CAS-004 Practice Test 34 — 15 Questions

Question 1

A security engineer is configuring a web application firewall (WAF) for an e-commerce site. The application uses JSON APIs for all transactions. Which WAF mode provides the best protection against injection attacks while minimizing false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Positive security model with strict API schema validation. A positive security model with strict API schema validation defines exactly what JSON structures, fields, and value types are allowed, so any request that deviates from the known-good schema is rejected. Because the e-commerce app uses JSON APIs with predictable schemas, this allow-list approach blocks injection payloads (SQLi, XSS, command injection) that would otherwise slip past signature-based rules, while producing very few false positives since legitimate traffic matches the schema.

Answer

Anomaly detection and learning mode

Answer

Passive mode for monitoring only

Answer

Negative security model with a large rule set

Question 2

A security architect is designing a data classification scheme aligned with a new privacy regulation. Which THREE of the following are common data classification levels used in enterprise environments? (Select THREE.)

Accepted Answer

Public. Common classification levels include public (no impact), internal (moderate impact), confidential (high impact), and restricted (very high impact). Secret is typically a government classification, not enterprise. Critical is not a standard classification level.

Answer

Critical

Answer

Secret

Question 3

Which TWO of the following are key components of a risk assessment methodology?

Accepted Answer

Threat identification.. Threat identification (B) is a core component of risk assessment because risk is derived from threats acting on vulnerabilities, so the methodology must enumerate and characterize relevant threat sources (e.g., natural, human, environmental) before likelihood and impact can be estimated. Asset inventory (E) is equally essential, since risk assessment requires knowing which assets (hardware, software, data, personnel, facilities) have value and therefore what could be harmed, enabling proper scoping and impact analysis. Together, asset inventory and threat identification feed the standard risk calculation (Risk = Threat × Vulnerability × Impact) used in frameworks such as NIST SP 800-30 and ISO/IEC 27005. Disaster recovery (A) is a reactive continuity capability, not a risk assessment input, and it is addressed after risks are evaluated. Risk appetite (C) is a governance decision about acceptable risk levels that guides treatment, not a component of the assessment itself. Incident response (D) is an operational capability for detecting and handling security events, which likewise falls outside the assessment methodology.

Answer

Disaster recovery.

Answer

Risk appetite.

Answer

Incident response.

Question 4

An organization's security policy defines that all sensitive data must be encrypted. However, a business unit has a legacy application that cannot support encryption without a major rewrite. The risk owner decides to accept the risk. This is an example of which risk treatment strategy?

Accepted Answer

Risk acceptance. Risk acceptance is the correct answer because the risk owner has decided to acknowledge the risk and continue operating without implementing additional controls. The legacy application cannot support encryption without a major rewrite, so the organization chooses to accept the risk rather than mitigate, transfer, or avoid it. This aligns with the definition of risk acceptance as a risk treatment strategy where no action is taken to reduce the risk, and the organization retains the potential consequences.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 5

Which two of the following are effective mitigations against XML External Entity (XXE) injection attacks? (Select the two best options.)

Accepted Answer

Disable Document Type Definition (DTD) processing in the XML parser. XXE attacks exploit the XML parser's ability to process external entities defined in a DTD. By disabling DTD processing entirely, the parser cannot resolve or fetch external resources, which neutralizes the primary vector for XXE injection. This is a standard security hardening step for XML parsers like libxml2, Xerces, or .NET's XmlReader, often achieved by setting properties such as `LIBXML_NOENT` to false or `XmlReaderSettings.DtdProcessing` to `Prohibit`.

Answer

Use a blacklist to filter out dangerous XML tags

Answer

Validate all XML input against a schema

Question 6

A security architect at a financial institution is designing a cloud-native application using AWS. The application processes sensitive customer data and must comply with PCI DSS. Which of the following security architecture decisions best supports both compliance and operational efficiency?

Accepted Answer

Implement a cloud access security broker (CASB) and use customer-managed encryption keys (CMKs) for data at rest. A CASB provides visibility and control over data in cloud environments, which is critical for PCI DSS compliance, while customer-managed encryption keys (CMKs) give the institution direct control over encryption of data at rest, meeting both compliance requirements and operational flexibility. This combination allows the financial institution to enforce data protection policies and audit access without sacrificing the agility of cloud-native deployment.

Answer

Place all application resources in a VPC with no internet gateway and use VPC endpoints for AWS services

Answer

Use a cloud-based web application firewall (WAF) and enable logging for all API calls

Answer

Deploy the application on a single tenant dedicated instance and rely on the cloud provider's compliance certifications

Question 7

An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?

Accepted Answer

Rewrite the database query to use parameterized prepared statements.. Parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.

Answer

Deploy a web application firewall (WAF) to filter malicious payloads.

Answer

Move all database queries to stored procedures.

Answer

Implement client-side input validation to block special characters.

Question 8

During a vendor risk assessment, a security analyst reviews a SOC 2 Type II report from a cloud provider. What is the primary value of this report?

Accepted Answer

It provides assurance over the design and operating effectiveness of controls over a period.. A SOC 2 Type II report provides assurance over the design and operating effectiveness of a service organization's controls over a specified period, typically 3–12 months. This period-based testing distinguishes it from Type I, which only assesses design at a point in time. For vendor risk management, Type II gives the analyst evidence that controls actually operated effectively throughout the audit window.

Answer

It offers a snapshot of the vendor's security posture at a single point in time.

Answer

It provides a real-time vulnerability scan of the vendor's network.

Answer

It verifies the vendor's compliance with PCI DSS.

Question 9

An organization is implementing a zero-trust architecture for remote access. Which component is essential for continuous authentication?

Accepted Answer

Identity provider with continuous evaluation. In a zero-trust architecture, continuous authentication requires an identity provider (IdP) that can evaluate user and device attributes in real time, such as risk scores, location, and behavior patterns, to maintain trust throughout a session. Unlike static authentication at login, continuous evaluation ensures that access is revoked immediately if conditions change, which is essential for zero-trust remote access.

Answer

VPN concentrator

Answer

Firewall with deep packet inspection

Answer

Network access control (NAC)

Question 10

A healthcare organization subject to HIPAA must ensure that patients can access their medical records. This requirement is an example of which data subject right under privacy regulations?

Accepted Answer

Right to access. The right to access under privacy regulations (including HIPAA's patient rights and GDPR Article 15) gives individuals the ability to obtain a copy of their personal data and confirm what is being processed. HIPAA's Privacy Rule specifically grants patients the right to inspect and obtain a copy of their protected health information. This maps directly to the right to access.

Answer

Right to be forgotten

Answer

Right to data portability

Answer

Right to rectification

Question 11

Refer to the exhibit. A security analyst notices that the pod is running with a service account token mounted. Which security best practice should be implemented to reduce the risk of token theft in container environments?

Accepted Answer

Set automountServiceAccountToken to false in the pod spec.. Setting automountServiceAccountToken to false in the pod spec prevents the default service account token from being automatically mounted into the pod's filesystem. This reduces the risk of token theft because the token is not present unless explicitly mounted. This is a Kubernetes security best practice for pods that do not need to interact with the Kubernetes API.

Answer

Store the token in a Kubernetes secret and mount it.

Answer

Use a different container runtime.

Answer

Disable the service account for the pod.

Question 12

A security analyst is calculating the annualized loss expectancy (ALE) for a server that processes credit card data. The server has a $100,000 asset value, and the exposure factor for a security breach is 0.4. Historical data shows that such breaches occur twice per year. What is the ALE?

Accepted Answer

$80,000. ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE = Asset Value × Exposure Factor = $100,000 × 0.4 = $40,000. ARO = 2 occurrences per year. Therefore ALE = $40,000 × 2 = $80,000.

Answer

$100,000

Answer

$40,000

Answer

$200,000

Question 13

A security architect is designing a cloud security strategy for a company that uses multiple cloud providers. The architect needs a solution that provides visibility into cloud application usage, enforces security policies, and protects data. Which technology is most appropriate?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) sits between cloud consumers and cloud providers to provide visibility into cloud application usage, enforce security policies (e.g., DLP, access control), and protect data across multiple cloud services. It is specifically designed for multi-cloud visibility and policy enforcement.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 14

During a forensic investigation, the examiner discovers that the chain of custody documentation was not properly maintained for a critical hard drive. What is the most likely consequence?

Accepted Answer

The evidence may be ruled inadmissible in legal proceedings. Proper chain of custody documentation is essential for evidence to be admissible in legal proceedings. If the chain of custody is not maintained, the integrity of the evidence is questioned, and it may be ruled inadmissible. This is because the court cannot verify that the evidence was not tampered with or altered from the time it was collected to its presentation in court. Therefore, the most likely consequence is that the evidence will be excluded.

Answer

The investigation can continue without any impact

Answer

The data on the drive is automatically deleted

Answer

The drive must be returned to the owner immediately

Question 15

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which of the following techniques would be most effective for identifying valid credentials that could be reused on the database server?

Accepted Answer

Using Mimikatz to dump credentials from memory. Mimikatz extracts plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory on a compromised Windows host. Because administrators frequently reuse local or domain credentials across servers, harvested credentials can be replayed against the database server via SMB, RDP, or native database authentication. This directly satisfies the objective of identifying reusable valid credentials for lateral movement.

Answer

Running a port scan on the internal network

Answer

Deploying a web shell for persistent access

Answer

Conducting a SQL injection on the database server