CAS-004 Practice Test 26 — 15 Questions

Question 1

When evaluating the security architecture of a containerized application, which THREE of the following practices should be implemented to minimize the attack surface? (Select THREE.)

Accepted Answer

Use minimal base images (e.g., Alpine Linux) instead of full OS images. Using minimal base images like Alpine Linux reduces the number of installed packages, libraries, and utilities, which directly shrinks the attack surface by eliminating unnecessary components that could contain vulnerabilities. This practice aligns with the principle of least functionality, ensuring only essential binaries are present in the container image.

Answer

Encrypt sensitive data at rest within the container

Answer

Implement multi-factor authentication for container registries

Question 2

A penetration tester is in the post-exploitation phase and wants to maintain access to a compromised system. Which of the following techniques is most effective for establishing persistent access while evading detection?

Accepted Answer

Creating a scheduled task that executes a reverse shell. A scheduled task (cron on Linux, Task Scheduler on Windows) that periodically launches a reverse shell is a classic persistence mechanism that blends into normal system activity, survives reboots, and is harder to detect than a static web shell or a new admin account. It provides recurring, stealthy access without leaving obvious artifacts like a listening service or a conspicuous privileged account.

Answer

Uploading a web shell to a publicly accessible directory

Answer

Creating a new local user account with administrative privileges

Answer

Installing a rogue certificate authority

Question 3

A security analyst calculates the annual loss expectancy (ALE) for a critical asset. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the annual loss expectancy?

Accepted Answer

$10,000. Annualized Loss Expectancy is calculated as ALE = SLE × ARO. With SLE = $50,000 and ARO = 0.2 (meaning the loss event is expected 0.2 times per year, i.e., once every five years), ALE = 50,000 × 0.2 = $10,000. This represents the expected yearly financial loss from the risk and is used to justify whether a control costing less than $10,000 per year is worth implementing.

Answer

$0

Answer

$50,200

Answer

$250,000

Question 4

A security architect is designing deception technologies to detect and delay attackers. Which TWO of the following are examples of deception technologies that can be deployed? Select TWO.

Accepted Answer

Honeytokens. Honeytokens (A) are deception artifacts such as fake credentials, files, or database records that have no legitimate use, so any access or use of them is a high-fidelity indicator of malicious activity and can trigger alerts while wasting attacker time. Honeypots (B) are decoy systems or services deliberately exposed to attract and observe attackers, allowing defenders to detect intrusions, collect TTPs, and delay or divert adversaries from real assets. SIEM (C) is a log aggregation, correlation, and alerting platform, not a deception mechanism, so it does not itself lure or deceive attackers. A vulnerability scanner (D) is an assessment tool that identifies weaknesses in systems and does not create decoys or false targets. An IPS (E) is a preventive control that detects and blocks malicious traffic inline, but it is not a deception technology because it does not present fake assets or bait to attackers.

Answer

Security Information and Event Management (SIEM)

Answer

Vulnerability scanner

Answer

Intrusion Prevention System (IPS)

Question 5

An organization wants to ensure that its employees understand their responsibilities regarding data protection. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Conduct regular security awareness training with assessments. The most effective because it combines regular, recurring training with assessments that verify comprehension, ensuring employees actively engage with data protection responsibilities rather than passively receiving information. This aligns with the continuous improvement cycle required by frameworks like NIST SP 800-50 and GDPR Article 39, which mandate ongoing awareness programs and demonstrable understanding. Assessments provide measurable evidence of employee competence, which is critical for compliance audits and reducing human-error-related breaches.

Answer

Include a clause in the employment contract

Answer

Post posters in common areas

Answer

Distribute a data protection policy annually via email

Question 6

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Accepted Answer

Lack of peer review and cryptanalysis. The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 7

A multinational corporation is migrating its data centers to a hybrid cloud model. The security team must ensure that data sovereignty laws are respected. The company operates in the EU, US, and Asia. Which of the following is the BEST approach?

Accepted Answer

Use cloud regions in each geographic area where data is stored and processed.. Using cloud regions in each geographic area ensures data remains within the jurisdiction where it was collected, directly complying with data sovereignty laws such as the EU's GDPR, US state laws, and Asia-Pacific regulations. This approach leverages the cloud provider's regional boundaries to enforce legal data residency without relying on technical controls that can be circumvented or misconfigured.

Answer

Require all employees to sign a data processing agreement.

Answer

Encrypt all data at rest and in transit using a single global encryption key.

Answer

Implement a virtual private network between all data centers and cloud providers.

Question 8

Which three options are best practices for writing secure scripts? (Choose three.)

Accepted Answer

Use parameterized inputs to prevent injection attacks.. Option B is correct because parameterized inputs (for example, prepared statements or argument arrays passed to execve-style APIs) keep untrusted data separate from executable code, which prevents injection attacks such as SQL injection and shell command injection. Option C is correct because validating all external input before processing enforces expected type, length, format, and range, rejecting malicious or malformed data before it can reach a vulnerable operation. Option E is correct because running scripts with the least privilege necessary limits the blast radius if the script is compromised, so it cannot modify or read resources beyond its required function. Option A is not a security best practice per se: logging errors and warnings aids debugging but can leak sensitive information if not sanitized, and it does not directly harden a script. Option D is incorrect because hardcoding sensitive credentials in a script exposes secrets to anyone who can read the file or source control history; secrets should be stored in a secrets manager or injected at runtime.

Answer

Log all errors and warnings for debugging.

Answer

Hardcode sensitive credentials in the script.

Question 9

A security engineer is reviewing the configuration of an AWS S3 bucket that stores customer data. Which of the following settings is most likely to cause a data breach?

Accepted Answer

Bucket policy that allows public read access. A bucket policy allowing public read access exposes data to anyone. Option A (versioning) is a feature, not a risk. Option C (encryption) is secure. Option D (MFA delete) is a security control.

Answer

Versioning enabled on the bucket

Answer

Server-side encryption with AWS KMS

Answer

MFA delete enabled on the bucket

Question 10

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

Accepted Answer

Avoid the risk by not collecting unnecessary personal data. With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

Answer

Transfer the risk through cyber insurance

Answer

Mitigate the risk by encrypting personal data

Answer

Accept the risk and self-insure

Question 11

A company is deploying IoT sensors in a remote area with limited connectivity. The sensors must be able to securely transmit data using minimal bandwidth. Which protocol should the engineer choose?

Accepted Answer

MQTT with TLS. MQTT with TLS is the correct choice because MQTT is a lightweight publish-subscribe protocol designed for constrained devices and low-bandwidth, high-latency networks. It minimizes overhead with a small header (2 bytes minimum) and supports persistent connections, making it ideal for IoT sensors in remote areas. TLS ensures encrypted, authenticated communication without adding significant bandwidth overhead when using modern cipher suites.

Answer

SNMPv3

Answer

HTTPS

Answer

SSH

Question 12

A penetration tester is conducting a test against a web application. The client has defined rules of engagement that prohibit any denial of service attacks. The tester discovers an endpoint that is vulnerable to command injection. Which THREE of the following actions should the tester take to validate the vulnerability while staying within scope? (Choose THREE.)

Accepted Answer

Use the echo command to write a file on the server. Option A is correct because using the echo command to write a benign file on the server safely demonstrates command injection without causing damage or service disruption, which respects the no-DoS rules of engagement. Option B is correct because running whoami is a non-destructive command that confirms code execution and reveals the privilege context of the injected commands, providing clear validation evidence. Option E is correct because pinging a controlled server (e.g., via the ping command to an IP the tester owns) verifies outbound code execution and network reachability without harming the target or violating the no-DoS constraint. Option C is not appropriate because deleting a system file is destructive and could cause an outage or data loss, violating the rules of engagement. Option D is not appropriate because flooding the endpoint with multiple requests constitutes a denial-of-service style test, which the client explicitly prohibited.

Answer

Delete a random system file to observe impact

Answer

Flood the endpoint with multiple requests to test resilience

Question 13

An incident response team is handling a ransomware incident. The team has successfully contained the threat and is now in the eradication phase. Which THREE actions are appropriate for the eradication phase? (Select THREE.)

Accepted Answer

Apply security patches to the vulnerability that allowed initial access. In the eradication phase, the goal is to remove the threat and close the attack vector, so option B is correct because applying security patches to the vulnerability that allowed initial access eliminates the root cause and prevents reinfection. Option C is correct because revoking and resetting all compromised user and service accounts removes adversary persistence and stops further unauthorized access using stolen credentials. Option D is correct because deleting all infected files and registry keys associated with the ransomware removes malicious artifacts and persistence mechanisms from affected systems. Option A is not appropriate here because restoring systems from clean backups is a recovery-phase action performed after eradication, and option E is not appropriate because conducting a lessons learned meeting occurs in the post-incident activity phase after recovery is complete.

Answer

Restore systems from clean backups

Answer

Conduct a lessons learned meeting

Question 14

An organization uses an EDR solution and wants to detect ransomware that encrypts files and then deletes volume shadow copies. Which EDR detection technique would be most effective for this behavior?

Accepted Answer

Behavioral detection for mass file modifications and vssadmin.exe execution. Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Answer

Signature-based detection using file hashes

Answer

Allowlisting of trusted applications

Answer

Network traffic analysis to detect C2 communication

Question 15

An organization wants to adopt a cybersecurity framework that provides a structured approach to managing cyber risks. Which framework is BEST suited?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is specifically designed to provide a structured, risk-based approach to managing cybersecurity risks, offering core functions (Identify, Protect, Detect, Respond, Recover) and implementation tiers that align with an organization's risk appetite. It is the best fit because it directly addresses cyber risk management through a flexible, outcome-driven framework, unlike other frameworks that focus on IT governance, information security management systems, or service management.

Answer

COBIT

Answer

ISO 27001

Answer

ITIL