CAS-004 Practice Test 4 — 25 Questions

Question 1

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Option A is correct because dynamic application security testing (DAST) and penetration testing exercise the running application before release, detecting runtime vulnerabilities such as injection, authentication flaws, and misconfigurations that static analysis cannot see. Option C is correct because static application security testing (SAST) analyzes source code or binaries during development, catching insecure coding patterns like buffer overflows and hardcoded secrets early when remediation is cheapest. Option E is correct because threat modeling during the design phase systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE), allowing architectural security controls to be built in before code exists. Option B does not belong because user acceptance testing validates functional business requirements, not security engineering controls. Option D does not belong because daily stand-ups are an Agile project-management ceremony with no direct security engineering function.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 2

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Accepted Answer

Use ECDSA P-384 for authentication. Option A (ECDSA P-384) is correct because elliptic-curve signatures at the 384-bit level provide roughly 192-bit security strength, far exceeding RSA-2048, and are well supported in IKEv2 for strong peer authentication. Option C (AES-256-GCM) is correct because AES-256 gives a 256-bit key and GCM is an AEAD mode that provides both confidentiality and integrity in a single efficient primitive, making it the strongest symmetric choice here. Option E (perfect forward secrecy via DHE) is correct because Diffie-Hellman ephemeral key exchange ensures that compromise of the long-term key cannot decrypt previously captured sessions, which is essential for 'strongest possible security' in an IKEv2 deployment. Option B (SHA-1) is not appropriate because SHA-1 is cryptographically broken for integrity and should be replaced by SHA-256 or stronger. Option D (IKEv1) is not appropriate because IKEv2 is more secure, more robust, and supports modern features like MOBIKE and stronger authentication methods.

Answer

Use SHA-1 for integrity

Answer

Use IKEv1 instead of IKEv2

Question 3

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. The development team is slow to fix the SQL injection vulnerability in code, so an immediate control is needed. Adding a WAF rule (option C) can block common SQL injection payloads at the perimeter without code changes, minimizing performance impact and maintaining defense in depth. Option A (disable search) is too disruptive. Option B (isolate database server) is a good defense-in-depth measure but does not address the vulnerability at the application layer. Option D (increase IDS sensitivity) only detects, not prevents. Therefore, C is the most effective immediate control.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 4

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Accepted Answer

Eliminates configuration drift and unauthorized changes. Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Answer

Reduces operational costs by reusing existing servers

Answer

Increases system performance through hardware acceleration

Answer

Simplifies monitoring by reducing the number of servers

Question 5

A financial institution is required to comply with SOX. Which of the following is a primary focus of this regulation?

Accepted Answer

Accuracy of financial reporting and internal controls. SOX (Sarbanes-Oxley Act) primarily focuses on the accuracy of financial reporting and the effectiveness of internal controls for publicly traded companies. It mandates that management assess and report on internal controls over financial reporting, and requires external auditors to attest to those assessments. This ensures transparency and accountability in financial disclosures.

Answer

Privacy of personal data for EU citizens

Answer

Security of health information

Answer

Protection of cardholder data

Question 6

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

Accepted Answer

The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.. Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Answer

The image tag "latest" might pull an outdated image.

Answer

The readOnlyRootFilesystem prevents logging.

Answer

The pod runs as root by default.

Question 7

A defense contractor must demonstrate compliance with NIST SP 800-171 for controlled unclassified information stored in a contractor-owned system. The compliance lead is preparing evidence for an upcoming assessment and wants to avoid the most common cause of failed assessments. Which activity best prevents assessment failure?

Accepted Answer

Maintaining artifacts that show each security requirement is implemented and periodically reviewed, tied to the specific system boundary being assessed.. Assessments of controlled unclassified information environments fail most often because organizations cannot produce current, boundary-specific evidence for implemented requirements. Sustaining reviewed artifacts tied to the assessed system lets assessors verify each objective directly. Plans of action, provider inheritance, and penetration tests each address only part of the picture and cannot substitute for complete implementation evidence.

Answer

Producing a plan of action and milestones that lists every unimplemented requirement with target dates, even if no compensating controls exist.

Answer

Relying on the cloud service provider's FedRAMP authorization to inherit all 110 security requirements for the contractor system.

Answer

Scheduling the assessment immediately after a penetration test so the most recent findings can serve as proof of implementation.

Question 8

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

Accepted Answer

It ensures consistent and repeatable security configurations. Infrastructure as code (IaC) enables security configurations to be defined in declarative or procedural scripts (e.g., Terraform, AWS CloudFormation, Ansible). This ensures that every deployment applies the exact same security settings (e.g., firewall rules, IAM policies, encryption at rest) without drift, making configurations consistent and repeatable across environments. The primary benefit is eliminating manual, error-prone processes that lead to configuration inconsistencies.

Answer

It eliminates the need for security testing

Answer

It allows unapproved changes to be deployed faster

Answer

It increases manual oversight of security settings

Question 9

During a digital forensics investigation of a compromised Linux server, the investigator needs to preserve the evidence in a forensically sound manner. The server is still running. Which of the following should the investigator do first?

Accepted Answer

Capture the contents of RAM using a tool like LiME or fmem. On a live system, volatile data — RAM contents, running processes, network connections, and encryption keys — is lost the moment power is cut or the system is rebooted. Order of volatility (RFC 3227) dictates capturing RAM first using tools like LiME or fmem before touching the disk. This preserves evidence that may never exist on disk, such as in-memory malware or active sessions.

Answer

Pull the power cord to preserve the disk state

Answer

Create a forensic image of the hard drive using dd over a network connection

Answer

Run the 'history' command to see recent user commands

Question 10

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. Option A is correct because an IPsec VPN tunnel between the AWS VPC and the on-premises network creates an encrypted, private path over the internet, satisfying both the requirement to minimize public exposure and to ensure encryption in transit. Option B is correct because AWS Direct Connect provides a dedicated private network connection from on-premises to AWS that bypasses the public internet entirely, and it can be combined with encryption (e.g., MACsec or VPN over Direct Connect) to meet the in-transit encryption requirement. Option C is not correct here because Secrets Manager handles credential storage and rotation, not the secure network path or encryption in transit between the web app and the database. Option D is not correct because VPC peering only connects VPCs within AWS (or between AWS VPCs), not an AWS VPC to an on-premises network. Option E is not correct because TLS encrypts the application-to-database session but does not by itself minimize internet exposure, since the traffic could still traverse the public internet.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.

Question 11

An organization is implementing a privacy by design approach for a new customer-facing application. Which of the following actions best exemplifies this principle?

Accepted Answer

Minimizing data collection to only what is necessary for the application's function. Privacy by design, codified in GDPR Article 25 as 'data protection by design and by default,' requires privacy to be embedded into systems from the outset. Data minimization — collecting only what is strictly necessary for the stated purpose — is a foundational PbD principle because it reduces the attack surface, limits breach impact, and satisfies the 'by default' requirement. It is a design-time decision, not a post-hoc control.

Answer

Adding a privacy notice to the application post-launch

Answer

Conducting a privacy impact assessment after the application is deployed

Answer

Encrypting data at rest and in transit

Question 12

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 13

An organization is implementing a risk management framework and wants to align with a standard that emphasizes a continuous, iterative process for identifying, assessing, and responding to risk. Which framework is most appropriate?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) is explicitly designed as a continuous, iterative process for identifying, assessing, and responding to risk. It consists of six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor, which are repeated throughout the system lifecycle. This aligns perfectly with the requirement for a continuous, iterative approach. ISO 27005 provides guidelines for risk management but is not as prescriptive about the continuous process as NIST RMF. FAIR is a quantitative risk analysis methodology, and COBIT is a governance framework for IT management, not specifically a risk management framework with a continuous iterative process.

Answer

FAIR

Answer

ISO 27005

Answer

COBIT

Question 14

A security architect is designing a public key infrastructure (PKI). Which component is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority. The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Answer

Validation Authority

Answer

Certificate Repository

Answer

Registration Authority

Question 15

A company must protect cryptographic keys used to sign financial transactions. The solution must be FIPS 140-2 Level 3 compliant and provide tamper-resistant hardware. Which technology should be deployed?

Accepted Answer

Hardware security module. A Hardware Security Module (HSM) is a dedicated physical appliance that generates, stores, and protects cryptographic keys inside a tamper-resistant boundary. FIPS 140-2 Level 3 requires physical tamper-resistance, identity-based authentication, and key zeroization on intrusion — capabilities that only validated hardware appliances like HSMs deliver. HSMs are the standard for signing high-value financial transactions because private keys never leave the cryptographic boundary in plaintext.

Answer

Software-based key management system

Answer

Cloud KMS

Answer

TPM

Question 16

Which document in a security policy hierarchy provides specific step-by-step instructions for performing a task?

Accepted Answer

Procedure. A procedure is the only document in a security policy hierarchy that provides detailed, step-by-step instructions for performing a specific task. It translates high-level policies and standards into actionable steps that employees can follow to ensure consistency and compliance. Procedures are operational in nature and answer 'how' to implement the requirements.

Answer

Guideline

Answer

Standard

Answer

Policy

Question 17

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. A SOC 2 report that does not cover HIPAA controls does not satisfy the requirement; the BAA is the contractual mechanism that binds the cloud provider to HIPAA safeguards and breach notification obligations. Therefore, requiring the provider to sign a BAA is the best course of action before migrating PHI.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 18

A penetration tester is performing reconnaissance against a target. Which TWO of the following are examples of active reconnaissance? (Select TWO.)

Accepted Answer

Banner grabbing. Banner grabbing (A) is active reconnaissance because the tester directly connects to target services (e.g., via netcat or telnet to a port) and reads the service's response banner, which generates traffic and can be logged by the target. Port scanning (C) is also active reconnaissance since tools like Nmap send TCP SYN, TCP connect, or UDP probes directly to the target's IP addresses to discover open ports, again interacting with the target's systems. In contrast, social media profiling (B), WHOIS lookup (D), and searching job postings (E) are passive reconnaissance techniques that rely on publicly available third-party information without directly touching the target's infrastructure, so they do not qualify as active reconnaissance.

Answer

Social media profiling

Answer

WHOIS lookup

Answer

Searching job postings for technology details

Question 19

A company is implementing a zero-trust network architecture. Which of the following components is essential for enforcing micro-segmentation?

Accepted Answer

Software-defined networking (SDN) with distributed firewalls. Software-defined networking (SDN) with distributed firewalls is essential for enforcing micro-segmentation because it enables granular, policy-based traffic control at the virtual network layer, independent of physical topology. SDN centralizes policy management and pushes firewall rules to hypervisor-level or host-level enforcement points, allowing east-west traffic to be segmented between individual workloads or application tiers without relying on traditional perimeter firewalls.

Answer

Security information and event management (SIEM) system

Answer

Multi-factor authentication (MFA)

Answer

Network access control (NAC)

Question 20

An organization is implementing continuous compliance monitoring. Which of the following metrics would best indicate whether the organization is maintaining compliance with PCI DSS Requirement 10 (log management)?

Accepted Answer

Percentage of systems with centralized logging enabled. PCI DSS Requirement 10 requires that audit logs be collected, retained, and reviewed, and centralized logging is a key control to ensure logs from all in-scope systems are captured in a tamper-resistant manner. The percentage of systems with centralized logging enabled directly measures coverage of this control. A high percentage indicates the organization is maintaining the log management requirement across its cardholder data environment.

Answer

Number of failed login attempts per day

Answer

Mean time to detect (MTTD) for security incidents

Answer

Vulnerability scan pass rate