CAS-004 Practice Test 2 — 25 Questions

Question 1

A security architect is selecting a cipher suite for TLS 1.3 to ensure forward secrecy and high performance. Which cipher suite should be recommended?

Accepted Answer

TLS_AES_256_GCM_SHA384. TLS 1.3 requires forward secrecy and uses AEAD ciphers. AES-256-GCM is a recommended AEAD cipher with strong security and performance.

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Answer

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Question 2

A security analyst is reviewing TLS 1.3 configuration for a web server. The analyst wants to ensure that the configuration provides forward secrecy and prevents the reuse of session keys. Which of the following is a characteristic of TLS 1.3 that supports these goals?

Accepted Answer

Use of ephemeral Diffie-Hellman key exchange. TLS 1.3 mandates ephemeral Diffie-Hellman key exchange (ECDHE or DHE), which provides forward secrecy by generating unique session keys for each session.

Answer

0-RTT session resumption

Answer

Support for static RSA key exchange

Answer

Removal of CBC mode cipher suites

Question 3

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management using SAML enables users to authenticate via external identity providers (e.g., social media platforms) while the corporate system retains control over access policies through the exchange of SAML assertions. This architecture decouples authentication from authorization, allowing the corporate service provider to enforce its own rules based on trusted identity claims.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures

Question 4

A penetration tester is in the post-exploitation phase and wants to maintain access to a compromised system. Which of the following techniques is most effective for establishing persistent access while evading detection?

Accepted Answer

Creating a scheduled task that executes a reverse shell. Creating a scheduled task that executes a backdoor is a common persistence mechanism. It can be disguised and runs at system startup or on a schedule, making it harder to detect.

Answer

Uploading a web shell to a publicly accessible directory

Answer

Creating a new local user account with administrative privileges

Answer

Installing a rogue certificate authority

Question 5

An organization wants to detect and respond to advanced threats that may evade traditional endpoint security solutions. They deploy an EDR solution that provides real-time visibility into endpoint activities. However, the security team is overwhelmed by alerts. Which technology can be integrated with EDR to automate response actions and reduce alert fatigue?

Accepted Answer

SOAR platform. SOAR platforms ingest alerts from various sources (including EDR) and use playbooks to automate incident response actions, such as isolating a host or blocking an IP. This reduces manual effort and alert fatigue.

Answer

SIEM with correlation rules

Answer

Network traffic analysis (NTA)

Answer

Deception technology

Question 6

Refer to the exhibit. A security engineer reviews the S3 bucket policy. Which of the following is the most concerning security issue?

Accepted Answer

The policy allows public read access to all objects in the bucket. The S3 bucket policy explicitly grants the `s3:GetObject` action to `"Principal": "*"`, which allows any unauthenticated user (public) to read all objects in the bucket. This is a critical misconfiguration that exposes sensitive data to the internet, often leading to data breaches. The policy does not restrict access by IP, referer, or any condition, making it a direct violation of the principle of least privilege.

Answer

The policy does not require encryption in transit

Answer

The policy uses the incorrect version of the policy language

Answer

The policy allows any user to list the objects in the bucket

Question 7

An organization needs to ensure consistent configuration across multiple Linux servers. They want to automate this process with a solution that requires minimal agent installation and uses push-based communication. Which approach is most appropriate?

Accepted Answer

Use Ansible playbooks to define and enforce server configurations.. Ansible is the most appropriate choice because it is agentless (no agent installation required) and uses push-based communication over SSH to enforce configurations. It uses YAML-based playbooks to define desired states, making it ideal for automating consistent configuration across multiple Linux servers with minimal overhead.

Answer

Use PowerShell Desired State Configuration (DSC) with Linux extensions.

Answer

Run a Docker container on each server with a configuration management tool inside.

Answer

Deploy Puppet with a master server and agents on each system.

Question 8

A security architect is designing a cloud security strategy for a company that uses multiple cloud providers. The architect needs a solution that provides visibility into cloud application usage, enforces security policies, and protects data. Which technology is most appropriate?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, policy enforcement, and data protection across multiple cloud services.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 9

A company is migrating its monolithic application to a microservices architecture. The security team wants to implement controls to protect inter-service communication and ensure data integrity. Which THREE security controls should be implemented? (Select THREE.)

Accepted Answer

Deploy an API gateway to enforce rate limiting and authentication. An API gateway acts as a single entry point for all service calls, enforcing rate limiting to prevent abuse and authentication (e.g., OAuth2, JWT) to verify identity before requests reach backend microservices. This centralizes security policy enforcement and protects inter-service communication by reducing the attack surface.

Option C is correct because mutual TLS (mTLS) provides strong service-to-service authentication and encryption for data in transit. With mTLS, each service presents a certificate to verify its identity, and the TLS handshake ensures all communication is encrypted and integrity-protected, preventing eavesdropping and man-in-the-middle attacks.

Option D is correct because a container orchestration platform (e.g., Kubernetes) can enforce network policies that restrict communication between services, ensuring only authorized service-to-service interactions. This provides an additional layer of security for inter-service communication beyond the API gateway and mTLS.

Answer

Encrypt data at rest using AES-256

Answer

Conduct static code analysis on all microservices

Question 10

An engineer reviews the TLS configuration for a web server, which includes the following line:
ssl_verify_client optional;
Which of the following is a security concern present in this configuration?

Accepted Answer

The server does not require client certificates for authentication.. The TLS configuration sets ssl_verify_client to optional, allowing clients to connect without a certificate. This undermines mutual TLS (mTLS) enforcement, leaving the server vulnerable to unauthorized access if client authentication is expected. Option A is incorrect; perfect forward secrecy is provided by modern cipher suites, and its absence is not a concern here. Option B is incorrect; TLS 1.2 and 1.3 are industry-standard secure protocols. Option C is incorrect; the private key path is outside the document root and properly secured, which is a typical configuration.

Answer

The cipher suite does not include perfect forward secrecy (PFS).

Answer

The configuration supports outdated TLS 1.2 protocols.

Answer

The private key is stored in an accessible location.

Question 11

A security analyst discovers that a third-party vendor has been granted access to the company's production database for support purposes. The vendor's contract expires in two weeks. What is the BEST course of action to ensure compliance with the principle of least privilege and reduce risk?

Accepted Answer

Immediately revoke the vendor's database access and provide temporary access only if needed.. The principle of least privilege requires that access rights be granted only for the minimum necessary duration. Since the vendor's contract expires in two weeks, there is no ongoing business need for continued access. Immediately revoking access and providing temporary access only if needed ensures that the vendor cannot access the production database after the contract ends, reducing the risk of unauthorized data exposure or malicious activity.

Answer

Extend the contract for another year to maintain support continuity.

Answer

Wait until the contract expires and then revoke access.

Answer

Monitor the vendor's activities until the contract expires.

Question 12

A security analyst is reviewing alerts from a SIEM and notices multiple failed login attempts from a single IP address to different user accounts over a 5-minute window. What should the analyst do FIRST?

Accepted Answer

Check the source IP and correlate with other logs to confirm suspicious activity.. In incident response, the first step is to verify the alert before taking any action. The analyst should check the source IP and correlate the failed login attempts with other logs (e.g., VPN logs, IDS alerts, or previous successful logins) to determine if this is a brute-force attack, a misconfigured application, or a false positive. Prematurely blocking the IP (option A) could disrupt legitimate traffic if the IP is a shared proxy or NAT. Isolating endpoints (option B) is excessive without confirmation that the attempts were successful or that the endpoints are compromised. Resetting all targeted accounts (option D) is disruptive and unnecessary without evidence of compromise. Therefore, the correct first step is to verify and correlate the alert (option C).

Answer

Block the IP address at the firewall.

Answer

Isolate all endpoints that received the login attempts.

Answer

Reset all user accounts that were targeted.

Question 13

An incident response team is handling a ransomware incident. The team has successfully contained the threat and is now in the eradication phase. Which THREE actions are appropriate for the eradication phase? (Select THREE.)

Accepted Answer

Apply security patches to the vulnerability that allowed initial access. Eradication involves removing the threat completely: deleting malware, revoking compromised credentials, and patching vulnerabilities.

Answer

Restore systems from clean backups

Answer

Conduct a lessons learned meeting

Question 14

A DevOps team is automating the deployment of a containerized application to production. Which THREE practices are essential for maintaining security and reliability? (Select THREE.)

Accepted Answer

Use Helm charts to package and deploy Kubernetes applications.. Helm charts are essential for packaging and deploying Kubernetes applications because they provide a standardized, version-controlled way to manage complex Kubernetes manifests. Helm simplifies deployment, rollback, and dependency management, which is critical for maintaining security and reliability in production environments.

Answer

Use Docker Compose files for production deployments.

Answer

Manually configure each environment to handle unique settings.

Question 15

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

Accepted Answer

Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.. Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.

Answer

Using signature-based intrusion detection systems (IDS) to match known attack patterns.

Answer

Deploying honeypots to attract and analyze attacker behavior.

Question 16

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Accepted Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings. Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Answer

Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

Question 17

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

Accepted Answer

The key length is insufficient against modern attacks. A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.

Answer

The firmware is not encrypted

Answer

The signature algorithm is obsolete

Answer

The signing key is not rotated

Question 18

Which three options are best practices for writing secure scripts? (Choose three.)

Accepted Answer

Use parameterized inputs to prevent injection attacks.. Parameterized inputs (also known as prepared statements or parameterized queries) separate SQL or shell command logic from user-supplied data, ensuring that input is treated strictly as data, not executable code. This prevents injection attacks such as SQL injection or command injection, which occur when untrusted input is concatenated directly into a command string. In scripting languages like Python, using `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))` instead of string formatting eliminates the risk of an attacker breaking out of the intended syntax.

Answer

Log all errors and warnings for debugging.

Answer

Hardcode sensitive credentials in the script.

Question 19

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Accepted Answer

All requests to the bucket are denied regardless of source IP.. The S3 bucket policy includes an explicit Deny statement that denies all actions (s3:*) for all principals (*), effectively blocking any request regardless of source IP. Even though there is an Allow statement permitting GetObject from the 10.0.0.0/8 range, the explicit Deny overrides it due to the policy evaluation logic where Deny takes precedence over Allow. Therefore, all requests to the bucket are denied.

Answer

Requests from outside 10.0.0.0/8 are allowed to read objects.

Answer

All requests from IPs in 10.0.0.0/8 are allowed to read objects.

Answer

Only anonymous requests are denied.

Question 20

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.