CAS-004 Practice Test 28 — 15 Questions

Question 1

During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?

Accepted Answer

Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services. Using a reverse proxy for inbound traffic and preventing DMZ hosts from initiating connections to internal networks enforces a trust direction. Option A is wrong because a stateful firewall alone does not enforce directionality if rules allow outbound from DMZ. Option B is wrong because DMZ hosts should not initiate internal connections. Option D is wrong because a VPN does not prevent DMZ-to-internal traffic.

Answer

Allow only specific IPs in the DMZ to connect to internal servers

Answer

Replace the DMZ firewall with a next-generation firewall that includes IPS

Answer

Move all DMZ services to a cloud provider and use a site-to-site VPN

Question 2

A security architect is reviewing firewall rules for a new application tier. Which TWO of the following principles should be applied when designing the firewall policy? (Choose two.)

Accepted Answer

Implement stateful packet inspection. Allowing only necessary ports and protocols (B) implements least privilege, and implementing stateful packet inspection (C) enables intelligent traffic filtering. Default allow (A) is insecure, static IPs (D) are not a principle, and logging (E) is operational, not a design principle.

Answer

Log all denied traffic

Answer

Use static IP addresses for all servers

Answer

Default allow all traffic

Question 3

A security architect is designing a secure remote access solution for employees using personal devices (BYOD). The company requires that corporate data is separated from personal data and can be wiped remotely without affecting personal data. Which solution best meets these requirements?

Accepted Answer

Implement mobile device management (MDM) with containerization. Containerization using MDM profiles creates a separate, encrypted workspace for corporate apps and data, allowing selective wipe. Full VPN gives access but not separation. Full device wipe is too aggressive. VDI requires constant connectivity and may not support offline work.

Answer

Deploy a virtual desktop infrastructure (VDI) solution

Answer

Provide a full VPN client and remote wipe capability

Answer

Require employees to use company-owned devices only

Question 4

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

Accepted Answer

Use selective authentication and restrict the authorized accounts. Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint. Disabling the trust is not practical.

Answer

Remove the trust entirely and use individual local accounts

Answer

Configure the trust to use forest-wide authentication instead of selective

Answer

Enable SID filtering on both forest trusts

Question 5

A company is designing a new multi-tier web application. The security team recommends placing a web application firewall (WAF) in front of the web servers and a network firewall between the web and application tiers. Which security architecture principle does this represent?

Accepted Answer

Defense in depth. Defense in depth (layered security) uses multiple controls to protect assets. Option A is wrong because it is not just a single control. Option B is wrong because separation of duties is about dividing responsibilities. Option D is wrong because least privilege limits access rights.

Answer

Separation of duties

Answer

Least privilege

Answer

Single point of failure

Question 6

A company is implementing a zero-trust network architecture. Which of the following components is essential for enforcing micro-segmentation?

Accepted Answer

Software-defined networking (SDN) with distributed firewalls. Micro-segmentation divides the network into small zones, each with its own security controls. Software-defined networking (SDN) enables dynamic policy enforcement at the hypervisor level. Option A is wrong because NAC controls access but not segmentation. Option B is wrong because MFA is an authentication mechanism. Option D is wrong because a SIEM correlates logs but does not enforce policies.

Answer

Security information and event management (SIEM) system

Answer

Multi-factor authentication (MFA)

Answer

Network access control (NAC)

Question 7

A company is designing a hybrid cloud architecture with AWS and an on-premises data center. They need to ensure that all data transmitted between environments is encrypted and that the connection is resilient. Which design should the architect choose?

Accepted Answer

Establish multiple redundant IPsec VPN tunnels to the VPC. A VPN tunnel using IPsec with IKEv2 provides encryption and authentication; redundant tunnels ensure failover. Direct Connect is private but often requires separate encryption. SSL tunnel would work but typically for web traffic. MPLS is a carrier service, not inherently encrypted.

Answer

Deploy a single MPLS connection with network-based encryption

Answer

Set up a single AWS Direct Connect connection and rely on the provider's encryption

Answer

Use an SSL VPN tunnel from the on-premises firewall to the VPC

Question 8

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Accepted Answer

Implement just-in-time (JIT) temporary privilege elevation. Time-limited accounts enforce temporary access, application-level VPNs restrict access to specific applications, and just-in-time (JIT) privileges reduce standing access. Full VPN access provides too much network access, shared accounts lack accountability, and permanent accounts are against least privilege.

Answer

Allow contractors to use a shared account for simplicity

Answer

Provide full network-level VPN access

Question 9

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. Implementing VLANs with access control lists (ACLs) to restrict communication between segments provides logical isolation without requiring new hardware. Air gaps are impractical. DMZ for all systems is not appropriate. Full 1:1 VLAN per device is unmanageable.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 10

An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?

Accepted Answer

Deploy a forward proxy with SSL/TLS inspection. An SSL/TLS inspection proxy can decrypt outbound traffic for inspection, allowing detection of malicious content while still allowing legitimate HTTPS. Option A is wrong because blocking all outbound 443 breaks functionality. Option B is wrong because increasing logging does not detect encrypted content. Option D is wrong because IDS cannot inspect encrypted traffic without decryption.

Answer

Block outbound TCP 443 and require users to use a VPN

Answer

Enable logging on the firewall for all outbound 443 traffic

Answer

Install a network-based IDS on the internal side of the firewall

Question 11

An organization uses a multi-cloud strategy with workloads in AWS and Azure. The security architect needs to implement a single identity provider for all cloud resources while maintaining on-premises Active Directory as the authoritative source. Which architecture minimizes latency and complexity?

Accepted Answer

Federate on-premises AD directly with both AWS and Azure using ADFS. Using Azure AD Connect for Azure and AWS SSO with SAML federation from on-premises AD centralizes identity without synchronizing to two clouds separately. Direct federation from on-prem to each cloud is acceptable but using separate identity sources increases complexity. A third-party IdP could work but adds cost.

Answer

Use a third-party cloud-based identity provider and sync AD to it

Answer

Synchronize AD to Azure AD and then use Azure AD as an identity source for AWS via SAML

Answer

Create separate identity stores in AWS and Azure and sync from AD

Question 12

A security architect finds this IAM policy attached to an S3 bucket. Which of the following best describes a critical security flaw in this policy?

Accepted Answer

The second statement allows public access from the 10.0.0.0/8 IP range. The second statement uses "Principal": "*" which allows any user or service to access the bucket if they meet the IP condition. Since "Effect": "Allow", it grants public access from the specified IP range. This is a major risk because the bucket is named "my-sensitive-bucket" and the IP range 10.0.0.0/8 is an internal private range that could be spoofed or used by anyone on that network. The first statement is fine for EC2 assume role. The flaw is that the policy allows anonymous access from a broad private IP range.

Answer

The condition on the second statement uses StringEquals instead of IpAddress

Answer

The first statement allows EC2 to assume any role in the account

Answer

The policy should use a NotPrincipal element to restrict access

Question 13

When evaluating the security architecture of a containerized application, which THREE of the following practices should be implemented to minimize the attack surface? (Select THREE.)

Accepted Answer

Use minimal base images (e.g., Alpine Linux) instead of full OS images. Using minimal base images reduces vulnerabilities; read-only file system prevents malware persistence; dropping unnecessary capabilities limits kernel attack surface. Option B is not about attack surface reduction; it's about data protection. Option C is about authentication, not attack surface.

Answer

Encrypt sensitive data at rest within the container

Answer

Implement multi-factor authentication for container registries

Question 14

A security architect is designing a secure wireless network for a government facility. Which TWO of the following measures should be implemented to ensure the highest level of security? (Select TWO.)

Accepted Answer

Disable SSID broadcast on the access points. WPA3-Enterprise with EAP-TLS is the most secure for authentication and encryption, and disabling SSID broadcast hides the network from casual scanning, though it is not a strong security measure. MAC filtering is easily spoofed. WPA2-PSK is less secure. Captive portals do not provide strong access control.

Answer

Use WPA2-PSK with a strong pre-shared key

Answer

Implement a captive portal with social login

Answer

Enable MAC address filtering on the access points

Question 15

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management allows external identity providers (e.g., social media) to be used, while the enterprise retains policy control through a federation server. Option A is wrong because it refers to non-repudiation. Option B is wrong because it describes SSO without federation. Option D is wrong because it describes credential management.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures