CAS-004 Practice Test 32 — 15 Questions

Question 1

An organization wants to implement continuous compliance monitoring for PCI DSS. Which of the following tools would be MOST effective for this purpose?

Accepted Answer

SIEM system. A SIEM (Security Information and Event Management) system is the most effective tool for continuous compliance monitoring because it aggregates and correlates log data from across the environment in real time, providing ongoing visibility into security events and control effectiveness. For PCI DSS, this directly supports requirements like 10.x (logging and monitoring), 11.5 (change detection), and 12.10 (incident response), enabling automated alerts and evidence collection. Unlike point-in-time tools, a SIEM continuously ingests data, making it ideal for demonstrating sustained compliance rather than periodic snapshots.

Answer

Encryption solution

Answer

Network firewall

Answer

Vulnerability scanner

Question 2

A security engineer must select a cryptographic algorithm to ensure non-repudiation for digitally signed documents. Which algorithm is most appropriate?

Accepted Answer

RSA with SHA-256. RSA with SHA-256 (Option A) is the most appropriate choice because digital signatures rely on asymmetric cryptography. RSA provides the private key for signing and the public key for verification, ensuring that only the signer could have created the signature. SHA-256 provides a secure hash. Together, they provide non-repudiation. In contrast, HMAC-SHA256 (Option B) uses a symmetric key, which does not provide non-repudiation because both parties share the key. AES-256 in GCM mode (Option C) is a symmetric encryption algorithm, not a signature algorithm. Elliptic Curve Diffie-Hellman (ECDH) (Option D) is a key exchange protocol, not suitable for digital signatures.

Answer

HMAC-SHA256

Answer

AES-256 in GCM mode

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Question 3

A security engineer is analyzing a serverless application that uses AWS Lambda. Which of the following is the most critical security concern when the function processes external input?

Accepted Answer

The function may be vulnerable to injection attacks if input is not sanitized. Injection attacks (e.g., SQL injection, command injection) are the most critical security concern for serverless functions processing external input because Lambda functions often interact with databases or execute commands. If input is not sanitized, attackers can execute arbitrary code or access data. This is a top OWASP risk and directly applies to any application handling untrusted input.

Answer

The function has a timeout of 5 minutes

Answer

The function uses environment variables for configuration

Answer

The function does not use a custom runtime

Question 4

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

Accepted Answer

Implement a rate-limiting rule on the network firewall for the source IP.. Rate-limiting the source IP at the network firewall immediately throttles the number of authentication attempts from that address, mitigating the brute-force attack without disrupting legitimate user access. This is the best immediate action as it directly blocks the attack vector at the network layer, preventing further failed logins while preserving user productivity.

Answer

Disable the affected user accounts until the source IP is blocked.

Answer

Reset the passwords for all affected accounts.

Answer

Enable multi-factor authentication for all accounts.

Question 5

An organization uses a hardware security module (HSM) to protect cryptographic keys. Which aspect of key management does an HSM primarily address?

Accepted Answer

Secure key storage and cryptographic operations. An HSM (Hardware Security Module) is a tamper-resistant physical device whose primary purpose is to securely generate, store, and use cryptographic keys without ever exposing them in plaintext outside the device boundary. It performs cryptographic operations (signing, encryption, key derivation) internally, so keys never leave the protected hardware. This directly addresses secure key storage and cryptographic operations.

Answer

Key rotation

Answer

Key escrow

Answer

Digital certificate issuance

Question 6

A security engineer is designing the key-management lifecycle for a hardware security module (HSM) that will hold a root certificate authority signing key. The requirement is that the private key must never exist in plaintext outside the HSM, even during backup, and that restoration must be possible after a total device failure. Which approach BEST satisfies these requirements?

Accepted Answer

Configure the HSM to back up the key material using its secure backup mechanism to at least two geographically separate HSMs.. The only approach that keeps the private key inside a hardware-protected boundary while still allowing recovery is a vendor-supported secure backup or cloning mechanism between HSMs. Wrapping, plaintext export, and software encryption all allow the key to exist in a form that can be recovered outside certified hardware, which the scenario explicitly forbids.

Answer

Store the key on the HSM and replicate it to a spare HSM using the vendor's plaintext export option, then destroy the source.

Answer

Encrypt the private key with AES-256 in software and store the ciphertext on a hardened file server accessible only to administrators.

Answer

Export the private key wrapped under a key-encryption key, store the wrapped blob on encrypted network storage, and re-import it after failure.

Question 7

A security architect is designing a network for a hospital that must keep its electronic health record (EHR) servers completely isolated from the internet while still allowing a small group of vendors to perform remote maintenance. The vendors use laptops that are not managed by the hospital. The architect proposes a jump host architecture. Which of the following designs best satisfies the requirement while minimizing risk?

Accepted Answer

Deploy a hardened jump host in a screened subnet, require vendor laptops to connect through a VPN with MFA, and then RDP to the EHR servers from the jump host after session recording is enabled.. The correct design uses a jump host in a screened subnet, VPN with MFA, and RDP with session recording. This combination isolates the EHR servers, authenticates the unmanaged vendor laptops, and provides an auditable path for maintenance. The other options either place the jump host on the protected VLAN, expose RDP directly, or use a reverse proxy that does not support direct server maintenance, all of which weaken isolation or control.

Answer

Publish the EHR servers through a reverse proxy with client certificate authentication, and let vendors connect directly to the EHR web interface without a jump host.

Answer

Deploy a jump host directly on the same VLAN as the EHR servers, allow vendors to connect to it over RDP from the internet after authenticating with a local account, and disable session logging to protect vendor privacy.

Answer

Create a site-to-site IPsec tunnel from each vendor's office to the EHR VLAN, and allow the vendors to use their own remote administration tools directly against the EHR servers.

Question 8

A security architect is designing a zero trust network architecture and needs to implement micro-segmentation. Which TWO of the following techniques are commonly used to achieve micro-segmentation? (Select TWO).

Accepted Answer

Software-defined networking (SDN) policies. Option B (Software-defined networking (SDN) policies) is correct because SDN centralizes control-plane policy and lets you program fine-grained, workload-level segmentation rules (e.g., via flow tables and distributed policy enforcement) rather than relying only on coarse network boundaries. Option D (Host-based firewalls) is correct because enforcing allow/deny rules directly on each workload's OS (e.g., Windows Defender Firewall, iptables/nftables, or a host agent) provides identity- and workload-centric micro-segmentation that follows the host even across network changes. Option A (NAC) is not the intended answer here because NAC primarily controls device admission and compliance at the network edge, not granular east-west workload-to-workload policy. Option C (IPsec VPN tunnels between subnets) is not correct because it provides encrypted connectivity between subnets, not the fine-grained segmentation policy itself. Option E (VLAN segmentation) is not correct because VLANs are coarse Layer 2 broadcast-domain partitions, not the granular, often identity-based micro-segmentation required in zero trust.

Answer

Network Access Control (NAC)

Answer

IPsec VPN tunnels between subnets

Answer

VLAN segmentation

Question 9

A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?

Accepted Answer

Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.. Integrating container image scanning into the CI/CD pipeline ensures vulnerabilities are detected before deployment, reducing delays and improving security. Option A is correct because adding a stage in Jenkins to run Trivy scans before pushing images to the registry catches issues early. Option B is incorrect because weekly scans after deployment do not prevent vulnerable images from being deployed. Option C is incorrect because Terraform can enforce registry trust but does not scan for vulnerabilities within the image. Option D is incorrect because relying on developers for local scans is inconsistent and not automated.

Answer

Schedule a weekly cron job to scan the container registry and generate reports.

Answer

Use Terraform to enforce that only images from a trusted registry are deployed.

Answer

Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.

Question 10

A security engineer needs to implement a solution that provides both confidentiality and integrity for data at rest. Which cryptographic method BEST meets these requirements?

Accepted Answer

AES-256-GCM. AES-256-GCM is correct because it provides both confidentiality (via AES encryption) and integrity (via Galois/Counter Mode authentication tag). GCM is an authenticated encryption mode that ensures data at rest remains both secret and tamper-proof, meeting the dual requirement directly.

Answer

SHA-256

Answer

Diffie-Hellman

Answer

RSA-2048

Question 11

During an incident response, a team is prioritizing containment actions. Which THREE of the following actions should be taken to contain the incident effectively?

Accepted Answer

Blocking malicious IP addresses at the firewall. Option A is correct because blocking malicious IP addresses at the firewall is a direct, immediate containment action that severs the attacker's command-and-control or exfiltration channel at the network perimeter, preventing further ingress or egress. Option D is correct because isolating affected systems from the network (e.g., VLAN quarantine, disabling switch ports, or pulling the cable) stops lateral movement and prevents the compromised hosts from infecting other assets while preserving their state for later analysis. Option E is correct because disabling compromised user accounts (e.g., resetting credentials and revoking sessions/tokens in Active Directory or the IdP) contains the incident by cutting off the attacker's authenticated access and halting further abuse of those identities. Option B does not belong because notifying law enforcement is an external communication/coordination step, not a technical containment action, and it typically occurs after containment or per legal guidance. Option C does not belong because collecting forensic images is evidence preservation and investigation work that, while important, is not itself a containment measure and is often performed after systems are isolated.

Answer

Notifying law enforcement

Answer

Collecting forensic images of affected systems

Question 12

A security architect must protect a hardware security module's firmware against an attacker who has physical access and can measure power consumption and electromagnetic emissions during signature operations. The architect wants a countermeasure that makes the secret key statistically uncorrelated with the observable side-channel leakage. Which approach BEST meets this goal?

Accepted Answer

Implement constant-time modular exponentiation with blinding of the base and exponent. Base and exponent blinding combined with constant-time arithmetic randomize the intermediate values on which the leakage depends, so power and EM traces no longer correlate with the secret exponent. Secure boot, at-rest encryption, and rate limiting all leave the runtime arithmetic unchanged and therefore do not stop differential power analysis by an attacker with physical measurement access.

Answer

Rate-limit signature operations to ten per second and log each attempt

Answer

Enable secure boot with a signed firmware image verified by an on-die ROM

Answer

Store the private key in encrypted form using an AES key derived from a PIN

Question 13

A security engineer is designing a new network architecture for a government agency that requires compliance with NIST SP 800-53. The network must segregate data tiers and enforce least privilege. Which of the following designs BEST meets the requirements?

Accepted Answer

Zero-trust architecture with micro-segmentation and continuous verification.. Zero-trust architecture with micro-segmentation and continuous verification directly enforces least privilege by requiring authentication and authorization for every connection, regardless of source location. Micro-segmentation isolates data tiers at the workload level, preventing lateral movement, which aligns with NIST SP 800-53 access control and system and communications protection requirements.

Answer

Perimeter-based security with a VPN for remote access.

Answer

DMZ architecture with a single firewall between the internet and internal network.

Answer

Flat network with VLANs for each data tier and ACLs controlling traffic.

Question 14

A security officer is reviewing continuous compliance monitoring tools. Which TWO of the following are primary benefits of implementing such tools? (Select TWO.)

Accepted Answer

Provides real-time visibility into compliance posture. Option B is correct because continuous compliance monitoring tools continuously collect and analyze telemetry from systems, configurations, and controls, giving organizations real-time (or near-real-time) visibility into their current compliance posture rather than a point-in-time snapshot. Option C is correct because this ongoing tracking allows deviations and drift to be detected as they occur, reducing reliance on infrequent periodic audits and enabling faster remediation. Option A is incorrect because no tool can guarantee 100% compliance with all regulations; compliance depends on people, processes, and legal interpretation, and monitoring only provides evidence and alerts. Option D is incorrect because a risk management framework (such as NIST RMF or ISO 31000) is a governance and process structure that tools support but cannot replace. Option E is incorrect because no tool can eliminate all security risks; monitoring reduces and manages risk but residual risk always remains.

Answer

Guarantees 100% compliance with all regulations

Answer

Replaces the need for a risk management framework

Answer

Eliminates all security risks

Question 15

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Accepted Answer

Adopt a unified control framework such as NIST SP 800-53. Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Answer

Focus only on the most stringent regulation

Answer

Implement automated GRC tools without changing controls

Answer

Maintain separate control sets for each regulation