CAS-004 Practice Test 31 — 15 Questions

Question 1

A security engineer is tasked with designing a cryptographic solution to protect data at rest in a multi-tenant cloud storage system. Each tenant's data must be encrypted with a unique key, and the system must support key rotation with minimal performance impact. Which of the following is the BEST approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement envelope encryption: generate a unique data encryption key (DEK) per tenant, encrypt each DEK with a key encryption key (KEK) stored in an HSM, and store the wrapped DEK alongside the data.. Envelope encryption with a unique data encryption key (DEK) per tenant allows independent key rotation and minimizes performance impact by only requiring re-wrapping of the DEK with a new key encryption key (KEK) stored in an HSM. Option A is wrong because storing both the tenant key and the master key in the same database column exposes the master key if the database is compromised. Option C is wrong because a single master key for all tenants violates isolation; if compromised, all tenant data is at risk. Option D is wrong because manual monthly rotation of all keys is not scalable and does not provide per-tenant isolation.

Answer

Generate a unique key per tenant and encrypt each key with a master key, then store both in the same database column.

Answer

Use a single master key for all tenants and store the key in a hardware security module (HSM) with access controls.

Answer

Implement a periodic key rotation schedule that rotates all tenant keys every month manually.

Question 2

A security analyst is investigating a potential advanced persistent threat (APT) that has evaded traditional signature-based defenses. The analyst hypothesizes that the attacker is using a specific technique from the MITRE ATT&CK framework: process injection. Which threat hunting methodology is most appropriate for this scenario?

Accepted Answer

Hypothesis-driven hunting based on a specific technique (process injection) and searching for evidence in memory and process activity. Hypothesis-driven hunting is the most appropriate because the analyst has a specific, testable hypothesis: the attacker is using process injection, a known ATT&CK technique (T1055). This methodology involves proactively searching for evidence of that technique—such as anomalous memory allocations, thread execution, or API calls—rather than waiting for alerts. It directly addresses the scenario where signature-based defenses have failed, as it focuses on behavioral artifacts rather than static indicators.

Answer

TTP-driven hunting by analyzing adversary behaviors mapped to the ATT&CK framework

Answer

Automated hunting using SIEM correlation rules that trigger on known malicious file hashes

Answer

IoC-driven hunting using known indicators of compromise from open-source feeds

Question 3

During a security incident, a SOC analyst identifies a process with a suspicious hash on several endpoints. The analyst wants to determine if this hash is known to be malicious by querying internal and external threat intelligence sources. Which standard should the analyst use to structure the threat intelligence data for automated sharing?

Accepted Answer

STIX. STIX (Structured Threat Information eXpression) is the OASIS standard that defines the structured language and data model for representing cyber threat intelligence — indicators, malware, attack patterns, and their relationships — in a machine-readable JSON format. When an analyst needs to structure threat intelligence data (such as a suspicious file hash) for automated sharing, STIX is the correct standard because it defines the content schema itself. TAXII is the transport protocol that carries STIX, not the structuring standard.

Answer

TAXII

Answer

OpenIOC

Answer

CybOX

Question 4

A security analyst is reviewing logs from a SIEM and notices that a user account has been successfully authenticated from two different geographic locations within a short time span, which is impossible. The SIEM uses user behavior analytics (UBA). What type of anomaly is this most likely to detect?

Accepted Answer

A credential theft and reuse incident. The scenario describes a successful authentication from two geographically distant locations within a time span that makes physical travel impossible. This is a classic indicator of credential theft and reuse, where an attacker has obtained valid credentials and is using them from a different location while the legitimate user is also active. UBA detects this as an anomaly because it deviates from the normal access pattern for that user, such as typical login locations and times.

Answer

A misconfigured VPN that routes traffic through multiple gateways

Answer

A brute-force attack on the user account

Answer

A man-in-the-middle attack intercepting the authentication

Question 5

An organization is implementing a threat hunting program. The team decides to use a hypothesis-driven approach. Which of the following best describes this methodology?

Accepted Answer

Developing a theory about potential adversary behavior and actively looking for signs. Hypothesis-driven threat hunting starts with an analyst forming a testable theory about how an adversary might operate in the environment — for example, 'attackers may be using PowerShell for lateral movement' — and then proactively searching telemetry for evidence that confirms or refutes that theory. This differs from reactive or feed-driven approaches because the hunt is guided by the analyst's hypothesis rather than by pre-existing alerts or indicators. The goal is to discover threats that have evaded automated detection, not to validate known badness.

Answer

Searching for known indicators of compromise from threat feeds

Answer

Automated scanning of all systems for vulnerabilities

Answer

Analyzing historical alerts for patterns

Question 6

Which CVSS metric component is used to reflect the impact of a vulnerability based on the specific environment of an organization?

Accepted Answer

Environmental metric. The Environmental metric in CVSS adjusts the Base score to reflect the specific environment of an organization, including factors like modified attack vector, confidentiality, integrity, and availability requirements. It is the component explicitly designed to capture organization-specific impact.

Answer

Attack vector metric

Answer

Temporal metric

Answer

Base metric

Question 7

An organization is implementing a privacy program based on privacy by design. Which principle requires that privacy controls be integrated into the system's default settings?

Accepted Answer

Privacy as the default setting. Privacy as the default setting is the privacy-by-design principle requiring that privacy protections be built into the system's default configuration, so users do not have to take action to protect their data. It means the most privacy-protective settings are on by default, and users must opt in to share more. This directly matches the question's wording about default settings.

Answer

Full functionality – positive-sum, not zero-sum

Answer

Privacy embedded into design

Answer

Proactive not reactive; preventative not remedial

Question 8

During an incident response, a forensic analyst captures the memory of a compromised Windows system. Using Volatility, the analyst runs the 'pslist' command and sees a suspicious process 'svchost.exe' with a parent process 'explorer.exe'. Which Volatility plugin should the analyst use next to detect potential process hollowing?

Accepted Answer

malfind. The malfind plugin is specifically designed to detect injected code and process hollowing by scanning process memory for regions with suspicious characteristics such as PAGE_EXECUTE_READWRITE permissions and MZ/PE headers in non-image memory. Given the suspicious svchost.exe parented by explorer.exe (svchost should normally be parented by services.exe), malfind is the correct next step to confirm hollowing or injection.

Answer

netscan

Answer

psxview

Answer

dlllist

Question 9

A company's development team uses a CI/CD pipeline hosted in a public cloud. The pipeline builds container images, pushes them to a private registry, and deploys them to a Kubernetes cluster. A security engineer must ensure that only signed and vulnerability-scanned images are deployed. The engineer has configured the registry to require signatures and the CI/CD pipeline to scan images. However, deployments are still failing because unsigned images are being pulled. The engineer discovers that developers can push images directly to the registry bypassing the CI/CD pipeline and that Kubernetes nodes can pull images without signature verification. Which of the following should the engineer implement to enforce image signing and scanning?

Accepted Answer

Restrict registry write access to the CI/CD service account and enable image signature verification via admission controller in Kubernetes.. It addresses both root causes: restricting registry write access to only the CI/CD service account prevents developers from bypassing the pipeline, and enabling image signature verification via an admission controller (e.g., using Kubernetes ImagePolicyWebhook or a tool like Cosign with OCI signatures) ensures that only signed and scanned images are allowed to run in the cluster. This combination enforces the security policy at both the registry and the cluster level, closing the gaps identified in the scenario.

Answer

Implement a manual approval step in the pipeline for each deployment.

Answer

Use network policies to block all outbound traffic from developer workstations to the container registry.

Answer

Configure the CI/CD pipeline to perform vulnerability scanning after every build.

Question 10

A security architect is evaluating a new cloud SaaS application that will handle sensitive customer data. The SaaS provider offers a shared responsibility model where the customer is responsible for data classification, access management, and encryption of data at rest using customer-managed keys. The architect must ensure that the organization retains the ability to revoke access to the data if the provider is compromised. Which key management strategy best meets this requirement?

Accepted Answer

Implement bring-your-own-key (BYOK) with keys stored in a customer-controlled external KMS. BYOK with keys stored in a customer-controlled external KMS ensures the organization retains full control over encryption keys, enabling immediate revocation of access to data at rest if the SaaS provider is compromised. This aligns with the shared responsibility model where the customer manages keys, and external KMS decouples key management from the provider's infrastructure, preventing the provider from accessing data after key revocation.

Answer

Escrow the encryption key with a third-party and rely on legal agreements for revocation

Answer

Use the provider's default encryption with a customer-managed key stored in the provider's KMS

Answer

Use a cloud hardware security module (HSM) to generate and store keys

Question 11

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

Accepted Answer

Enable SQL injection signature rules.. Option A is correct because enabling SQL injection signature rules lets the WAF match known SQLi patterns (e.g., UNION SELECT, OR 1=1, comment sequences) in request parameters, headers, and bodies, blocking or alerting on malicious payloads before they reach the application. Option B is correct because input validation for all query parameters enforces expected data types, lengths, and character sets, rejecting or sanitizing malformed input that could otherwise be interpreted as SQL syntax, providing a complementary defense beyond signature matching. Option C is not correct because rate limiting on login endpoints mitigates brute-force and credential-stuffing attacks, not SQL injection. Option D is not correct because IP reputation blocking addresses known malicious sources but does not detect SQLi payloads from otherwise trusted or new IPs. Option E is not correct because SSL/TLS inspection decrypts traffic for analysis but does not itself identify or block SQL injection attempts.

Answer

Enable rate limiting on login endpoints.

Answer

Enable IP reputation blocking.

Answer

Enable SSL/TLS inspection for all traffic.

Question 12

A multinational corporation that processes personal data of EU residents is required to appoint a Data Protection Officer (DPO) and implement data protection impact assessments. Which regulation primarily drives these requirements?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) is the EU regulation that mandates appointing a Data Protection Officer (DPO) in certain cases and requires Data Protection Impact Assessments (DPIAs) for high-risk processing. It applies to any organization processing personal data of EU residents, regardless of the organization's location, making it the primary driver of these requirements.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 13

During a policy gap analysis, it is discovered that the organization has a policy stating that sensitive data must be encrypted, but there are no procedures for implementing encryption on mobile devices. This is an example of a gap between:

Accepted Answer

Policy and procedures. A policy states the mandatory 'what' (sensitive data must be encrypted), while procedures describe the step-by-step 'how' (how to enable encryption on mobile devices, which tools, who does it). The gap described is the absence of implementation procedures supporting an existing policy, so it is a policy-to-procedures gap.

Answer

Standards and guidelines

Answer

Policy and standards

Answer

Policy and guidelines

Question 14

A security architect is designing a data classification scheme. Which of the following is the highest level of sensitivity that would typically require the most stringent controls?

Accepted Answer

Restricted. In most data classification schemes, 'Restricted' represents the highest sensitivity level, reserved for data whose unauthorized disclosure would cause severe damage, such as trade secrets, regulated personal data, or national security information. It requires the most stringent controls, including strict access controls, encryption, and auditing. Public, Internal, and Confidential are lower tiers in the typical hierarchy.

Answer

Public

Answer

Internal

Answer

Confidential

Question 15

A company processes personal data of EU citizens and wants to implement privacy by design. Which of the following is the BEST first step in this process?

Accepted Answer

Conducting a Privacy Impact Assessment (PIA). A Privacy Impact Assessment (PIA) — also called a Data Protection Impact Assessment (DPIA) under GDPR Article 35 — is the foundational first step in privacy by design because it forces the organization to systematically identify and mitigate privacy risks before processing begins. It maps data flows, identifies personal data elements, assesses legal bases, and evaluates risks to data subjects, which then informs all subsequent controls like encryption, retention, and DPO involvement. Without this assessment, other measures are implemented blindly and may not address the actual risks. GDPR explicitly requires a DPIA for high-risk processing, making it a legal prerequisite in many cases.

Answer

Appointing a Data Protection Officer (DPO)

Answer

Implementing data encryption at rest and in transit

Answer

Developing a data retention policy