CAS-004 Practice Exam 4 — 20 Questions

Question 1

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 2

An organization is implementing a governance framework to ensure that security controls are aligned with business objectives. Which of the following frameworks is specifically designed for this purpose?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed to align IT governance and security controls with business objectives by providing a comprehensive framework that links business goals to IT goals and enablers. It focuses on governance of enterprise IT (GEIT), ensuring that security investments and controls directly support strategic business outcomes, unlike other frameworks that are more operational or compliance-focused.

Answer

NIST SP 800-53

Answer

ITIL 4

Answer

ISO/IEC 27001

Question 3

An organization uses an EDR solution and wants to detect ransomware that encrypts files and then deletes volume shadow copies. Which EDR detection technique would be most effective for this behavior?

Accepted Answer

Behavioral detection for mass file modifications and vssadmin.exe execution. Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Answer

Signature-based detection using file hashes

Answer

Allowlisting of trusted applications

Answer

Network traffic analysis to detect C2 communication

Question 4

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 5

A security architect is designing a zero trust architecture for a corporate network. Which principle is fundamental to the zero trust model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every access request must be verified regardless of origin.

Answer

Trust based on device compliance

Answer

Trust based on network location

Answer

Trust but verify

Question 6

During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period of time. SOC 2 Type II reports on the effectiveness of controls over a period of time.

Answer

The vendor's financial stability

Answer

The vendor's compliance with privacy laws

Answer

The vendor's penetration test results

Question 7

Which of the following is a primary benefit of using a Web Application Firewall (WAF) in front of a web application?

Accepted Answer

It filters malicious HTTP requests and can block common web exploits. A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model and inspects HTTP/HTTPS traffic for malicious payloads. It uses a combination of signature-based detection, behavioral analysis, and rule sets (e.g., OWASP ModSecurity Core Rule Set) to filter out common web exploits such as SQL injection, cross-site scripting (XSS), and path traversal. By intercepting and blocking malicious requests before they reach the web application, a WAF provides a critical layer of defense without requiring changes to the application code.

Answer

It encrypts all traffic between client and server

Answer

It prevents all types of attacks against the application

Answer

It performs static code analysis on the application

Question 8

A security architect is designing deception technologies to detect and delay attackers. Which TWO of the following are examples of deception technologies that can be deployed? Select TWO.

Accepted Answer

Honeytokens. Honeypots and honeytokens are classic deception technologies. Honeypots mimic real systems, and honeytokens are fake data objects.

Answer

Security Information and Event Management (SIEM)

Answer

Vulnerability scanner

Answer

Intrusion Prevention System (IPS)

Question 9

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

Accepted Answer

Pod Security Policies. Pod Security Policies (or Pod Security Admission) enforce security standards for pods, such as preventing privileged containers.

Answer

Secrets management

Answer

Network policies

Answer

RBAC

Question 10

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. Using a shared symmetric key means any service with the key can forge tokens, compromising authentication integrity.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set

Question 11

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Accepted Answer

Lack of peer review and cryptanalysis. The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 12

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Accepted Answer

Run the container with a non-root user and drop all capabilities. Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 13

A security team is implementing deception technology to detect attackers inside the network. They plan to deploy fake systems that appear vulnerable and attract attackers. Which of the following is an example of a honeytoken?

Accepted Answer

A fake database credential file that triggers an alert when opened. A honeytoken is a decoy object such as a fake credential, file, or database record that is used to detect unauthorized access. A fake database credential file that triggers an alert when accessed is a typical honeytoken.

Answer

A network segment with multiple decoy systems

Answer

A fake DNS entry for a non-existent domain

Answer

A virtual machine running a vulnerable web server

Question 14

A security engineer is designing a secure hybrid cloud connection between an on-premises data center and AWS. Which service provides a dedicated, private network connection that bypasses the public internet?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private connection from on-premises to AWS.

Answer

Site-to-Site VPN

Answer

Transit Gateway

Answer

VPC Peering

Question 15

A security architect is designing a cryptographic system for a government agency that must protect classified data for the next 30 years. The agency is concerned about the threat from quantum computers. Which NIST post-quantum cryptography algorithm is recommended for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for general encryption. CRYSTALS-Dilithium is a digital signature algorithm. RSA and ECDH are vulnerable to quantum attacks.

Answer

ECDH with NIST P-384

Answer

CRYSTALS-Dilithium

Answer

RSA-4096

Question 16

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 17

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. An SBOM lists open-source components and their versions, enabling vulnerability tracking. Dependency analysis helps identify known vulnerabilities in those components.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 18

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

Accepted Answer

AWS Config. AWS Config continuously monitors and evaluates AWS resource configurations against desired policies, helping meet compliance requirements like SOC 2.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Shield

Question 19

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Accepted Answer

Runtime protection. CWPP should provide vulnerability management across different environments and runtime protection (e.g., intrusion detection) for workloads regardless of location.

Answer

Security information and event management

Answer

Identity and access management

Answer

Data loss prevention

Question 20

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. Software Bill of Materials (SBOM) is a list of all components in the application, including open-source libraries. Dependency analysis tools use SBOMs to identify known vulnerabilities. SAST analyzes source code, not libraries. DAST tests running applications. RASP provides runtime protection.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)