CAS-004 Practice Exam 2 — 20 Questions

Question 1

A security architect is reviewing the network architecture of a financial trading system. The system uses a time-sensitive order matching engine that must process trades with minimal latency. The architect is concerned about the risk of a DDoS attack on the matching engine. Which of the following architectural changes would best mitigate DDoS risk while preserving low latency?

Accepted Answer

Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.. A cloud-based DDoS scrubbing service (e.g., AWS Shield Advanced, Cloudflare Magic Transit) filters malicious traffic at the cloud edge before it reaches the on-premises matching engine. This preserves low latency because only clean, low-volume traffic is forwarded, and the scrubbing infrastructure is designed for high-throughput, low-latency processing without introducing inline inspection delays on the critical path.

Answer

Deploy an intrusion prevention system (IPS) in inline mode in front of the matching engine.

Answer

Move the matching engine to a cloud provider with elastic scalability.

Answer

Implement a reverse proxy with rate limiting and IP blacklisting.

Question 2

A security administrator needs to secure remote access for employees using personal devices. The company requires that company data be encrypted and that the device be wiped if lost. Which solution best meets these requirements?

Accepted Answer

Deploy a mobile device management (MDM) solution that enforces device encryption and supports remote wipe.. Mobile device management (MDM) solutions are specifically designed to enforce security policies on personal devices, including mandatory device encryption (e.g., AES-256 for data at rest) and the ability to perform a remote wipe (factory reset) to destroy company data if the device is lost or stolen. This directly addresses the requirement to protect company data on unmanaged, employee-owned devices.

Answer

Use network access control (NAC) to allow only compliant devices onto the network.

Answer

Require employees to connect via a corporate VPN and use two-factor authentication.

Answer

Implement remote desktop protocol (RDP) gateways for all remote access.

Question 3

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. Option A is correct because an IPsec VPN tunnel creates an encrypted, site-to-site connection between the AWS VPC and the on-premises network, ensuring encryption in transit and minimizing internet exposure by using the VPN gateway as the endpoint. Option B is correct because AWS Direct Connect provides a dedicated, private network connection that bypasses the internet entirely, reducing exposure and supporting encryption via optional MACsec or IPsec, while maintaining low latency and consistent bandwidth.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.

Question 4

A security architect is evaluating a new cloud SaaS application that will handle sensitive customer data. The SaaS provider offers a shared responsibility model where the customer is responsible for data classification, access management, and encryption of data at rest using customer-managed keys. The architect must ensure that the organization retains the ability to revoke access to the data if the provider is compromised. Which key management strategy best meets this requirement?

Accepted Answer

Implement bring-your-own-key (BYOK) with keys stored in a customer-controlled external KMS. Option D is correct because BYOK with keys stored in a customer-controlled external KMS ensures the organization retains full control over encryption keys, enabling immediate revocation of access to data at rest if the SaaS provider is compromised. This aligns with the shared responsibility model where the customer manages keys, and external KMS decouples key management from the provider's infrastructure, preventing the provider from accessing data after key revocation.

Answer

Escrow the encryption key with a third-party and rely on legal agreements for revocation

Answer

Use the provider's default encryption with a customer-managed key stored in the provider's KMS

Answer

Use a cloud hardware security module (HSM) to generate and store keys

Question 5

An organization is deploying a new cloud-based application that processes personally identifiable information (PII). The security team must ensure data at rest is encrypted. Which THREE of the following controls should be implemented to protect the data? (Select THREE.)

Accepted Answer

Implement a key management system (KMS) with automatic key rotation.. Option B is correct because a key management system (KMS) with automatic key rotation ensures that encryption keys are securely stored, rotated, and managed, which is essential for protecting data at rest. Without proper key management, encryption can be rendered ineffective if keys are compromised or stale. This control directly supports the confidentiality of PII stored in the cloud.

Answer

Use tokenization for all PII fields in the database.

Answer

Configure TLS 1.3 for all data connections.

Question 6

A security architect is designing a secure software development pipeline. The organization wants to ensure that code is thoroughly analyzed before deployment. Which TWO of the following should be integrated into the pipeline to identify vulnerabilities early? (Select TWO.)

Accepted Answer

Static application security testing (SAST). SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code without executing it, scanning for vulnerabilities like SQL injection, buffer overflows, and insecure cryptographic functions. Integrating SAST early in the pipeline (shift-left) allows developers to fix issues before compilation, reducing remediation cost and risk. SCA (Software Composition Analysis) identifies known vulnerabilities in third-party libraries and open-source components by comparing dependency versions against databases like the National Vulnerability Database (NVD). Both tools are non-intrusive and can be automated in CI/CD pipelines to catch flaws before deployment.

Answer

Fuzz testing

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Question 7

A security architect is designing a VPN solution for remote employees. The company requires strong authentication and integrity protection but is less concerned about confidentiality for non-sensitive traffic. Which protocol is most appropriate?

Accepted Answer

ESP in tunnel mode with null encryption. Option C is correct because ESP in tunnel mode with null encryption provides authentication and integrity via HMAC (e.g., HMAC-SHA256) while omitting encryption (ESP_NULL, RFC 2410). This satisfies the requirement for strong authentication and integrity without confidentiality for non-sensitive traffic, as the payload is authenticated but not encrypted.

Answer

L2TP/IPsec with ESP

Answer

SSL/TLS VPN

Answer

AH in transport mode

Question 8

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Accepted Answer

OAuth 2.0 tokens. OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

Answer

LDAP binds

Answer

SAML assertions

Answer

Kerberos tickets

Question 9

A security engineer is troubleshooting a web application that uses OAuth 2.0 for authorization. Users report that after authenticating, they are unable to access resources that require a specific scope. The engineer inspects the authorization request and finds that the scope parameter is missing. Which OAuth flow is most likely being used?

Accepted Answer

Implicit grant. The implicit grant flow in OAuth 2.0 does not require the client to include the scope parameter in the authorization request; the access token is returned directly in the URL fragment without a separate token endpoint call. When the scope parameter is missing, the authorization server may issue a token with a default or limited scope, causing users to be unable to access resources that require a specific scope. This matches the described symptom, making the implicit grant the most likely flow in use.

Answer

Client credentials grant

Answer

Authorization code grant

Answer

Resource owner password credentials grant

Question 10

An organization wants to implement a solution that ensures data cannot be read if a storage device is physically stolen. Which encryption approach BEST meets this requirement?

Accepted Answer

Full disk encryption (FDE) on the storage device. Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Answer

Transport Layer Security (TLS) for network traffic

Answer

File-level encryption on sensitive documents

Answer

Database column-level encryption for stored data

Question 11

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

Accepted Answer

Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.. Option C is correct because a Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Answer

Store the private keys in an encrypted database on a separate database server.

Answer

Use a software-based key vault that runs on the same operating system as the web server.

Answer

Store the private keys in a local file with restricted permissions on the application server.

Question 12

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Accepted Answer

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.. Option C is correct because the iptables rules show a default FORWARD policy of ACCEPT, but the INPUT chain has a default policy of DROP. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that only return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the FORWARD chain's default policy.

Answer

New connections from the internet to 10.0.1.0/24 are allowed.

Answer

All traffic is allowed by default because the policy is ACCEPT.

Answer

The rules apply to incoming traffic on the firewall itself.

Question 13

A network administrator is configuring a firewall rule set. The requirement is to allow inbound HTTPS traffic from the internet to a web server at 10.1.1.10, and to allow the web server to respond. All other inbound traffic should be blocked. Which rule set accomplishes this?

Accepted Answer

Allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound. Option B is correct because HTTPS uses TCP port 443, and the rule set correctly allows inbound TCP 443 to the web server at 10.1.1.10, permits the server's outbound responses (stateful or explicit), and then denies all other inbound traffic. This matches the requirement to allow only HTTPS traffic from the internet while blocking everything else.

Answer

Allow inbound TCP 80 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Answer

Deny all inbound; allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10

Answer

Allow inbound TCP 22 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Question 14

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 15

A company is designing a new data center with high availability requirements. The network team proposes using virtualized network functions (VNFs) on commodity hardware to reduce costs. Which security consideration is MOST important when implementing this design?

Accepted Answer

Isolate VNFs to prevent lateral movement if one VNF is compromised. Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Answer

Ensure VNFs are deployed across multiple physical hosts for redundancy

Answer

Encrypt all traffic between VNFs to prevent eavesdropping

Answer

Implement quality of service (QoS) to guarantee bandwidth for critical VNFs

Question 16

Match each automation security concept with its correct description.

Answer

Immutable infrastructure

Answer

Infrastructure as Code

Answer

Secret management

Answer

Container orchestration

Question 17

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

Accepted Answer

Exposure of sensitive credentials in the image layers. Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Answer

Use of untrusted base image

Answer

Privilege escalation via SUID binaries

Answer

Dependency confusion from unpinned packages

Question 18

A security engineer needs to implement a solution that will detect and block command-and-control (C2) traffic from malware on the internal network. The solution must be able to inspect encrypted traffic and operate at the network layer. Which of the following is the BEST choice?

Accepted Answer

Deploy a next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering.. A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

Answer

Implement a web application firewall (WAF) to filter outbound HTTP/HTTPS traffic.

Answer

Install a network-based intrusion detection/prevention system (IDS/IPS) with signature updates.

Answer

Use endpoint detection and response (EDR) agents on all workstations and servers.

Question 19

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

Accepted Answer

Check if the host is configured as a mail server in the organization's asset database.. Option B is correct because the first step in investigating potential data exfiltration over TCP port 25 (SMTP) is to verify whether the host is authorized to send email. If the host is a legitimate mail server, the traffic may be normal; if not, it could indicate malware or a misconfigured application exfiltrating data via SMTP. This aligns with the CAS-004 objective of validating asset roles before escalating to containment.

Answer

Submit a change request to implement an email content filter.

Answer

Block the outbound traffic on the firewall to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the host to detect any malware.

Question 20

A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?

Accepted Answer

Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.. Option D is correct because the attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.

Answer

Enforce a minimum password complexity policy for all users.

Answer

Require multi-factor authentication for all SSH logins.

Answer

Implement rate limiting on SSH connections per source IP.