CAS-004 Practice Test 27 — 15 Questions

Question 1

A security architect reviews the iptables firewall rules above. A new web server with IP 192.168.1.100 must be reachable from the internet on ports 80 and 443. Which of the following changes is necessary to allow inbound HTTPS while maintaining security?

Accepted Answer

Change rule 3 source to 0.0.0.0/0 and restrict rule 2 to a management subnet. The current rule 3 only allows HTTPS from the 192.168.1.0/24 subnet. To allow from the internet, the source must be changed to 0.0.0.0/0. However, the existing SSH rule (rule 2) already allows from any source, which is a risk. The correct action is to change rule 3's source to 0.0.0.0/0 and also restrict rule 2 to management subnet. Option A is correct. Adding a new rule would work but leave rule 3 misconfigured.

Answer

Delete rule 3 and add a rule: ACCEPT tcp from any to 192.168.1.100 dpt 80,443

Answer

Change default INPUT policy to ACCEPT and rely on application security

Answer

Add a new rule before rule 5: ACCEPT tcp from any to 192.168.1.100 dpt 443

Question 2

A security architect is designing a secure enclave for processing classified data. Which TWO of the following controls are essential for ensuring data confidentiality in such an enclave? (Select TWO.)

Accepted Answer

Data diodes for one-way data transfer from the enclave to external networks. Full-disk encryption protects data at rest if a device is lost; data diodes ensure one-way data flow, preventing exfiltration. Option B is misleading because air gaps are common but not a 'control' per se; the question asks for controls. Option D is not essential as SCAP is for compliance assessment. Option E is about availability, not confidentiality.

Answer

Physical air gap between the enclave and other networks

Answer

Security Content Automation Protocol (SCAP) vulnerability scanning

Answer

Redundant power supplies and cooling

Question 3

An architect is designing a multi-factor authentication (MFA) solution for remote access. Which of the following is the STRONGEST form of second factor?

Accepted Answer

FIDO2 WebAuthn hardware token. FIDO2 WebAuthn hardware tokens are phishing-resistant and provide strong cryptographic authentication. SMS codes, email OTPs, and knowledge-based questions are vulnerable to phishing or interception.

Answer

Email OTP

Answer

SMS one-time code

Answer

Knowledge-based questions

Question 4

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

Accepted Answer

In the DMZ. A reverse proxy should be placed in the DMZ to handle external requests and provide an additional layer of security by buffering the internal web servers. Placing it inside the internal network, database tier, or management network would defeat its purpose.

Answer

In the management network

Answer

In the database tier

Answer

Inside the internal network

Question 5

A small business is designing a defense-in-depth strategy for its e-commerce website. The web server is hosted in a cloud provider and handles credit card transactions. Which of the following additional controls best complements the existing firewall and IDS?

Accepted Answer

Implement a web application firewall (WAF). A web application firewall (WAF) adds a layer of protection against application-layer attacks, which complements the network-layer firewall and IDS. Antivirus is for endpoints, SIEM provides logging but not proactive defense, and load balancers distribute traffic but do not add security controls beyond resilience.

Answer

Set up a security information and event management (SIEM) system

Answer

Add a load balancer with SSL termination

Answer

Deploy a network-based antivirus on the web server

Question 6

A security architect reviews this Cisco router ACL configuration. The web server at 192.168.1.100 is accessible from the internet. What additional security measure should be implemented to protect the internal network (10.0.0.0/24)?

Accepted Answer

Replace the ACLs with a stateful firewall that inspects connection states. The INSIDE_OUT ACL allows all traffic from the internal network to any destination, including potentially malicious outbound connections. Implementing a stateful firewall would track connection states and provide better inspection. Egress filtering could be added, but stateful inspection is more comprehensive. The OUTSIDE_IN ACL only allows inbound web traffic, which is good. The missing piece is stateful awareness to prevent internal hosts from initiating connections to malicious external hosts.

Answer

Remove the log statement from the deny rules to improve performance

Answer

Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web ports only

Answer

Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound

Question 7

A company is implementing a software-defined perimeter (SDP) architecture. Which TWO of the following are key characteristics of SDP? (Select TWO.)

Accepted Answer

The infrastructure is invisible to unauthorized users. SDP hides infrastructure from unauthorized users and enforces device authentication before granting access. Option A is wrong because SDP does not inherently use public keys; it can use various authentication methods. Option D is wrong because SDP uses a controller, not peering. Option E is wrong because SDP is not based on VLANs.

Answer

Network segmentation is implemented via VLANs

Answer

Peering between SDP components is done via BGP

Answer

All communications are encrypted using public key cryptography

Question 8

A company is implementing a microservices architecture and needs to ensure secure service-to-service communication. Which of the following BEST describes the recommended approach?

Accepted Answer

Mutual TLS (mTLS) with certificate authentication. Mutual TLS (mTLS) provides mutual authentication and encryption, making it the most secure and scalable option for microservices. Shared API keys are less secure, IP whitelisting is not scalable, and basic HTTP authentication lacks encryption.

Answer

Basic HTTP authentication

Answer

IP whitelisting

Answer

Shared API keys

Question 9

Refer to the exhibit. A security analyst notices that traffic from external clients to the web server at 10.0.0.10 port 80 is being blocked. Which of the following is the MOST likely cause?

Accepted Answer

The ACL is misordered (deny before permit). The ACL is processed top-down. The 'deny ip any any' rule matches all traffic before the permit rule, so all traffic is blocked. Misordering is the cause. The web server using HTTPS (443) is possible but not indicated, and the destination IP appears correct. Lack of logging is not the cause.

Answer

The ACL lacks a log statement

Answer

The web server is using port 443

Answer

The destination IP is incorrect

Question 10

During a merger, two companies need to integrate their networks securely. Company A uses RFC 1918 addresses (10.0.0.0/8) and Company B also uses 10.0.0.0/8. Which architectural solution prevents routing conflicts and maintains security?

Accepted Answer

Deploy network address translation (NAT) on the border routers to translate one company's addresses to a unique range. NAT at the boundary translates overlapping addresses, allowing communication without conflict. Option A is wrong because it disrupts routing. Option B is wrong without NAT, traffic may not route correctly. Option D is wrong as it does not address IP overlap.

Answer

Configure a site-to-site VPN with no address translation

Answer

Enable direct BGP peering between the two networks

Answer

Implement a firewall between the networks and allow all traffic

Question 11

A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?

Accepted Answer

Encrypt the data at rest and in transit, and implement IAM policies. Encrypting the data at rest and in transit, combined with strict access controls, protects data in both environments. A VPN secures transit but does not address at-rest encryption. Relying on the cloud provider's default security may not suffice. Disabling encryption during migration increases exposure.

Answer

Leverage the cloud provider's default security groups and disable encryption

Answer

Migrate the ERP without changes and apply encryption after migration

Answer

Use a VPN to connect on-premises and cloud while keeping data unencrypted

Question 12

A security architect is evaluating a new SIEM solution for a large enterprise. Which THREE of the following capabilities are CRITICAL for effective threat detection and response? (Choose three.)

Accepted Answer

Real-time correlation of events from multiple sources. Real-time event correlation (A), UEBA (B), and threat intelligence integration (D) are core SIEM capabilities. Automated patch management (C) and scheduled vulnerability scanning (E) are typically separate tools, not built into SIEM.

Answer

Scheduled vulnerability scanning

Answer

Automated patch management

Question 13

A security architect is designing a network segmentation strategy for a data center to reduce the attack surface. Which TWO of the following are best practices for implementing effective network segmentation?

Accepted Answer

Use VLANs to logically isolate traffic between different security zones.. Option A (Use VLANs for isolation) is correct because VLANs provide logical separation at Layer 2. Option B (Implement microsegmentation with firewalls) is correct because microsegmentation uses granular firewall rules to isolate workloads. Option C is incorrect because a shared DMZ for all external services increases risk. Option D is incorrect because NAC focuses on device authentication, not segmentation. Option E is incorrect because any-to-any traffic defeats segmentation.

Answer

Deploy network access control (NAC) to authenticate devices before granting network access.

Answer

Place all external-facing services in a single shared DMZ segment.

Answer

Allow any-to-any communication within each security zone to avoid performance bottlenecks.

Question 14

A security architect is evaluating a hardware security module (HSM) for key management. Which of the following is a PRIMARY benefit of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant physical protection of keys. HSMs provide tamper-resistant physical protection for cryptographic keys, which is their primary advantage. They are typically more expensive, and key rotation may be more complex. Cloud integration is possible but not a primary benefit.

Answer

Easier key rotation

Answer

Integration with cloud APIs

Answer

Lower cost

Question 15

A company is adopting a DevOps model and wants to integrate security into CI/CD pipelines. Which of the following is the MOST effective approach?

Accepted Answer

Automated security scanning in the pipeline with fail-fast. Automated security scanning with fail-fast ensures that vulnerabilities are caught early in the pipeline, aligning with DevOps speed. Manual reviews, annual scans, and post-deployment testing are too slow or reactive.

Answer

Annual vulnerability scans

Answer

Post-deployment security testing

Answer

Manual security reviews before each release

CAS-004 Practice Test 27 — 15 Questions

Exhibit

CAS-004 Practice Test 27 — 15 Questions

Exhibit