CAS-004 Practice Exam 4 — 20 Questions

Question 1

A SOC team is implementing a SOAR playbook to automate the response to phishing emails reported by users. The playbook should perform initial triage and, if the email is determined to be malicious, take containment actions. Which TWO of the following actions should be included in the playbook? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automatically block the sender's email address in the email gateway. Option E is correct because extracting embedded URLs and file hashes is a core initial triage step in a phishing SOAR playbook — these indicators are submitted to threat intelligence platforms (e.g., VirusTotal, MISP) to determine whether the email is malicious before any containment action is taken. Option C is correct because, once the email is confirmed malicious, blocking the sender's address at the email gateway is a standard, low-risk containment action that prevents further messages from that sender reaching other users. Option A is not appropriate because requiring manager approval introduces a manual delay that defeats the purpose of an automated SOAR playbook and is not a triage or containment action. Option B is not a triage or containment action; ticketing is a documentation/notification step, not part of the initial decision or containment logic. Option D is not indicated here because a full antivirus scan on the workstation is a host-level remediation action that is not triggered by email triage alone and would typically follow only if the user executed an attachment or payload.

Answer

Send an alert to the user's manager for approval

Answer

Automatically create a ticket in the service desk system

Answer

Initiate a full antivirus scan on the user's workstation

Question 2

A senior security architect is designing a detection strategy for advanced persistent threats (APTs) that employ living-off-the-land (LotL) techniques. Which THREE of the following approaches are most effective for detecting LotL activities? (Choose three.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). Option A (UEBA) is correct because LotL attacks abuse legitimate credentials and tools, so baselining normal user and entity behavior and flagging anomalies (e.g., unusual process lineage, off-hours privileged activity) is one of the few ways to surface attacker activity that leaves no malicious binary. Option B (honeytokens and honeypots) is correct because decoy credentials, files, and hosts have no legitimate use, so any interaction with them is high-fidelity evidence of an intruder performing reconnaissance or lateral movement with native tooling. Option D (monitoring native tool usage with EDR and command-line argument logging) is correct because LotL techniques rely on built-in binaries such as PowerShell, WMI, certutil, and rundll32, and capturing process creation with full command lines (e.g., via Sysmon Event ID 1 or EDR telemetry) exposes suspicious invocations like encoded PowerShell or certutil -urlcache. Option C is not correct because signature-based detection on known malicious file hashes cannot detect LotL activity, which by definition uses already-installed, signed, legitimate system binaries that have no malicious hash. Option E is not correct because blanket blocking of all scripts and macros is a preventive hardening control, not a detection approach, and it is impractical and would not identify an adversary already operating with native tools.

Answer

Signature-based detection on malicious file hashes

Answer

Blocking all scripts and macros by default

Question 3

A risk manager is applying the FAIR model to quantify a risk. Which TWO of the following are primary components used in FAIR analysis? (Select TWO.)

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO) are used in quantitative risk analysis (e.g., ALE), but not primary FAIR components. Exposure Factor (EF) is part of SLE calculation. Annual Loss Expectancy (ALE) is a result, not a component.

Answer

Single Loss Expectancy (SLE)

Answer

Annual Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 4

Which of the following is a primary advantage of using ChaCha20-Poly1305 over AES-256-GCM in certain environments?

Accepted Answer

Faster performance on devices without AES-NI. ChaCha20-Poly1305 is designed to be faster in software that lacks AES hardware acceleration, making it suitable for mobile devices.

Answer

Better hardware acceleration support

Answer

Higher security margin

Answer

Smaller ciphertext size

Question 5

A security architect is designing a new authentication system for a cloud-based application that requires strong multi-factor authentication. The solution must be resistant to phishing attacks and not rely on shared secrets. Which of the following is the BEST choice?

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn is a passwordless authentication protocol that uses public key cryptography and is resistant to phishing because the private key never leaves the user's device.

Answer

HOTP with a hardware token

Answer

TOTP via a mobile authenticator app

Answer

SMS one-time passcodes

Question 6

Which of the following is a key benefit of using an Extended Detection and Response (XDR) solution over traditional Endpoint Detection and Response (EDR)?

Accepted Answer

XDR provides centralized visibility across multiple security layers including endpoints, network, and cloud. XDR extends detection beyond endpoints to include network, email, cloud, and other data sources, providing broader visibility and correlation across the entire environment.

Answer

XDR only works with a single vendor's products

Answer

XDR eliminates the need for SIEM and SOAR systems

Answer

XDR only focuses on network traffic analysis

Question 7

A security team is adopting the NIST risk management framework. Which step should they perform first?

Accepted Answer

Categorize.. The NIST Risk Management Framework (RMF) begins with the Categorize step, where the information system and the information it processes, stores, and transmits are categorized based on an impact analysis (low, moderate, high) per FIPS 199. This initial step establishes the security categorization that drives all subsequent RMF steps, including control selection, implementation, and assessment. Without proper categorization, the organization cannot determine which baseline controls from NIST SP 800-53 are appropriate for the system's risk profile.

Answer

Select.

Answer

Implement.

Answer

Assess.

Question 8

A security analyst discovers that a web application is vulnerable to directory traversal. Which of the following is the MOST effective mitigation?

Accepted Answer

Whitelist of allowed file paths. A whitelist of allowed file paths is the most effective mitigation because it defines an explicit set of permissible paths, preventing any unauthorized file access regardless of traversal attempts. Unlike input validation, which can be bypassed with encoding or alternative traversal sequences, a whitelist enforces a positive security model that blocks all unspecified paths, including those using '..' or symbolic links. This approach directly addresses the root cause of directory traversal by restricting the application to only known-safe resources.

Answer

Encrypting all files on the server

Answer

Chroot jail

Answer

Input validation that rejects paths containing '..'

Question 9

A developer is using a third-party library with a known vulnerability. The vulnerability has a CVSS score of 9.8 and an exploit is publicly available. Which of the following is the most immediate course of action?

Accepted Answer

Update the library to the patched version if available. The most immediate course of action is to update the library to the patched version if available, because the vulnerability has a CVSS score of 9.8 (critical) and a public exploit exists, meaning active exploitation is likely imminent. Patching directly removes the root cause of the vulnerability in the library, which is the most effective and immediate mitigation. This aligns with the principle of eliminating the vulnerability at its source rather than relying on compensating controls.

Answer

Contact the vendor for a patch

Answer

Remove the library and rewrite functionality

Answer

Implement a WAF rule to block exploitation

Question 10

A security engineer is reviewing a TLS 1.3 configuration. Which of the following is a key feature of TLS 1.3 that improves security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman key exchange (DHE or ECDHE), which ensures that session keys cannot be recovered even if the server's long-term private key is later compromised. This is a core security improvement over TLS 1.2, where static RSA key exchange was allowed and lacked forward secrecy.

Answer

Support for RC4 cipher suite

Answer

Support for static RSA key exchange

Answer

Ability to downgrade to TLS 1.2

Question 11

A vulnerability management team is prioritizing patches for a set of critical vulnerabilities. Vulnerability A has a CVSS base score of 9.8, vulnerability B has a CVSS base score of 7.5, and vulnerability C has a CVSS base score of 8.2. However, vulnerability B is actively being exploited in the wild, while the others are not. Which vulnerability should be patched first according to best practices?

Accepted Answer

Vulnerability B because it is actively exploited. Vulnerability B should be patched first because it is actively being exploited in the wild. While CVSS base scores indicate severity, active exploitation means the vulnerability poses an immediate and real threat. Best practices prioritize vulnerabilities with known exploits, especially those used in active attacks, over higher-scored but unexploited ones.

Answer

All three should be patched simultaneously

Answer

Vulnerability C because it has a higher base score than B

Answer

Vulnerability A because it has the highest base score

Question 12

Based on the exhibit, which security issue does this IAM policy represent?

Accepted Answer

Overly permissive resource access. The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.

Answer

No versioning configured

Answer

Missing server-side encryption

Answer

Insufficient logging and monitoring

Question 13

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

Accepted Answer

seccomp. seccomp (secure computing mode) is a Linux kernel feature that filters system calls made by a process. In container security, seccomp profiles define which syscalls a containerized process can invoke, directly restricting its ability to interact with the kernel. This is the primary mechanism used by container runtimes like Docker and containerd to enforce syscall-level restrictions.

Answer

AppArmor

Answer

chroot

Answer

SELinux

Question 14

A security architect is evaluating a hardware security module (HSM) for key management. Which of the following is a PRIMARY benefit of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant physical protection of keys. An HSM provides tamper-resistant physical protection for cryptographic keys, ensuring that even if an attacker gains physical access to the device, the keys cannot be extracted or modified. This is a primary benefit over software-based key storage, which stores keys in memory or disk and is vulnerable to OS-level attacks, memory dumps, or file system breaches. The HSM's hardware root of trust and physical security mechanisms (e.g., tamper switches, zeroization) make it the gold standard for key protection in compliance-heavy environments like FIPS 140-2 Level 3 or PCI DSS.

Answer

Easier key rotation

Answer

Integration with cloud APIs

Answer

Lower cost

Question 15

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

Accepted Answer

Validating and sanitizing all input from logs. Log files can contain maliciously crafted entries designed to exploit parsing logic. Without input validation and sanitization, an attacker could inject commands or manipulate the script into blocking legitimate IPs or executing unintended actions, leading to a denial-of-service or compromise of the automation system itself.

Answer

Using the most efficient parsing algorithm

Answer

Ensuring the script runs with root privileges

Answer

Writing detailed audit logs of script actions

Question 16

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Option A is correct because dynamic application security testing (DAST) and penetration testing exercise the running application before release, detecting runtime vulnerabilities such as injection, authentication flaws, and misconfigurations that static analysis cannot see. Option C is correct because static application security testing (SAST) analyzes source code or binaries during development, catching insecure coding patterns like buffer overflows and hardcoded secrets early when remediation is cheapest. Option E is correct because threat modeling during the design phase systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE), allowing architectural security controls to be built in before code exists. Option B does not belong because user acceptance testing validates functional business requirements, not security engineering controls. Option D does not belong because daily stand-ups are an Agile project-management ceremony with no direct security engineering function.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 17

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Accepted Answer

Use ECDSA P-384 for authentication. Option A (ECDSA P-384) is correct because elliptic-curve signatures at the 384-bit level provide roughly 192-bit security strength, far exceeding RSA-2048, and are well supported in IKEv2 for strong peer authentication. Option C (AES-256-GCM) is correct because AES-256 gives a 256-bit key and GCM is an AEAD mode that provides both confidentiality and integrity in a single efficient primitive, making it the strongest symmetric choice here. Option E (perfect forward secrecy via DHE) is correct because Diffie-Hellman ephemeral key exchange ensures that compromise of the long-term key cannot decrypt previously captured sessions, which is essential for 'strongest possible security' in an IKEv2 deployment. Option B (SHA-1) is not appropriate because SHA-1 is cryptographically broken for integrity and should be replaced by SHA-256 or stronger. Option D (IKEv1) is not appropriate because IKEv2 is more secure, more robust, and supports modern features like MOBIKE and stronger authentication methods.

Answer

Use SHA-1 for integrity

Answer

Use IKEv1 instead of IKEv2

Question 18

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. The development team is slow to fix the SQL injection vulnerability in code, so an immediate control is needed. Adding a WAF rule (option C) can block common SQL injection payloads at the perimeter without code changes, minimizing performance impact and maintaining defense in depth. Option A (disable search) is too disruptive. Option B (isolate database server) is a good defense-in-depth measure but does not address the vulnerability at the application layer. Option D (increase IDS sensitivity) only detects, not prevents. Therefore, C is the most effective immediate control.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 19

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Accepted Answer

Eliminates configuration drift and unauthorized changes. Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Answer

Reduces operational costs by reusing existing servers

Answer

Increases system performance through hardware acceleration

Answer

Simplifies monitoring by reducing the number of servers

Question 20

A financial institution is required to comply with SOX. Which of the following is a primary focus of this regulation?

Accepted Answer

Accuracy of financial reporting and internal controls. SOX (Sarbanes-Oxley Act) primarily focuses on the accuracy of financial reporting and the effectiveness of internal controls for publicly traded companies. It mandates that management assess and report on internal controls over financial reporting, and requires external auditors to attest to those assessments. This ensures transparency and accountability in financial disclosures.

Answer

Privacy of personal data for EU citizens

Answer

Security of health information

Answer

Protection of cardholder data