CAS-004 Practice Exam 3 — 20 Questions

Question 1

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Accepted Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings. Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Answer

Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

Question 2

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

Accepted Answer

The key length is insufficient against modern attacks. A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.

Answer

The firmware is not encrypted

Answer

The signature algorithm is obsolete

Answer

The signing key is not rotated

Question 3

Which three options are best practices for writing secure scripts? (Choose three.)

Accepted Answer

Use parameterized inputs to prevent injection attacks.. Parameterized inputs (also known as prepared statements or parameterized queries) separate SQL or shell command logic from user-supplied data, ensuring that input is treated strictly as data, not executable code. This prevents injection attacks such as SQL injection or command injection, which occur when untrusted input is concatenated directly into a command string. In scripting languages like Python, using `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))` instead of string formatting eliminates the risk of an attacker breaking out of the intended syntax.

Answer

Log all errors and warnings for debugging.

Answer

Hardcode sensitive credentials in the script.

Question 4

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Accepted Answer

All requests to the bucket are denied regardless of source IP.. The S3 bucket policy includes an explicit Deny statement that denies all actions (s3:*) for all principals (*), effectively blocking any request regardless of source IP. Even though there is an Allow statement permitting GetObject from the 10.0.0.0/8 range, the explicit Deny overrides it due to the policy evaluation logic where Deny takes precedence over Allow. Therefore, all requests to the bucket are denied.

Answer

Requests from outside 10.0.0.0/8 are allowed to read objects.

Answer

All requests from IPs in 10.0.0.0/8 are allowed to read objects.

Answer

Only anonymous requests are denied.

Question 5

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.

Question 6

A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?

Accepted Answer

Security information and event management (SIEM) with behavior analytics. A SIEM with User and Entity Behavior Analytics (UEBA) is most effective for reducing MTTD because it baselines normal behavior and detects anomalies in real time, enabling early detection of threats. Full disk encryption (B) protects data at rest but does not aid detection. A DLP system (C) focuses on preventing data exfiltration, not broad detection. A NIDS (D) relies on signature matching, which can miss novel or subtle attacks and typically has a higher detection latency than behavior analytics.

Answer

Full disk encryption software

Answer

Data loss prevention (DLP) system

Answer

Network-based intrusion detection system (NIDS)

Question 7

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

Accepted Answer

The certificate uses the SHA-1 hash algorithm. The certificate uses the SHA-1 hash algorithm, which is cryptographically broken and vulnerable to collision attacks. SHA-1 is deprecated by major browsers and the CA/Browser Forum, and its use in TLS certificates poses a significant security risk because an attacker could forge a certificate with the same hash.

Answer

The RSA key length is 2048 bits

Answer

The certificate is self-signed

Answer

The validity period is only one year

Question 8

A security engineer is evaluating the use of AES-256-GCM for encrypting sensitive data in transit. They note that the Additional Authenticated Data (AAD) field is empty. What is the security implication?

Accepted Answer

The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.. In AES-256-GCM, the Additional Authenticated Data (AAD) provides context binding, ensuring that the ciphertext is authentic only within a specific context (e.g., a particular session or transaction). When AAD is empty, an attacker who has access to multiple valid ciphertexts (each with its own context) could potentially swap them without detection, leading to a mix-and-match attack. The cipher still provides authentication (via the authentication tag) and confidentiality, but without AAD, the binding to the intended context is lost. Option B is wrong because missing AAD does not directly affect protection against man-in-the-middle attacks; the cipher still provides integrity and authentication. Option C is wrong because AES-256-GCM provides authentication through its GMAC authentication tag, even without AAD. Option D is wrong because AAD has no impact on key recovery; GCM is secure against key recovery attacks regardless of AAD.

Answer

The cipher is still secure, but missing AAD offers no additional protection against man-in-the-middle attacks.

Answer

The encryption provides no authentication because AAD is missing.

Answer

The cipher becomes vulnerable to key recovery attacks because AAD is missing.

Question 9

A small business uses Puppet for configuration management on Linux servers. They are now migrating to containers and want to maintain security. The operations team is unfamiliar with containers. The security team insists on automated vulnerability scanning of container images before deployment. What should be the company's first step?

Accepted Answer

Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.. The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.

Answer

Deploy a Kubernetes cluster and migrate all applications.

Answer

Discontinue using Puppet and switch entirely to container-based configurations.

Answer

Train the operations team on Docker and Kubernetes fundamentals.

Question 10

A security analyst is reviewing a CI/CD pipeline configuration. The pipeline uses a containerized application and includes automated security scanning. Which TWO practices should be implemented to ensure container immutability and reduce the attack surface?

Accepted Answer

Run containers with read-only root filesystem.. Running containers with a read-only root filesystem enforces immutability, preventing any modifications at runtime. Option B is correct because scanning images for vulnerabilities at build time reduces the attack surface by catching issues before deployment. Option C is incorrect because using the same base image for all environments does not directly relate to immutability or attack surface reduction and may ignore environment-specific security needs. Option D is incorrect because running containers as root weakens security and increases the attack surface. Option E is incorrect because storing credentials in environment variables is insecure and should be avoided.

Answer

Use the same base image for all environments.

Answer

Run containers as root.

Answer

Store credentials in environment variables.

Question 11

An organization is implementing a hardware security module (HSM) to protect cryptographic keys used for code signing. The HSM is required to meet a government standard for physical security and tamper resistance. Which FIPS 140 security level must the HSM achieve to provide tamper-evident coatings and tamper response mechanisms?

Accepted Answer

FIPS 140-2 Level 3. FIPS 140-2 Level 3 requires tamper-evident coatings and tamper response mechanisms that zeroize keys upon tampering. Level 2 requires tamper-evident coatings but no response, Level 4 is for extreme environments.

Answer

FIPS 140-2 Level 4

Answer

FIPS 140-2 Level 2

Answer

FIPS 140-2 Level 1

Question 12

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Accepted Answer

Disable TLS 1.0 and enable TLS 1.2 only. The vulnerability being remediated is likely the use of outdated TLS 1.0, which is deprecated by PCI DSS and has known weaknesses (e.g., POODLE, BEAST). Disabling TLS 1.0 and enabling only TLS 1.2 directly addresses the cryptographic protocol weakness, ensuring compliance with PCI DSS requirement 4.1 (use of strong cryptography). This is the most appropriate action because it removes the insecure protocol entirely rather than isolating or compensating for it.

Answer

Move the host to a separate VLAN

Answer

Apply a compensating control such as an API gateway

Answer

Accept the risk because the CVSS score is below 8.0

Question 13

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). SBOMs list all components and their versions; dependency analysis identifies vulnerabilities in those components.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration

Question 14

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Accepted Answer

Reset the service account password and revoke any active tokens.. Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Answer

Check the workstation logs for signs of malware.

Answer

Notify law enforcement and the organization's legal department.

Answer

Restore the affected files from a known good backup.

Question 15

A security administrator is configuring SSH for a jump host used to access critical servers. Which of the following is the most secure configuration option to restrict authentication and reduce the attack surface?

Accepted Answer

Allow only key-based authentication. Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

Answer

Enable root login with a strong password

Answer

Allow only SSH protocol version 2

Answer

Change the default port to 2222

Question 16

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 17

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

Accepted Answer

In the DMZ. A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

Answer

In the management network

Answer

In the database tier

Answer

Inside the internal network

Question 18

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 19

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

Accepted Answer

Implement short-lived access tokens with refresh tokens that are automatically rotated. Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Answer

Extend the session token expiration time to reduce the frequency of re-authentication

Answer

Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture

Answer

Reduce the number of authentication factors required for re-authentication

Question 20

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. The best course of action because it directly addresses both security issues: cross-region replication of KMS master keys eliminates the single point of failure, and restricting health check ports to internal IP ranges reduces exposure. Option A is incorrect because it replaces TLS with IPsec (unnecessary) and adds complexity. Option C consolidates to one region, which defeats the purpose of multi-region deployment for availability and disaster recovery. Option D embeds keys in code, violating key management best practices. Option B minimizes latency and cost while ensuring security.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely