CAS-004 Practice Test 35 — 15 Questions

Question 1

A security analyst is reviewing alerts from a SIEM and notices multiple failed login attempts from a single IP address to different user accounts over a 5-minute window. What should the analyst do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the source IP and correlate with other logs to confirm suspicious activity.. The analyst should first validate the alert by checking the source IP and correlating with other logs to confirm whether the activity is truly malicious. This step ensures that the response is based on accurate information and avoids unnecessary actions. Correlating logs can reveal patterns, such as whether the attempts are part of a broader attack or a false positive. Only after confirmation should the analyst proceed with containment or remediation.

Answer

Block the IP address at the firewall.

Answer

Isolate all endpoints that received the login attempts.

Answer

Reset all user accounts that were targeted.

Question 2

Which of the following is a key difference between a security guideline and a security procedure?

Accepted Answer

Guidelines are recommended; procedures are mandatory. A security guideline is a recommended, non-mandatory statement of best practice that advises how to align with policy, while a security procedure is a mandatory, step-by-step instruction that must be followed to accomplish a specific task. This distinction in enforceability and specificity is the defining difference between the two document types. Guidelines offer flexibility; procedures prescribe exact actions.

Answer

Both are equally enforceable

Answer

Procedures are high-level; guidelines are detailed

Answer

Guidelines are mandatory; procedures are optional

Question 3

A company is preparing for post-quantum cryptography migration. According to NIST PQC standards, which algorithm is a candidate for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is the NIST-standardized algorithm for key encapsulation (KEM), selected in the post-quantum cryptography standardization process. It is designed for secure key exchange and is efficient for both client and server. NIST selected Kyber as the primary KEM standard (FIPS 203).

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Answer

Falcon

Question 4

In a cloud shared responsibility model, which of the following is typically the customer's responsibility for IaaS?

Accepted Answer

Guest OS patch management. In the cloud shared responsibility model for IaaS, the customer is responsible for managing the guest operating system, including patch management, security updates, and configuration. The cloud provider is responsible for the hypervisor, hardware, and physical security of data centers. Therefore, guest OS patch management is the customer's responsibility.

Answer

Hypervisor security

Answer

Hardware maintenance

Answer

Physical security of data centers

Question 5

An organization wants to implement an immutable infrastructure for its containerized applications. Which security benefit is most directly achieved by immutability?

Accepted Answer

Prevents unauthorized modifications to running containers. Immutable infrastructure means containers are deployed from a fixed, versioned image and are never modified in place — any change requires redeploying a new container. This design directly prevents unauthorized or accidental modifications to running containers, since the running instance is treated as read-only and any drift is discarded on replacement. The security benefit is integrity enforcement: attackers cannot persist by editing files inside a live container because the container is ephemeral and replaced from a trusted image.

Answer

Eliminates need for runtime security monitoring

Answer

Allows use of privileged containers securely

Answer

Reduces image scanning frequency

Question 6

Which of the following is the primary purpose of a honeypot in a security operations environment?

Accepted Answer

To provide early detection of unauthorized activity. A honeypot is a decoy system designed to attract and detect attackers. Its primary purpose is to provide early detection of unauthorized activity by luring attackers away from real systems and alerting security teams to their presence and methods.

Answer

To encrypt sensitive data at rest

Answer

To replace the need for traditional firewalls

Answer

To block malicious traffic at the network perimeter

Question 7

An incident response team discovers that an attacker was able to forge a certificate for a legitimate domain. Which TWO mechanisms should the team implement to detect and prevent such misissuance in the future? (Select TWO.)

Accepted Answer

Certificate Transparency (CT) logging and monitoring. Certificate Transparency (CT) logging and monitoring (D) is correct because CT requires CAs to submit every issued certificate to public, append-only logs, so the team can monitor these logs for unauthorized or forged certificates for their domains and detect misissuance quickly. Certificate pinning in client applications (E) is correct because it hardcodes or constrains the expected certificate/public key for a domain, so a forged certificate issued by a rogue or compromised CA will be rejected by the client, preventing its use even if it chains to a trusted root. CRLs (A) and OCSP stapling (C) only convey revocation status of certificates and cannot detect or prevent a newly forged certificate that has not yet been revoked, and EV certificates (B) merely assert a higher validation level without providing any detection or pinning mechanism against misissuance.

Answer

Certificate Revocation Lists (CRLs)

Answer

Implementing Extended Validation (EV) certificates

Answer

Online Certificate Status Protocol (OCSP) stapling

Question 8

A SOC analyst notices that a containerized application is making unexpected outbound connections. The container runs with minimal privileges. Which step should the analyst take first to investigate without compromising the environment?

Accepted Answer

Capture a network packet dump from the host and correlate with container logs.. Capturing a network packet dump from the host allows the analyst to observe the unexpected outbound connections without altering the container's state or risking privilege escalation. By correlating the packet capture (e.g., using tcpdump or Wireshark) with container logs, the analyst can identify the destination IPs, ports, and protocols involved while maintaining the container's minimal privileges and preserving forensic integrity.

Answer

Restore the container from a trusted image and re-deploy.

Answer

Use `docker exec` to attach a shell and run network diagnostic commands.

Answer

Immediately kill the container and analyze its filesystem from a backup.

Question 9

A security analyst is calculating the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $5,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$1,000. The Annualized Loss Expectancy (ALE) is calculated as SLE × ARO. With an SLE of $5,000 and an ARO of 0.2, the ALE is $5,000 × 0.2 = $1,000. This represents the expected yearly financial loss from the risk event, factoring in how often it is expected to occur.

Answer

$0

Answer

$5,200

Answer

$25,000

Question 10

A security analyst is reviewing a Kubernetes cluster's security configuration. Which component should be used to ensure that only authorized pods can communicate with each other?

Accepted Answer

Network Policies. Network Policies in Kubernetes are the native mechanism for controlling pod-to-pod traffic. They use label selectors to define which pods can communicate with which other pods on specified ports and protocols, effectively acting as a firewall at the pod level. Without a Network Policy, all pods in a cluster can communicate freely by default, so applying one is the correct way to restrict east-west traffic to only authorized flows.

Answer

Pod Security Policies (PSP)

Answer

Seccomp profiles

Answer

RBAC roles

Question 11

A company is adopting a serverless architecture using AWS Lambda. Which of the following are security concerns specific to serverless functions? (Select TWO.)

Accepted Answer

Event injection via malformed input. Event injection via malformed input (B) is a specific serverless security concern because AWS Lambda functions are triggered by events from sources like API Gateway, S3, or DynamoDB Streams. An attacker can craft malicious input that exploits the function's event-handling logic, leading to unintended execution paths or data corruption. This differs from traditional injection attacks because the event structure itself can be manipulated to bypass validation.

Answer

Insecure deserialization of function input

Answer

Container escape vulnerabilities

Answer

SQL injection in the database

Question 12

An organization uses a TPM 2.0 for measured boot and attestation. Which TPM feature ensures that the boot process has not been tampered with by measuring each component before it executes?

Accepted Answer

Platform Configuration Registers (PCRs). Platform Configuration Registers (PCRs) store hash measurements of boot components. Any change in the boot sequence will result in different PCR values, alerting to tampering.

Answer

Endorsement Key (EK)

Answer

Secure boot

Answer

Sealed storage

Question 13

The security engineer notices that SSH login attempts to 192.168.1.1 from the untrust zone are being blocked. Which policy misconfiguration is MOST likely causing this?

Accepted Answer

The source zone is not permitted. The security engineer observes SSH login attempts from the untrust zone to 192.168.1.1 being blocked. In a typical firewall policy, the source zone must be explicitly permitted for traffic to be allowed. If the source zone 'untrust' is not included in the policy's source zone list, the firewall will drop the traffic regardless of other correct parameters. This is the most likely misconfiguration because SSH traffic from the untrust zone is reaching the destination but being denied at the policy level.

Answer

The application is incorrect

Answer

The log setting prevents connections

Answer

The destination address is incorrect

Question 14

A security architect is designing a microsegmentation strategy for a data center hosting both legacy monolithic applications and modern containerized workloads. The organization wants to enforce least-privilege network access between workloads without relying on IP addresses or VLANs, and it requires the ability to define policy based on workload identity and tags that follow the workload across environments. Which technology best meets these requirements?

Accepted Answer

Host-based microsegmentation using identity and tag-based policies. Host-based microsegmentation is the only option that enforces policy based on workload identity and tags, decoupling security from IP addresses and VLANs. This allows consistent least-privilege enforcement across legacy and containerized workloads and supports policy portability across environments.

Answer

Traditional stateful firewalls with static IP-based rules

Answer

Software-defined networking (SDN) with VLAN segmentation

Answer

Network access control (NAC) with 802.1X port-based authentication

Question 15

A technology company suspects an insider threat is exfiltrating intellectual property. The security team has deployed user and entity behavior analytics (UEBA) and set up data loss prevention (DLP) rules. A UEBA alert flags a senior developer who is accessing the source code repository at 2 AM from a VPN connection that routes through a foreign country. The developer also recently downloaded a large quantity of source code—more than 10 times the normal volume. DLP policies are configured to block emails with attachments over 10 MB. Which of the following should the incident response team do FIRST?

Accepted Answer

Isolate the developer's workstation and revoke access to the source code repository immediately.. The first step in incident response for a suspected insider threat with active exfiltration is to contain the threat by isolating the workstation and revoking access to prevent further data loss. This aligns with the containment phase of incident response. Conducting an interview or reviewing logs can come later, but immediate isolation is critical to stop ongoing exfiltration.

Answer

Implement stricter DLP policies to block large downloads from the repository.

Answer

Conduct an informal interview with the developer to ask about the unusual activity.

Answer

Review DLP logs to confirm that no emails containing source code were sent.