CAS-004 Practice Test 24 — 15 Questions

Question 1

A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?

Accepted Answer

The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.. The pod mounts a hostPath volume, which allows the container to access and potentially modify host filesystem, leading to container escape. Option C is correct. Options A and B are mitigated by the security context. Option D is false.

Answer

The container image is from a public registry and should use a private one.

Answer

The container runs as non-root, but root access is required for certain operations.

Answer

The container allows privilege escalation, which should be disabled.

Question 2

A security administrator needs to automate the process of revoking access for terminated employees across multiple cloud services. Which scripting approach would best minimize the risk of errors and ensure consistent execution?

Accepted Answer

Use a configuration management tool like Ansible with a playbook that calls cloud provider modules using encrypted vault files for credentials.. Option B is correct because using Ansible with encrypted vault files provides secure credential management and consistent execution. Option A hardcodes credentials, creating security risks. Option C uses environment variables, which are less secure. Option D is manual and error-prone.

Answer

Create a shell script that relies on environment variables containing API keys.

Answer

Write a Python script using separate API calls for each service with hardcoded credentials.

Answer

Manually execute commands each time an employee is terminated.

Question 3

In a CI/CD pipeline, a security gate fails because a high-severity vulnerability is found in the base image of a container. The pipeline is configured to block deployment on such findings. What is the appropriate remediation step?

Accepted Answer

Update the base image to a patched version. Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Answer

Override the security gate and proceed with deployment

Answer

Rebuild the image using the same base image

Answer

Add the vulnerability to an exception list

Question 4

A systems administrator must automate the patching of 200 Windows servers. The environment has strict security requirements and change management. Which scripting approach best balances automation and control?

Accepted Answer

Use PowerShell DSC (Desired State Configuration) with a pull server and authorized users via JEA.. PowerShell with Just Enough Administration (JEA) provides both automation and secure access. Option B is correct. Option A is unreliable for enterprise. Option C bypasses change management. Option D is too manual.

Answer

Write a Python script that uses WMI to apply patches and reboot servers.

Answer

Create a scheduled task on each server that runs a script from a network share.

Answer

Use Group Policy to install updates during the next restart.

Question 5

An organization uses AWS, Azure, and GCP for different workloads. They want a single tool to manage infrastructure consistently across all providers. Which approach is most appropriate?

Accepted Answer

Use Terraform with provider plugins. Terraform supports multiple providers via plugins, enabling consistent management. Provider-specific tools are limited to one cloud, and writing scripts for each is inefficient.

Answer

Use Azure Resource Manager templates

Answer

Write provider-specific scripts in PowerShell

Answer

Use AWS CloudFormation

Question 6

An organization uses Kubernetes to orchestrate containers. Which practice enhances the security of pod-to-pod communication?

Accepted Answer

Implement network policies that restrict ingress and egress traffic based on labels.. Option B is correct because Kubernetes Network Policies can restrict traffic based on labels, providing micro-segmentation. Option A (ClusterIP) is a service type, not a security control. Option C (NodePort) unnecessarily exposes pods. Option D relies on default permissive settings.

Answer

Expose all pods via NodePort services.

Answer

Use ClusterIP services for all internal traffic.

Answer

Rely on the default Kubernetes network configuration.

Question 7

Refer to the exhibit. A security administrator finds this IAM policy attached to a Lambda execution role. What is the most critical security risk?

Accepted Answer

The Lambda has full IAM management capabilities. The policy grants full IAM management capabilities (iam:*) on all resources, allowing the Lambda to create, modify, or delete IAM resources. This could lead to privilege escalation or resource destruction.

Answer

The Lambda can invoke any other Lambda

Answer

The Lambda can assume any role

Answer

The Lambda can access any S3 bucket

Question 8

A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)

Accepted Answer

Dropping all capabilities (CAP_DROP=ALL). Setting USER to non-root prevents the container from running as root, and dropping all capabilities removes many known escalation vectors. Using host networking and mounting the Docker socket increase risk. SELinux helps but is not specific to privilege escalation.

Answer

Enabling SELinux

Answer

Using host networking

Answer

Mounting /var/run/docker.sock

Question 9

A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?

Accepted Answer

Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].. Using read-only root filesystem and dropping all capabilities limits the attack surface. Option D is correct. Option A allows privileged access. Option B keeps default capabilities. Option C runs as root, increasing risk.

Answer

Set runAsNonRoot: false and readOnlyRootFilesystem: true.

Answer

Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].

Answer

Set privileged: true and readOnlyRootFilesystem: false.

Question 10

A security analyst needs to write a script that detects changes to critical files across a fleet of Linux servers. Which approach is most efficient and secure?

Accepted Answer

Use an agentless tool like OSSEC with a central manager to report file integrity changes.. Option C is correct because OSSEC provides centralized file integrity monitoring with agentless capability. Option A is distributed and harder to manage. Option B relies on syslog, which may not capture all changes. Option D is more complex and not as efficient.

Answer

Use a cron job on each server running a Python script that checks file hashes.

Answer

Enable Linux auditd on each server and forward logs to a SIEM for analysis.

Answer

Deploy a centralized log server and parse syslog for file modifications.

Question 11

A Windows administrator needs to automate the retrieval of failed login events from the Security log. Which scripting language is most native and efficient for this task?

Accepted Answer

PowerShell. PowerShell has built-in cmdlets like Get-WinEvent to interact with Windows Event Log. Bash and Python require extra modules, and JavaScript is not suited.

Answer

Bash

Answer

Ruby

Answer

Python

Question 12

Which two practices are essential for securing a CI/CD pipeline? (Choose two.)

Accepted Answer

Implement code signing for all build artifacts.. Options B and C are correct. Code signing ensures artifact integrity, and vulnerability scanning prevents deploying insecure images. Option A is insecure. Option D lacks necessary review. Option E is beneficial but not as essential as B and C.

Answer

Allow any developer to merge code into the main branch without review.

Answer

Store credentials in plaintext within pipeline configuration files.

Answer

Use immutable tags for container images.

Question 13

A security engineer is reviewing a Kubernetes deployment where the pod spec includes `securityContext: { privileged: true }`. What is the primary security concern of this configuration?

Accepted Answer

The container can modify the host's kernel. Privileged containers have almost all capabilities of the host, including access to host devices and kernel modules. This significantly increases the attack surface compared to running as root alone.

Answer

The container can access host resources like the filesystem

Answer

The container can run as root

Answer

The container has unrestricted network access

Question 14

An analyst wants to automate incident response tasks in a SOC environment. Which THREE scripting languages are commonly used for automation? (Choose three.)

Accepted Answer

Python. Python, Bash, and PowerShell are widely used for security automation due to cross-platform support, extensive libraries, and native system integration. Java is less common for quick automation, and COBOL is obsolete.

Answer

Java

Answer

COBOL

Question 15

A DevOps team uses Ansible to automate server configuration. They need to ensure that sensitive variables like passwords are not exposed in playbook logs or version control. What is the recommended approach?

Accepted Answer

Use Ansible Vault to encrypt sensitive variables. Ansible Vault encrypts sensitive data, preventing exposure. Storing in plain text is insecure, environment variables can leak in logs, and encrypting the whole playbook is unnecessary and hampers readability.

Answer

Use environment variables only

Answer

Store secrets in plain text within the playbook

Answer

Encrypt the entire playbook file

CAS-004 Practice Test 24 — 15 Questions

Exhibit

CAS-004 Practice Test 24 — 15 Questions

Exhibit