CAS-004 Practice Test 33 — 15 Questions

Question 1

A threat intelligence analyst is profiling a threat actor that has been targeting the energy sector. Which THREE of the following attributes are most important to include in a threat actor profile? Select THREE.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Motivations and objectives. Option B (Motivations and objectives) is correct because understanding why an actor targets the energy sector — whether for espionage, disruption, or financial gain — drives their targeting logic, persistence, and operational tempo, which is essential for prioritizing defenses. Option C (Targeted industries and regions) is correct because identifying the specific industries and geographic regions the actor focuses on enables sector-specific and region-specific threat modeling and intelligence sharing for energy organizations. Option D (Tactics, Techniques, and Procedures (TTPs)) is correct because TTPs describe the actor's behavioral patterns and tradecraft, which are more durable than atomic indicators and directly inform detection engineering and defensive countermeasures. Option A (Vulnerabilities exploited) is not among the three most important profile attributes because specific CVEs are tactical, time-bound details that change frequently and are better tracked as vulnerability intelligence rather than core actor profiling. Option E (List of known indicators of compromise) is also not among the three most important because IOCs are volatile, easily changed by the adversary, and represent artifacts rather than the actor's enduring characteristics.

Answer

Vulnerabilities exploited (CVEs)

Answer

List of known indicators of compromise (IOCs)

Question 2

A security analyst is reviewing a SIEM alert that indicates a user's credentials were used to log in from two different countries within a span of 10 minutes. This is likely an indicator of what type of attack?

Accepted Answer

Credential theft and reuse. A single user account authenticating from two geographically distant countries within 10 minutes is physically impossible for one person to do via normal travel, which strongly indicates the credentials have been stolen and are being reused by an attacker from a different location. This is the classic 'impossible travel' indicator of credential theft and reuse. The legitimate user and the attacker are using the same credentials from different locations, producing the anomalous login pattern.

Answer

Brute-force attack

Answer

Man-in-the-middle attack

Answer

Pass-the-hash attack

Question 3

A security team is evaluating an EDR solution. Which of the following capabilities is a primary differentiator between EDR and traditional antivirus?

Accepted Answer

Behavioral analysis and detection. EDR's primary differentiator from traditional antivirus is its use of behavioral analysis and detection. Traditional AV relies on static signatures to identify known malware, whereas EDR continuously records endpoint telemetry (process trees, registry changes, network connections) and applies behavioral heuristics, machine learning, and threat intelligence to detect novel or fileless attacks. This allows EDR to identify malicious activity even when no signature exists, and to provide detection, investigation, and response capabilities rather than just prevention.

Answer

Centralized policy management

Answer

File integrity monitoring

Answer

Signature-based detection of known malware

Question 4

A company is deploying a wireless network for guests. Which security measure is most important to prevent unauthorized users from accessing internal resources?

Accepted Answer

Place the guest network on a separate VLAN with no access to internal subnets. Placing the guest network on a separate VLAN with no access to internal subnets provides network segmentation, which is the most effective security measure to prevent unauthorized users from reaching internal resources. This approach uses VLAN tagging (802.1Q) and access control lists (ACLs) to enforce Layer 2 and Layer 3 isolation, ensuring that guest traffic cannot traverse to internal networks even if other wireless security measures are bypassed.

Answer

Use WPA2-Enterprise with 802.1X

Answer

Disable SSID broadcast

Answer

Implement MAC address filtering

Question 5

A security analyst is investigating a malware sample and wants to determine its capabilities without executing it. The analyst examines the binary's imports, strings, and structure. What type of analysis is being performed?

Accepted Answer

Static analysis. Static analysis involves examining a file's code, structure, and metadata without running it. By inspecting imports, strings, and headers, the analyst gains insight into potential functionality (e.g., API calls, embedded URLs) without risking execution. This is the definition of static analysis, as opposed to dynamic analysis which requires running the sample. Reverse engineering is a broader process that includes static and dynamic techniques, but the specific actions described are classic static analysis.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 6

A security analyst is reviewing a Kubernetes cluster and wants to ensure that only authorized users can create or modify pods. Which Kubernetes object should be configured to enforce this?

Accepted Answer

RBAC. Kubernetes RBAC (Role-Based Access Control) uses Roles/ClusterRoles bound to users, groups, or service accounts via RoleBindings/ClusterRoleBindings to authorize actions like create or modify on pods. Configuring RBAC with verbs such as create, update, and patch on the pods resource enforces exactly who can manipulate pods.

Answer

Admission controllers

Answer

Pod security policies

Answer

Network policies

Question 7

During a compliance audit, an organization's security team discovers that sensitive data in a legacy database is stored in plaintext. The database is critical for operations and cannot be taken offline for patching until the next maintenance window in three months. Which of the following is the BEST compensating control to reduce risk immediately?

Accepted Answer

Restrict network access to the database to only authorized applications. Restricting network access to the database to only authorized applications is the best compensating control because it immediately reduces the attack surface without requiring any changes to the database itself. By implementing a host-based firewall or network ACLs that limit inbound connections to only specific application servers (e.g., via IP whitelisting and port restrictions), the organization can prevent unauthorized users or malware from directly querying the plaintext data. This control is operational immediately, does not require downtime, and aligns with the principle of least privilege, making it the most practical short-term risk mitigation while awaiting the maintenance window.

Answer

Use file-level encryption on the database storage volume

Answer

Implement transparent database encryption (TDE)

Answer

Apply a digital signature to the database files

Question 8

Under GDPR, which of the following is a data subject right that allows an individual to request that their personal data be erased?

Accepted Answer

Right to erasure. The right to erasure (also known as the 'right to be forgotten') is explicitly defined in GDPR Article 17, allowing data subjects to request deletion of their personal data under certain conditions. This is a core data subject right alongside access, rectification, and portability. Option C directly names this right.

Answer

Right to portability

Answer

Right to access

Answer

Right to rectification

Question 9

An organization is implementing a privacy program to comply with GDPR. Which of the following BEST describes the concept of 'privacy by design' as it applies to a new customer relationship management (CRM) system?

Accepted Answer

Incorporating data minimization and access controls into the system architecture from the start.. Privacy by design is a foundational GDPR principle (Article 25) requiring data protection to be embedded into systems and processes from the outset, not bolted on afterward. Option A captures this by integrating data minimization and access controls into the CRM's architecture during design, which is exactly what 'by design' means. This proactive approach reduces compliance risk and prevents costly retrofits.

Answer

Assigning a data protection officer to review system logs quarterly.

Answer

Adding a privacy notice to the CRM after deployment.

Answer

Conducting a privacy impact assessment (PIA) after the system is live.

Question 10

During a penetration test, the tester has gained initial access to a network and now aims to move laterally to a sensitive database server. Which phase of the penetration testing lifecycle does this activity represent?

Accepted Answer

Post-exploitation. Post-exploitation is the phase after initial access where the tester maintains access, escalates privileges, moves laterally, and gathers additional data. Moving laterally to a sensitive database server after gaining initial access is a classic post-exploitation activity.

Answer

Exploitation

Answer

Reporting

Answer

Reconnaissance

Question 11

A company is implementing a SIEM solution and needs to ensure that logs from network devices, servers, and endpoints are collected in a consistent format. Which protocol should be used to transport logs securely?

Accepted Answer

Syslog over TLS. Syslog over TLS (often called syslog-ng or rsyslog with TLS) is the correct choice because it provides a standardized method to transport syslog messages securely over the network. Syslog itself is the de facto standard for log collection from network devices, servers, and endpoints, and adding TLS ensures confidentiality and integrity during transmission. This meets the requirement for consistent log format (syslog) and secure transport (TLS).

Answer

Syslog over UDP

Answer

SFTP

Answer

SNMP traps

Question 12

A SOC analyst receives an alert indicating that a workstation has been making outbound connections to a known command-and-control (C2) IP address. The analyst initiates the incident response process. Which of the following should be the FIRST action taken?

Accepted Answer

Isolate the workstation from the network.. The FIRST action in incident response when a host is confirmed to be communicating with a known C2 server is containment — specifically, network isolation of the affected workstation. Isolating the host immediately stops the active exfiltration channel and prevents lateral movement or further C2 tasking, while preserving volatile evidence (memory, running processes, network connections) for later forensic analysis. Running scans, deleting files, or notifying management are subsequent steps that either destroy evidence or waste time while the attacker retains an active foothold.

Answer

Run a full antivirus scan on the affected workstation.

Answer

Notify the organization's management and legal team.

Answer

Delete the suspicious files identified by the antivirus.

Question 13

A DevOps engineer is automating the deployment of a web application using containers. Which of the following security practices should be implemented to reduce the attack surface of the containers? (Select TWO.)

Accepted Answer

Run containers as a non-root user. Running containers as a non-root user (option A) is a fundamental security best practice because it limits the privileges available to processes inside the container. If an attacker compromises the application, they will not have root access to the host or the container runtime, reducing the potential for privilege escalation or host-level damage. This aligns with the principle of least privilege, which is critical for container security.

Answer

Build images with embedded database credentials

Answer

Expose port 22 for SSH debugging

Answer

Grant all Linux capabilities to the container

Question 14

Which of the following is a primary benefit of using a Web Application Firewall (WAF) in front of a web application?

Accepted Answer

It filters malicious HTTP requests and can block common web exploits. A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model and inspects HTTP/HTTPS traffic for malicious payloads. It uses a combination of signature-based detection, behavioral analysis, and rule sets (e.g., OWASP ModSecurity Core Rule Set) to filter out common web exploits such as SQL injection, cross-site scripting (XSS), and path traversal. By intercepting and blocking malicious requests before they reach the web application, a WAF provides a critical layer of defense without requiring changes to the application code.

Answer

It encrypts all traffic between client and server

Answer

It prevents all types of attacks against the application

Answer

It performs static code analysis on the application

Question 15

A security administrator is implementing TPM 2.0 for secure boot and measured boot on new laptops. Which TWO capabilities does TPM 2.0 provide that are directly related to ensuring the integrity of the boot process? (Select TWO.)

Accepted Answer

Remote attestation to verify boot measurements. TPM 2.0 can produce a signed quote of PCR values that a remote verifier uses to attest that the boot chain matches expected measurements, directly ensuring boot-process integrity. Option B (Platform Configuration Registers (PCRs) for storing measurements) is correct because TPM 2.0 PCRs hold the cumulative hashes of boot components (firmware, bootloader, OS) that form the basis of measured boot and are the values attested in option A. Option C is not a TPM capability; UEFI Secure Boot enforcement is performed by UEFI firmware using signature databases (db, dbx, KEK, PK), though the TPM may record its state. Option D, sealed storage, protects encryption keys by binding them to PCR values, but it is a data-protection feature rather than a direct boot-integrity capability. Option E, RSA key generation for code signing, is a general cryptographic function and not specifically tied to ensuring boot-process integrity.

Answer

UEFI secure boot enforcement

Answer

Sealed storage to protect encryption keys

Answer

Generation of RSA keys for code signing