CAS-004 Practice Test 23 — 15 Questions

Question 1

An enterprise is adopting a DevOps model and wants to integrate security into the CI/CD pipeline. The security architect recommends adding automated security testing. Which phase of the pipeline should static application security testing (SAST) be introduced to minimize rework?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

During the build phase after code commit. SAST scans source code or compiled binaries for vulnerabilities without executing the application. Introducing SAST during the build phase, immediately after code commit and before artifacts are packaged, allows developers to catch and fix security flaws early when remediation cost is lowest, aligning with the 'shift left' principle in DevOps.

Answer

During the production deployment phase

Answer

After the code is promoted to production

Answer

During runtime in the staging environment

Question 2

A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?

Accepted Answer

Use parameterized queries or prepared statements for all database interactions.. Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.

Answer

Use stored procedures exclusively for database access.

Answer

Deploy a web application firewall (WAF) with SQL injection rules.

Answer

Implement client-side input validation and sanitize all user input.

Question 3

A company is deploying a SASE architecture. Which component is responsible for securing web traffic and enforcing acceptable use policies at the edge?

Accepted Answer

Secure Web Gateway (SWG). A Secure Web Gateway (SWG) sits at the network edge and inspects outbound web traffic, enforcing URL filtering, malware blocking, and acceptable use policies — exactly the function described. In a SASE architecture, SWG is the component that governs user web access regardless of location, applying policy based on categories, reputation, and content inspection. It is distinct from ZTNA (which controls application access), CASB (which governs cloud service usage), and SD-WAN (which optimizes WAN transport).

Answer

Zero Trust Network Access (ZTNA)

Answer

Cloud Access Security Broker (CASB)

Answer

SD-WAN

Question 4

A security administrator is configuring IPsec VPN between two sites. The data transmitted includes sensitive financial records. The administrator wants to ensure both confidentiality and integrity of the data, and also wants to authenticate the source. Which IPsec protocol and mode should be used?

Accepted Answer

ESP in tunnel mode. ESP (Encapsulating Security Payload) provides both confidentiality and integrity (optionally authentication). AH only provides integrity and authentication but not confidentiality. Transport mode encrypts only the payload, while tunnel mode encrypts the entire IP packet. For site-to-site VPN, tunnel mode is typically used.

Answer

AH in tunnel mode

Answer

ESP in transport mode

Answer

AH in transport mode

Question 5

A company is implementing a privileged access management (PAM) solution to reduce the risk of standing privileges. Which feature allows users to request temporary elevated access for a specific task, which is automatically revoked after the task is completed?

Accepted Answer

Just-in-time (JIT) access provisioning. Just-in-time (JIT) access provisioning grants temporary privileges that expire after use, reducing standing privileges. Break-glass accounts are emergency accounts, not time-based.

Answer

Break-glass accounts

Answer

Password vaulting

Answer

Session recording

Question 6

An organization requires a cryptographic algorithm that provides both encryption and authentication in a single pass. Which algorithm should be selected?

Accepted Answer

AES-256-GCM. AES-256-GCM (Galois/Counter Mode) is an authenticated encryption with associated data (AEAD) algorithm that provides both confidentiality (encryption) and integrity/authentication in a single pass. It combines AES counter mode encryption with GHASH for authentication, making it efficient and secure. This meets the requirement for a single algorithm that does both.

Answer

AES-256-CBC

Answer

SHA-256

Answer

RSA 4096

Question 7

A SOC team receives an alert from a SOAR platform indicating a potential phishing email. The SOAR playbook automatically quarantines the email, blocks the sender, and opens a ticket. This is an example of which SOAR capability?

Accepted Answer

Automation. Automation in SOAR refers to executing predefined actions without human intervention — here, the playbook automatically quarantines the email, blocks the sender, and opens a ticket. This is the defining characteristic of automation: machine-driven execution of response steps based on a trigger.

Answer

Response

Answer

Orchestration

Answer

Correlation

Question 8

A container security team wants to enforce that containers run with the least privileges possible. Which Linux security module can be used to restrict system calls available to a container?

Accepted Answer

seccomp. seccomp (secure computing mode) is a Linux kernel feature that filters system calls, allowing a container to be restricted to only the syscalls it needs. In container runtimes like Docker, containerd, and Kubernetes, seccomp profiles are applied per container to enforce least privilege at the syscall level. This directly answers 'restrict system calls available to a container.'

Answer

Pod Security Policy

Answer

AppArmor

Answer

SELinux

Question 9

Which TWO of the following are best practices for securing a database server?

Accepted Answer

Disable default accounts. Option C is correct because default accounts (such as Oracle's SCOTT/TIGER, MySQL's anonymous users, or SQL Server's sa) are widely known to attackers and should be disabled, renamed, or have their passwords changed to eliminate an easy entry point. Option D is correct because using encrypted connections (e.g., TLS/SSL for MySQL, PostgreSQL, and SQL Server, or Oracle Native Network Encryption) protects credentials and data in transit from eavesdropping and man-in-the-middle attacks. Option A is not a best practice because sample databases often contain known schemas, default credentials, and unnecessary attack surface that should be removed from production servers. Option B is wrong because enabling remote access from any IP (0.0.0.0/0) exposes the database to the entire internet; access should be restricted to specific trusted hosts or subnets via firewall rules and bind-address settings. Option E is incorrect because simple passwords are trivially brute-forced or guessed; strong password policies, account lockout, and multi-factor authentication are the recommended controls.

Answer

Install sample databases for testing

Answer

Enable remote access from any IP

Answer

Use simple passwords for ease of administration

Question 10

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker used DNS tunneling to exfiltrate data. Which THREE network traffic indicators would support this hypothesis? (Select THREE.)

Accepted Answer

Large DNS response packets (greater than 512 bytes). Option B is correct because DNS tunneling typically requires encoding data in DNS responses, which pushes packet sizes beyond the standard 512-byte UDP DNS limit and often forces TCP fallback or EDNS0 usage, making large DNS response packets a strong indicator. Option D is correct because tunneling tools encode exfiltrated data into subdomain labels, producing long, high-entropy, randomly generated subdomains that are atypical of legitimate DNS traffic. Option E is correct because DNS tunneling generates a high volume of queries from a single host as data is chunked and sent in many small DNS requests, so an unusual spike in query count from one internal host supports the hypothesis. Option A does not belong because failed login attempts indicate authentication attacks such as brute forcing, not DNS-based exfiltration. Option C does not belong because unencrypted HTTP to external IPs is a general web traffic observation and is not specific to DNS tunneling, which operates over port 53.

Answer

A sudden increase in failed login attempts

Answer

Unencrypted HTTP traffic to external IPs

Question 11

A security analyst is prioritizing remediation of vulnerabilities. Which three of the following factors should be considered when determining the risk level of a vulnerability? (Choose three.)

Accepted Answer

Availability of a public exploit. Option A (Availability of a public exploit) is correct because a publicly available exploit, especially one weaponized in frameworks like Metasploit or CISA's KEV catalog, dramatically increases the likelihood of active exploitation and thus raises the risk level. Option C (Asset value or criticality) is correct because the same vulnerability poses far greater risk on a high-value asset such as a domain controller or PII database than on an isolated test machine, directly affecting impact. Option D (CVSS base score) is correct because it provides a standardized, vendor-agnostic metric of intrinsic severity based on exploitability and impact, forming a foundational input to risk prioritization. Option B (Vendor patch availability) is not one of the three because a patch being available reduces exposure but does not itself define the inherent risk level of the vulnerability. Option E (Number of days since discovery) is not selected because age alone is a weak indicator; a long-unpatched critical flaw may be high risk, but time since discovery is not a standard risk-scoring factor like exploit availability, asset criticality, or CVSS.

Answer

Vendor patch availability

Answer

Number of days since the vulnerability was discovered

Question 12

Which of the following is a key feature of TLS 1.3 compared to earlier versions?

Accepted Answer

Reduced handshake latency. TLS 1.3 reduces handshake latency by combining the ClientHello and key share into a single round trip (1-RTT) and supporting 0-RTT resumption for repeat connections. It also removes legacy features like static RSA key exchange, RC4, and SSL 3.0 compatibility. The net effect is faster connection establishment without sacrificing security.

Answer

Mandatory use of static RSA key exchange

Answer

Support for RC4 cipher

Answer

Backward compatibility with SSL 3.0

Question 13

An organization wants to implement a privileged access management (PAM) solution to manage administrative credentials. They require that administrators request temporary access to privileged accounts and that these credentials are automatically rotated after each use. Which PAM approach best meets these requirements?

Accepted Answer

Just-in-time access provisioning with credential rotation. Just-in-time (JIT) access provisioning grants privileged credentials only for the duration of a task and automatically rotates or revokes them afterward, directly matching the requirement for temporary access with post-use rotation. This approach minimizes standing privileges and the attack surface. Password vaulting with checkout (A) provides temporary access but does not inherently rotate credentials after each use unless combined with rotation workflows.

Answer

Password vaulting with checkout

Answer

Privileged account session management

Answer

Break-glass account procedures

Question 14

A company is implementing a secure SDLC and wants to integrate application security testing early. Which THREE tools are most appropriate for shift-left security? (Select THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST (B) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find vulnerabilities like injection flaws during coding in the IDE or CI pipeline — the essence of shift-left. IAST (C) is correct because it instruments the running application (often via agents) during functional testing to detect vulnerabilities in real time with code-level detail, fitting early integration into dev/test workflows. SCA (D) is correct because it scans dependencies and third-party libraries for known CVEs and license issues, which is critical for shifting left since most modern code is composed of open-source components. RASP (A) is not appropriate here because it runs inside the application at runtime in production, protecting against live attacks rather than enabling early pre-deployment testing. DAST (E) is not selected because it tests a deployed running application from the outside (black-box), typically later in the pipeline, making it less aligned with early shift-left integration than SAST, IAST, and SCA.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 15

An organization uses a multi-cloud strategy with workloads on AWS, Azure, and GCP. They need a single tool to monitor and enforce security configurations across all cloud environments. Which cloud security solution is best suited for this requirement?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM is correct because it continuously monitors cloud configurations against security benchmarks (CIS, NIST, PCI) and detects misconfigurations across AWS, Azure, and GCP from a single pane of glass. It is purpose-built for multi-cloud posture management — identifying publicly exposed buckets, overly permissive IAM roles, and unencrypted storage. This directly matches the requirement to monitor and enforce security configurations across all three clouds.

Answer

Secure Access Service Edge (SASE)

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)