CAS-004 Practice Test 5 — 25 Questions

Question 1

A security architect is designing an API security strategy for a microservices-based application. The architect needs to ensure that only authenticated and authorized clients can invoke APIs, and that rate limiting is enforced to prevent abuse. Which technology should be placed in front of the microservices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

API Gateway. An API gateway handles authentication, authorization, rate limiting, and routing, providing a central security control point.

Answer

Web Application Firewall (WAF)

Answer

Reverse proxy

Answer

Load balancer

Question 2

A security administrator needs to ensure that only authorized devices can access the corporate network. Which technology would best enforce this requirement at the network access layer?

Accepted Answer

802.1X. 802.1X provides port-based authentication, allowing only authorized devices to connect to the network.

Answer

TLS 1.3

Answer

IPsec VPN

Answer

DNSSEC

Question 3

An organization wants to implement an immutable infrastructure for its containerized applications. Which security benefit is most directly achieved by immutability?

Accepted Answer

Prevents unauthorized modifications to running containers. Immutable infrastructure ensures that once a container image is deployed, it is never modified. Any change requires a new image deployment, which prevents configuration drift and unauthorized changes.

Answer

Eliminates need for runtime security monitoring

Answer

Allows use of privileged containers securely

Answer

Reduces image scanning frequency

Question 4

A company uses a hybrid cloud model with workloads on AWS and on-premises. They need to ensure secure connectivity between the two environments with high bandwidth and low latency, bypassing the public internet. Which solution should they implement?

Accepted Answer

Configure AWS Direct Connect for dedicated private connectivity. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet for reliable and secure connectivity. VPN over the internet is less reliable and has higher latency. Private link exposes services privately but does not connect on-premises to cloud. SD-WAN can manage traffic but does not provide a direct dedicated connection.

Answer

Implement SD-WAN with integrated security

Answer

Establish a site-to-site VPN over the internet

Answer

Use AWS PrivateLink to access VPC endpoints

Question 5

A company is migrating sensitive workloads to the cloud and must comply with FedRAMP requirements. Which of the following is the most appropriate cloud deployment model?

Accepted Answer

Community cloud. FedRAMP requirements are stringent and often best met by a government community cloud or a dedicated cloud environment that has been FedRAMP authorized.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 6

A security architect is implementing a zero trust model for a financial services company. The goal is to prevent lateral movement in the data center. Which approach best achieves this objective?

Accepted Answer

Deploying micro-segmentation to isolate workloads and enforce granular policies. Micro-segmentation divides the network into small, isolated segments to restrict lateral movement, which is a key zero trust principle. Software-defined perimeter (SDP) focuses on user-to-resource access, but micro-segmentation directly limits east-west traffic. Defense-in-depth is broader and not specific to lateral movement. Identity-centric access controls user authentication but does not prevent lateral movement.

Answer

Using a software-defined perimeter to hide network resources

Answer

Implementing identity-centric access controls across all resources

Answer

Applying defense-in-depth layering by adding multiple security controls

Question 7

A security architect is implementing network segmentation in a hybrid cloud environment. Which TWO controls are most effective for reducing east-west traffic risks?

Accepted Answer

Micro-segmentation. Micro-segmentation allows granular policies per workload, and east-west traffic inspection detects lateral movement. Both are key to reducing risks inside the network.

Answer

VPN concentrator

Answer

NAT gateway

Answer

Perimeter firewall

Question 8

A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.

Answer

Site-to-site VPN over the internet

Answer

AWS Client VPN

Answer

AWS Transit Gateway with internet gateway

Question 9

An organization is concerned about future quantum computer attacks on their public key infrastructure. Which NIST-standardized algorithm is designed for digital signatures and is resistant to quantum attacks?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is a NIST PQC standard for digital signatures.

Answer

Falcon

Answer

RSA-4096

Answer

CRYSTALS-Kyber

Question 10

A security architect is designing a defense-in-depth strategy for a web application. Which combination of controls provides overlapping protection against SQL injection attacks?

Accepted Answer

Input validation and parameterized queries. Defense-in-depth layers multiple controls. Input validation prevents malicious input from reaching the application, while parameterized queries ensure that SQL statements are safe even if validation fails. WAFs can detect and block injection attempts at the network layer.

Answer

Encryption and hashing

Answer

Intrusion detection system (IDS) and antivirus

Answer

Web application firewall (WAF) and network segmentation

Question 11

During a secure SDLC, a development team wants to identify vulnerabilities in running code. Which type of testing should be performed?

Accepted Answer

DAST. DAST (Dynamic Application Security Testing) tests running applications from the outside, simulating attacks to find vulnerabilities in runtime behavior.

Answer

IAST

Answer

SAST

Answer

RASP

Question 12

An organization is implementing a hybrid cloud architecture and must ensure secure connectivity between its on-premises network and a public cloud VPC. The traffic includes sensitive data that must not traverse the internet. The solution must provide high bandwidth and low latency. Which connectivity option should the architect choose?

Accepted Answer

AWS Direct Connect. Direct Connect provides a dedicated, private, high-bandwidth connection between on-premises and cloud, bypassing the internet.

Answer

Site-to-Site VPN over the internet

Answer

AWS Client VPN

Answer

Internet gateway with encryption

Question 13

An organization is deploying a Kubernetes cluster and needs to harden security. Which THREE controls should be implemented? (Choose three.)

Accepted Answer

Role-Based Access Control (RBAC). RBAC controls access, network policies segment traffic, and admission controllers enforce policies before pods are created.

Answer

Seccomp profiles

Answer

Service mesh

Question 14

A security architect is implementing defense-in-depth for a critical application. Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify and record security events after they occur; an IDS monitors traffic for suspicious activity.

Answer

Data encryption

Answer

Access control list

Answer

Firewall

Question 15

An organization is implementing a CASB to secure their SaaS applications. Which CASB deployment mode is most appropriate for monitoring and controlling data in transit between users and cloud apps without modifying the user's device?

Accepted Answer

API-based. API-based CASB connects directly to the cloud app's API to monitor and control data, without requiring client software.

Answer

Reverse proxy

Answer

Forward proxy

Answer

Inline gateway

Question 16

Which of the following is a core principle of the Zero Trust security model?

Accepted Answer

Never trust, always verify. Zero Trust assumes no implicit trust and requires verification for every access request, regardless of location.

Answer

Perimeter-based trust

Answer

Trust based on network location

Answer

Trust but verify

Question 17

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for post-quantum cryptography.

Answer

RSA-4096

Answer

ECDHE

Answer

CRYSTALS-Dilithium

Question 18

A security architect is designing a PKI for a large organization. The architect wants to ensure that private keys are stored securely and that cryptographic operations are performed in a tamper-resistant environment. Which solution should be used?

Accepted Answer

Hardware Security Module (HSM). Hardware Security Modules (HSMs) provide dedicated, tamper-resistant hardware for key storage and cryptographic operations.

Answer

Trusted Platform Module (TPM)

Answer

Software-based keystore

Answer

Key Management Service (KMS) in the cloud

Question 19

A security architect is evaluating a SASE solution. Which component of SASE is primarily responsible for inspecting encrypted traffic for threats?

Accepted Answer

Secure web gateway (SWG). SASE integrates SWG (Secure Web Gateway) for web filtering and threat inspection, including decryption and inspection of TLS traffic.

Answer

Zero Trust Network Access (ZTNA)

Answer

Next-generation firewall (NGFW)

Answer

SD-WAN edge

Question 20

Which of the following is a cloud-native security control provided by a cloud service provider to manage user permissions and access to resources?

Accepted Answer

Identity and Access Management (IAM). Identity and Access Management (IAM) is a fundamental cloud service for managing users, roles, and permissions.

Answer

Virtual Private Cloud (VPC)

Answer

CloudTrail

Answer

Key Management Service (KMS)