CAS-004 Practice Test 5 — 25 Questions

Question 1

An organization discovers that a vendor's data breach exposed customer PII. The contract with the vendor does not address breach notification. What is the BEST way to prevent this in the future?

Accepted Answer

Add a breach notification clause in vendor contracts. Adding a breach notification clause directly addresses the contractual gap that left the organization without recourse or timely notification when the vendor suffered a data breach. This contractual remedy ensures that future incidents trigger a predefined notification process, aligning with regulatory requirements such as GDPR or HIPAA that mandate breach notification obligations for data processors. Without such a clause, the organization has no enforceable mechanism to compel the vendor to report breaches, regardless of other risk management activities.

Answer

Purchase cyber insurance covering vendor breaches

Answer

Terminate the vendor relationship immediately

Answer

Conduct more frequent vendor risk assessments

Question 2

Match each encryption standard or algorithm to its type.

Accepted Answer

AES: Symmetric encryption algorithm. The correct matches are AES with symmetric encryption, RSA with asymmetric encryption, and SHA-256 with hashing. Common confusions include mistaking AES for asymmetric or RSA for symmetric.

Answer

RSA: Symmetric encryption algorithm

Answer

AES: Asymmetric encryption algorithm

Question 3

During a security incident, a forensic analyst needs to acquire a memory dump from a Linux server without altering the system state. Which tool is most appropriate for this task?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is the most appropriate tool because it is specifically designed to acquire volatile memory from Linux systems while minimizing the footprint on the target system. It loads as a kernel module and directly accesses physical memory, ensuring that the acquisition process does not alter the system state, which is critical for forensic integrity.

Answer

Volatility framework

Answer

dd if=/dev/mem of=mem.dump

Answer

memdump utility

Question 4

Using the FAIR model, which of the following best describes the factor that represents the probable frequency of a threat acting on a vulnerability?

Accepted Answer

Threat event frequency (TEF). Threat event frequency (TEF) is the FAIR factor that quantifies how often a threat agent is expected to act against an asset within a given timeframe. It directly measures the probable frequency of a threat acting on a vulnerability, independent of whether the action succeeds. TEF is a primary input to calculating loss event frequency (LEF).

Answer

Vulnerability

Answer

Loss event frequency (LEF)

Answer

Control effectiveness

Question 5

A financial institution is required to comply with PCI DSS. A low-severity vulnerability is found in the cardholder data environment that would cost significant downtime to patch. What is the BEST course of action?

Accepted Answer

Implement compensating controls and formally accept the risk with documented approval. PCI DSS Requirement 6.2 allows organizations to formally accept risk for low-severity vulnerabilities when patching would cause significant operational impact, provided compensating controls are implemented and documented approval is obtained from management. This balances security compliance with business continuity, as the vulnerability is low-risk and the downtime cost outweighs the immediate threat.

Answer

Transfer the risk to a third party

Answer

Accept the risk without documentation

Answer

Immediately patch the vulnerability

Question 6

During a penetration test, an assessor successfully exploits a timing side-channel attack to extract an ECDSA private key from a secure enclave. Which TWO mitigations should the development team implement to prevent such attacks? (Select TWO.)

Accepted Answer

Implement constant-time cryptographic operations. Option A is correct because constant-time cryptographic operations ensure that execution time and memory access patterns do not depend on secret data, which directly eliminates the timing side-channel that leaked the ECDSA private key from the enclave. Option D is correct because ECDSA signing blinding (e.g., randomizing the nonce k and/or the private key d with a random value before the scalar multiplication) decorrelates the timing of the modular exponentiation/scalar multiplication from the actual secret, so an attacker cannot recover the key even if timing varies. Option B is not appropriate because adding random delays only obfuscates timing and is statistically defeatable by averaging many traces; it is not a sound cryptographic countermeasure. Option C does not belong because disabling debug interfaces addresses physical/JTAG-style access, not a timing side-channel observed through normal cryptographic execution. Option E does not belong because Ed25519 is also vulnerable to timing side-channels if implemented without constant-time code and blinding, so simply swapping algorithms does not fix the root cause.

Answer

Add random delays to cryptographic operations

Answer

Disable debug interfaces on the secure enclave

Answer

Replace ECDSA with Ed25519

Question 7

A security architect is designing a VPN that requires both authentication and encryption. Which IPsec protocol provides both services in a single protocol?

Accepted Answer

ESP in tunnel mode. ESP provides both encryption and optional authentication, while AH only provides authentication without encryption.

Answer

AH in transport mode

Answer

IKEv2

Answer

AH in tunnel mode

Question 8

A company is evaluating a vendor that will process sensitive customer data. The vendor's SOC 2 Type II report shows that controls were in place but had several exceptions noted. Which of the following is the BEST course of action?

Accepted Answer

Perform a risk assessment on the exceptions. A SOC 2 Type II report with exceptions indicates that controls were tested over a period and found to have gaps. The best course is to perform a risk assessment on the exceptions to evaluate their severity, impact on confidentiality, integrity, or availability of sensitive data, and determine if compensating controls or remediation plans are acceptable. This aligns with the risk management framework required for vendor due diligence under compliance standards like GDPR or PCI DSS.

Answer

Request a SOC 2 Type I report instead

Answer

Accept the vendor because it has a Type II report

Answer

Reject the vendor immediately due to exceptions

Question 9

A company is evaluating its disaster recovery plan. Which metric indicates the maximum acceptable downtime?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disruption — the target time within which systems must be restored to avoid unacceptable business impact. It is the metric that directly answers 'how long can we be down?' and drives DR architecture decisions like warm standby versus hot standby. RTO is paired with RPO, which defines acceptable data loss.

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Point Objective (RPO)

Answer

Mean Time Between Failures (MTBF)

Question 10

Refer to the exhibit. The data classification policy defines levels and rules. During an audit, a database containing both PII and credit card numbers is found labeled as 'Internal'. Which of the following is the BEST first action?

Accepted Answer

Reclassify the database as 'Critical' to reflect the highest required level. When a database contains data spanning multiple classification levels, the governing principle is that the asset must be classified at the highest sensitivity level of any data it contains. Since credit card numbers (regulated as cardholder data under PCI DSS) are more sensitive than generic PII labeled 'Internal', the database must be reclassified to reflect that highest level. Reclassifying as 'Critical' aligns the label with the actual data sensitivity and triggers the appropriate handling controls.

Answer

Accept the risk as the data is not public

Answer

Remove the credit card numbers from the database

Answer

Create a new classification level for mixed data

Question 11

An organization is implementing a DevSecOps pipeline. Which of the following are essential security controls to include? (Select TWO.)

Accepted Answer

Implement SAST in the build phase. SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

Answer

Conduct annual penetration testing

Answer

Use network segmentation for production

Answer

Disable security scanning to speed up deployments

Question 12

An organization is implementing a software-defined perimeter (SDP) for zero trust network access. Which THREE characteristics are typical of an SDP architecture? (Choose three.)

Accepted Answer

Applications are invisible to unauthorized users. Option B is correct because a core SDP principle is the "dark cloud" or black cloud model, where protected applications do not respond to unauthenticated probes and remain invisible until a user and device are authenticated and authorized by the controller. Option C is correct because SDP establishes dynamic, per-session encrypted connections (for example, mutual TLS or DTLS tunnels) between the initiating host and the accepting host, rather than granting broad network-level access. Option E is correct because SDP enforces device authentication and posture checks through the controller before any connection to the accepting host is brokered, which is fundamental to zero trust network access. Option A is not correct because SDP deliberately moves away from static IP-based allowlists and perimeter rules, relying instead on identity- and context-based authorization. Option D is not correct because SDP does not funnel all traffic through a single shared firewall; it uses distributed controllers and gateways to broker individualized, least-privilege connections.

Answer

Relies on IP-based allowlists

Answer

Uses a single shared firewall for all traffic

Question 13

Based on the exhibit, what type of attack is indicated?

Accepted Answer

Brute-force attack. The exhibit shows a high number of failed authentication attempts (e.g., 500+ in a short window) against a single user account, which is characteristic of a brute-force attack. This attack systematically tries multiple password combinations to gain unauthorized access, often targeting a specific username or service. The log entries indicate repeated login failures without any evidence of intercepted traffic or session manipulation.

Answer

Man-in-the-middle

Answer

Denial of service

Answer

Replay attack

Question 14

An architect is designing a multi-factor authentication (MFA) solution for remote access. Which of the following is the STRONGEST form of second factor?

Accepted Answer

FIDO2 WebAuthn hardware token. FIDO2 WebAuthn hardware tokens provide the strongest second factor because they use public-key cryptography to generate a unique key pair per service, with the private key stored securely on the token. This eliminates phishing, man-in-the-middle, and replay attacks, as the token signs a challenge from the relying party without ever sharing a shared secret over the network.

Answer

Email OTP

Answer

SMS one-time code

Answer

Knowledge-based questions

Question 15

A penetration tester is planning a test against a web application. The rules of engagement specify that the tester must not disrupt production services. Which TWO reconnaissance techniques are considered passive and would be appropriate for initial information gathering without impacting the target? (Select TWO.)

Accepted Answer

WHOIS lookup on the domain. WHOIS lookup on the domain (D) is correct because it queries public registrar databases for registration details such as registrant contacts, name servers, and creation/expiration dates, generating no traffic to the target's own infrastructure and thus causing zero disruption. OSINT gathering from public sources (E) is correct because it collects information from third-party sites, search engines, cached pages, and public records, again without sending packets to the target and therefore remaining passive and non-disruptive. Port scanning (A) is not passive: it sends TCP/UDP probes (e.g., SYN or connect scans) directly to target hosts, which can be logged, rate-limited, or destabilize fragile services. Vulnerability scanning (B) is also active and intrusive, as it transmits crafted requests and payloads that can crash or overload production systems. Social engineering attacks (C) are neither passive reconnaissance nor non-disruptive, since they involve direct interaction with personnel and can cause operational or security incidents.

Answer

Port scanning the target network

Answer

Vulnerability scanning

Answer

Social engineering attacks

Question 16

A company is implementing a vendor risk management program. Which THREE of the following should be included in the initial vendor assessment?

Accepted Answer

Financial stability. Financial stability (B) is a critical initial vendor assessment factor because it evaluates the vendor's ability to remain solvent and support long-term contractual obligations. A financially unstable vendor poses a direct risk to service continuity and may be unable to invest in necessary security controls, leading to potential data breaches or service disruptions.

Answer

Employee training records

Answer

Marketing collateral

Question 17

A SOC manager is considering implementing a SOAR platform. Which is the primary benefit of SOAR in day-to-day operations?

Accepted Answer

Automated playbook execution and orchestration of response actions. SOAR automates repetitive tasks and orchestrates workflows, enabling faster and consistent incident response. Option B is wrong because SOAR is not primarily for centralized log storage; that's typically a SIEM or log management system. Option C is wrong because SOAR does not replace human analysts; it augments them. Option D is wrong because reducing false positive alerts is primarily a function of SIEM tuning, not SOAR. SOAR can help by automating responses, but it does not directly reduce false positives.

Answer

Centralized storage of all security logs

Answer

Elimination of the need for human analysts

Answer

Reduction in false positive alerts from the SIEM

Question 18

A large enterprise is implementing a SOAR platform to automate incident response. The security team wants to create a playbook for handling phishing emails reported by users. The playbook should: 1) validate the reported email by checking headers and attachments, 2) automatically block the sender's domain at the email gateway if malicious, 3) create a ticket, and 4) send an automated response to the user. Which of the following describes the best approach to design this playbook?

Accepted Answer

Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.. The best approach is to use automated triage to extract indicators and then present the verdict to an analyst for manual approval before executing blocks. This balances automation with human oversight, reducing false positives and ensuring that blocking actions are justified. It also aligns with SOAR best practices of automating repetitive tasks while keeping critical decisions under human control.

Answer

Create a ticket and route it to a junior analyst for manual investigation, then close after user acknowledgement.

Answer

Immediately sandbox the attachment and block the sender's domain if the sandbox reports malicious behavior.

Answer

Automatically delete the email from all users' inboxes and send a warning to the organization.

Question 19

An organization uses Ansible to automate server configuration for a hybrid cloud environment. The security team requires that sensitive data such as API keys and passwords are not exposed in the Ansible playbooks or logs. The Ansible control node is shared among several administrators. What is the best approach to protect these secrets?

Accepted Answer

Use Ansible Vault to encrypt the secret variables and restrict access to the vault password file.. Ansible Vault encrypts sensitive variables and files so secrets are never stored in plaintext in playbooks or logs. Restricting access to the vault password file ensures only authorized administrators on the shared control node can decrypt the secrets. This satisfies the requirement that secrets not be exposed in playbooks or logs.

Answer

Store secrets in plaintext in a separate file and set restrictive file permissions.

Answer

Remove all secrets from automation and require manual entry during each playbook run.

Answer

Define secrets as environment variables on the control node and reference them in playbooks.

Question 20

A small business wants to achieve compliance with the Payment Card Industry Data Security Standard (PCI DSS). Which of the following is an essential requirement they must implement?

Accepted Answer

Implement logging and monitoring of all access to cardholder data. PCI DSS Requirement 10 mandates logging and monitoring of access to cardholder data. Option B is wrong because encryption in transit is required, not at rest by all merchants. Option C is wrong because quarterly scans are required, not monthly. Option D is wrong because penetration testing is required annually, not continuously.

Answer

Encrypt all cardholder data at rest

Answer

Conduct vulnerability scans on a monthly basis

Answer

Perform continuous penetration testing