CAS-004 Practice Exam 2 — 20 Questions

Question 1

A security team is evaluating the effectiveness of their patching program. Which metric would best indicate how quickly the organization applies critical patches?

Accepted Answer

Mean time to patch. Mean time to patch measures the average time taken from the release of a patch to its application on systems. It directly indicates how quickly the organization applies critical patches, as a lower mean time to patch signifies a faster patching process. Other metrics like patch compliance percentage show the proportion of systems patched but not the speed.

Answer

Number of unpatched systems

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity

Question 2

A security analyst is reviewing a suspicious file. Which static analysis technique would the analyst use to examine the file without executing it?

Accepted Answer

Use strings to extract readable text. Using the 'strings' utility extracts readable ASCII/Unicode text from a binary without executing it, which is a classic static analysis technique for examining suspicious files. It reveals embedded URLs, file paths, error messages, and other indicators of compromise without any runtime risk.

Answer

Submit the file to VirusTotal

Answer

Execute the file in a debugger

Answer

Run the file in a sandbox

Question 3

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

Accepted Answer

Use parameterized queries or input sanitization for any user-supplied data. Input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.

Answer

Hardcode API keys into the script for simplicity

Answer

Run the script with root privileges to ensure it has access to all images

Answer

Store credentials in a world-readable configuration file

Question 4

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 5

To protect against quantum computing attacks, a security architect is planning to transition to post-quantum cryptography. Which algorithm has been selected by NIST for general encryption (key encapsulation) in the PQC standard?

Accepted Answer

CRYSTALS-Kyber. NIST selected CRYSTALS-Kyber as the primary standard for general encryption and key encapsulation (FIPS 203) in its post-quantum cryptography program. Kyber is a lattice-based KEM designed for efficient key establishment, making it the correct choice for general encryption.

Answer

Falcon

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Question 6

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management using SAML enables users to authenticate via external identity providers (e.g., social media platforms) while the corporate system retains control over access policies through the exchange of SAML assertions. This architecture decouples authentication from authorization, allowing the corporate service provider to enforce its own rules based on trusted identity claims.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures

Question 7

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC)?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.

Answer

Continuous deployment

Answer

Code signing

Question 8

An organization needs to ensure consistent configuration across multiple Linux servers. They want to automate this process with a solution that requires minimal agent installation and uses push-based communication. Which approach is most appropriate?

Accepted Answer

Use Ansible playbooks to define and enforce server configurations.. Ansible is the most appropriate choice because it is agentless (no agent installation required) and uses push-based communication over SSH to enforce configurations. It uses YAML-based playbooks to define desired states, making it ideal for automating consistent configuration across multiple Linux servers with minimal overhead.

Answer

Use PowerShell Desired State Configuration (DSC) with Linux extensions.

Answer

Run a Docker container on each server with a configuration management tool inside.

Answer

Deploy Puppet with a master server and agents on each system.

Question 9

An IoT device manufacturer wants to ensure secure firmware updates. Which approach best protects against malicious firmware being installed on devices?

Accepted Answer

Digitally sign the firmware with a private key. Code signing with a trusted key ensures only authorized firmware can be installed.

Answer

Compress the firmware to reduce size

Answer

Use a hash of the firmware for integrity verification

Answer

Encrypt the firmware with a symmetric key

Question 10

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 11

A security analyst reviews a web application that accepts user-supplied data to generate PDF reports. The application uses a legacy library that directly inserts user input into SQL queries and also includes user input in the PDF generation without sanitization. Which is the most effective countermeasure?

Accepted Answer

Use parameterized queries and output encoding. The application has two distinct vulnerabilities: SQL injection (from direct insertion of user input into SQL queries) and likely cross-site scripting or PDF injection (from unsanitized user input in PDF generation). Parameterized queries prevent SQL injection by separating code from data, while output encoding neutralizes malicious content before it is rendered in the PDF. Together, these address the root causes of both flaws, making A the most effective countermeasure.

Answer

Enable HTTPS and HSTS

Answer

Implement a web application firewall (WAF) to block malicious input

Answer

Deploy a SIEM to log all database queries and PDF generation events

Question 12

A healthcare provider is migrating patient records to a cloud EHR system. The security officer is concerned about data ownership and portability. Which contractual clause is MOST critical to include in the cloud service agreement?

Accepted Answer

A clause on data portability and format standards. Data portability and format standards clauses directly address the security officer's concerns about data ownership and the ability to move patient records out of the cloud EHR system. Without such a clause, the provider could lock the healthcare organization into proprietary formats, making migration difficult or impossible. This is critical for compliance with regulations like HIPAA, which require patients to access and transfer their health information.

Answer

A service level agreement guaranteeing 99.999% uptime

Answer

A stipulation that encryption keys are managed by the customer

Answer

A requirement for breach notification within 24 hours

Question 13

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Accepted Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings. Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Answer

Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

Question 14

A company is deploying a new web application that handles sensitive customer data. The application is built using a microservices architecture running in containers on a Kubernetes cluster. The security team wants to implement mutual TLS (mTLS) for service-to-service communication. However, they are concerned about the operational overhead of certificate management. Which approach minimizes management overhead while still ensuring strong authentication?

Accepted Answer

Use a service mesh that provides automatic mTLS and certificate rotation. A service mesh (e.g., Istio, Linkerd) automates mTLS by injecting sidecar proxies that handle certificate issuance, validation, and rotation via a built-in certificate authority (CA). This eliminates manual certificate management while ensuring strong, per-service authentication and encryption, directly addressing the operational overhead concern.

Answer

Generate self-signed certificates for each service and manually distribute them

Answer

Use a single certificate for all services with Subject Alternative Names

Answer

Implement TLS termination at the ingress and use plaintext inside the cluster

Question 15

A company deploys a web application behind a WAF. The security team discovers that the WAF allows traffic from a known malicious IP. After investigating, they find the WAF is configured to allow all traffic from a specific country for business reasons. Which of the following is the BEST course of action?

Accepted Answer

Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.. The country-based allow rule exists for legitimate business reasons, so removing it outright would break required traffic. The correct approach is to preserve the business-justified allow rule while layering a more specific deny exception for the known malicious IP, since WAF rule precedence evaluates more specific rules before broader ones. This achieves both security and business continuity without disrupting legitimate users from that country.

Answer

Deploy an additional IPS device to block the IP.

Answer

Remove the country-based allow rule immediately.

Answer

Change the WAF from detection mode to blocking mode.

Question 16

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 17

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 18

An organization is unable to patch a critical vulnerability in a legacy application due to vendor limitations. The risk assessment indicates a high likelihood of exploitation. Which compensating control should the organization implement to reduce the risk?

Accepted Answer

Implement network segmentation to isolate the application. Network segmentation isolates the legacy application from critical systems, limiting the blast radius if the vulnerability is exploited. This compensating control reduces risk by preventing lateral movement and restricting access to the vulnerable application, even though the vulnerability remains unpatched.

Answer

Deploy an additional firewall in front of the application

Answer

Disable the application until a patch is available

Answer

Increase the frequency of vulnerability scanning

Question 19

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 20

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment