CAS-004 Practice Test 29 — 15 Questions

Question 1

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings or seals and identity-based authentication, along with physical security. Tamper resistance with zeroization is more Level 4. Role-based authentication is Level 3 but identity-based is more specific. Plaintext key export is disallowed at Level 3.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 2

A security architect at a financial institution is designing a cloud-native application using AWS. The application processes sensitive customer data and must comply with PCI DSS. Which of the following security architecture decisions best supports both compliance and operational efficiency?

Accepted Answer

Implement a cloud access security broker (CASB) and use customer-managed encryption keys (CMKs) for data at rest. Using a CASB provides visibility and control over cloud traffic, and encryption with customer-managed keys satisfies PCI DSS requirements. Option A is wrong because ignoring cloud risks is not acceptable. Option B is wrong because a cloud-based WAF is not specifically for data protection compliance. Option D is wrong because VPC endpoints reduce exposure but do not address data protection requirements directly.

Answer

Place all application resources in a VPC with no internet gateway and use VPC endpoints for AWS services

Answer

Use a cloud-based web application firewall (WAF) and enable logging for all API calls

Answer

Deploy the application on a single tenant dedicated instance and rely on the cloud provider's compliance certifications

Question 3

A multinational corporation is deploying a new application that will be accessed by employees, partners, and customers. The security architecture must support single sign-on (SSO) across different identity providers (IdPs) while maintaining strict access control based on user attributes such as role, location, and device posture. The company uses Active Directory for employees, a cloud IdP for partners, and self-registration for customers. The architect needs to design a centralized policy enforcement point that can evaluate access requests from multiple IdPs and enforce dynamic access policies before granting access to the application.

Which of the following is the BEST architectural approach?

Accepted Answer

Implement an externalized authorization management system (e.g., OAuth 2.0 with OpenID Connect) using a policy decision point (PDP) and a policy enforcement point (PEP) at the application gateway. A Policy Enforcement Point (PEP) integrated with a Policy Decision Point (PDP) can abstract authentication from authorization, allowing unified policy regardless of IdP. Option A is wrong because relying on each IdP for authorization leads to policy fragmentation. Option B is wrong because a SAML federation server handles authentication but not authorization. Option D is wrong because a proxy alone does not provide the policy decision capabilities.

Answer

Deploy a SAML/WS-Federation federation server that authenticates users and then passes the identity to the application for authorization

Answer

Have each IdP enforce its own access policies and pass the authorization decision via SAML assertions

Answer

Configure a reverse proxy to authenticate users from any IdP and pass their identity to the application

Question 4

A financial institution needs to ensure that transaction logs are tamper-proof after creation. Which solution should be implemented?

Accepted Answer

Cryptographic hashing with chain hashing. Cryptographic chained hashing (e.g., blockchain) links each log entry to the previous one via a hash, making tampering detectable. Encryption does not protect integrity. ACLs can be bypassed. Digital signatures are effective but more complex to manage for every entry.

Answer

Access control lists

Answer

Encryption with AES

Answer

Digital signatures on each log entry

Question 5

A company wants to ensure that only authorized code runs on its point-of-sale (POS) terminals. Which technology should be implemented?

Accepted Answer

Code signing. Code signing ensures that executables are digitally signed by a trusted publisher, and the system verifies the signature before execution. TPM is for attestation, application whitelisting is a policy, and secure boot focuses on boot-time integrity.

Answer

Application whitelisting

Answer

Trusted Platform Module (TPM)

Answer

Secure Boot

Question 6

Which of the following is the primary purpose of implementing a public key infrastructure (PKI)?

Accepted Answer

To bind public keys to identities through certificates for authentication and encryption.. Option A is correct because PKI provides certificate-based trust to enable authentication and encryption. Option B is wrong because VPNs use PKI but that's not the primary purpose. Option C is wrong because PKI can help with code signing but it's a subset. Option D is wrong because password hashing is separate from PKI.

Answer

To store and verify password hashes for user authentication.

Answer

To sign software and files to verify integrity and origin.

Answer

To provide a secure method for remote access via VPN.

Question 7

The security engineer notices that SSH login attempts to 192.168.1.1 from the untrust zone are being blocked. Which policy misconfiguration is MOST likely causing this?

Accepted Answer

The source zone is not permitted. The Remote-Admin policy only permits traffic from the vpn zone, not untrust. Therefore, SSH attempts from untrust are implicitly denied by the firewall's default deny policy. The destination address and application are correctly specified. The log setting does not affect access. A policy for SSH from untrust is missing.

Answer

The application is incorrect

Answer

The log setting prevents connections

Answer

The destination address is incorrect

Question 8

A company is deploying IoT sensors in a remote area with limited connectivity. The sensors must be able to securely transmit data using minimal bandwidth. Which protocol should the engineer choose?

Accepted Answer

MQTT with TLS. MQTT with TLS is a lightweight publish-subscribe protocol that uses minimal bandwidth and provides security through TLS. HTTPS has higher overhead. SSH is not designed for many-to-one telemetry. SNMPv3 is for network management, not general IoT data.

Answer

SNMPv3

Answer

HTTPS

Answer

SSH

Question 9

An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?

Accepted Answer

FIPS 140-2. FIPS 140-2 (or its successor 140-3) is the U.S. government standard for validating cryptographic modules. NIST SP 800-53 is for security controls, PCI DSS for payment card data, and ISO 27001 for management systems.

Answer

ISO 27001

Answer

PCI DSS

Answer

NIST SP 800-53

Question 10

An organization wants to implement a zero-trust architecture for remote access. Which of the following is the MOST important component?

Accepted Answer

Micro-segmentation. Micro-segmentation is fundamental to zero-trust because it restricts lateral movement by dividing the network into small, isolated segments. VPN concentrators are traditional perimeter controls. RAID 5 is storage redundancy. Syslog is logging.

Answer

RAID 5

Answer

Syslog server

Answer

VPN concentrator

Question 11

A small business wants to protect endpoints from malware without incurring per-device licensing costs. Which approach is MOST cost-effective?

Accepted Answer

Use built-in Windows Defender and periodically scan with free tools. Built-in Windows Defender is free and adequate for basic protection. Periodically scanning with free tools (e.g., Microsoft Safety Scanner) enhances security at no cost. Enterprise EDR, network IPS, and host firewalls (some free) but enterprise products incur costs.

Answer

Implement network-based IPS

Answer

Use open-source host firewall

Answer

Purchase enterprise EDR suite

Question 12

During a security incident, a forensic analyst needs to acquire a memory dump from a Linux server without altering the system state. Which tool is most appropriate for this task?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is designed to acquire memory dumps with minimal impact, loading as a kernel module and exporting memory to a file or network. dd is for disk, memdump is limited, and Volatility is for analysis, not acquisition.

Answer

Volatility framework

Answer

dd if=/dev/mem of=mem.dump

Answer

memdump utility

Question 13

During a penetration test, an engineer discovers that the application uses client-side JavaScript to validate input before submission. What is the MOST significant vulnerability?

Accepted Answer

Server-side validation is missing. Client-side validation can be easily bypassed by disabling JavaScript or sending crafted HTTP requests. Without server-side validation, attackers can submit malicious payloads, leading to injection attacks. XSS and IDOR are separate issues; weak session management is unrelated to input validation.

Answer

Cross-site scripting

Answer

Insecure direct object reference

Answer

Weak session management

Question 14

A security engineer is evaluating options for securing firmware updates on IoT devices. Which TWO methods provide integrity verification of the update?

Accepted Answer

Hash-based message authentication code (HMAC). Correct: Digital signature verification and HMAC. Digital signatures use asymmetric cryptography to ensure authenticity and integrity. HMAC uses a shared secret to verify integrity. AES encryption alone does not provide integrity, obfuscation is not security, and secure boot is about boot-time integrity, not update verification.

Answer

Obfuscation of the firmware code

Answer

AES encryption of the firmware

Answer

Secure Boot

Question 15

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX provides hardware-based memory encryption that isolates code and data in enclaves, protecting data in use from other processes. TPM is for attestation and key storage, HSM for dedicated cryptographic operations, and Secure Boot for boot integrity.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)