CAS-004 Practice Test 33 — 15 Questions

Question 1

A virtualization administrator needs to ensure that virtual machines (VMs) from different customers cannot communicate with each other unless explicitly allowed. Which network security control should be implemented on the hypervisor?

Accepted Answer

Use a virtual firewall to create per-VM security groups. Micro-segmentation (e.g., NSX) allows fine-grained control over VM-to-VM traffic at the virtual switch level.

Answer

Patch the hypervisor regularly

Answer

Assign each VM to a different physical server

Answer

Enable hypervisor memory overcommitment

Question 2

A security architect is evaluating web application firewall (WAF) features to protect against common attacks. Which TWO of the following attacks can a WAF most effectively prevent?

Accepted Answer

Cross-site scripting (XSS). SQL injection and XSS are application-layer attacks that a WAF can detect and block based on signatures or heuristics. CSRF requires tokens, and session hijacking is often at the network layer.

Answer

Session hijacking

Answer

Distributed denial-of-service (DDoS)

Answer

Cross-site request forgery (CSRF)

Question 3

A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?

Accepted Answer

Security information and event management (SIEM) with behavior analytics. Option C is correct because SIEM with User and Entity Behavior Analytics (UEBA) baseline normal behavior and detect anomalies quickly. Option A is wrong because IDS only matches signatures. Option B is wrong because DLP focuses on data loss. Option D is wrong because encryption is for data protection.

Answer

Full disk encryption software

Answer

Data loss prevention (DLP) system

Answer

Network-based intrusion detection system (NIDS)

Question 4

A security analyst is reviewing alerts from a SIEM and notices multiple failed login attempts from a single IP address to different user accounts over a 5-minute window. What should the analyst do FIRST?

Accepted Answer

Check the source IP and correlate with other logs to confirm suspicious activity.. Option B is correct because the first step in incident response is to verify the alert and determine if it is a false positive. Option A is premature without verification. Option C is reactive and may not address the immediate threat. Option D is excessive and may disrupt operations.

Answer

Block the IP address at the firewall.

Answer

Isolate all endpoints that received the login attempts.

Answer

Reset all user accounts that were targeted.

Question 5

During a security review, it is discovered that a critical application uses hardcoded cryptographic keys. The development team refactors the code to retrieve keys from a centralized key management system (KMS) using role-based access control. Which additional practice should be implemented to minimize the risk of key compromise?

Accepted Answer

Implement key expiration and automated rotation. Rotation reduces the window of exposure if a key is compromised, and automating it ensures consistency.

Answer

Log every key access without rotation

Answer

Use a single, long key to reduce management overhead

Answer

Store keys in a hardware security module only

Question 6

An OpenVPN configuration file is shown. A security auditor recommends replacing the cipher and auth directives. Which of the following is the BEST replacement pair from a security engineering perspective?

Accepted Answer

cipher AES-256-GCM and auth SHA256. Option C is correct because AES-256-GCM is an AEAD cipher that provides both encryption and authentication, and TLS 1.3 uses AEAD. Option A is wrong because the configuration already uses SHA256 for auth; adding HMAC is redundant but not best. Option B is wrong because Blowfish is outdated and DES is weak. Option D is wrong because 3DES is weak and MD5 is deprecated.

Answer

cipher AES-128-GCM and auth SHA384

Answer

cipher 3DES-168 and auth MD5

Answer

cipher Blowfish-128 and auth SHA1

Question 7

A defense contractor is developing a new secure messaging application for classified communications. The application must ensure end-to-end encryption, perfect forward secrecy, and resistance to quantum computing attacks. The development team proposes using ECDH for key exchange and AES-256-GCM for message encryption. The security architect reviews the design and identifies a weakness: the current key exchange does not authenticate the public keys, making it vulnerable to man-in-the-middle attacks. The team suggests adding digital signatures using RSA-2048. However, the architect is concerned about quantum resistance. What should the architect recommend?

Accepted Answer

Use ECDH with RSA-2048 signatures for authentication and plan to migrate to CRYSTALS-KYBER when standardized.. Option A is correct because it immediately addresses the lack of authentication by using RSA-2048 signatures while also planning for quantum resistance by migrating to CRYSTALS-KYBER, a NIST-standardized post-quantum key encapsulation mechanism. This hybrid approach ensures security now and in the future. Option B is wrong because larger Diffie-Hellman parameters do not provide quantum resistance and do not solve authentication. Option C is wrong because pre-shared keys break perfect forward secrecy and are not scalable. Option D is wrong because EdDSA with Curve25519 is not quantum-resistant, and hash-based signatures are not practical for real-time key exchange.

Answer

Replace ECDH with Diffie-Hellman using 4096-bit prime modulus and use RSA-4096 signatures.

Answer

Implement ECDH with Edwards-curve Digital Signature Algorithm (EdDSA) using Curve25519 and hash-based signatures for long-term keys.

Answer

Use pre-shared keys (PSK) for both key exchange and encryption, eliminating the need for public key authentication.

Question 8

A security engineer is designing a secure communication channel between two internal systems over an untrusted network. Which protocol should be used to ensure both confidentiality and integrity of data in transit?

Accepted Answer

TLS. TLS provides encryption for confidentiality and MAC for integrity, making it the best choice for secure communication over an untrusted network.

Answer

SSH

Answer

HTTPS

Answer

IPsec

Question 9

A large financial organization is migrating its on-premises authentication infrastructure to a cloud-based identity provider (IdP) to support a hybrid workforce. Currently, on-premises Active Directory is used with smart cards for authentication. The cloud IdP will support SAML 2.0 and OAuth 2.0. The security team requires that all authentication to cloud applications be protected by hardware-backed keys and that user credentials never leave the on-premises network. The solution must also support FIDO2 authentication for passwordless logins. During a pilot, users report that after authenticating to the cloud IdP using their smart cards, they are prompted again for credentials when accessing certain cloud applications. The logs show that the cloud IdP is issuing multiple authentication requests to the on-premises AD Federation Services (AD FS). The CISO is concerned about performance and security of repeated authentication. As a security architect, what is the best course of action?

Accepted Answer

Configure AD FS to pass through the smart card certificate to the cloud IdP and enable seamless SSO by using the certificate as a security token.. Option B is correct because it solves the repeated authentication issue by having AD FS pass the smart card certificate to the cloud IdP, allowing the cloud IdP to accept the certificate as a valid security token for seamless SSO. This keeps credentials on-premises and leverages hardware-backed keys. Option A is wrong because caching authentication tokens on a reverse proxy introduces security risks and does not solve the fundamental issue of token trust. Option C is wrong because although HSM integration improves key security, it still may not eliminate re-prompting if the cloud IdP does not trust the AD FS token. Option D is wrong because conditional access policies based on device compliance do not address the authentication chaining problem.

Answer

Deploy a hardware security module (HSM) on-premises and integrate it with AD FS to perform certificate-based authentication and issue short-lived tokens.

Answer

Implement a reverse proxy to cache authentication tokens and replay them to cloud applications.

Answer

Implement a conditional access policy in the cloud IdP to skip authentication for trusted devices based on device compliance.

Question 10

Given the exhibit, what is the MOST likely scenario?

Accepted Answer

An internal host is compromised and attacking an external web server.. Option C is correct. The internal host 10.0.1.100 initially tried to connect to port 80 (HTTP) but was denied, then used port 443 (HTTPS) which was allowed, and then performed SQL injection on the web server. This suggests the host is compromised and attempting to attack an external server via HTTPS to bypass firewall rules. Option A is wrong because the traffic is outward, not inbound. Option B is wrong because SQL injection is detected, and the pattern is deliberate. Option D is wrong because host is active.

Answer

A misconfigured application is sending malformed data to a server.

Answer

An external attacker is scanning the internal network.

Answer

A web vulnerability scanner is performing authorized tests.

Question 11

A security analyst observes anomalous outbound network traffic from a server that normally only performs internal functions. According to the incident response plan, what should the analyst do first?

Accepted Answer

Follow the incident response plan. Option A is correct because the first step in incident response is to follow the established plan to ensure proper handling and minimize damage. Option B is wrong because containment should follow identification and reporting. Option C is wrong because shutting down may destroy evidence. Option D is wrong because ignoring is risky.

Answer

Contain the server by disconnecting it from the network

Answer

Immediately shut down the server

Answer

Ignore the traffic as it might be a false positive

Question 12

During a forensic investigation, the examiner discovers that the chain of custody documentation was not properly maintained for a critical hard drive. What is the most likely consequence?

Accepted Answer

The evidence may be ruled inadmissible in legal proceedings. Option A is correct because without chain of custody, evidence could be tampered, making it inadmissible in court. Option B is wrong that investigators are still admissible if procedure is followed, but chain of custody is vital. Option C is wrong that analysis is still valid but legally challenged. Option D is wrong because return to operations is not primary concern.

Answer

The investigation can continue without any impact

Answer

The data on the drive is automatically deleted

Answer

The drive must be returned to the owner immediately

Question 13

A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Option D is correct because authentication logs, especially from domain controllers, record logon events that indicate lateral movement. Option A is wrong because firewall logs show network flows but not authentication. Option B is wrong because antivirus logs show malware detections, not lateral movement directly. Option C is wrong because DNS logs show name resolution.

Answer

Antivirus logs

Answer

DNS logs

Answer

Firewall logs

Question 14

A forensic analyst needs to collect volatile data from a live Windows system. In which order should the analyst collect the following data? (Order of volatility)

Accepted Answer

Memory dump, network connections, running processes, disk image. Option B is correct because memory is the most volatile and should be collected first, followed by network connections, then processes, and finally disk data. Option A is wrong because disk is less volatile. Option C is wrong because processes should be after memory. Option D is wrong because network state is more volatile than disk.

Answer

Disk image, memory dump, network connections, running processes

Answer

Network connections, running processes, memory dump, disk image

Answer

Running processes, memory dump, network connections, disk image

Question 15

Which THREE components are essential for a fully functional Security Operations Center (SOC)? (Select exactly 3.)

Accepted Answer

Incident response team. Options A, C, and E are correct because SIEM for correlation, incident response team, and playbooks are core. Option B is a security control but not a SOC component. Option D is network infrastructure.

Answer

VPN concentrator

Answer

Firewall