CAS-004 Practice Test 21 — 15 Questions

Question 1

Which of the following is a key difference between compliance and security?

Accepted Answer

Compliance typically represents a minimum bar, while security seeks best practice. Compliance frameworks (PCI DSS, HIPAA, ISO 27001) define a baseline set of controls an organization must satisfy to meet regulatory or contractual obligations — they establish a floor, not a ceiling. Security, by contrast, is an ongoing risk-management discipline that aims to reduce risk to an acceptable level using best practices, defense in depth, and continuous improvement. An organization can be fully compliant yet still be insecure because compliance scopes are narrow and point-in-time, whereas security must address the full threat landscape.

Answer

Compliance is voluntary, security is mandatory

Answer

Compliance is proactive, security is reactive

Answer

Security only applies to technical controls, compliance to administrative

Question 2

A small business is designing a defense-in-depth strategy for its e-commerce website. The web server is hosted in a cloud provider and handles credit card transactions. Which of the following additional controls best complements the existing firewall and IDS?

Accepted Answer

Implement a web application firewall (WAF). A web application firewall (WAF) is the correct complement because it specifically protects against application-layer attacks (e.g., SQL injection, cross-site scripting) that a network firewall and IDS cannot block. Since the e-commerce site handles credit card transactions, a WAF is critical for PCI DSS compliance and to filter malicious HTTP/HTTPS traffic targeting the web application logic.

Answer

Set up a security information and event management (SIEM) system

Answer

Add a load balancer with SSL termination

Answer

Deploy a network-based antivirus on the web server

Question 3

An organization is using the FAIR framework to quantify risk. The analyst estimates the probable loss event frequency (LEF) as 4 per year and the probable loss magnitude (LM) as $25,000 per event. What is the annualized loss expectancy (ALE) under FAIR?

Accepted Answer

$100,000. Under the FAIR (Factor Analysis of Information Risk) framework, Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 4 events per year and LM = $25,000 per event, so ALE = 4 × $25,000 = $100,000. This represents the expected annual financial loss from the risk scenario.

Answer

$6,250

Answer

$125,000

Answer

$25,000

Question 4

A security engineer is configuring IPsec VPN between two sites. The requirement is to encrypt the entire IP packet, including the original IP header. Which IPsec mode and protocol should be used?

Accepted Answer

Tunnel mode with ESP. Tunnel mode with ESP encrypts the entire original IP packet and adds a new IP header, which is required for gateway-to-gateway VPNs. ESP provides encryption and optional authentication.

Answer

Transport mode with AH

Answer

Tunnel mode with AH

Answer

Transport mode with ESP

Question 5

During a threat hunting exercise, a security analyst hypothesizes that an adversary is using PowerShell to execute malicious scripts. Which approach is the analyst employing?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific assumption about adversary behavior, unlike IoC-driven (based on known indicators) or TTP-driven (focused on tactics, techniques, procedures).

Answer

TTP-driven hunting

Answer

Machine learning-driven hunting

Answer

IoC-driven hunting

Question 6

A security team is preparing for a penetration test. Which document defines the scope, rules, and restrictions for the test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is a formal document that outlines the scope, permissions, and constraints of a penetration test.

Answer

Memorandum of Understanding (MOU)

Answer

Statement of Work (SoW)

Answer

Service Level Agreement (SLA)

Question 7

A security analyst is reviewing threat intelligence feeds and notices indicators from a known APT group. Which threat intelligence sharing standard is most commonly used to structure and share such cyber threat information in a machine-readable format?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the standard protocols for sharing cyber threat intelligence in a structured, machine-readable format. STIX defines the data model, and TAXII defines the transport mechanism.

Answer

CybOX

Answer

MITRE ATT&CK

Answer

OpenIOC

Question 8

A security engineer is writing a Python script to parse system logs and alert on suspicious patterns. What is the best practice to ensure the script remains secure when handling log data?

Accepted Answer

Sanitize log input and use safe parsing functions like `json.loads()` for structured logs.. Sanitizing log input and using safe parsing functions like `json.loads()` prevents injection attacks (e.g., command injection, code injection) that can occur when untrusted log data is processed. `json.loads()` strictly parses JSON according to RFC 7159, rejecting malformed or malicious payloads, whereas unsanitized input could contain escape sequences or embedded scripts that compromise the script's execution context.

Answer

Store all logs in a database and query directly.

Answer

Use `eval()` to dynamically evaluate log content.

Answer

Run the script with root privileges to access all logs.

Question 9

During a tabletop exercise, the CSIRT discovers that the organization lacks a clear chain of command for decision-making during incidents. Which document should be updated to address this gap?

Accepted Answer

Incident response plan. The Incident Response Plan (IRP) is the document that defines roles, responsibilities, communication paths, and the chain of command during incident handling. A gap in decision-making authority is a governance issue that belongs in the IRP, which should specify who has authority to declare incidents, authorize containment, and escalate.

Answer

Business continuity plan

Answer

Security awareness training material

Answer

Network topology diagram

Question 10

A security analyst is reviewing metrics for the security program. Which metric best measures the effectiveness of incident response processes?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to respond to and resolve incidents, directly reflecting the efficiency of incident response processes. A lower MTTR indicates a more effective and timely response, making it the best metric to assess incident response effectiveness.

Answer

Mean time to detect (MTTD)

Answer

Patch compliance percentage

Answer

Number of vulnerabilities by severity

Question 11

During a penetration test, an engineer discovers that the application uses client-side JavaScript to validate input before submission. What is the MOST significant vulnerability?

Accepted Answer

Server-side validation is missing. Client-side JavaScript validation can be bypassed by disabling JavaScript, using a proxy, or crafting direct HTTP requests, so the most significant vulnerability is that server-side validation is missing. This allows malicious or malformed input to reach the server and potentially cause injection, data corruption, or business logic abuse.

Answer

Cross-site scripting

Answer

Insecure direct object reference

Answer

Weak session management

Question 12

A security architect is designing a web application that handles sensitive user data. To protect against cross-site scripting (XSS) attacks, which of the following should be implemented?

Accepted Answer

Implement input validation and output encoding. Input validation and output encoding are the primary defenses against XSS because they prevent malicious scripts from being interpreted by the browser. Input validation rejects or sanitizes dangerous characters (e.g., <, >, &) at the point of entry, while output encoding (e.g., HTML entity encoding) ensures that any user-supplied data rendered in the page is treated as text, not executable code. This directly addresses the root cause of XSS—untrusted data being injected into the DOM.

Answer

Implement Content Security Policy (CSP)

Answer

Use HTTPS for all communications

Answer

Deploy a Web Application Firewall (WAF)

Question 13

An organization is implementing a PKI and wants to ensure that clients can quickly check if a certificate has been revoked without downloading a large list. Which protocol should be used?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP (Online Certificate Status Protocol) allows clients to check the revocation status of a single certificate in real time without downloading a full CRL.

Answer

Certificate Revocation List (CRL)

Answer

Certificate Transparency (CT)

Answer

Simple Certificate Enrollment Protocol (SCEP)

Question 14

Which THREE of the following are common vulnerabilities in IoT devices? (Select THREE.)

Accepted Answer

Hardcoded credentials. Hardcoded credentials (B) are a classic IoT vulnerability because manufacturers often ship devices with fixed default usernames and passwords (e.g., admin/admin) that cannot be changed, allowing attackers to authenticate via Telnet/SSH or web interfaces. Lack of secure boot (C) is a vulnerability because without a hardware root of trust verifying firmware signatures at each boot stage, attackers can flash malicious firmware or persistently modify the boot chain. Unencrypted communications (E) expose IoT traffic to eavesdropping and man-in-the-middle attacks, since protocols like plain HTTP, MQTT without TLS, or unencrypted Zigbee/BLE traffic leak credentials and telemetry. By contrast, large storage capacity (A) and high compute power (D) are merely hardware characteristics that do not by themselves create exploitable weaknesses, so they are not common IoT vulnerabilities.

Answer

Large storage capacity

Answer

High compute power

Question 15

A company is conducting a third-party risk assessment for a SaaS provider. The provider has provided a SOC 2 Type II report, penetration test results, and a completed security questionnaire. Which of these provides the most independent and comprehensive view of the provider's control environment over time?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of controls over a period of time (typically 3-12 months). This gives a comprehensive, time-tested view of the provider's control environment, unlike point-in-time assessments.

Answer

Penetration test report

Answer

Security questionnaire

Answer

Vendor's marketing materials