CAS-004 Practice Test 30 — 15 Questions

Question 1

A financial institution must comply with the Sarbanes-Oxley Act (SOX). Which of the following is a primary focus of SOX compliance?

Accepted Answer

Accuracy and reliability of financial reporting. SOX is a U.S. federal law enacted in 2002 to protect investors by improving the accuracy and reliability of corporate financial disclosures. Its primary focus is ensuring that financial reporting is accurate, reliable, and subject to internal controls and independent audits. This directly aligns with option D.

Answer

Security of credit card transactions

Answer

Privacy of health information

Answer

Protection of personally identifiable information (PII)

Question 2

A security analyst is reviewing a suspicious process that has been identified on an endpoint. The analyst wants to determine if the process has any network connections and what data it might be sending. Which tool is most appropriate for analyzing the memory of the affected system to identify network connections and potential data exfiltration?

Accepted Answer

Volatility. Volatility is a memory forensics framework that analyzes RAM dumps to extract running processes, network connections, and injected code. It is the most appropriate tool for examining memory to identify network connections and potential data exfiltration from a suspicious process.

Answer

Wireshark

Answer

Autopsy

Answer

Nmap

Question 3

During a threat modeling exercise for a new web application, the team identifies that the application uses JWT for authentication. Which vulnerability is most likely if the server does not properly verify the JWT signature?

Accepted Answer

JWT tampering. When a server fails to verify the JWT signature, an attacker can modify the token's payload (e.g., change the 'sub' or 'role' claim) and re-encode it without needing the signing key, because the server will accept any token whose signature it never validates. This is JWT tampering — the attacker forges or alters claims to impersonate another user or escalate privileges. The vulnerability is specific to improper cryptographic validation of the token, not to input handling or access control logic.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Insecure direct object reference

Question 4

An organization has implemented a risk treatment plan that includes purchasing cyber insurance for potential data breach costs. Which risk treatment option does this represent?

Accepted Answer

Risk transfer. Purchasing cyber insurance transfers the financial consequences of a data breach to a third-party insurer, which is the definition of risk transfer. The organization does not eliminate the risk or reduce its likelihood — it shifts the monetary impact to another party. This is a classic example of risk transfer in risk treatment planning.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 5

Match each port number to its associated protocol.

Accepted Answer

Port 80: HTTP. These are standard IANA port assignments for common protocols. Correct matches: Port 80=HTTP, Port 443=HTTPS, Port 22=SSH, Port 21=FTP. Common confusions involve swapping port numbers for similar protocols.

Answer

Port 80: HTTPS

Answer

Port 22: Telnet

Question 6

A company is implementing a defense-in-depth strategy for its web application. Which THREE security controls should be included in the architecture? (Choose three.)

Accepted Answer

Web application firewall (WAF). A web application firewall (WAF) is correct because it inspects and filters HTTP/HTTPS traffic at Layer 7, blocking common attacks such as SQL injection and cross-site scripting before they reach the application, which is a core element of defense-in-depth for a web app. Runtime application self-protection (RASP) is correct because it instruments the application from within the runtime, detecting and blocking attacks like deserialization or injection in real time based on actual execution context, complementing perimeter controls. Network segmentation is correct because it limits lateral movement by isolating the web tier from databases and internal services using VLANs, subnets, or security groups, so a compromised web server cannot freely reach other assets. A load balancer with SSL termination is not a security control in this context; it primarily provides availability and offloads TLS processing, and while it may support TLS, it does not itself enforce application-layer threat protection. Single sign-on (SSO) is an authentication convenience and access-management mechanism, not a defense-in-depth control for protecting the web application against attacks.

Answer

Load balancer with SSL termination

Answer

Single sign-on (SSO)

Question 7

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

Accepted Answer

Include security requirements in contracts and conduct periodic audits. Including security requirements in contracts and conducting periodic audits is the most effective method because it creates a legally binding obligation for vendors to adhere to the organization's security policies, and audits provide direct, verifiable evidence of compliance. Unlike self-assessments or certifications, audits allow the organization to actively inspect controls, configurations, and processes, ensuring ongoing adherence rather than relying on a point-in-time assertion. This approach aligns with the NIST SP 800-53 continuous monitoring framework and is a core principle of third-party risk management (TPRM) in the CAS-004 domain.

Answer

Require vendors to obtain ISO 27001 certification

Answer

Send annual self-assessment questionnaires

Answer

Perform quarterly penetration tests on vendor networks

Question 8

A security team is deploying deception technology to detect lateral movement within the network. They plan to use honeypots configured to mimic critical servers. Which TWO of the following are essential considerations for the honeypot deployment to be effective? (Choose TWO.)

Accepted Answer

Use realistic network services and data to attract attackers. Option B is correct because honeypots only generate useful detection telemetry if they present realistic, believable network services, banners, and data that entice an attacker into interacting with them; a bare or obviously fake service will be ignored and yield no lateral-movement indicators. Option C is correct because a honeypot must be isolated (for example, on a separate VLAN or segment with strict firewall/ACL rules) so that an attacker who compromises it cannot pivot into production systems, which would turn a detection asset into an attack platform. Option A is not required: matching production patch levels is not essential to effectiveness, and honeypots are often deliberately left vulnerable to attract attackers. Option D is not required and can be risky, since placing honeypots in the same broadcast domain as production servers exposes them to unnecessary traffic and increases pivot risk. Option E is wrong because logging and monitoring are fundamental to a honeypot's purpose; disabling logging would defeat detection.

Answer

Configure the honeypots with the same patch level as production systems

Answer

Ensure the honeypots are in the same broadcast domain as production servers

Answer

Disable logging on honeypots to avoid detection by attackers

Question 9

A large enterprise has deployed a security information and event management (SIEM) system that ingests logs from all critical servers, network devices, and endpoints. The SIEM is configured to correlate events and generate alerts for suspicious activities. Recently, the SOC team has been overwhelmed by a high volume of false positive alerts, particularly from the web server farm. The false positives are mainly triggered by legitimate web crawling and scanning activities from partners and internal tools. The SOC manager wants to reduce false positives without missing real threats. As the security architect, you are asked to recommend a solution. Which of the following is the BEST course of action?

Accepted Answer

Create allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules.. Creating allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules directly addresses the root cause: false positives from trusted entities. This approach preserves detection sensitivity for unknown or malicious sources while suppressing alerts from pre-vetted IPs, reducing alert fatigue without compromising security coverage.

Answer

Increase the event threshold for web server alerts to reduce sensitivity.

Answer

Disable logging of successful requests on the web servers to reduce log volume.

Answer

Tune the SIEM to use more aggressive deduplication and aggregation globally.

Question 10

During a penetration test, the tester has obtained a foothold on an internal server. The tester wants to identify other systems on the network and find potential targets for lateral movement. Which type of reconnaissance is MOST appropriate in this scenario?

Accepted Answer

Internal network scanning with Nmap. Active reconnaissance on internal networks (e.g., port scanning, OS fingerprinting) is appropriate after gaining a foothold, as it provides detailed information about adjacent systems. Passive reconnaissance (like sniffing) might be stealthier but active scanning is more effective for mapping.

Answer

OSINT gathering via Shodan

Answer

Social engineering attacks on employees

Answer

Passive sniffing with Wireshark

Question 11

A company is implementing single sign-on using SAML 2.0. A security architect is reviewing the authentication flow and notices that the identity provider (IdP) does not digitally sign the SAML assertions. Which of the following is the most significant security risk?

Accepted Answer

The assertion could be modified in transit. SAML assertions carry the authentication and authorization claims that the service provider (SP) trusts. Without a digital signature, there is no cryptographic integrity protection, so an attacker who can intercept or manipulate the SAML response (e.g., via a man-in-the-middle or by tampering with the POST binding) can alter the assertion contents—such as changing the user identity or elevating privileges—and the SP has no way to detect the modification. This is the most significant risk because it directly undermines the trust model of SSO.

Answer

The assertion could be intercepted and read

Answer

The IdP could be spoofed

Answer

The assertion could be replayed

Question 12

A security engineer is deploying a wireless network for a high-security facility. Which protocol should be used to provide the strongest authentication and encryption for client devices?

Accepted Answer

WPA3-Enterprise with 802.1X. WPA3-Enterprise with 802.1X is the correct choice because it provides the strongest authentication and encryption for a high-security facility. It uses Simultaneous Authentication of Equals (SAE) for secure key exchange, mandates GCMP-256 encryption, and integrates with 802.1X/EAP for per-user, certificate-based authentication, eliminating shared passphrase vulnerabilities.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with AES

Answer

WPA3-Personal with SAE

Question 13

A cloud security architect is designing a multi-region active-active application. The application must maintain high availability even if an entire AWS region fails. Which architecture BEST meets this requirement?

Accepted Answer

Deploy identical stacks in two regions with Route 53 weighted routing and DynamoDB global tables. Deploying identical application stacks in two AWS regions with Route 53 weighted routing distributes traffic evenly across both regions, and DynamoDB global tables provide multi-region, multi-master replication with eventual consistency, ensuring the application remains fully active and available even if an entire AWS region fails. This architecture meets the active-active and region-failure requirement without relying on failover or single-region dependencies.

Answer

Active-active in one region with auto scaling

Answer

Single region with multiple AZs and RDS Multi-AZ

Answer

Two regions with active-passive failover using Route 53 health checks

Question 14

Which THREE of the following are required by the NIST Cybersecurity Framework (CSF) for the 'Protect' function?

Accepted Answer

Performing regular maintenance of systems. Performing regular maintenance of systems is required under the Protect function of the NIST Cybersecurity Framework (CSF) because it directly supports the 'Protective Technology' and 'Maintenance' subcategories (PR.MA). Regular patching, updates, and hardware upkeep ensure that security controls remain effective against known vulnerabilities, reducing the attack surface. This is a proactive measure to sustain the integrity and availability of systems, aligning with the CSF's focus on safeguarding critical infrastructure.

Answer

Conducting a risk assessment for critical assets

Answer

Developing an incident response plan

Question 15

A security analyst is analyzing a memory dump from a compromised host using Volatility. Which Volatility plugin would be most useful to identify a malicious process that is hidden from the standard process listing?

Accepted Answer

psxview. The psxview plugin in Volatility cross-references multiple process listing sources (pslist, psscan, thrdproc, pspcid, csrss, session, deskthrd) to detect processes hidden from the standard listing. It is specifically designed to reveal rootkit-hidden processes by comparing discrepancies between these sources.

Answer

pstree

Answer

malfind

Answer

pslist