CAS-004 Practice Test 24 — 15 Questions

Question 1

A small business uses Puppet for configuration management on Linux servers. They are now migrating to containers and want to maintain security. The operations team is unfamiliar with containers. The security team insists on automated vulnerability scanning of container images before deployment. What should be the company's first step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.. The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.

Answer

Deploy a Kubernetes cluster and migrate all applications.

Answer

Discontinue using Puppet and switch entirely to container-based configurations.

Answer

Train the operations team on Docker and Kubernetes fundamentals.

Question 2

An organization is implementing a vendor risk management program and is reviewing a contract that includes a right-to-audit clause. Which THREE of the following are common elements that should be verified during such an audit? (Select THREE.)

Accepted Answer

Access control mechanisms. Option C (Access control mechanisms) is correct because a right-to-audit review must verify that the vendor enforces least privilege, authentication, and authorization controls to protect the organization's data from unauthorized access. Option D (Incident response procedures) is correct because the audit should confirm the vendor has documented detection, containment, eradication, and notification processes, including breach notification timelines, to meet contractual and regulatory obligations. Option E (Data encryption practices) is correct because auditors must verify encryption in transit and at rest, key management, and algorithm standards to ensure data confidentiality and integrity. Option A (Employee satisfaction surveys) is not a security or compliance control relevant to vendor risk, and Option B (Vendor's financial stability) is a business viability concern typically assessed during due diligence rather than a right-to-audit control review.

Answer

Employee satisfaction surveys

Answer

Vendor's financial stability

Question 3

A financial services company is implementing a zero-trust architecture. The security architect needs to ensure that all network traffic between application tiers is inspected and logged regardless of source location. Which of the following should be implemented?

Accepted Answer

Implement microsegmentation using a next-generation firewall. Microsegmentation using a next-generation firewall (NGFW) is the correct approach because it enforces granular, per-application-tier security policies that inspect and log all traffic regardless of source location. NGFWs provide deep packet inspection (DPI), application-level visibility, and logging capabilities, which are essential for zero-trust architecture where no implicit trust is granted to any network segment.

Answer

Deploy a site-to-site VPN across all tiers

Answer

Use a single, centralized firewall for all traffic

Answer

Place all application servers in a DMZ

Question 4

An organization must comply with FedRAMP requirements for a cloud service. Which aspect of cloud security is most directly assessed under FedRAMP?

Accepted Answer

Security controls of the cloud service provider. FedRAMP most directly assesses the security controls of the cloud service provider (CSP). The entire FedRAMP process is designed to evaluate, authorise, and continuously monitor the security posture of a CSP's offering against NIST SP 800-53 controls. While data residency, cost, and performance may be considerations, they are not the primary focus of FedRAMP assessment.

Answer

Data residency compliance

Answer

Cost optimization of cloud resources

Answer

Performance SLA

Question 5

A company's incident response team is developing a playbook for ransomware incidents. The playbook should cover the preparation phase. Which THREE of the following are appropriate preparation activities? (Choose THREE.)

Accepted Answer

Train employees on how to recognize and report phishing attempts. Option A is correct because user awareness training on recognizing and reporting phishing is a foundational preparation activity, since phishing is a leading initial access vector for ransomware and trained employees enable earlier detection and response. Option B is correct because regular backup testing and maintaining offline, immutable backups are essential preparation steps that ensure data can be restored without paying a ransom and that backups are not encrypted or deleted by the malware. Option D is correct because establishing communication procedures with legal, PR, and other stakeholders before an incident occurs is a preparation-phase task that supports coordinated, compliant crisis communication during an actual ransomware event. Option C is not a preparation activity but a containment action performed during the detection/response phase after an infection is identified. Option E is not a preparation activity in this context; threat hunting is an ongoing detection operation conducted during normal security monitoring rather than a preparatory step in a ransomware playbook.

Answer

Isolate infected systems from the network immediately after detection

Answer

Perform threat hunting in the network to identify potential threats

Question 6

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 7

A security analyst is using the MITRE ATT&CK framework to map adversarial behaviors. Which THREE of the following are tactics defined by ATT&CK? (Select THREE.)

Accepted Answer

Privilege escalation. Privilege escalation (B) is a valid ATT&CK tactic (TA0004) describing techniques adversaries use to gain higher-level permissions on a system or network, such as exploiting vulnerabilities or abusing elevation control mechanisms. Persistence (C) is a valid tactic (TA0003) covering techniques like scheduled tasks, registry Run keys, or creating accounts that let adversaries maintain their foothold across restarts or credential changes. Exfiltration (D) is a valid tactic (TA0010) describing techniques used to steal data from the target network, such as exfiltration over C2 channel or over alternative protocols. Incident response (A) is not an ATT&CK tactic; it is a defensive workflow, and ATT&CK's tactics are adversary goals, not response phases. Phishing (E) is not a tactic but a technique (T1566) that falls under the Initial Access tactic, so it does not qualify as a tactic itself.

Answer

Incident response

Answer

Phishing

Question 8

A security engineer is reviewing the results of a penetration test. The tester successfully exploited a vulnerability in a web application and escalated privileges to domain admin. Which THREE of the following findings should be included in the technical report to provide actionable remediation steps? (Select THREE.)

Accepted Answer

The recommendation to patch the web application. Option B is correct because the technical report must provide actionable remediation, and recommending that the web application be patched directly addresses the exploited vulnerability and prevents recurrence. Option C is correct because documenting the exact command used to exploit the vulnerability gives defenders a reproducible proof of concept, enabling them to verify the flaw and test that remediation actually blocks the attack. Option E is correct because the step-by-step path from initial access to domain admin illustrates the full attack chain and privilege-escalation weaknesses, which is essential for prioritizing fixes to identity, segmentation, and tiered administration controls. Option A does not belong because estimated financial loss is a business-impact or risk-management metric, not a technical remediation step. Option D does not belong because the tester's name and contact details are administrative metadata, not actionable technical remediation guidance.

Answer

The estimated financial loss from the exploit

Answer

The name and contact of the penetration tester

Question 9

A DevSecOps team is integrating security into the CI/CD pipeline. Which THREE practices should be included to ensure supply chain security?

Accepted Answer

Dependency analysis. Dependency analysis (B) is correct because it inspects third-party libraries and transitive dependencies for known CVEs (e.g., via SCA tools like OWASP Dependency-Check, Snyk, or Trivy) before artifacts are built, directly protecting the software supply chain from vulnerable or malicious packages. Container image scanning (C) is correct because it examines image layers and installed packages against vulnerability databases (e.g., Clair, Trivy, Grype) so compromised base images or components are caught in the CI/CD pipeline before deployment. Software Bill of Materials (E) is correct because an SBOM (e.g., SPDX or CycloneDX format) provides a machine-readable inventory of components and dependencies, enabling provenance tracking, rapid impact analysis when new CVEs emerge, and compliance with supply chain mandates. Network segmentation (A) is a runtime infrastructure control that limits lateral movement but does not secure the build and delivery pipeline itself, and runtime application self-protection (D) is a runtime defense that detects and blocks attacks in a running application, not a CI/CD supply chain practice.

Answer

Network segmentation

Answer

Runtime application self-protection

Question 10

An organization needs to ensure that evidence collected during a forensic investigation remains intact and admissible in court. Which process is most critical for maintaining the integrity of digital evidence?

Accepted Answer

Maintaining an unbroken chain of custody. Chain of custody documents every person who handled the evidence, from collection to presentation in court, ensuring that evidence has not been tampered with. This is essential for admissibility.

Answer

Storing evidence in a secure locker

Answer

Using write-blockers when imaging drives

Answer

Hashing the evidence with SHA-256

Question 11

An organization is planning to deploy a new internal CA hierarchy. Which THREE considerations are critical for ensuring the security and manageability of the PKI?

Accepted Answer

Keep the root CA offline and only bring it online for cross-certification or disaster recovery.. Option A is correct because keeping the root CA offline (air-gapped) protects the trust anchor's private key from compromise, bringing it online only for cross-certification or disaster recovery, which is a foundational PKI best practice. Option B is correct because using a 4096-bit RSA key for the long-lived root CA and at least 2048-bit keys for issuing CAs provides adequate cryptographic strength for the hierarchy's lifetime and resists brute-force attacks. Option E is correct because embedding CRL distribution points and OCSP responder URLs in certificates enables timely revocation checking, which is essential for security and manageability of the PKI. Option C is incorrect because SHA-1 is deprecated and vulnerable to collision attacks; SHA-256 or stronger should be used. Option D is incorrect because a single-tier CA exposes the root to online issuance risks and reduces flexibility, whereas a multi-tier hierarchy with an offline root is more secure and manageable.

Answer

Use SHA-1 for certificate signing to ensure compatibility with legacy systems.

Answer

Use a single-tier CA to simplify management.

Question 12

A company uses a microservices architecture with Docker containers orchestrated by Kubernetes. Developers push code to a Git repository, which triggers a CI/CD pipeline using Jenkins. The pipeline builds Docker images and pushes them to a private registry (Harbor). Recently, a critical vulnerability (CVE-2024-XXXX) was discovered in the base image of several containers. The security team wants to ensure that only images that pass vulnerability scans are deployed to production. The pipeline currently builds and pushes images without any security check. Developers are responsible for updating base images, but this has been inconsistent. Which action should the security team take?

Accepted Answer

Configure Jenkins to run Trivy scans on each built image and fail the pipeline if vulnerabilities exceed a defined threshold, and only allow images that pass to be pushed to the production registry. It integrates vulnerability scanning directly into the CI/CD pipeline. By running Trivy as a step after the image is built but before it is pushed to the production registry, the pipeline can fail if the vulnerability count or severity exceeds a defined threshold. This ensures that only images that pass the security scan are deployed to production. Option A (manual updates) is unreliable and does not enforce policy. Option B (Harbor webhook) would block pulls but does not prevent the push of vulnerable images; the image would already be in the registry. Option D (PodSecurity admission) controls what runs in Kubernetes but does not assess vulnerability severity and operates too late; the image would already be built and pushed.

Answer

Require developers to manually check their images and update base images

Answer

Implement a webhook in Harbor to automatically scan all images upon push and block vulnerable images from being pulled

Answer

Use Kubernetes PodSecurity admission to block containers with high-severity vulnerabilities

Question 13

A security analyst receives an alert from the SIEM indicating multiple failed logon attempts from an external IP address followed by a successful logon for a domain admin account. Which phase of the incident response lifecycle is the analyst currently in?

Accepted Answer

Detection. The analyst is in the Detection phase because they are analyzing an alert from the SIEM indicating suspicious activity. Detection involves monitoring and identifying potential security incidents through alerts, logs, and other tools. The analyst has not yet moved to containment or other phases; they are still assessing the alert.

Answer

Lessons learned

Answer

Containment

Answer

Preparation

Question 14

A company wants to ensure that a third-party vendor allows them to perform an audit of the vendor's security controls. Which clause should be included in the contract?

Accepted Answer

Right-to-audit clause. A right-to-audit clause explicitly grants the contracting organization the contractual authority to inspect, audit, and verify the vendor's security controls, policies, and practices. Without this clause, the vendor has no legal obligation to permit audits, regardless of what security assurances they claim. This is a foundational third-party risk management control required by frameworks like SOC 2, ISO 27001, and PCI DSS.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 15

A network administrator needs to establish a secure VPN tunnel between two branch offices using IPsec. The requirement is to encrypt the entire IP packet, including the original IP header. Which IPsec mode should be used?

Accepted Answer

Tunnel mode. Tunnel mode encrypts the entire IP packet and adds a new IP header, making it suitable for VPNs between networks.

Answer

AH mode

Answer

IKEv1

Answer

Transport mode