CAS-004 Practice Test 27 — 15 Questions

Question 1

Under the GDPR, which of the following is a data subject right?

Accepted Answer

Right to erasure (right to be forgotten). The right to erasure (right to be forgotten) is explicitly listed in Article 17 of the GDPR. It allows data subjects to request deletion of their personal data under certain conditions, such as when the data is no longer necessary for the purpose it was collected. This is one of the core data subject rights alongside access, rectification, and portability.

Answer

Right to transfer data across borders without restriction

Answer

Right to unlimited processing

Answer

Right to sell data

Question 2

An incident responder is analyzing a malware sample obtained from an infected host. The responder wants to perform dynamic analysis to observe the malware's behavior in a safe environment. Which of the following is the best approach?

Accepted Answer

Execute the malware in a virtual machine with network monitoring tools. Dynamic analysis requires observing malware behavior during execution, not examining its static properties. Running the sample in an isolated VM with network monitoring (e.g., Wireshark, INetSim, FakeNet-NG) allows the responder to capture real-time process creation, file system changes, registry modifications, and C2 callbacks. This is the only option that actually executes the malware and observes runtime behavior, which is the definition of dynamic analysis.

Answer

Check the PE header for imported functions

Answer

Disassemble the malware using IDA Pro

Answer

Run strings on the malware binary

Question 3

A security team is implementing deception technology to detect attackers inside the network. They plan to deploy fake systems that appear vulnerable and attract attackers. Which of the following is an example of a honeytoken?

Accepted Answer

A fake database credential file that triggers an alert when opened. A honeytoken is a piece of decoy data or a credential artifact — such as a fake database credential file, API key, or document — that has no legitimate use, so any access to it signals malicious activity and triggers an alert. Option D describes exactly this: a fake credential file that fires an alert when opened. The other options describe broader deception constructs (honeynets, honeypots, fake DNS records) rather than a discrete token of data.

Answer

A network segment with multiple decoy systems

Answer

A fake DNS entry for a non-existent domain

Answer

A virtual machine running a vulnerable web server

Question 4

An organization is deploying a new cloud-based application that processes personally identifiable information (PII). The security team must ensure data at rest is encrypted. Which THREE of the following controls should be implemented to protect the data? (Select THREE.)

Accepted Answer

Implement a key management system (KMS) with automatic key rotation.. A key management system (KMS) with automatic key rotation ensures that encryption keys are securely stored, rotated, and managed, which is essential for protecting data at rest. Without proper key management, encryption can be rendered ineffective if keys are compromised or stale. This control directly supports the confidentiality of PII stored in the cloud.

Answer

Use tokenization for all PII fields in the database.

Answer

Configure TLS 1.3 for all data connections.

Question 5

A SOC team uses a SOAR platform to automate incident response. They want to ensure that playbooks run with minimal human intervention but still require approval for actions that could cause service disruption. Which approach should be used?

Accepted Answer

Implement conditional manual approval for destructive actions.. Implementing conditional manual approval for destructive actions allows playbooks to run automatically for most steps, but pauses for human approval when an action could cause service disruption. This balances automation with safety.

Answer

Require analyst sign-off for every playbook action.

Answer

Use network isolation as a safety net for any action.

Answer

Configure the SOAR to automatically execute all playbook steps.

Question 6

A company is implementing a software-defined perimeter (SDP) architecture. Which TWO of the following are key characteristics of SDP? (Select TWO.)

Accepted Answer

The infrastructure is invisible to unauthorized users. A core principle of Software-Defined Perimeter (SDP) is to make the infrastructure invisible to unauthorized users. This is achieved by deploying SDP controllers and gateways that hide network components (e.g., servers, IP addresses) from unauthenticated clients, effectively creating a 'black cloud' that only reveals resources after successful authentication and authorization.

Answer

Network segmentation is implemented via VLANs

Answer

Peering between SDP components is done via BGP

Answer

All communications are encrypted using public key cryptography

Question 7

A company is migrating its applications to a SaaS model. Which of the following should be included in the contract to ensure secure data handling?

Accepted Answer

Data encryption at rest and in transit. Data encryption at rest and in transit is a fundamental security requirement for protecting sensitive data in a SaaS environment. Encryption at rest (e.g., AES-256) ensures data stored on the provider's servers is unreadable if physically compromised, while encryption in transit (e.g., TLS 1.2/1.3) protects data as it moves between the client and the SaaS platform. This directly addresses secure data handling, which is the core concern of the question.

Answer

Right to audit

Answer

Indemnification clause

Answer

SLA for uptime

Question 8

A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.. A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.

Answer

Deploy IPsec tunnels between each pair of services using pre-shared keys.

Answer

Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.

Answer

Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.

Question 9

A security architect is designing a secure remote access solution for employees using personal devices (BYOD). The company requires that corporate data is separated from personal data and can be wiped remotely without affecting personal data. Which solution best meets these requirements?

Accepted Answer

Implement mobile device management (MDM) with containerization. Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the BYOD device that isolates corporate data from personal data. The MDM policy can remotely wipe only the corporate container (selective wipe) without affecting the user's personal apps, photos, or settings, meeting both separation and remote wipe requirements.

Answer

Deploy a virtual desktop infrastructure (VDI) solution

Answer

Provide a full VPN client and remote wipe capability

Answer

Require employees to use company-owned devices only

Question 10

A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?

Accepted Answer

Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].. Setting `runAsNonRoot: true` prevents the container from running as the root user, `readOnlyRootFilesystem: true` prevents writes to the container's root filesystem, and dropping all Linux capabilities with `drop: ['ALL']` removes all kernel privileges. Together, these three settings at the pod security context level drastically reduce the attack surface for container escape attacks by eliminating common privilege escalation vectors.

Answer

Set runAsNonRoot: false and readOnlyRootFilesystem: true.

Answer

Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].

Answer

Set privileged: true and readOnlyRootFilesystem: false.

Question 11

An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause contractually grants the organization the ability to inspect, assess, and verify a vendor's security controls, policies, and practices — either directly or via a qualified third party. This is the mechanism that provides ongoing visibility into the vendor's security posture beyond initial due diligence. Without it, the organization has no legal standing to demand evidence of security compliance during the contract term.

Answer

Non-disclosure agreement (NDA)

Answer

Service-level agreement (SLA) for uptime

Answer

Data processing agreement (DPA)

Question 12

An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?

Accepted Answer

FIPS 140-2. FIPS 140-2 (Federal Information Processing Standard Publication 140-2) is the U.S. government standard for validating cryptographic modules. It specifies security requirements for hardware and software modules that perform cryptographic functions, ensuring they have been tested and validated by an accredited laboratory. For an application processing sensitive user data, deploying a FIPS 140-2 validated module guarantees that the cryptographic implementation meets rigorous security standards.

Answer

ISO 27001

Answer

PCI DSS

Answer

NIST SP 800-53

Question 13

A security architect is designing a microservices application that uses JWTs for authentication. Which of the following is the most critical security concern regarding JWT handling?

Accepted Answer

The server not validating the JWT's 'alg' header properly. A failure to validate the JWT's 'alg' header can allow an attacker to change the algorithm to 'none' or from an asymmetric algorithm (e.g., RS256) to a symmetric one (e.g., HS256), potentially bypassing signature verification. This vulnerability, known as a JWT algorithm confusion attack, is a critical security concern because it directly undermines the integrity and authenticity of the token, which is the core security mechanism for authentication in microservices.

Answer

Token expiration not being enforced

Answer

The JWT being transmitted over HTTP instead of HTTPS

Answer

The JWT containing personally identifiable information (PII)

Question 14

A security analyst discovers that a containerized application is running with root privileges. Which of the following is the best practice to reduce the attack surface?

Accepted Answer

Run the container as a non-root user. Running a container as a non-root user directly reduces the attack surface by limiting the privileges available to an attacker if the container is compromised. Option A (minimal base image) reduces potential vulnerabilities but does not address the root privilege issue. Option B (disable network access) could break application functionality and does not affect privilege level. Option D (read-only root filesystem) prevents writing to the filesystem but still allows root-level access.

Answer

Use a minimal base image

Answer

Disable network access for the container

Answer

Use a read-only root filesystem

Question 15

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. A single, unified PIA that addresses the requirements of both GDPR and CCPA is the most efficient and consistent approach, as many of the core elements (data mapping, risk assessment, mitigation) overlap. It avoids duplication and ensures that the organization has a holistic view of privacy risks across jurisdictions. This approach is recommended by privacy professionals when regulations share common principles.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data