CAS-004 Practice Exam 3 — 20 Questions

Question 1

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the container with a non-root user and drop all capabilities. Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 2

A regional bank is preparing for its annual regulatory examination and must demonstrate that its third-party risk management program is mature. The examiner asks which practices provide continuous, rather than point-in-time, oversight of critical vendors. (Choose two.)

Accepted Answer

Establishing contractual rights to audit, receive breach notifications within defined timeframes, and obtain regular independent assurance reports. Continuous third-party oversight combines recurring independent validation with enforceable contractual information rights. Periodic assessments with remediation tracking confirm that identified weaknesses are corrected, while audit rights, breach notification clauses, and independent assurance requirements keep the bank informed between reviews. One-time questionnaires, spend-based ranking, and reliance on vendor marketing all capture stale or unverified information.

Answer

Relying on the vendor's own marketing materials and public certifications page to confirm its security posture

Answer

Ranking vendors solely by annual contract value and assigning oversight resources proportionally to spend

Answer

Collecting a completed security questionnaire from each vendor once during initial onboarding and archiving the response

Question 3

A system administrator needs to securely store cryptographic keys and perform signing operations in a tamper-resistant hardware device. Which solution should be used?

Accepted Answer

A Hardware Security Module (HSM) with FIPS 140-2 Level 3 certification.. An HSM (Hardware Security Module) is designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment.

Answer

A secure enclave like Intel SGX.

Answer

A software-based key store with encrypted files.

Answer

A Trusted Platform Module (TPM) 2.0.

Question 4

An organization is creating a data classification policy. Which THREE of the following are common classification levels used in government and defense? (Select THREE.)

Accepted Answer

Top Secret. Top Secret is a standard classification level in government and defense, indicating information that would cause exceptionally grave damage to national security if disclosed without authorization. It is the highest level in the U.S. classification system, defined under Executive Order 13526, and requires the most stringent access controls and handling procedures.

Answer

Private

Answer

Public

Question 5

A security architect is implementing a zero trust architecture for a corporate network. Which TWO principles are fundamental to the zero trust approach? (Choose two.)

Accepted Answer

Verify every access request regardless of source. Option D is correct because zero trust requires that every access request be authenticated and authorized explicitly, regardless of whether it originates inside or outside the traditional network perimeter—no user or device is trusted by default. Option E is correct because least privilege access is a core zero trust principle, granting users and devices only the minimum permissions needed for their tasks and limiting lateral movement if credentials are compromised. Options A, B, and C are incorrect because they reflect perimeter-based, castle-and-moat security models: granting access by network location, assuming implicit trust for internal users, and relying on a single perimeter firewall all contradict zero trust's 'never trust, always verify' philosophy.

Answer

Grant access based on network location

Answer

Assume implicit trust for internal users

Answer

Use a single perimeter firewall

Question 6

An organization is required to retain logs for seven years per regulatory requirement. Which of the following should be considered to ensure the integrity of these logs?

Accepted Answer

Write-once, read-many (WORM) storage. Write-once, read-many (WORM) storage ensures that once log data is written, it cannot be altered, overwritten, or deleted for the retention period. This immutability directly satisfies the regulatory requirement for log integrity over seven years, as it prevents both accidental modification and malicious tampering. WORM can be implemented via optical media, magnetic tape with WORM firmware, or object storage with retention policies.

Answer

Hashing each log entry

Answer

Encryption of the logs

Answer

Compression to reduce storage space

Question 7

Which TWO of the following are advantages of using a hardware security module (HSM) over a software-based cryptographic module? (Select exactly 2.)

Accepted Answer

Physical tamper resistance and protection against key extraction.. Option C is correct because an HSM is a dedicated physical device designed with tamper-resistant and tamper-evident mechanisms (such as epoxy encapsulation, sensors, and zeroization) that protect cryptographic keys from extraction even under physical attack, which a software module running on general-purpose hardware cannot guarantee. Option E is correct because HSMs include dedicated cryptographic accelerators and optimized processors that offload symmetric and asymmetric operations from the host CPU, yielding higher throughput and lower latency for bulk encryption and key operations. Option A is not generally true, since HSMs can be harder to deploy and integrate in cloud environments than pure software modules, which are simply installed or linked. Option B is incorrect because HSM firmware updates typically require manual or vendor-managed intervention and are not automatically applied like some software patch pipelines. Option D is incorrect because HSMs are typically far more expensive than software-based cryptographic modules due to specialized hardware, certification, and management overhead.

Answer

Easier to deploy in cloud environments than software.

Answer

Automatically receive security patches without manual intervention.

Answer

Lower cost than software modules.

Question 8

A company uses a hybrid cloud model with workloads on AWS and on-premises. They need to ensure secure connectivity between the two environments with high bandwidth and low latency, bypassing the public internet. Which solution should they implement?

Accepted Answer

Configure AWS Direct Connect for dedicated private connectivity. AWS Direct Connect provides a dedicated, private network connection between on-premises infrastructure and AWS, bypassing the public internet entirely. It delivers consistent high bandwidth and low latency, which is exactly what hybrid workloads requiring predictable performance need. Because traffic never traverses the public internet, Direct Connect also improves security posture by reducing exposure to internet-based threats.

Answer

Implement SD-WAN with integrated security

Answer

Establish a site-to-site VPN over the internet

Answer

Use AWS PrivateLink to access VPC endpoints

Question 9

Refer to the exhibit. A security analyst notices that traffic from external clients to the web server at 10.0.0.10 port 80 is being blocked. Which of the following is the MOST likely cause?

Accepted Answer

The ACL is misordered (deny before permit). The ACL is misordered because Cisco ACLs process rules sequentially from top to bottom, and a 'deny any' statement placed before a 'permit' statement will block all traffic, including the desired web traffic to 10.0.0.10 port 80. Since the exhibit shows a deny statement preceding the permit, the permit is never evaluated, causing the block.

Answer

The ACL lacks a log statement

Answer

The web server is using port 443

Answer

The destination IP is incorrect

Question 10

A security operations center (SOC) analyst receives an alert from the SIEM indicating a user has logged into the corporate VPN from an unusual geographic location at 3 AM, which is outside the user's normal working hours. The user has not previously exhibited this behavior. Which advanced SIEM capability is most likely responsible for generating this alert?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) uses machine learning to establish a baseline of normal user activity and detect anomalies such as unusual login times and locations. This is a core feature of advanced SIEM platforms.

Answer

Correlation rule based on static thresholds

Answer

Signature-based detection

Answer

Threat intelligence feed correlation

Question 11

During a security incident, the incident response team has identified the root cause and removed the threat from all affected systems. Which phase of the incident response lifecycle involves returning systems to normal operation and monitoring for any signs of recurrence?

Accepted Answer

Recovery. The Recovery phase of the incident response lifecycle focuses on restoring systems to normal operation after the threat has been eradicated. It involves bringing systems back online, validating their integrity, and monitoring for any signs of recurrence. This phase ensures that the organization can resume business operations securely.

Answer

Eradication

Answer

Containment

Answer

Lessons Learned

Question 12

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an insider is using encrypted tunnels to transfer data. Which TWO of the following network traffic analysis (NTA) indicators are most likely to suggest encrypted exfiltration? (Choose two.)

Accepted Answer

Large data transfers to an external IP address during non-business hours. Option A is correct because large outbound data transfers to an external IP address outside normal business hours are a classic NTA indicator of exfiltration, as insiders often schedule bulk transfers when monitoring and user activity are lower. Option D is correct because repeated TLS connections to an external host on a non-standard port strongly suggest an encrypted tunnel or covert channel, since TLS hides payload contents and the non-standard port deviates from normal HTTPS/443 behavior. Option B is not correct because multiple HTTP GET requests to a known CDN are typically normal web browsing or content retrieval and do not indicate large-scale encrypted exfiltration. Option C is not correct because a single large upload to a cloud storage provider during work hours may be legitimate business activity and lacks the suspicious timing or tunneling characteristics of insider exfiltration. Option E is not correct because high DNS query volume to one domain more likely indicates DNS tunneling or beaconing, but the question specifically asks for indicators of encrypted exfiltration tunnels rather than DNS-based covert channels.

Answer

Multiple HTTP GET requests to a known content delivery network

Answer

A single large file upload to a cloud storage provider during work hours

Answer

High volumes of DNS queries to a single external domain

Question 13

A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?

Accepted Answer

System categorization. System categorization is a step unique to the NIST RMF (Step 1: Categorize) that uses FIPS 199 to classify information systems by impact level (Low, Moderate, High). ISO 27005 focuses on risk management processes — risk identification, assessment, and treatment — but does not include a formal system categorization step as part of its framework. This makes system categorization the correct differentiator.

Answer

Risk identification

Answer

Risk treatment

Answer

Risk assessment

Question 14

During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period of time. SOC 2 Type II reports on the effectiveness of controls over a period of time.

Answer

The vendor's financial stability

Answer

The vendor's compliance with privacy laws

Answer

The vendor's penetration test results

Question 15

During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?

Accepted Answer

Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services. The most effective way to prevent a compromised DMZ host from pivoting into the internal network is to enforce a unidirectional traffic flow. By blocking all outbound connections from the DMZ to the internal network at the firewall and using a reverse proxy (e.g., HAProxy, Nginx, or Apache with mod_proxy) to handle inbound requests, the DMZ hosts never directly initiate connections to internal resources. This eliminates the lateral movement path even if a DMZ host is fully compromised, as the reverse proxy terminates the external connection and forwards requests to internal servers without allowing the DMZ host to establish a new outbound session.

Answer

Allow only specific IPs in the DMZ to connect to internal servers

Answer

Replace the DMZ firewall with a next-generation firewall that includes IPS

Answer

Move all DMZ services to a cloud provider and use a site-to-site VPN

Question 16

A multinational corporation is implementing a data classification scheme. Which of the following data types should be classified as 'restricted'?

Accepted Answer

Customer PII with legal requirements. Customer PII with legal requirements should be classified as 'restricted' because it involves personal data protected by laws and regulations (e.g., GDPR, CCPA), and unauthorized disclosure could lead to legal penalties, financial loss, and reputational damage. Restricted data typically requires the highest level of protection.

Answer

Internal meeting minutes

Answer

Employee training materials

Answer

Marketing brochures

Question 17

A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)

Accepted Answer

Record and monitor all privileged sessions. Option A is correct because recording and monitoring all privileged sessions provides an audit trail and enables real-time detection of malicious or anomalous activity by administrators, which is a core PAM control. Option B is correct because just-in-time (JIT) access provisioning grants elevated privileges only when needed and for a limited time, reducing the standing attack surface and the window for credential misuse. Option C is correct because break-glass accounts provide controlled emergency access when normal PAM workflows fail, and when properly vaulted, monitored, and alerted on, they preserve availability without creating unmanaged privileged access. Option D is not the best fit because MFA for all users is a general identity control, not a PAM-specific practice for critical server privileged access. Option E is not correct because periodic password rotation for service accounts is a legacy practice that can weaken security and is not a core PAM enhancement compared to session monitoring, JIT access, and break-glass procedures.

Answer

Enforce multi-factor authentication for all users

Answer

Require periodic password rotation for all service accounts

Question 18

An organization is implementing a secure software development lifecycle. Which of the following practices BEST ensures that security requirements are addressed early in the development process?

Accepted Answer

Threat modeling during design phase. Threat modeling during the design phase is the best practice for addressing security requirements early because it proactively identifies potential threats, attack vectors, and vulnerabilities in the system architecture before any code is written. By analyzing data flow, trust boundaries, and threat agents (e.g., using STRIDE or PASTA methodologies), security controls can be integrated into the design, reducing costly rework later. This aligns with the 'shift left' principle in secure SDLC, ensuring security is not an afterthought.

Answer

Security training for developers

Answer

Code analysis after development

Answer

Penetration testing before release

Question 19

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which technique is most commonly used for lateral movement in a Windows environment?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) is a credential theft technique where an attacker captures NTLM password hashes (e.g., via Mimikatz from LSASS memory) and uses them to authenticate to other Windows systems without cracking the plaintext password. It is one of the most common lateral movement techniques in Windows environments because NTLM authentication accepts the hash directly.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

ARP spoofing

Question 20

A company is evaluating a new cloud service provider. The provider offers a SOC 2 Type II report, a third-party penetration test summary, and a completed security questionnaire. However, the company's procurement team discovers that the provider uses a subcontractor for data storage. Which of the following is the BEST next step for the security team?

Accepted Answer

Request a right-to-audit clause covering the subcontractor.. When a cloud provider uses a subcontractor for data storage, the security team should ensure they have the right to audit the subcontractor's controls, typically through a right-to-audit clause in the contract. This allows the company to verify that the subcontractor meets the required security standards. The other options are either too extreme or insufficient.

Answer

Require the provider to use only in-house resources.

Answer

Accept the risk because the provider has a SOC 2 report.

Answer

Immediately terminate the contract due to subcontractor risk.