CAS-004 Practice Test 3 — 10 Questions

Question 1

An organization is implementing a Secure Access Service Edge (SASE) architecture to support remote workers. Which key capability does SASE provide that traditional VPNs lack?

Accepted Answer

Identity-based access with zero trust principles. SASE convergences network and security functions and includes identity-based access, allowing granular policy enforcement based on user identity, device posture, and context. Traditional VPNs typically provide network-layer access without identity-driven security policies. SD-WAN is a component of SASE, not a unique capability. Web filtering is available separately. DLP is also available separately.

Answer

Software-defined WAN (SD-WAN) functionality

Answer

Network-layer encryption using IPsec

Answer

Web content filtering and DLP

Question 2

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

Accepted Answer

Use parameterized queries or input sanitization for any user-supplied data. Input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.

Answer

Hardcode API keys into the script for simplicity

Answer

Run the script with root privileges to ensure it has access to all images

Answer

Store credentials in a world-readable configuration file

Question 3

A security assessor is evaluating an application that uses ChaCha20-Poly1305 for encryption. Which TWO of the following are true about this cryptographic algorithm?

Accepted Answer

It is a stream cipher. ChaCha20-Poly1305 is a stream cipher (ChaCha20) combined with a MAC (Poly1305). It is an AEAD cipher. It is not a block cipher, and it does not require padding.

Answer

It is based on the AES algorithm

Answer

It requires padding to achieve correct block sizes

Answer

It is a block cipher

Question 4

A company is designing a new data center with high availability requirements. The network team proposes using virtualized network functions (VNFs) on commodity hardware to reduce costs. Which security consideration is MOST important when implementing this design?

Accepted Answer

Isolate VNFs to prevent lateral movement if one VNF is compromised. Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Answer

Ensure VNFs are deployed across multiple physical hosts for redundancy

Answer

Encrypt all traffic between VNFs to prevent eavesdropping

Answer

Implement quality of service (QoS) to guarantee bandwidth for critical VNFs

Question 5

A company is deploying a cloud access security broker (CASB) to gain visibility into shadow IT. Which mode of operation would allow the CASB to inspect traffic without requiring proxy configuration on endpoints?

Accepted Answer

API-based mode. API-based mode uses cloud provider APIs to access logs and metadata, providing visibility without inline traffic interception or endpoint changes.

Answer

Reverse proxy mode

Answer

Inline mode

Answer

Forward proxy mode

Question 6

A security architect is selecting a cipher suite for TLS 1.3 to ensure forward secrecy and high performance. Which cipher suite should be recommended?

Accepted Answer

TLS_AES_256_GCM_SHA384. TLS 1.3 requires forward secrecy and uses AEAD ciphers. AES-256-GCM is a recommended AEAD cipher with strong security and performance.

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Answer

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Question 7

A security analyst is reviewing TLS 1.3 configuration for a web server. The analyst wants to ensure that the configuration provides forward secrecy and prevents the reuse of session keys. Which of the following is a characteristic of TLS 1.3 that supports these goals?

Accepted Answer

Use of ephemeral Diffie-Hellman key exchange. TLS 1.3 mandates ephemeral Diffie-Hellman key exchange (ECDHE or DHE), which provides forward secrecy by generating unique session keys for each session.

Answer

0-RTT session resumption

Answer

Support for static RSA key exchange

Answer

Removal of CBC mode cipher suites

Question 8

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management using SAML enables users to authenticate via external identity providers (e.g., social media platforms) while the corporate system retains control over access policies through the exchange of SAML assertions. This architecture decouples authentication from authorization, allowing the corporate service provider to enforce its own rules based on trusted identity claims.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures

Question 9

A penetration tester is in the post-exploitation phase and wants to maintain access to a compromised system. Which of the following techniques is most effective for establishing persistent access while evading detection?

Accepted Answer

Creating a scheduled task that executes a reverse shell. Creating a scheduled task that executes a backdoor is a common persistence mechanism. It can be disguised and runs at system startup or on a schedule, making it harder to detect.

Answer

Uploading a web shell to a publicly accessible directory

Answer

Creating a new local user account with administrative privileges

Answer

Installing a rogue certificate authority

Question 10

An organization wants to detect and respond to advanced threats that may evade traditional endpoint security solutions. They deploy an EDR solution that provides real-time visibility into endpoint activities. However, the security team is overwhelmed by alerts. Which technology can be integrated with EDR to automate response actions and reduce alert fatigue?

Accepted Answer

SOAR platform. SOAR platforms ingest alerts from various sources (including EDR) and use playbooks to automate incident response actions, such as isolating a host or blocking an IP. This reduces manual effort and alert fatigue.

Answer

SIEM with correlation rules

Answer

Network traffic analysis (NTA)

Answer

Deception technology