CAS-004 Practice Test 30 — 15 Questions

Question 1

A company deploys a web application behind a WAF. The security team discovers that the WAF allows traffic from a known malicious IP. After investigating, they find the WAF is configured to allow all traffic from a specific country for business reasons. Which of the following is the BEST course of action?

Accepted Answer

Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.. Option C is correct because creating a geo-IP exception list for the malicious IP within the allowed country maintains business requirements while blocking the threat. Option A is wrong because removing the entire country block may disrupt business and is too broad. Option B is wrong because an IPS is a different control; adjusting WAF rules is more direct. Option D is wrong because changing the WAF to block mode may cause false positives and is a drastic change.

Answer

Deploy an additional IPS device to block the IP.

Answer

Remove the country-based allow rule immediately.

Answer

Change the WAF from detection mode to blocking mode.

Question 2

An organization is migrating to a hybrid cloud model. The security policy mandates that all keys used for data encryption must be managed on-premises. Which key management solution should be used?

Accepted Answer

HSM on-premises with key escrow. An on-premises Hardware Security Module (HSM) ensures keys never leave the local environment. BYOK still involves key material being processed in the cloud. Cloud HSM is managed by the provider. Software key stores lack physical security.

Answer

Cloud KMS with BYOK

Answer

Software-based key store on-premises

Answer

Cloud HSM

Question 3

Which THREE of the following are key components of a zero-trust security architecture? (Select THREE).

Accepted Answer

Micro-segmentation. Zero trust requires micro-segmentation to limit lateral movement, continuous monitoring to verify every session, and least privilege access to enforce minimal permissions. VPN is a perimeter technology, and implicit trust violates zero trust principles.

Answer

VPN concentrator

Answer

Implicit trust for internal network traffic

Question 4

A company is implementing a zero-trust network architecture. Which THREE of the following are critical components of this approach?

Accepted Answer

Default-deny access policies (least privilege). Zero-trust requires that no entity is trusted by default, even inside the network. Micro-segmentation, continuous authentication, and least privilege are core principles.

Answer

VPN for all remote access

Answer

A single perimeter firewall

Question 5

A company has implemented a hardware security module (HSM) to manage cryptographic keys for a payment processing system. Which of the following best describes an advantage of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant key storage. HSMs are tamper-resistant devices that protect keys from physical and logical attacks, offering a higher level of security than software-based storage. While HSMs can be costly and may have slower key generation, their primary advantage is physical security.

Answer

Easier key rotation

Answer

Faster cryptographic operations

Answer

Lower implementation cost

Question 6

A security engineer is implementing a solution to securely store and manage cryptographic keys for a fleet of IoT devices. The devices have limited processing power and cannot perform asymmetric operations. Which of the following is the BEST approach?

Accepted Answer

Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.. Option A is correct because a cloud HSM offers secure key management and offloads cryptographic operations, suitable for simple symmetric operations on IoTs. Option B is wrong because TPM is typically used for device identity and limited storage, not scalable for fleet management. Option C is wrong because storing keys in firmware is insecure; they can be extracted. Option D is wrong because key wrapping via KMS still requires the IoT to store keys, which is insecure.

Answer

Install a Trusted Platform Module (TPM) in each device to store keys on the device.

Answer

Use a cloud KMS to generate and wrap keys, then store the wrapped key in the device.

Answer

Store keys in obfuscated form in the device firmware and use a custom algorithm for encryption.

Question 7

Which TWO of the following are valid techniques to mitigate the risk of side-channel attacks on cryptographic implementations? (Select exactly 2.)

Accepted Answer

Implementing constant-time algorithms to avoid timing variations.. Options B and E are correct. Constant-time operations and power analysis protection are direct mitigations. Option A is wrong because longer keys do not prevent side-channel leakage. Option C is wrong because using a CSPRNG is about key generation, not execution. Option D is wrong because obfuscation is not a cryptographic defense against side channels.

Answer

Obfuscating the source code of the cryptographic library.

Answer

Using a cryptographically secure random number generator for key generation.

Answer

Increasing the key length to 4096 bits.

Question 8

A security engineer is designing a secure wireless network for a corporate office. Which TWO configurations should be implemented to maximize security?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise provides the strongest encryption and authentication. 802.1X with EAP-TLS allows certificate-based authentication, further enhancing security. WPA2-PSK is vulnerable to brute force attacks. Disabling SSID broadcast and MAC filtering are security-through-obscurity measures and do not provide real protection.

Answer

WPA2-PSK

Answer

MAC address filtering

Answer

Disable SSID broadcast

Question 9

A cloud security architect is designing a key management system for a multi-tenant SaaS application. Which TWO practices are essential for ensuring cryptographic key security? (Select TWO).

Accepted Answer

Separate key management from data storage. Key rotation limits exposure if a key is compromised, and separating key management from data storage reduces attack surface. Storing keys in plaintext is insecure, using a single master key increases risk, and auditing is a detective control but not as fundamental as the other two.

Answer

Store keys in plaintext configuration files for easy retrieval

Answer

Use a single master key for all customers

Answer

Audit all key access events

Question 10

An organization is implementing a public key infrastructure (PKI). Which THREE of the following are essential components?

Accepted Answer

Certificate authority (CA). A CA issues certificates, a RA verifies identity before certificate issuance, and the certificate database stores issued certificates and CRLs.

Answer

Key escrow agent

Answer

Time-stamping authority (TSA)

Question 11

A security engineer needs to implement a solution that provides both confidentiality and integrity for data at rest. Which cryptographic method BEST meets these requirements?

Accepted Answer

AES-256-GCM. AES-256-GCM is an authenticated encryption mode that provides both confidentiality (encryption) and integrity (authentication) in a single algorithm. RSA-2048 is asymmetric and does not provide data integrity directly. SHA-256 is a hash function only. Diffie-Hellman is a key exchange protocol.

Answer

SHA-256

Answer

Diffie-Hellman

Answer

RSA-2048

Question 12

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Accepted Answer

Lack of peer review and cryptanalysis. Custom cryptographic algorithms often lack peer review and may contain subtle flaws that compromise security. The primary concern is the absence of public cryptanalysis, not performance, key length (assuming sufficient), or browser compatibility.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 13

A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?

Accepted Answer

Authenticate and authorize every device and user for every resource access, and encrypt all communication.. Option B is correct because zero trust requires all resources to be accessed securely regardless of location, and all communication should be encrypted. Option A is wrong because zero trust does not rely on network perimeter; it assumes no implicit trust. Option C is wrong because VPNs are a perimeter technology; zero trust uses micro-segmentation. Option D is wrong because VLANs are not a primary zero-trust control; they are network segmentation.

Answer

Place all resources on the internal network and rely on perimeter firewalls.

Answer

Implement VLANs to separate traffic based on user roles.

Answer

Use a VPN to secure all remote access to the corporate network.

Question 14

An organization is deploying hardware security modules (HSMs) to protect cryptographic keys used for digital signatures. Which attack vector is most effectively mitigated by using an HSM compared to storing keys in software?

Accepted Answer

Key extraction from memory dumps. HSMs protect keys from extraction even if the host system is compromised, making them resistant to key extraction attacks.

Answer

Side-channel attacks on the host CPU

Answer

Man-in-the-middle attacks on cryptographic operations

Answer

Brute-force attacks on key strength

Question 15

A security team is implementing controls to meet PCI DSS requirements for cardholder data. Which THREE controls are required?

Accepted Answer

Encrypt cardholder data at rest. PCI DSS requires encryption of cardholder data at rest (Requirement 3.4), unique user IDs (Requirement 8.1.1), and quarterly vulnerability scans (Requirement 11.2). Regular antivirus updates (Requirement 5) are also required but many organizations also use MFA for remote access (Requirement 8.3); however, the three listed are undeniably mandatory per the current version.

Answer

Regularly update antivirus software

Answer

Perform quarterly vulnerability scans