CAS-004 Practice Test 29 — 15 Questions

Question 1

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $50,000 and an exposure factor (EF) of 0.2. The annualized rate of occurrence (ARO) is estimated at 4. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$40,000. The ALE is calculated as SLE × ARO, where SLE (Single Loss Expectancy) = Asset Value × Exposure Factor. Here, SLE = $50,000 × 0.2 = $10,000, and ARO = 4, so ALE = $10,000 × 4 = $40,000. This represents the expected annual monetary loss from the risk.

Answer

$10,000

Answer

$50,000

Answer

$200,000

Question 2

A small business wants to protect endpoints from malware without incurring per-device licensing costs. Which approach is MOST cost-effective?

Accepted Answer

Use built-in Windows Defender and periodically scan with free tools. The most cost-effective because Windows Defender (now Microsoft Defender Antivirus) is built into modern Windows operating systems at no additional cost, providing real-time protection against malware. Supplementing it with free on-demand scanners like Microsoft Safety Scanner or Malwarebytes Free provides periodic secondary checks without per-device licensing fees, meeting the small business's requirement for endpoint protection without recurring costs.

Answer

Implement network-based IPS

Answer

Use open-source host firewall

Answer

Purchase enterprise EDR suite

Question 3

A security architect is evaluating a CSPM tool for a multi-cloud environment. Which TWO capabilities should the architect consider essential for the CSPM? (Choose two.)

Accepted Answer

Continuous compliance monitoring against frameworks like CIS. Option A (Continuous compliance monitoring against frameworks like CIS) is essential because a CSPM's core purpose is to continuously assess cloud configurations against recognized benchmarks and standards such as CIS, PCI DSS, and NIST, providing ongoing assurance across the multi-cloud estate. Option C (Configuration drift detection) is also essential since CSPM must detect when resources deviate from approved secure baselines, whether through manual changes, automation, or IaC mismatches, and alert or remediate accordingly. Option B (Vulnerability scanning of container images) belongs to container/image scanning tools (e.g., Trivy, Clair) rather than CSPM, which focuses on cloud resource configuration posture. Option D (Real-time web application firewall) is a runtime application protection control typically delivered by a WAF, not a posture management function. Option E (Data loss prevention for cloud storage) is a separate data-security capability (DLP) and, while complementary, is not a defining CSPM requirement.

Answer

Vulnerability scanning of container images

Answer

Real-time web application firewall

Answer

Data loss prevention for cloud storage

Question 4

An organization wants to implement passwordless authentication using FIDO2/WebAuthn. Which of the following best describes the primary security advantage of this approach over traditional password-based authentication?

Accepted Answer

It prevents phishing by using cryptographic keys bound to the origin. FIDO2/WebAuthn uses public-key cryptography where the private key never leaves the authenticator, and the credential is cryptographically bound to the origin (relying party ID) during registration. This origin binding means a phishing site on a different domain cannot trigger the authenticator to produce a valid assertion, because the browser enforces the RP ID match. Even if a user is tricked into visiting a lookalike site, the signature will not validate against the legitimate server's expected origin.

Answer

It eliminates the need for multi-factor authentication

Answer

It allows users to reuse the same password across services

Answer

It requires a hardware token for every login

Question 5

A security architect is designing a system that requires hardware-enforced isolation for sensitive computations. Which technology provides the strongest isolation by running code in a protected environment within the CPU?

Accepted Answer

Intel SGX. Intel SGX provides enclaves that isolate code and data even from the operating system, offering strong hardware isolation.

Answer

HSM

Answer

TPM 2.0

Answer

ARM TrustZone

Question 6

A security analyst is reviewing threat intelligence feeds and notices that a known Advanced Persistent Threat (APT) group has been using a specific technique to move laterally within networks. The analyst wants to map this technique to the MITRE ATT&CK framework. Which resource would the analyst use to find the corresponding ATT&CK technique ID?

Accepted Answer

MITRE ATT&CK Navigator or website. The MITRE ATT&CK Navigator and the official ATT&CK website are the authoritative resources for mapping adversary techniques to ATT&CK technique IDs (e.g., T1021 for Remote Services). The analyst would search the technique name or tactic (Lateral Movement) to find the corresponding ID and details.

Answer

NIST SP 800-61

Answer

STIX/TAXII feeds

Answer

CVE database

Question 7

A security architect is designing a secure connectivity solution between an on-premises data center and a public cloud provider. The solution must provide low latency, high bandwidth, and avoid traversing the public internet. Which approach BEST meets these requirements?

Accepted Answer

Direct Connect. AWS Direct Connect (and equivalent dedicated cloud interconnects) provides a private, dedicated network connection from on-premises to the cloud provider, bypassing the public internet entirely. This delivers consistent low latency, high bandwidth (up to 100 Gbps per port with link aggregation), and predictable performance that internet-based options cannot guarantee.

Answer

SSL VPN

Answer

SD-WAN over internet

Answer

Site-to-site VPN over internet

Question 8

An organization wants to implement a hardware root of trust for measuring system integrity at boot. Which technology should be used to store measurements in Platform Configuration Registers (PCRs) and support remote attestation?

Accepted Answer

TPM 2.0. TPM 2.0 provides PCRs for measured boot and supports attestation, making it suitable for hardware root of trust.

Answer

HSM

Answer

Secure Enclave

Answer

UEFI Secure Boot

Question 9

A security manager is reviewing business continuity plans. Which element is MOST critical to test regularly?

Accepted Answer

Failover capability of critical systems. The most critical element to test regularly is the failover capability of critical systems, as it directly validates that business-critical operations can continue during a disruption. This testing ensures that the entire failover process works, including system redundancy, network paths, and data synchronization. While updated contact lists (A) are important for communication, they do not test operational continuity. Alternate site readiness (C) is a component of failover testing, but testing the full failover capability is more comprehensive. Backup media integrity (D) is essential for data recovery but does not validate the entire system recovery process.

Answer

Updated contact lists

Answer

Alternate site readiness

Answer

Backup media integrity

Question 10

A security analyst is reviewing a CVSS score for a vulnerability that affects a critical server. The base score is 7.5, but the analyst needs to adjust for the environment. Which TWO of the following are valid CVSS environmental metrics that can modify the score? (Choose two.)

Accepted Answer

Modified Attack Vector (MAV). Modified Attack Vector (MAV) is a valid CVSS environmental metric because the Environmental metric group includes Modified versions of the Base exploitability metrics (MAV, MAC, MPR, MUI, MS), allowing the analyst to re-score the Attack Vector based on how the vulnerable server is actually reachable in their environment. Modified Privileges Required (MPR) is likewise a valid environmental metric, since it lets the analyst adjust the privilege level an attacker needs in their specific deployment rather than using the Base PR value. Both MAV and MPR are explicitly part of the CVSS Environmental metric group and therefore can modify the overall score. By contrast, Exploit Code Maturity (ECM) belongs to the Temporal metric group, not the Environmental group, so it is not an environmental metric. Attack Vector (AV) and Privileges Required (PR) are Base metrics, which describe the intrinsic vulnerability and cannot themselves be used to adjust for the environment.

Answer

Exploit Code Maturity (ECM)

Answer

Privileges Required (PR)

Answer

Attack Vector (AV)

Question 11

A vulnerability scanner reports a critical vulnerability on a critical server with a CVSS v3.1 base score of 9.8. The server cannot be patched immediately due to vendor constraints. Which of the following should the security team implement as a compensating control?

Accepted Answer

Isolate the server on a separate network segment with strict firewall rules. When a patch cannot be applied, compensating controls such as network segmentation, firewall rules, or WAF can reduce risk. Network isolation is a common compensating control.

Answer

Disable the server until a patch is available

Answer

Increase monitoring of the server

Answer

Apply a workaround provided by the vendor

Question 12

An organization is migrating critical workloads to the cloud and must comply with FedRAMP. Which cloud service model provides the most customer control over security configuration while still leveraging the provider's FedRAMP authorization?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives the customer control over the operating system, middleware, runtime, and applications while the provider manages the physical infrastructure, hypervisor, and network fabric. Under FedRAMP, the provider's authorization covers the underlying infrastructure, but the customer retains responsibility for configuring and securing everything above the hypervisor — offering the most security configuration control among the listed models while still leveraging the provider's FedRAMP package.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 13

During a threat modeling exercise for a new web application, the team identifies a risk of API abuse due to lack of rate limiting. Which security control should be implemented at the API gateway to mitigate this risk?

Accepted Answer

Rate limiting policies. Rate limiting policies are the direct control to mitigate API abuse by restricting the number of requests a client can make within a time window. Implemented at the API gateway, they prevent denial-of-service, brute-force, and excessive consumption of backend resources. While other controls like input validation or OAuth scopes address different threats, rate limiting specifically targets the risk of API abuse due to lack of throttling.

Answer

Input validation

Answer

OAuth 2.0 scopes

Answer

JWT token expiration

Question 14

A financial institution is adopting a new vendor-managed SaaS platform for customer data processing. The CISO wants to ensure the vendor's security controls meet regulatory requirements before data is transferred. Which of the following should be completed FIRST?

Accepted Answer

Perform a third-party risk assessment.. Before transferring sensitive customer data to a new vendor-managed SaaS platform, the CISO must first perform a third-party risk assessment to evaluate the vendor's security posture against regulatory requirements (e.g., GDPR, PCI DSS). This assessment reviews the vendor's SOC 2 reports, ISO 27001 certification, and contractual security controls, ensuring compliance before any technical testing or data transfer occurs. Without this initial risk evaluation, subsequent technical controls like penetration tests or DLP may be premature or misaligned with regulatory obligations.

Answer

Execute a penetration test on the SaaS platform.

Answer

Implement data loss prevention controls.

Answer

Conduct a vulnerability assessment of the vendor's network.

Question 15

A company is adopting a defense-in-depth strategy. Which of the following is an example of a preventive control at the network layer?

Accepted Answer

Network segmentation. Network segmentation is a preventive control because it proactively restricts lateral movement by dividing the network into isolated segments using firewalls, VLANs, or subnets. This limits an attacker's ability to move freely after compromising a host, thereby preventing the spread of an attack. It operates at the network layer (Layer 3) and enforces access control policies between segments, making it a classic example of a preventive control in a defense-in-depth strategy.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Penetration testing