CAS-004 Practice Test 3 — 25 Questions

Question 1

During a security incident, the incident response team has identified the root cause and removed the threat from all affected systems. Which phase of the incident response lifecycle involves returning systems to normal operation and monitoring for any signs of recurrence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recovery. The Recovery phase of the incident response lifecycle focuses on restoring systems to normal operation after the threat has been eradicated. It involves bringing systems back online, validating their integrity, and monitoring for any signs of recurrence. This phase ensures that the organization can resume business operations securely.

Answer

Eradication

Answer

Containment

Answer

Lessons Learned

Question 2

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an insider is using encrypted tunnels to transfer data. Which TWO of the following network traffic analysis (NTA) indicators are most likely to suggest encrypted exfiltration? (Choose two.)

Accepted Answer

Large data transfers to an external IP address during non-business hours. Option A is correct because large outbound data transfers to an external IP address outside normal business hours are a classic NTA indicator of exfiltration, as insiders often schedule bulk transfers when monitoring and user activity are lower. Option D is correct because repeated TLS connections to an external host on a non-standard port strongly suggest an encrypted tunnel or covert channel, since TLS hides payload contents and the non-standard port deviates from normal HTTPS/443 behavior. Option B is not correct because multiple HTTP GET requests to a known CDN are typically normal web browsing or content retrieval and do not indicate large-scale encrypted exfiltration. Option C is not correct because a single large upload to a cloud storage provider during work hours may be legitimate business activity and lacks the suspicious timing or tunneling characteristics of insider exfiltration. Option E is not correct because high DNS query volume to one domain more likely indicates DNS tunneling or beaconing, but the question specifically asks for indicators of encrypted exfiltration tunnels rather than DNS-based covert channels.

Answer

Multiple HTTP GET requests to a known content delivery network

Answer

A single large file upload to a cloud storage provider during work hours

Answer

High volumes of DNS queries to a single external domain

Question 3

A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?

Accepted Answer

System categorization. System categorization is a step unique to the NIST RMF (Step 1: Categorize) that uses FIPS 199 to classify information systems by impact level (Low, Moderate, High). ISO 27005 focuses on risk management processes — risk identification, assessment, and treatment — but does not include a formal system categorization step as part of its framework. This makes system categorization the correct differentiator.

Answer

Risk identification

Answer

Risk treatment

Answer

Risk assessment

Question 4

During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period of time. SOC 2 Type II reports on the effectiveness of controls over a period of time.

Answer

The vendor's financial stability

Answer

The vendor's compliance with privacy laws

Answer

The vendor's penetration test results

Question 5

During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?

Accepted Answer

Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services. The most effective way to prevent a compromised DMZ host from pivoting into the internal network is to enforce a unidirectional traffic flow. By blocking all outbound connections from the DMZ to the internal network at the firewall and using a reverse proxy (e.g., HAProxy, Nginx, or Apache with mod_proxy) to handle inbound requests, the DMZ hosts never directly initiate connections to internal resources. This eliminates the lateral movement path even if a DMZ host is fully compromised, as the reverse proxy terminates the external connection and forwards requests to internal servers without allowing the DMZ host to establish a new outbound session.

Answer

Allow only specific IPs in the DMZ to connect to internal servers

Answer

Replace the DMZ firewall with a next-generation firewall that includes IPS

Answer

Move all DMZ services to a cloud provider and use a site-to-site VPN

Question 6

A multinational corporation is implementing a data classification scheme. Which of the following data types should be classified as 'restricted'?

Accepted Answer

Customer PII with legal requirements. Customer PII with legal requirements should be classified as 'restricted' because it involves personal data protected by laws and regulations (e.g., GDPR, CCPA), and unauthorized disclosure could lead to legal penalties, financial loss, and reputational damage. Restricted data typically requires the highest level of protection.

Answer

Internal meeting minutes

Answer

Employee training materials

Answer

Marketing brochures

Question 7

A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)

Accepted Answer

Record and monitor all privileged sessions. Option A is correct because recording and monitoring all privileged sessions provides an audit trail and enables real-time detection of malicious or anomalous activity by administrators, which is a core PAM control. Option B is correct because just-in-time (JIT) access provisioning grants elevated privileges only when needed and for a limited time, reducing the standing attack surface and the window for credential misuse. Option C is correct because break-glass accounts provide controlled emergency access when normal PAM workflows fail, and when properly vaulted, monitored, and alerted on, they preserve availability without creating unmanaged privileged access. Option D is not the best fit because MFA for all users is a general identity control, not a PAM-specific practice for critical server privileged access. Option E is not correct because periodic password rotation for service accounts is a legacy practice that can weaken security and is not a core PAM enhancement compared to session monitoring, JIT access, and break-glass procedures.

Answer

Enforce multi-factor authentication for all users

Answer

Require periodic password rotation for all service accounts

Question 8

An organization is implementing a secure software development lifecycle. Which of the following practices BEST ensures that security requirements are addressed early in the development process?

Accepted Answer

Threat modeling during design phase. Threat modeling during the design phase is the best practice for addressing security requirements early because it proactively identifies potential threats, attack vectors, and vulnerabilities in the system architecture before any code is written. By analyzing data flow, trust boundaries, and threat agents (e.g., using STRIDE or PASTA methodologies), security controls can be integrated into the design, reducing costly rework later. This aligns with the 'shift left' principle in secure SDLC, ensuring security is not an afterthought.

Answer

Security training for developers

Answer

Code analysis after development

Answer

Penetration testing before release

Question 9

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which technique is most commonly used for lateral movement in a Windows environment?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) is a credential theft technique where an attacker captures NTLM password hashes (e.g., via Mimikatz from LSASS memory) and uses them to authenticate to other Windows systems without cracking the plaintext password. It is one of the most common lateral movement techniques in Windows environments because NTLM authentication accepts the hash directly.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

ARP spoofing

Question 10

A company is evaluating a new cloud service provider. The provider offers a SOC 2 Type II report, a third-party penetration test summary, and a completed security questionnaire. However, the company's procurement team discovers that the provider uses a subcontractor for data storage. Which of the following is the BEST next step for the security team?

Accepted Answer

Request a right-to-audit clause covering the subcontractor.. When a cloud provider uses a subcontractor for data storage, the security team should ensure they have the right to audit the subcontractor's controls, typically through a right-to-audit clause in the contract. This allows the company to verify that the subcontractor meets the required security standards. The other options are either too extreme or insufficient.

Answer

Require the provider to use only in-house resources.

Answer

Accept the risk because the provider has a SOC 2 report.

Answer

Immediately terminate the contract due to subcontractor risk.

Question 11

A SOC team is implementing a SOAR playbook to automate the response to phishing emails reported by users. The playbook should perform initial triage and, if the email is determined to be malicious, take containment actions. Which TWO of the following actions should be included in the playbook? (Choose TWO.)

Accepted Answer

Automatically block the sender's email address in the email gateway. Option E is correct because extracting embedded URLs and file hashes is a core initial triage step in a phishing SOAR playbook — these indicators are submitted to threat intelligence platforms (e.g., VirusTotal, MISP) to determine whether the email is malicious before any containment action is taken. Option C is correct because, once the email is confirmed malicious, blocking the sender's address at the email gateway is a standard, low-risk containment action that prevents further messages from that sender reaching other users. Option A is not appropriate because requiring manager approval introduces a manual delay that defeats the purpose of an automated SOAR playbook and is not a triage or containment action. Option B is not a triage or containment action; ticketing is a documentation/notification step, not part of the initial decision or containment logic. Option D is not indicated here because a full antivirus scan on the workstation is a host-level remediation action that is not triggered by email triage alone and would typically follow only if the user executed an attachment or payload.

Answer

Send an alert to the user's manager for approval

Answer

Automatically create a ticket in the service desk system

Answer

Initiate a full antivirus scan on the user's workstation

Question 12

A senior security architect is designing a detection strategy for advanced persistent threats (APTs) that employ living-off-the-land (LotL) techniques. Which THREE of the following approaches are most effective for detecting LotL activities? (Choose three.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). Option A (UEBA) is correct because LotL attacks abuse legitimate credentials and tools, so baselining normal user and entity behavior and flagging anomalies (e.g., unusual process lineage, off-hours privileged activity) is one of the few ways to surface attacker activity that leaves no malicious binary. Option B (honeytokens and honeypots) is correct because decoy credentials, files, and hosts have no legitimate use, so any interaction with them is high-fidelity evidence of an intruder performing reconnaissance or lateral movement with native tooling. Option D (monitoring native tool usage with EDR and command-line argument logging) is correct because LotL techniques rely on built-in binaries such as PowerShell, WMI, certutil, and rundll32, and capturing process creation with full command lines (e.g., via Sysmon Event ID 1 or EDR telemetry) exposes suspicious invocations like encoded PowerShell or certutil -urlcache. Option C is not correct because signature-based detection on known malicious file hashes cannot detect LotL activity, which by definition uses already-installed, signed, legitimate system binaries that have no malicious hash. Option E is not correct because blanket blocking of all scripts and macros is a preventive hardening control, not a detection approach, and it is impractical and would not identify an adversary already operating with native tools.

Answer

Signature-based detection on malicious file hashes

Answer

Blocking all scripts and macros by default

Question 13

A risk manager is applying the FAIR model to quantify a risk. Which TWO of the following are primary components used in FAIR analysis? (Select TWO.)

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO) are used in quantitative risk analysis (e.g., ALE), but not primary FAIR components. Exposure Factor (EF) is part of SLE calculation. Annual Loss Expectancy (ALE) is a result, not a component.

Answer

Single Loss Expectancy (SLE)

Answer

Annual Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 14

Which of the following is a primary advantage of using ChaCha20-Poly1305 over AES-256-GCM in certain environments?

Accepted Answer

Faster performance on devices without AES-NI. ChaCha20-Poly1305 is designed to be faster in software that lacks AES hardware acceleration, making it suitable for mobile devices.

Answer

Better hardware acceleration support

Answer

Higher security margin

Answer

Smaller ciphertext size

Question 15

A security architect is designing a new authentication system for a cloud-based application that requires strong multi-factor authentication. The solution must be resistant to phishing attacks and not rely on shared secrets. Which of the following is the BEST choice?

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn is a passwordless authentication protocol that uses public key cryptography and is resistant to phishing because the private key never leaves the user's device.

Answer

HOTP with a hardware token

Answer

TOTP via a mobile authenticator app

Answer

SMS one-time passcodes

Question 16

Which of the following is a key benefit of using an Extended Detection and Response (XDR) solution over traditional Endpoint Detection and Response (EDR)?

Accepted Answer

XDR provides centralized visibility across multiple security layers including endpoints, network, and cloud. XDR extends detection beyond endpoints to include network, email, cloud, and other data sources, providing broader visibility and correlation across the entire environment.

Answer

XDR only works with a single vendor's products

Answer

XDR eliminates the need for SIEM and SOAR systems

Answer

XDR only focuses on network traffic analysis

Question 17

A security team is adopting the NIST risk management framework. Which step should they perform first?

Accepted Answer

Categorize.. The NIST Risk Management Framework (RMF) begins with the Categorize step, where the information system and the information it processes, stores, and transmits are categorized based on an impact analysis (low, moderate, high) per FIPS 199. This initial step establishes the security categorization that drives all subsequent RMF steps, including control selection, implementation, and assessment. Without proper categorization, the organization cannot determine which baseline controls from NIST SP 800-53 are appropriate for the system's risk profile.

Answer

Select.

Answer

Implement.

Answer

Assess.

Question 18

A security analyst discovers that a web application is vulnerable to directory traversal. Which of the following is the MOST effective mitigation?

Accepted Answer

Whitelist of allowed file paths. A whitelist of allowed file paths is the most effective mitigation because it defines an explicit set of permissible paths, preventing any unauthorized file access regardless of traversal attempts. Unlike input validation, which can be bypassed with encoding or alternative traversal sequences, a whitelist enforces a positive security model that blocks all unspecified paths, including those using '..' or symbolic links. This approach directly addresses the root cause of directory traversal by restricting the application to only known-safe resources.

Answer

Encrypting all files on the server

Answer

Chroot jail

Answer

Input validation that rejects paths containing '..'

Question 19

A developer is using a third-party library with a known vulnerability. The vulnerability has a CVSS score of 9.8 and an exploit is publicly available. Which of the following is the most immediate course of action?

Accepted Answer

Update the library to the patched version if available. The most immediate course of action is to update the library to the patched version if available, because the vulnerability has a CVSS score of 9.8 (critical) and a public exploit exists, meaning active exploitation is likely imminent. Patching directly removes the root cause of the vulnerability in the library, which is the most effective and immediate mitigation. This aligns with the principle of eliminating the vulnerability at its source rather than relying on compensating controls.

Answer

Contact the vendor for a patch

Answer

Remove the library and rewrite functionality

Answer

Implement a WAF rule to block exploitation

Question 20

A security engineer is reviewing a TLS 1.3 configuration. Which of the following is a key feature of TLS 1.3 that improves security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman key exchange (DHE or ECDHE), which ensures that session keys cannot be recovered even if the server's long-term private key is later compromised. This is a core security improvement over TLS 1.2, where static RSA key exchange was allowed and lacked forward secrecy.

Answer

Support for RC4 cipher suite

Answer

Support for static RSA key exchange

Answer

Ability to downgrade to TLS 1.2