CAS-004 Practice Test 25 — 15 Questions

Question 1

A company deploys a microservices architecture using container orchestration. The security team wants to enforce mutual TLS between services. Which technology should be used?

Accepted Answer

Service mesh. A service mesh (e.g., Istio, Linkerd) is the correct technology because it provides a dedicated infrastructure layer for handling service-to-service communication, including automatic mutual TLS (mTLS) enforcement between microservices. It injects sidecar proxies that intercept all traffic and negotiate mTLS using X.509 certificates, ensuring both encryption and authentication without modifying application code.

Answer

SSH tunneling

Answer

API gateway

Answer

VPN

Question 2

An IoT device manufacturer wants to ensure the security of over-the-air (OTA) firmware updates. Which TWO measures are essential to protect the update process?

Accepted Answer

Sign the firmware with a trusted code signing certificate. Option A is correct because signing the firmware with a trusted code signing certificate lets the device verify authenticity and integrity via the vendor's public key, ensuring the OTA image genuinely originates from the manufacturer and has not been tampered with. Option C is correct because a secure boot chain validates that signature against a hardware-rooted trust anchor before the update is applied, preventing malicious or corrupted firmware from ever executing. Together, signing plus signature verification in a secure boot chain form the essential cryptographic trust path for OTA updates. Option B is not sufficient because a simple checksum detects only accidental corruption, not deliberate tampering, since it is not cryptographically bound to a secret or key. Option D is wrong because a hardcoded key can be extracted from the device and reused by attackers, and encryption alone does not prove authenticity. Option E is wrong because permitting downgrades enables rollback attacks that reintroduce known vulnerabilities.

Answer

Use a simple checksum for integrity verification

Answer

Encrypt the firmware using a hardcoded key

Answer

Allow firmware downgrades to previous versions

Question 3

A company's incident response team is conducting a post-incident review. They identify that the intrusion was not detected for 72 hours due to insufficient logging on critical servers. Which phase of the incident response lifecycle should be improved to address this gap?

Accepted Answer

Preparation. The gap is insufficient logging on critical servers, which is a preparation issue because logging must be configured and enabled before an incident occurs. Detection relies on logs, but if logs are not properly set up during the preparation phase, detection will fail. Therefore, improving preparation by ensuring adequate logging is the correct phase to address.

Answer

Lessons learned

Answer

Containment

Answer

Detection

Question 4

During a risk assessment, the analyst identifies that a legacy system containing sensitive data cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk treatment strategy is MOST appropriate?

Accepted Answer

Mitigation by implementing compensating controls. When a legacy system cannot be patched due to vendor end-of-life, the most appropriate risk treatment is to implement compensating controls (e.g., network segmentation, strict access controls, host-based intrusion detection) to reduce the likelihood or impact of exploitation. This allows the organization to continue critical operations while managing the residual risk, as avoidance or transfer would be impractical or insufficient.

Answer

Transfer by purchasing cyber insurance

Answer

Avoidance by decommissioning the system

Answer

Acceptance by documenting the risk

Question 5

A security architect is designing a network segmentation strategy for a multi-tenant cloud environment. Which of the following is the MOST effective technique to isolate tenant workloads while maintaining manageability?

Accepted Answer

Virtual private clouds (VPCs) with separate subnets. Virtual private clouds (VPCs) with separate subnets provide native, tenant-level isolation in a multi-tenant cloud environment by creating logically isolated network segments with their own IP address space, routing tables, and security policies. This approach is the most effective because it scales easily, integrates with cloud-native security controls (e.g., security groups, network ACLs), and maintains manageability through centralized orchestration without requiring per-tenant hardware or complex overlay configurations.

Answer

Host-based iptables

Answer

Stateful firewall rules

Answer

VLAN tagging

Question 6

An organization is implementing a public key infrastructure (PKI). Which THREE of the following are essential components?

Accepted Answer

Certificate authority (CA). Option B (Certificate authority (CA)) is essential because the CA is the trusted entity that issues, signs, and revokes digital certificates, forming the core of any PKI. Option C (Certificate database and CRL) is essential because the PKI must store issued certificates and publish a Certificate Revocation List so relying parties can validate certificate status. Option D (Registration authority (RA)) is essential because the RA handles identity proofing and certificate enrollment requests on behalf of the CA, binding a subject's identity to its public key. Option A (Key escrow agent) is not essential; key escrow is an optional recovery mechanism used in some deployments, not a required PKI component. Option E (Time-stamping authority (TSA)) is not essential; a TSA provides trusted time proofs for non-repudiation in specific use cases but is not required for basic PKI operation.

Answer

Key escrow agent

Answer

Time-stamping authority (TSA)

Question 7

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). Option B, the software bill of materials (SBOM), is correct because it enumerates every third-party and open-source component, library, and version in the product, which is the foundation for verifying provenance and detecting tampered or vulnerable dependencies. Option C, the dependency analysis report, is correct because it maps direct and transitive dependencies and flags known vulnerabilities, license conflicts, and unexpected or unvetted components, directly supporting integrity verification of the supply chain. Together, the SBOM provides the authoritative component inventory while the dependency analysis validates those components against known-good and known-bad data. Option A, penetration test results, is not correct because pen testing assesses exploitable weaknesses in a running system, not the provenance or integrity of third-party components. Option D, network flow logs, is not correct because they record traffic metadata for monitoring and forensics, not component-level supply chain integrity. Option E, database encryption configuration, is not correct because it addresses data-at-rest protection and is unrelated to verifying third-party component provenance.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration

Question 8

Which of the following are secure scripting practices when automating administrative tasks? (Choose two.)

Accepted Answer

Use a secrets management service to retrieve credentials at runtime. Using a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) retrieves credentials at runtime via secure APIs, avoiding hardcoded secrets in scripts. This practice ensures credentials are encrypted at rest and in transit, and supports rotation without modifying the script. It aligns with the principle of least privilege and reduces the risk of credential exposure in version control or logs.

Answer

Hardcode credentials in the script for convenience

Answer

Run the script with the highest privileges required

Question 9

An organization is implementing a data classification scheme. Which data type should be given the highest protection and is typically restricted to a very small number of individuals?

Accepted Answer

Restricted. Restricted data is the highest classification tier in most data classification schemes, reserved for the most sensitive information whose unauthorized disclosure would cause severe harm. Access is typically limited to a very small number of named individuals with explicit need-to-know and often additional controls like encryption, logging, and physical security. Examples include trade secrets, M&A plans, and certain regulated personal data.

Answer

Confidential

Answer

Internal

Answer

Public

Question 10

Which key performance indicator (KPI) is most useful for measuring the effectiveness of an incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to respond to and contain a security incident from detection. It directly reflects the efficiency and effectiveness of the incident response process, as lower MTTR indicates faster containment and reduced impact. Other metrics like patch compliance or vulnerabilities by severity are related to vulnerability management, not incident response effectiveness.

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity

Answer

Number of security awareness training sessions

Question 11

A security team discovers a misconfiguration that exposes sensitive data. The operations team wants to wait until the next maintenance window. What is the BEST course of action?

Accepted Answer

Immediately fix the misconfiguration. When a misconfiguration exposes sensitive data, the security team must prioritize immediate remediation to prevent data exfiltration or regulatory penalties. Waiting for a maintenance window violates the principle of timely risk mitigation, especially when the exposure is active and exploitable. The best course of action is to fix the misconfiguration immediately, even if it requires a temporary service disruption, as the risk of data breach outweighs operational convenience.

Answer

Document the risk and accept it

Answer

Notify the data protection authority

Answer

Implement a temporary workaround

Question 12

A company's risk assessment identifies that employees often use weak passwords. Which control directly addresses this risk?

Accepted Answer

Enforce a strong password policy. Enforcing a strong password policy directly addresses the risk of weak passwords by mandating complexity, length, and expiration requirements (e.g., minimum 12 characters, mixed case, numbers, symbols). This control reduces the likelihood of successful brute-force or dictionary attacks by increasing the entropy of user credentials. Unlike other options, it specifically targets the root cause—weak password creation—rather than adding compensating controls.

Answer

Conduct security awareness training

Answer

Deploy single sign-on

Answer

Implement multi-factor authentication

Question 13

A company is implementing continuous compliance monitoring for PCI DSS. Which TWO activities are most appropriate for this approach? (Select TWO.)

Accepted Answer

Automated daily file integrity monitoring on critical systems. Option B is correct because continuous compliance monitoring relies on automated, recurring controls such as daily file integrity monitoring (FIM) on critical systems, which detects unauthorized changes to system files in near real time and supports PCI DSS Requirement 11.5. Option E is correct because real-time monitoring of firewall and IDS logs provides continuous visibility into security events and supports PCI DSS Requirements 10 and 11.4, enabling prompt detection and response rather than point-in-time checks. Option A is not appropriate because monthly manual log review is periodic and labor-intensive, not continuous or automated. Option C is not appropriate because an annual QSA on-site audit is a point-in-time assessment, not continuous monitoring. Option D is not appropriate because quarterly vulnerability scanning, while required by PCI DSS, is periodic rather than continuous monitoring.

Answer

Manual review of access logs every month

Answer

Annual on-site audit by a Qualified Security Assessor (QSA)

Answer

Automated quarterly vulnerability scanning of the cardholder data environment

Question 14

A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?

Accepted Answer

Incorporating privacy controls during the initial system architecture. Privacy by design, codified in GDPR Article 25 and the ISO/IEC 27550 framework, requires that privacy protections be embedded into systems and processes from the outset rather than bolted on afterward. Incorporating privacy controls during initial system architecture — data minimization, purpose limitation, access controls, retention policies — is the textbook embodiment of this principle. The other options are reactive or partial measures that do not satisfy the 'by design' requirement.

Answer

Encrypting data at rest only

Answer

Performing an annual privacy audit

Answer

Providing privacy training to employees

Question 15

Which THREE components are essential for a fully functional Security Operations Center (SOC)? (Select exactly 3.)

Accepted Answer

Incident response team. A fully functional SOC requires an incident response team (A), because trained analysts and responders are the human element that detects, triages, contains, and remediates security incidents; without people, no tooling or process can operate. A SIEM system (C) is essential because it aggregates and correlates logs and telemetry from across the environment, generates alerts, and supports detection and investigation at SOC scale. Standard operating procedures and playbooks (E) are also essential, as they define repeatable, documented workflows for triage, escalation, containment, and recovery so responses are consistent and auditable. A VPN concentrator (B) is only a remote-access/network appliance and is not a core SOC component, and a firewall (D) is a preventive network control that feeds data to the SOC but is not itself one of the three essential SOC pillars of people, process, and technology.

Answer

VPN concentrator

Answer

Firewall