CAS-004 Practice Test 26 — 15 Questions

Question 1

A company is implementing MFA for remote access. Which TWO factors are considered possession factors?

Accepted Answer

A hardware OTP token. Possession factors are things the user has: a hardware token or a smartphone (for soft tokens). Biometrics and passwords are not possession factors.

Answer

A fingerprint scan

Answer

A PIN

Answer

A password

Question 2

A company is implementing measured boot using TPM 2.0. What is the primary purpose of storing boot measurements in Platform Configuration Registers (PCRs)?

Accepted Answer

To enable remote attestation of the system's boot state.. PCRs store hashes of boot components; these measurements are used for remote attestation to verify the integrity of the boot process.

Answer

To speed up the boot process.

Answer

To provide a root of trust for storage (sealed storage).

Answer

To encrypt the bootloader.

Question 3

A company wants to ensure that a compromised root CA does not affect the validity of previously issued certificates. Which PKI control should be implemented?

Accepted Answer

Offline root CA and online issuing CA. CRLs and OCSP allow revocation, but offline root CA and issuing CA separation ensure that compromise of root does not directly affect issued certs if root is kept offline.

Answer

Certificate pinning

Answer

Certificate transparency logs

Answer

Short-lived certificates

Question 4

A security architect is designing a new web application that must meet strict data confidentiality and integrity requirements. The application will run in a cloud environment and must support low-latency operations. The architect is considering cipher suites for TLS 1.3. Which combination of algorithms would best meet these requirements?

Accepted Answer

ChaCha20-Poly1305 with ECDHE key exchange and Ed25519. ChaCha20-Poly1305 is a symmetric cipher that offers excellent performance on mobile and low-power devices, while providing authenticated encryption. ECDHE provides forward secrecy, and Ed25519 provides efficient authentication. AES-256-GCM is also good but ChaCha20 often performs better in software. RSA key exchange does not provide forward secrecy. SHA-256 is a hashing algorithm, not an encryption algorithm.

Answer

AES-128-CBC with HMAC-SHA256 and RSA-2048

Answer

ChaCha20-Poly1305 with static ECDH and SHA-384

Answer

AES-256-GCM with RSA key exchange and SHA-256

Question 5

An organization wants to implement passwordless authentication for its employees using FIDO2/WebAuthn. What is a primary security advantage of this approach over traditional password-based MFA?

Accepted Answer

It is resistant to phishing attacks because credentials are bound to the origin.. FIDO2 uses public key cryptography; the private key never leaves the user's device, so phishing attacks cannot steal credentials. This provides strong resistance to phishing.

Answer

It eliminates the need for a second factor.

Answer

It allows users to reuse the same credential across multiple websites.

Answer

It does not require any client-side hardware.

Question 6

During a security audit, it was discovered that an application uses RSA with 1024-bit keys for encrypting sensitive data. The organization's security policy mandates a minimum of 128-bit symmetric equivalent security. Which of the following should be recommended as a replacement?

Accepted Answer

RSA with 3072-bit keys. RSA 2048 provides approximately 112-bit security, while RSA 3072 provides 128-bit. AES-256-GCM is symmetric, not asymmetric. ECDSA is for signatures, not encryption. So RSA 3072 is the correct choice.

Answer

AES-256-GCM

Answer

ECDSA P-384

Answer

RSA with 2048-bit keys

Question 7

A security analyst is investigating a potential side-channel attack on an IoT device. The device's cryptographic operations show variable execution times based on the key and plaintext. Which mitigation is most effective against timing attacks?

Accepted Answer

Use constant-time cryptographic implementations.. Timing attacks exploit variations in execution time. Using constant-time algorithms ensures that operations take the same amount of time regardless of input, preventing information leakage.

Answer

Use a faster processor to reduce execution time.

Answer

Implement random delays in cryptographic operations.

Answer

Disable caching in the CPU during cryptographic operations.

Question 8

An organization is deploying a just-in-time (JIT) privileged access management solution. What is a key benefit of JIT access compared to standing privileged accounts?

Accepted Answer

It reduces the window of exposure for privileged credentials.. JIT access provides temporary privileges that are automatically revoked after use, reducing the attack surface and limiting lateral movement.

Answer

It allows users to permanently elevate privileges.

Answer

It eliminates the need for multi-factor authentication.

Answer

It requires no audit logging.

Question 9

An organization is implementing a PKI and wants to ensure that clients can quickly check if a certificate has been revoked without downloading a large list. Which protocol should be used?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP (Online Certificate Status Protocol) allows clients to check the revocation status of a single certificate in real time without downloading a full CRL.

Answer

Certificate Revocation List (CRL)

Answer

Certificate Transparency (CT)

Answer

Simple Certificate Enrollment Protocol (SCEP)

Question 10

A security engineer is configuring a web server to use TLS 1.3. Which feature of TLS 1.3 should be disabled to prevent replay attacks in 0-RTT mode?

Accepted Answer

0-RTT. 0-RTT data is vulnerable to replay; disabling 0-RTT eliminates this risk. However, the question asks what should be disabled to prevent replay attacks in 0-RTT mode, so the answer is 0-RTT itself.

Answer

Session resumption

Answer

Forward secrecy

Answer

Cipher suite negotiation

Question 11

An organization is implementing a PKI hierarchy. The security team wants to ensure that if an issuing CA is compromised, the root CA remains unaffected and can revoke the issuing CA's certificate. Which of the following BEST describes the recommended architecture?

Accepted Answer

A two-tier hierarchy with an offline root CA and an online issuing CA. In a hierarchical PKI, the root CA is offline and issues certificates to intermediate CAs. The root CA can revoke the intermediate CA's certificate without being compromised itself.

Answer

A single-tier CA with the root CA online and issuing certificates directly

Answer

A three-tier hierarchy with a root CA, an intermediate CA, and an issuing CA, all online

Answer

Using self-signed certificates from the issuing CA without a root CA

Question 12

A company wants to implement certificate pinning for its mobile application to prevent man-in-the-middle attacks. Which of the following is the BEST practice when implementing certificate pinning?

Accepted Answer

Pin the public key of the server certificate. Pinning the public key rather than the entire certificate allows for certificate renewal without invalidating the pin.

Answer

Disable certificate pinning after the first successful connection

Answer

Pin the root CA certificate only

Answer

Pin the entire certificate chain

Question 13

An organization is deploying a new PKI and wants to ensure certificate revocation is performed efficiently. Which THREE methods should be implemented? (Select THREE.)

Accepted Answer

Online Certificate Status Protocol (OCSP). CRL, OCSP, and OCSP stapling are all standard revocation checking mechanisms; OCSP stapling improves performance by having the server present the OCSP response.

Answer

Short-lived certificates

Answer

Certificate transparency logs

Question 14

Which key exchange algorithm provides perfect forward secrecy (PFS) and is recommended for use in TLS 1.3?

Accepted Answer

ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides PFS as session keys are ephemeral.

Answer

RSA key exchange

Answer

Pre-shared key (PSK)

Answer

Diffie-Hellman (DH)

Question 15

A company is evaluating multi-factor authentication methods. Which TWO are considered phishing-resistant? (Select TWO.)

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn uses origin-bound keys, and hardware tokens (e.g., YubiKey) generate one-time passwords or use challenge-response resistant to phishing.

Answer

Biometric authentication on a smartphone

Answer

TOTP via mobile app

Answer

SMS one-time codes