CAS-004 Practice Test 28 — 15 Questions

Question 1

Which TWO of the following are essential elements of an effective data governance framework?

Accepted Answer

Data classification policies and procedures. Data classification policies and procedures (A) are essential because they define how data is categorized by sensitivity and value, which drives the controls, handling rules, and access decisions that the rest of the governance framework depends on. Assignment of data stewardship roles (C) is equally essential because governance requires clearly designated owners and stewards who are accountable for data quality, protection, and lifecycle management across business and IT domains. Together, classification and stewardship form the core of an effective framework by establishing both what must be protected and who is responsible for it. The other options do not belong: mandatory data localization (B) is a jurisdiction-specific regulatory constraint rather than a universal governance element, an automated breach notification system (D) is an incident-response control, and full-disk encryption on all endpoints (E) is a technical safeguard rather than a governance essential.

Answer

Mandatory data localization requirements

Answer

Automated breach notification system

Answer

Implementation of full-disk encryption on all endpoints

Question 2

An organization wants to share threat intelligence with industry peers using a standardized format. Which of the following formats is specifically designed for representing structured threat information in a machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence.

Answer

CyboX

Answer

TAXII

Answer

OpenIOC

Question 3

A company is deploying IoT sensors that require secure firmware updates over the air (OTA). To ensure integrity and authenticity of the firmware, which of the following should be implemented?

Accepted Answer

Code signing with a trusted certificate. Code signing with a trusted certificate provides both integrity and authenticity: the firmware is hashed and signed by the vendor's private key, and the device verifies the signature using the vendor's public key. This ensures the firmware has not been tampered with and originates from a trusted source. Hash verification alone only checks integrity, not authenticity.

Answer

Secure boot on the device

Answer

Hash verification only

Answer

Encryption of the firmware image

Question 4

During a ransomware incident, the organization discovers that all production backups have been encrypted by the attacker. What is the most effective recovery approach?

Accepted Answer

Restore from offline immutable backups. Restoring from offline immutable backups is the most effective recovery approach when production backups have been encrypted by ransomware. Immutable backups cannot be altered or deleted, even by an attacker with administrative credentials, ensuring that a clean copy of data is available for restoration. This approach minimizes downtime and avoids paying the ransom.

Answer

Restore from system restore points

Answer

Use a decryption tool from security vendors

Answer

Pay the ransom to obtain the decryption key

Question 5

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

Accepted Answer

Hardware Security Module (HSM). A Hardware Security Module (HSM) is a dedicated tamper-resistant appliance that generates, stores, and uses cryptographic keys without exposing them, performing operations like signing and encryption inside the hardware boundary. It is the standard component for protecting private keys in an enterprise PKI. HSMs provide FIPS 140-2/3 validated protection and resist physical and logical extraction attempts.

Answer

Certificate Revocation List (CRL)

Answer

Key Management Service (KMS)

Answer

Certificate Authority (CA)

Question 6

A security architect is designing a data classification scheme. Which of the following is the MOST effective way to ensure consistent labeling across the organization?

Accepted Answer

Automated classification based on data content.. Automated classification based on data content is the most effective method for ensuring consistent labeling across an organization because it removes human error and subjectivity. By using content inspection, pattern matching, and metadata analysis, the system can apply labels uniformly based on predefined rules, such as detecting credit card numbers (PCI-DSS) or personally identifiable information (PII). This approach enforces policy without relying on individual user judgment, which is critical for large-scale compliance.

Answer

Implementing DLP solutions.

Answer

Manual labeling by data owners.

Answer

User training and awareness.

Question 7

A threat hunter wants to identify potential lateral movement within the network. Which data source is LEAST useful for this purpose?

Accepted Answer

DNS query logs. DNS query logs are the least useful data source for identifying lateral movement because they primarily reveal domain name resolution activity, which may indicate command-and-control or data exfiltration but do not directly show authentication or file-share access between internal hosts. Lateral movement is best detected through authentication events (Event ID 4624), explicit credential use (Event ID 4648), and file share access (Event ID 5140).

Answer

Windows Event ID 4624 (Logon) from domain controllers

Answer

Windows Event ID 4648 (Logon with explicit credentials)

Answer

Windows Event ID 5140 (File share accessed)

Question 8

Refer to the exhibit. This clause is a requirement of which of the following?

Accepted Answer

GDPR Article 32.. The clause in the exhibit mandates a data processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization and encryption of personal data. This is a direct requirement of GDPR Article 32, which specifically addresses the security of processing personal data and is distinct from sector-specific or framework-based standards.

Answer

PCI DSS.

Answer

ISO 27001.

Answer

HIPAA Security Rule.

Question 9

Which TWO of the following are considered secure design principles for cryptographic systems?

Accepted Answer

Use well-vetted, standard cryptographic algorithms. Option C is correct because secure cryptographic design requires using well-vetted, standard algorithms such as AES, RSA, or SHA-256, which have undergone extensive public scrutiny and peer review, ensuring their resistance to known attacks. Option E is correct because cryptographic keys must be generated using a cryptographically secure random number generator (CSPRNG), such as /dev/urandom or a hardware security module, to ensure sufficient entropy and unpredictability, preventing attackers from guessing or reproducing keys. Option A is incorrect because custom, in-house encryption algorithms are not peer-reviewed and often contain subtle vulnerabilities, violating the principle of using proven standards. Option B is incorrect because reusing the same key for both encryption and authentication is cryptographically unsafe, as it can enable cross-protocol attacks and key-recovery attacks; secure systems use separate keys for distinct purposes. Option D is incorrect because relying on algorithm secrecy (security through obscurity) is a flawed principle; secure systems should remain secure even if the algorithm is publicly known, with security resting on the secrecy of the key.

Answer

Implement custom encryption algorithms designed in-house

Answer

Use the same key for encryption and authentication to reduce complexity

Answer

Rely on secrecy of the algorithm for security

Question 10

An organization uses Kubernetes to orchestrate containers. Which practice enhances the security of pod-to-pod communication?

Accepted Answer

Implement network policies that restrict ingress and egress traffic based on labels.. Network policies in Kubernetes act as a firewall for pods, allowing you to define ingress and egress rules based on labels, namespaces, or IP blocks. By default, all pod-to-pod traffic is allowed; implementing network policies restricts this traffic to only what is explicitly permitted, thereby enhancing security by enforcing the principle of least privilege.

Answer

Expose all pods via NodePort services.

Answer

Use ClusterIP services for all internal traffic.

Answer

Rely on the default Kubernetes network configuration.

Question 11

During a vendor risk assessment, a third-party vendor refuses to provide a SOC 2 report but offers a completed security questionnaire. The vendor handles sensitive customer data. Which of the following is the BEST course of action?

Accepted Answer

Require a right-to-audit clause to conduct an on-site assessment.. When a vendor handling sensitive customer data refuses to provide a SOC 2 report, the best course is to require a right-to-audit clause in the contract and conduct an on-site assessment. This gives the organization direct assurance over the vendor's controls without relying solely on self-attested questionnaires, which are not independent evidence.

Answer

Immediately terminate the relationship.

Answer

Lower the data classification to reduce risk.

Answer

Accept the questionnaire as sufficient evidence.

Question 12

A security architect is designing an API security strategy for a microservices-based application. The architect needs to ensure that only authenticated and authorized clients can invoke APIs, and that rate limiting is enforced to prevent abuse. Which technology should be placed in front of the microservices?

Accepted Answer

API Gateway. An API Gateway is designed to handle authentication, authorization, rate limiting, and other cross-cutting concerns for APIs in a microservices architecture. It acts as a single entry point for all API calls, enforcing security policies before requests reach the microservices. This centralizes API security and simplifies management.

Answer

Web Application Firewall (WAF)

Answer

Reverse proxy

Answer

Load balancer

Question 13

A company is adopting container security best practices. Which TWO actions should be implemented to reduce the attack surface of container images? (Select TWO.)

Accepted Answer

Set the container filesystem as read-only where possible.. Option A is correct because mounting the container filesystem as read-only (e.g., via the Docker `--read-only` flag or Kubernetes `securityContext.readOnlyRootFilesystem: true`) prevents an attacker who compromises the container from writing malicious files, modifying binaries, or persisting malware, thereby shrinking the writable attack surface. Option B is correct because using signed images and verifying signatures before deployment (e.g., with Docker Content Trust, Notary, or Sigstore/Cosign) ensures image integrity and provenance, blocking tampered or untrusted images from entering the environment and thus reducing supply-chain attack surface. Option C is wrong because disabling vulnerability scanning removes a key control for detecting known CVEs in image layers, increasing rather than reducing risk. Option D is wrong because storing secrets in environment variables exposes them via process listings, `docker inspect`, and logs; secrets should instead be mounted from a secrets manager or vault. Option E is wrong because running containers as root violates least privilege and expands the impact of a compromise; containers should run as a non-root user.

Answer

Disable vulnerability scanning to optimize build time.

Answer

Store secrets in environment variables.

Answer

Run containers with the root user to simplify permissions.

Question 14

A security administrator is reviewing the configuration of a wireless network that uses WPA3-Enterprise. The administrator wants to ensure that the authentication mechanism provides mutual authentication and supports centralized policy enforcement. Which of the following should be used?

Accepted Answer

802.1X with EAP-TLS. EAP-TLS is the strongest EAP method for WPA3-Enterprise because it uses certificates for both client and server, enabling mutual authentication and centralized policy enforcement through RADIUS. The other methods either do not provide mutual certificate-based authentication, are designed for personal networks, or do not meet WPA3-Enterprise standards.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2

Answer

WPA3-Personal with SAE

Answer

802.1X with EAP-TTLS/PAP

Question 15

A security analyst is using the MITRE ATT&CK framework to categorize adversary behavior observed in recent incidents. The analyst notes that the adversary used spearphishing with a malicious attachment to gain initial access, then executed a PowerShell script to download additional tools. Which ATT&CK tactic is the PowerShell execution associated with?

Accepted Answer

Execution. In MITRE ATT&CK, Execution (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including T1059 Command and Scripting Interpreter. PowerShell is explicitly documented under T1059.001, so running a PowerShell script to download tools is classified as Execution. Initial Access describes how the adversary got in (the spearphishing), not what they ran afterward.

Answer

Defense Evasion

Answer

Initial Access

Answer

Command and Control