CAS-004 Practice Test 4 — 25 Questions

Question 1

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 2

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. An SBOM lists open-source components and their versions, enabling vulnerability tracking. Dependency analysis helps identify known vulnerabilities in those components.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 3

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

Accepted Answer

AWS Config. AWS Config continuously monitors and evaluates AWS resource configurations against desired policies, helping meet compliance requirements like SOC 2.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Shield

Question 4

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Accepted Answer

Runtime protection. CWPP should provide vulnerability management across different environments and runtime protection (e.g., intrusion detection) for workloads regardless of location.

Answer

Security information and event management

Answer

Identity and access management

Answer

Data loss prevention

Question 5

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. Software Bill of Materials (SBOM) is a list of all components in the application, including open-source libraries. Dependency analysis tools use SBOMs to identify known vulnerabilities. SAST analyzes source code, not libraries. DAST tests running applications. RASP provides runtime protection.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 6

A company is adopting a defense-in-depth strategy. Which of the following is an example of a preventive control at the network layer?

Accepted Answer

Network segmentation. Network segmentation limits lateral movement and reduces attack surface, making it a preventive network control.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Penetration testing

Question 7

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

Accepted Answer

Identity-based access policies. In a zero-trust model, identity is the primary security boundary. Micro-segmentation uses identity and context to enforce least-privilege access, regardless of network location.

Answer

VPN concentrators

Answer

Network address translation

Answer

Perimeter firewalls

Question 8

An organization wants to enforce consistent security policies across multiple cloud providers (AWS, Azure, GCP). Which tool is designed to continuously monitor and remediate misconfigurations in cloud environments?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) automates the detection and remediation of cloud misconfigurations across multiple providers.

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 9

An organization uses a multi-cloud strategy with workloads on AWS, Azure, and GCP. They need a single tool to monitor and enforce security configurations across all cloud environments. Which cloud security solution is best suited for this requirement?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) automates the monitoring and remediation of security misconfigurations across multiple cloud providers. CASB focuses on application access. CWPP protects workloads. SASE is for network and security convergence.

Answer

Secure Access Service Edge (SASE)

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Question 10

An organization is implementing a Secure Access Service Edge (SASE) architecture. Which of the following is a key component of SASE?

Accepted Answer

Cloud Access Security Broker (CASB). SASE converges SD-WAN and security functions, including SWG, CASB, ZTNA, and FWaaS, delivered from the cloud.

Answer

Demilitarized Zone (DMZ)

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Question 11

A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?

Accepted Answer

Use a Hardware Security Module (HSM) for key management. Hardware Security Modules (HSMs) provide tamper-resistant, dedicated hardware for key generation and storage, offering the highest security for root CA keys. Smart cards are less secure for large-scale root CA operations. Encrypted files on a server are vulnerable. A dedicated VM provides software-based isolation but is less secure than HSM.

Answer

Store the key in an encrypted file on a secure server

Answer

Generate the key on a dedicated virtual machine

Answer

Keep the key on a smart card stored in a safe

Question 12

An organization wants to implement infrastructure as code (IaC) with immutable infrastructure. Which security benefit does immutable infrastructure provide?

Accepted Answer

Reduced attack surface due to consistent configurations. Immutable infrastructure enforces that servers are never modified after deployment; updates are made by replacing the entire server, reducing configuration drift and vulnerabilities.

Answer

Better performance through caching

Answer

Simpler network segmentation

Answer

Easier patch management

Question 13

An organization is adopting SASE to converge network and security functions. Which component of SASE provides secure web gateway (SWG) capabilities?

Accepted Answer

Secure Web Gateway. SWG is a key SASE component that protects users from web-based threats by filtering traffic.

Answer

ZTNA

Answer

SD-WAN

Answer

CASB

Question 14

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

Accepted Answer

Least privilege access with just-in-time privileges. Identity-centric zero trust focuses on strong authentication, least privilege, and continuous verification of identity for every access request.

Answer

Implicit trust based on network location

Answer

Single static firewall perimeter

Question 15

A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?

Accepted Answer

Direct Connect / ExpressRoute. Direct Connect (AWS) or Azure ExpressRoute provide dedicated private network connections from on-premises to the cloud, offering low latency and security.

Answer

Site-to-site VPN over the internet

Answer

Private link (e.g., AWS PrivateLink)

Answer

SD-WAN with internet breakout

Question 16

During a secure SDLC, a security architect wants to identify design flaws early. Which activity is most appropriate for the design phase?

Accepted Answer

Threat modeling. Threat modeling is performed during the design phase to identify potential security threats and vulnerabilities before code is written.

Answer

Penetration testing

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Question 17

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). During development, SAST scans source code, dependency analysis checks libraries, and threat modeling identifies design flaws.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment

Question 18

A company is migrating to a public cloud and wants to ensure they understand their security responsibilities. According to the shared responsibility model, which of the following is typically the responsibility of the cloud customer?

Accepted Answer

Identity and access management. The customer is responsible for securing data, applications, and access management even in IaaS/PaaS/SaaS.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure security

Question 19

A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?

Accepted Answer

It prevents attackers from establishing persistence by modifying system files. Immutable infrastructure ensures that servers are never modified after deployment. This prevents configuration drift and makes it harder for attackers to persist. It also facilitates rapid recovery. It does not eliminate vulnerabilities or remove the need for patching; instead, patching is done by replacing instances. It simplifies forensics because instances are ephemeral and can be analyzed post-incident.

Answer

It eliminates all security vulnerabilities in the infrastructure

Answer

It removes the need for vulnerability scanning of base images

Answer

It simplifies compliance by eliminating the need for patching

Question 20

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

Accepted Answer

Hardware Security Module (HSM). A hardware security module (HSM) provides secure generation, storage, and management of cryptographic keys in a tamper-resistant device.

Answer

Certificate Revocation List (CRL)

Answer

Key Management Service (KMS)

Answer

Certificate Authority (CA)