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 7

An analyst wants to automate incident response tasks in a SOC environment. Which THREE scripting languages are commonly used for automation? (Choose three.)

Accepted Answer

Python. Python is correct because it is a versatile, high-level scripting language widely used in SOC automation for tasks such as parsing logs, interacting with REST APIs, and orchestrating incident response workflows. Its extensive libraries (e.g., requests, pandas, and boto3 for AWS) and cross-platform support make it ideal for automating repetitive security operations tasks.

Answer

Java

Answer

COBOL

Question 8

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 9

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Accepted Answer

OAuth 2.0 tokens. OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

Answer

LDAP binds

Answer

SAML assertions

Answer

Kerberos tickets

Question 10

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Accepted Answer

Add an SELinux policy module to allow httpd_t to connectto unconfined_t. The web server (httpd_t) is denied access to the local database socket because SELinux enforces mandatory access controls. Adding an SELinux policy module that allows httpd_t to connect to unconfined_t (the domain of the database socket) grants the necessary permission without disabling security. This is the targeted fix that preserves SELinux protection while resolving the connectivity issue.

Answer

Disable SELinux entirely

Answer

Restart the httpd service

Answer

Change the SELinux enforcing mode to permissive

Question 11

During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?

Accepted Answer

Perform a memory capture using a tool like DumpIt or winpmem. In digital forensics, the order of volatility dictates that volatile data (e.g., running processes, network connections) should be collected first because it is lost when the system is powered down. Memory capture preserves this data, including process information and active network connections.

Answer

Export the Windows event logs related to network activity

Answer

Execute a network scan from the compromised host to identify active connections

Answer

Capture a full disk image using FTK Imager

Question 12

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

Accepted Answer

Use selective authentication and restrict the authorized accounts. Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint. Disabling the trust is not practical.

Answer

Remove the trust entirely and use individual local accounts

Answer

Configure the trust to use forest-wide authentication instead of selective

Answer

Enable SID filtering on both forest trusts

Question 13

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 14

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 15

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

Question 16

A security team wants to implement a certificate pinning strategy for their mobile application to prevent man-in-the-middle attacks. Which of the following should be pinned in the application code?

Accepted Answer

The server's public key. Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Answer

The intermediate CA certificate

Answer

The server's IP address

Answer

The root CA certificate

Question 17

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Accepted Answer

Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes. The database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Answer

Immediately block the external IP address at the perimeter firewall

Answer

Disable the database server's network interface

Answer

Review the database server's recent application logs for any anomalies

Question 18

An organization is implementing a vulnerability management program and needs to prioritize patching based on risk. The team has identified multiple vulnerabilities with different CVSS scores. Which THREE factors should be considered when prioritizing patches according to CVSS environmental metrics? (Choose THREE.)

Accepted Answer

Confidentiality, integrity, and availability requirements of the affected system. Environmental metrics in CVSS allow customization of the score based on the organization's environment. Key factors include security requirements (confidentiality, integrity, availability), which affect the overall severity. Asset criticality and compliance requirements are also considered. Patch availability and exploit maturity are temporal metrics, not environmental.

Answer

Availability of a patch or workaround

Answer

Exploit code maturity and remediation level

Question 19

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 20

A security analyst is analyzing a network capture and sees repeated TCP SYN packets to a host but no SYN-ACK responses. Which TWO conclusions are MOST likely? (Choose two.)

Accepted Answer

A firewall is dropping the SYN packets before they reach the host.. Repeated TCP SYN packets without any SYN-ACK responses indicate that the target host is not responding to connection attempts. This can occur if a stateful firewall is blocking the incoming SYN packets before they reach the host (option D). Alternatively, an attacker may be conducting a SYN flood DDoS attack, overwhelming the host with SYN packets so that it cannot send SYN-ACK responses (option E). Options A, B, and C are incorrect because TCP receive window issues (A) do not prevent SYN-ACKs, network loops (B) would still allow responses, and accepted connections (C) would produce SYN-ACKs.

Answer

The host is out of TCP receive window space.

Answer

The network has a loop causing packet duplication.

Answer

The host has accepted the connections.