CAS-004 Practice Test 2 — 25 Questions

Question 1

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management using SAML enables users to authenticate via external identity providers (e.g., social media platforms) while the corporate system retains control over access policies through the exchange of SAML assertions. This architecture decouples authentication from authorization, allowing the corporate service provider to enforce its own rules based on trusted identity claims.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures

Question 2

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC)?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.

Answer

Continuous deployment

Answer

Code signing

Question 3

An organization needs to ensure consistent configuration across multiple Linux servers. They want to automate this process with a solution that requires minimal agent installation and uses push-based communication. Which approach is most appropriate?

Accepted Answer

Use Ansible playbooks to define and enforce server configurations.. Ansible is the most appropriate choice because it is agentless (no agent installation required) and uses push-based communication over SSH to enforce configurations. It uses YAML-based playbooks to define desired states, making it ideal for automating consistent configuration across multiple Linux servers with minimal overhead.

Answer

Use PowerShell Desired State Configuration (DSC) with Linux extensions.

Answer

Run a Docker container on each server with a configuration management tool inside.

Answer

Deploy Puppet with a master server and agents on each system.

Question 4

An IoT device manufacturer wants to ensure secure firmware updates. Which approach best protects against malicious firmware being installed on devices?

Accepted Answer

Digitally sign the firmware with a private key. Code signing with a trusted key ensures only authorized firmware can be installed.

Answer

Compress the firmware to reduce size

Answer

Use a hash of the firmware for integrity verification

Answer

Encrypt the firmware with a symmetric key

Question 5

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 6

A security analyst reviews a web application that accepts user-supplied data to generate PDF reports. The application uses a legacy library that directly inserts user input into SQL queries and also includes user input in the PDF generation without sanitization. Which is the most effective countermeasure?

Accepted Answer

Use parameterized queries and output encoding. The application has two distinct vulnerabilities: SQL injection (from direct insertion of user input into SQL queries) and likely cross-site scripting or PDF injection (from unsanitized user input in PDF generation). Parameterized queries prevent SQL injection by separating code from data, while output encoding neutralizes malicious content before it is rendered in the PDF. Together, these address the root causes of both flaws, making A the most effective countermeasure.

Answer

Enable HTTPS and HSTS

Answer

Implement a web application firewall (WAF) to block malicious input

Answer

Deploy a SIEM to log all database queries and PDF generation events

Question 7

A healthcare provider is migrating patient records to a cloud EHR system. The security officer is concerned about data ownership and portability. Which contractual clause is MOST critical to include in the cloud service agreement?

Accepted Answer

A clause on data portability and format standards. Data portability and format standards clauses directly address the security officer's concerns about data ownership and the ability to move patient records out of the cloud EHR system. Without such a clause, the provider could lock the healthcare organization into proprietary formats, making migration difficult or impossible. This is critical for compliance with regulations like HIPAA, which require patients to access and transfer their health information.

Answer

A service level agreement guaranteeing 99.999% uptime

Answer

A stipulation that encryption keys are managed by the customer

Answer

A requirement for breach notification within 24 hours

Question 8

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Accepted Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings. Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Answer

Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

Question 9

A company is deploying a new web application that handles sensitive customer data. The application is built using a microservices architecture running in containers on a Kubernetes cluster. The security team wants to implement mutual TLS (mTLS) for service-to-service communication. However, they are concerned about the operational overhead of certificate management. Which approach minimizes management overhead while still ensuring strong authentication?

Accepted Answer

Use a service mesh that provides automatic mTLS and certificate rotation. A service mesh (e.g., Istio, Linkerd) automates mTLS by injecting sidecar proxies that handle certificate issuance, validation, and rotation via a built-in certificate authority (CA). This eliminates manual certificate management while ensuring strong, per-service authentication and encryption, directly addressing the operational overhead concern.

Answer

Generate self-signed certificates for each service and manually distribute them

Answer

Use a single certificate for all services with Subject Alternative Names

Answer

Implement TLS termination at the ingress and use plaintext inside the cluster

Question 10

A company deploys a web application behind a WAF. The security team discovers that the WAF allows traffic from a known malicious IP. After investigating, they find the WAF is configured to allow all traffic from a specific country for business reasons. Which of the following is the BEST course of action?

Accepted Answer

Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.. The country-based allow rule exists for legitimate business reasons, so removing it outright would break required traffic. The correct approach is to preserve the business-justified allow rule while layering a more specific deny exception for the known malicious IP, since WAF rule precedence evaluates more specific rules before broader ones. This achieves both security and business continuity without disrupting legitimate users from that country.

Answer

Deploy an additional IPS device to block the IP.

Answer

Remove the country-based allow rule immediately.

Answer

Change the WAF from detection mode to blocking mode.

Question 11

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 12

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 13

An organization is unable to patch a critical vulnerability in a legacy application due to vendor limitations. The risk assessment indicates a high likelihood of exploitation. Which compensating control should the organization implement to reduce the risk?

Accepted Answer

Implement network segmentation to isolate the application. Network segmentation isolates the legacy application from critical systems, limiting the blast radius if the vulnerability is exploited. This compensating control reduces risk by preventing lateral movement and restricting access to the vulnerable application, even though the vulnerability remains unpatched.

Answer

Deploy an additional firewall in front of the application

Answer

Disable the application until a patch is available

Answer

Increase the frequency of vulnerability scanning

Question 14

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 15

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment

Question 16

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Accepted Answer

Run the container with a non-root user and drop all capabilities. Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 17

A regional bank is preparing for its annual regulatory examination and must demonstrate that its third-party risk management program is mature. The examiner asks which practices provide continuous, rather than point-in-time, oversight of critical vendors. (Choose two.)

Accepted Answer

Establishing contractual rights to audit, receive breach notifications within defined timeframes, and obtain regular independent assurance reports. Continuous third-party oversight combines recurring independent validation with enforceable contractual information rights. Periodic assessments with remediation tracking confirm that identified weaknesses are corrected, while audit rights, breach notification clauses, and independent assurance requirements keep the bank informed between reviews. One-time questionnaires, spend-based ranking, and reliance on vendor marketing all capture stale or unverified information.

Answer

Relying on the vendor's own marketing materials and public certifications page to confirm its security posture

Answer

Ranking vendors solely by annual contract value and assigning oversight resources proportionally to spend

Answer

Collecting a completed security questionnaire from each vendor once during initial onboarding and archiving the response

Question 18

A system administrator needs to securely store cryptographic keys and perform signing operations in a tamper-resistant hardware device. Which solution should be used?

Accepted Answer

A Hardware Security Module (HSM) with FIPS 140-2 Level 3 certification.. An HSM (Hardware Security Module) is designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment.

Answer

A secure enclave like Intel SGX.

Answer

A software-based key store with encrypted files.

Answer

A Trusted Platform Module (TPM) 2.0.

Question 19

An organization is creating a data classification policy. Which THREE of the following are common classification levels used in government and defense? (Select THREE.)

Accepted Answer

Top Secret. Top Secret is a standard classification level in government and defense, indicating information that would cause exceptionally grave damage to national security if disclosed without authorization. It is the highest level in the U.S. classification system, defined under Executive Order 13526, and requires the most stringent access controls and handling procedures.

Answer

Private

Answer

Public

Question 20

A security architect is implementing a zero trust architecture for a corporate network. Which TWO principles are fundamental to the zero trust approach? (Choose two.)

Accepted Answer

Verify every access request regardless of source. Option D is correct because zero trust requires that every access request be authenticated and authorized explicitly, regardless of whether it originates inside or outside the traditional network perimeter—no user or device is trusted by default. Option E is correct because least privilege access is a core zero trust principle, granting users and devices only the minimum permissions needed for their tasks and limiting lateral movement if credentials are compromised. Options A, B, and C are incorrect because they reflect perimeter-based, castle-and-moat security models: granting access by network location, assuming implicit trust for internal users, and relying on a single perimeter firewall all contradict zero trust's 'never trust, always verify' philosophy.

Answer

Grant access based on network location

Answer

Assume implicit trust for internal users

Answer

Use a single perimeter firewall