CAS-004 Practice Test 22 — 15 Questions

Question 1

A security analyst needs to write a script that detects changes to critical files across a fleet of Linux servers. Which approach is most efficient and secure?

Accepted Answer

Use an agentless tool like OSSEC with a central manager to report file integrity changes.. OSSEC is a host-based intrusion detection system (HIDS) specifically designed for file integrity monitoring (FIM). Its agentless mode uses SSH to connect to remote servers, retrieve file hashes, and compare them against a known baseline stored on a central manager. This approach is both efficient (centralized reporting, no per-server cron jobs) and secure (encrypted communication, tamper-proof baseline storage).

Answer

Use a cron job on each server running a Python script that checks file hashes.

Answer

Enable Linux auditd on each server and forward logs to a SIEM for analysis.

Answer

Deploy a centralized log server and parse syslog for file modifications.

Question 2

An organization uses a microservices architecture where services communicate via REST APIs. To ensure defense in depth, they want to authenticate and authorize every API call. Which of the following implementations BEST enforces this at the application layer?

Accepted Answer

OAuth 2.0 with JWT bearer tokens and scoped permissions. OAuth 2.0 with JWT bearer tokens and scoped permissions is the best choice because it provides a standardized, token-based authentication and authorization mechanism at the application layer. The JWT contains claims (e.g., issuer, subject, expiration, and scopes) that can be cryptographically verified by each microservice without requiring a centralized session store, enabling fine-grained, per-API authorization. This directly addresses the requirement to authenticate and authorize every API call within a defense-in-depth strategy.

Answer

Mutual TLS (mTLS) between services

Answer

API keys in HTTP headers

Answer

IP whitelisting at the network firewall

Question 3

A security engineer needs to design a solution to detect and respond to insider threats involving unauthorized data exfiltration via USB devices. Which of the following is the MOST effective approach?

Accepted Answer

Implement a data loss prevention (DLP) solution with device control and content inspection.. The most effective because a DLP solution with device control and content inspection can monitor, block, or alert on unauthorized data transfers to USB devices by inspecting the content being written (e.g., file types, keywords, patterns) and enforcing policies at the endpoint or network level. This directly addresses the specific threat of data exfiltration via USB, unlike other options that either lack detection or are too restrictive.

Answer

Conduct regular security awareness training on data handling policies.

Answer

Deploy endpoint detection and response (EDR) agents on all workstations.

Answer

Disable all USB ports via group policy.

Question 4

A company is migrating its workloads to a public cloud and wants to ensure it understands the division of security responsibilities. Which model defines the demarcation of security controls between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model clearly delineates which security tasks are handled by the cloud provider and which by the customer, varying by service type (IaaS, PaaS, SaaS).

Answer

Cloud Security Posture Management (CSPM)

Answer

Zero trust architecture

Answer

Cloud Access Security Broker (CASB)

Question 5

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?

Accepted Answer

Implement data mapping to track personal data across systems and jurisdictions.. Option A is correct because data mapping (also called data inventory or record of processing activities) is foundational to both GDPR and CCPA compliance: GDPR Article 30 requires maintaining records of processing activities, and CCPA requires businesses to know what personal information they collect, where it flows, and to whom it is disclosed, which is impossible without mapping data across systems and jurisdictions. Option B is correct because data classification policies let the organization categorize personal data by sensitivity and regulatory category (e.g., GDPR special categories vs. CCPA personal information), which drives the appropriate handling, access, and protection controls mandated by both laws. Option C is not the best fit because DLP monitors exfiltration but does not by itself establish the governance framework of knowing and categorizing regulated data that GDPR and CCPA demand. Option D is not the best fit because retention schedules address storage limitation (GDPR Art. 5(1)(e)) but are a downstream control that depends on the mapping and classification provided by A and B. Option E is not the best fit because SIEM log analysis supports detection and incident response, not the core data governance obligations of data inventory and classification required by these privacy regulations.

Answer

Deploy data loss prevention (DLP) technology to monitor data exfiltration.

Answer

Define a data retention schedule that automatically deletes data after a set period.

Answer

Integrate a security information and event management (SIEM) system for log analysis.

Question 6

An organization wants to implement a solution that ensures data cannot be read if a storage device is physically stolen. Which encryption approach BEST meets this requirement?

Accepted Answer

Full disk encryption (FDE) on the storage device. Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Answer

Transport Layer Security (TLS) for network traffic

Answer

File-level encryption on sensitive documents

Answer

Database column-level encryption for stored data

Question 7

A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?

Accepted Answer

Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.. In a zero-trust architecture with microsegmentation, access failures after authentication often stem from network policies blocking traffic. The security architect should first review the microsegmentation firewall rules to ensure traffic to the application's subnet is permitted, as the identity-aware proxy and SSO are confirmed working. This directly addresses the suspected cause and is the most logical first step before other remediations.

Answer

Deploy a VPN to provide a secure tunnel for remote users.

Answer

Reset the affected users' credentials and force them to re-authenticate.

Answer

Increase logging verbosity on the identity-aware proxy to capture more details.

Question 8

Which THREE of the following are common vulnerabilities found in web applications according to the OWASP Top 10 2021? (Select THREE.)

Accepted Answer

Cryptographic Failures. The OWASP Top 10 2021 explicitly lists A. Cryptographic Failures (A02:2021) as a top web application risk, covering failures related to protecting data in transit and at rest, such as missing TLS, weak ciphers, or improper key management. B. Broken Access Control is ranked A01:2021, the most critical category, encompassing flaws like missing authorization checks, IDOR, and privilege escalation that let users act outside their intended permissions. C. Server-Side Request Forgery (SSRF) is A10:2021, a newly added category in the 2021 list, where an attacker induces the server to make requests to unintended internal or external resources. D. SQL Injection is not a standalone OWASP Top 10 2021 category; it falls under A03:2021 Injection, so it is not one of the three named items. E. Remote Code Execution via buffer overflow is a memory-safety issue more typical of native software and CWE listings, not a distinct OWASP Top 10 2021 web application category.

Answer

SQL Injection

Answer

Remote Code Execution (RCE) via buffer overflow

Question 9

A security manager is evaluating two risk quantification approaches: Factor Analysis of Information Risk (FAIR) and a qualitative heat map. Which of the following is a key advantage of using FAIR over the qualitative heat map?

Accepted Answer

FAIR provides a monetary value for risk, enabling ROI calculations. FAIR (Factor Analysis of Information Risk) is a quantitative risk framework that expresses risk in monetary terms — typically annualized loss expectancy (ALE) derived from loss event frequency and loss magnitude. This monetary output enables direct ROI calculations for security investments and lets leadership compare cyber risk against other business risks in financial terms.

Answer

FAIR is the only framework recognized by NIST

Answer

FAIR is easier to communicate to non-technical stakeholders

Answer

FAIR requires less data and expertise to implement

Question 10

In a zero trust architecture, which concept ensures that an attacker who compromises one segment cannot move laterally to other segments?

Accepted Answer

Micro-segmentation. Micro-segmentation divides a network into granular, isolated segments — often down to individual workloads or identities — and enforces policy between each segment so that compromise of one segment does not grant lateral movement to others. In zero trust, micro-segmentation is the enforcement mechanism that operationalizes 'never trust, always verify' at the network layer, typically using software-defined policies rather than physical firewalls.

Answer

Software-defined perimeter

Answer

Defense-in-depth layering

Answer

Identity-centric access

Question 11

A developer needs to securely store user passwords in a database. Which hashing technique is recommended for password storage?

Accepted Answer

bcrypt with a per-user salt. Bcrypt is recommended for password storage because it incorporates a per-user salt to prevent rainbow table attacks and uses a configurable cost factor to slow down brute-force attempts, making it resistant to GPU-based cracking. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password hashing with built-in salting and adaptive work factor.

Answer

SHA-256 with a random salt

Answer

MD5 with a static salt

Answer

Base64 encoding

Question 12

Which of the following risk treatment options involves transferring the financial impact of a risk to a third party, such as through insurance?

Accepted Answer

Transfer. Risk transfer shifts the financial consequence of a risk to a third party, most commonly through insurance, contractual indemnification, or outsourcing. The organization retains the risk event's possibility but offloads the monetary impact to another party. This is distinct from avoiding, accepting, or mitigating the risk.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 13

A security architect is designing a secure software development pipeline. The organization wants to ensure that code is thoroughly analyzed before deployment. Which TWO of the following should be integrated into the pipeline to identify vulnerabilities early? (Select TWO.)

Accepted Answer

Static application security testing (SAST). SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code without executing it, scanning for vulnerabilities like SQL injection, buffer overflows, and insecure cryptographic functions. Integrating SAST early in the pipeline (shift-left) allows developers to fix issues before compilation, reducing remediation cost and risk. SCA (Software Composition Analysis) identifies known vulnerabilities in third-party libraries and open-source components by comparing dependency versions against databases like the National Vulnerability Database (NVD). Both tools are non-intrusive and can be automated in CI/CD pipelines to catch flaws before deployment.

Answer

Fuzz testing

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Question 14

When conducting a vendor risk assessment, which contractual clause is most important for ensuring ongoing visibility into the vendor's security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause contractually grants the customer the ability to inspect the vendor's security controls, processes, and records — either directly or via third-party reports like SOC 2. This is the mechanism that provides ongoing visibility into the vendor's security posture over the life of the relationship, not just at onboarding. Without it, the customer has no enforceable means to verify that controls remain effective.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 15

Based on the exhibit, what vulnerability is present in the firewall rule?

Accepted Answer

Overly permissive service specification. The firewall rule permits 'any' as the service, meaning all TCP/UDP ports and protocols are allowed through. This is overly permissive because it bypasses the principle of least privilege, exposing the internal network to unnecessary traffic and potential attacks. A proper rule should specify only required services (e.g., TCP/443 for HTTPS) to minimize the attack surface.

Answer

Source IP range is too broad

Answer

No logging is enabled

Answer

Missing application ID control