CAS-004 Practice Test 36 — 15 Questions

Question 1

A network administrator is configuring a firewall to allow only necessary traffic to a web server. The server should be accessible from the internet on port 443 and from a management subnet on port 22. Which firewall rule ensures least privilege?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow traffic from any to port 443, and from management subnet to port 22; deny all else. It explicitly allows only the required traffic (HTTPS on port 443 from any source, SSH on port 22 from the management subnet) and then denies all other traffic by default. This follows the principle of least privilege by ensuring no unintended services or sources are permitted, which is the core goal of firewall rule design.

Answer

Allow traffic from management subnet to port 443 and any to port 22

Answer

Allow traffic from any source to ports 443 and 22

Answer

Allow all traffic to the server, then block specific ports

Question 2

A security architect is evaluating cryptographic agility for a system that must be resistant to quantum computing attacks. Which TWO algorithms are part of the NIST PQC standards? (Select TWO.)

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium (option B) is correct because NIST selected it in July 2022 as a post-quantum digital signature algorithm, standardized in FIPS 204 (ML-DSA), designed to resist quantum attacks via lattice-based cryptography. CRYSTALS-Kyber (option E) is also correct because NIST selected it as the post-quantum key-encapsulation mechanism (KEM), standardized in FIPS 203 (ML-KEM), also based on module-lattice hardness. RSA-4096 (option A) is not a PQC algorithm; its security relies on integer factorization, which Shor's algorithm on a quantum computer can break. AES-256 (option C) is a symmetric cipher, not a NIST PQC standard, though it retains quantum resistance via Grover only reducing effective strength to 128 bits. SHA-256 (option D) is a hash function, not a PQC algorithm, and is likewise not part of the NIST PQC standardization selections.

Answer

RSA-4096

Answer

AES-256

Answer

SHA-256

Question 3

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. Option C is correct because an SBOM's core purpose is to enumerate every software component — including open-source libraries and their exact versions — so that downstream consumers can identify what is inside a product and trace provenance. Option E is correct because SBOMs enable dependency analysis, allowing organizations to correlate listed components and versions against vulnerability databases (e.g., NVD/CVE feeds) to detect known vulnerabilities in the supply chain. Together, these two form the essential SBOM strategy: knowing what components exist and analyzing their dependencies for risk. Option A (penetration testing results) is a point-in-time security assessment, not a component inventory, so it is not an SBOM element. Option B (employee background checks) is a personnel security control unrelated to software composition. Option D (network flow logs) captures runtime traffic metadata, not the software components or dependencies that an SBOM documents.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 4

A mid-sized e-commerce company has recently experienced a data breach where customer payment card information was exfiltrated. The security team has identified that the breach originated from a compromised web server that was part of a PCI DSS compliant environment. The server was running outdated software and had several known vulnerabilities. Post-incident analysis reveals that the attacker exploited a SQL injection vulnerability in the order-tracking feature. The incident response team followed NIST SP 800-61 guidelines: they contained the threat, eradicated the malicious code, and restored the server from a known clean backup. However, two weeks after the restoration, the same server is again showing signs of similar malicious activity. The server is still in production and handling credit card transactions. Which of the following is the MOST effective course of action to prevent this recurring compromise?

Accepted Answer

Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.. The root cause of the breach is a SQL injection vulnerability in the order-tracking feature. Simply patching the server or redeploying the same code (Option B), implementing network segmentation (Option C), or adding a WAF (Option D) are all band-aid solutions that do not address the underlying flawed code. To prevent recurrence, the application code must be reviewed and the SQL injection flaw remediated by using parameterized queries. After fixing the code, redeploying after passing a static code analysis scan ensures the vulnerability is resolved. Therefore, option A is the most effective course of action.

Answer

Replace the web server with a new server running the latest OS and web server version, then redeploy the same web application code.

Answer

Implement network segmentation to isolate the web server and restrict outbound traffic to only essential services.

Answer

Increase logging and deploy a WAF in front of the server with rules to block common SQLi patterns.

Question 5

An OpenVPN configuration file is shown. A security auditor recommends replacing the cipher and auth directives. Which of the following is the BEST replacement pair from a security engineering perspective?

Accepted Answer

cipher AES-256-GCM and auth SHA256. Cipher AES-256-GCM and auth SHA256, is the best replacement pair. AES-256-GCM is an AEAD cipher that provides both confidentiality and integrity, making the auth directive redundant but still compatible with SHA256. AES-256-GCM is considered strong and current. Option B uses AES-128-GCM with SHA384; while still secure, AES-256 is generally preferred for higher security margins. Option C uses 3DES-168 and MD5, both of which are weak and deprecated. Option D uses Blowfish-128 and SHA1, where Blowfish is outdated and SHA1 is considered weak.

Answer

cipher AES-128-GCM and auth SHA384

Answer

cipher 3DES-168 and auth MD5

Answer

cipher Blowfish-128 and auth SHA1

Question 6

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Accepted Answer

Use try-except blocks to handle exceptions gracefully. Using try-except blocks in Python allows the script to catch and handle exceptions (e.g., missing environment variables, API call failures) gracefully without crashing. This is a fundamental secure coding practice that prevents unhandled errors from exposing sensitive information or causing unpredictable behavior in automated compliance checks.

Answer

Use os.system() to run shell commands for resource management

Answer

Hardcode API tokens as fallback if environment variables are missing

Answer

Log the API tokens for troubleshooting purposes

Question 7

An organization's security team is reviewing security metrics to present to the board. Which THREE of the following are commonly used Key Performance Indicators (KPIs) for a security program? (Select THREE.)

Accepted Answer

Patch compliance percentage. Patch compliance percentage (A) is a valid KPI because it measures the proportion of systems that have current security patches applied within a defined SLA, directly reflecting vulnerability exposure reduction and the effectiveness of patch management. Mean time to respond (B) is a KPI that quantifies the average elapsed time from alert or incident identification to containment/remediation action, showing the operational efficiency of the incident response process. Mean time to detect (E) is a KPI measuring the average time between an actual compromise or event occurring and its detection, which gauges monitoring and detection capability maturity. Number of firewalls deployed (C) is a raw inventory count, not a performance measure, so it is a metric rather than a KPI. Vulnerabilities by severity (D) is a point-in-time risk/volume metric describing the current state, not a performance indicator of the security program's effectiveness over time.

Answer

Number of firewalls deployed

Answer

Vulnerabilities by severity

Question 8

A security team is auditing a Kubernetes cluster. They find a pod running with `securityContext`: `privileged: true` and `runAsUser: 0`. Which of the following is the most critical risk?

Accepted Answer

The pod can access all node resources and potentially escape to the host.. Setting `privileged: true` and `runAsUser: 0` (root) in a pod's securityContext grants the container unrestricted access to the host's kernel capabilities. This effectively disables all container isolation, allowing the container to perform privileged operations such as loading kernel modules, accessing raw block devices, and using `nsenter` or `chroot` to escape the container and gain root-level access to the underlying node. This is the most critical risk because it directly compromises the host and potentially the entire cluster.

Answer

The pod cannot communicate with other pods.

Answer

The pod cannot mount volumes.

Answer

The pod will be killed by Kubernetes if it consumes too much memory.

Question 9

A SOC team is implementing a SOAR playbook to automate response to phishing emails reported by users. Which step should be included in the playbook to prevent other users from accessing the malicious link?

Accepted Answer

Block the malicious URL in the web proxy. Blocking the malicious URL in the web proxy prevents all users from accessing the phishing link, effectively containing the threat. This step is proactive and protects the entire organization, not just the reporter.

Answer

Isolate the reporter's workstation

Answer

Reset the reporter's password

Answer

Delete the email from all mailboxes

Question 10

After a risk assessment, a company identifies that the residual risk for a critical application is higher than the risk appetite. The risk owner proposes implementing additional controls to reduce the risk further. Which risk treatment option does this represent?

Accepted Answer

Risk mitigation. Risk mitigation involves implementing additional controls to reduce the likelihood or impact of a risk. Since the residual risk exceeds the risk appetite, the risk owner proposes further controls to lower it, which is the definition of risk mitigation. This aligns with the goal of bringing risk within acceptable limits.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 11

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

Accepted Answer

IaaS. IaaS (Infrastructure as a Service) places the most security responsibility on the customer because the provider only manages the physical hardware, hypervisor, and network fabric. The customer is responsible for the guest OS, middleware, runtime, applications, and data — including patching, hardening, IAM, and encryption. Under SOC 2, this means the customer must implement and evidence most of the Trust Services Criteria controls themselves.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 12

A security engineer is configuring a VPN between two sites and needs to ensure data confidentiality and integrity. Which IPsec mode and protocol combination should be used to encrypt the entire IP packet including the header?

Accepted Answer

Tunnel mode with ESP. IPsec tunnel mode with ESP encrypts and authenticates the entire IP packet, providing confidentiality and integrity. Transport mode only encrypts the payload, and AH provides integrity without encryption.

Answer

Transport mode with ESP

Answer

Transport mode with AH

Answer

Tunnel mode with AH

Question 13

A security analyst is reviewing an incident where an attacker used a compromised service account to perform lateral movement within an Active Directory environment. The analyst wants to identify other systems that the attacker may have accessed using this account. Which two data sources would be most effective for this investigation? (Choose two.)

Accepted Answer

Domain controller security logs for Kerberos service ticket requests (Event ID 4769) involving the service account.. To track lateral movement of a service account, the analyst needs authentication records across the domain. Windows Security event logs (4624) show successful logons per system, and domain controller Kerberos service ticket requests (4769) show which services the account requested tickets for. Together, these reveal the systems the attacker accessed. Other sources lack account-specific authentication details.

Answer

SIEM alerts for unusual process execution on the service account's original workstation.

Answer

Antivirus logs on the domain controller.

Answer

Firewall logs showing outbound connections from the service account's workstation.

Question 14

A global e-commerce company processes payment card data and is required to comply with PCI DSS. During a quarterly vulnerability scan, the security team discovers that a web application firewall (WAF) rule is blocking legitimate traffic, causing transaction failures. The WAF is a critical compensating control for a known vulnerability in the application that cannot be patched for 90 days. The compliance officer is concerned about maintaining PCI DSS compliance while ensuring business continuity. The security team proposes temporarily disabling the WAF to restore service while they fine-tune the rules. Which of the following is the BEST action?

Accepted Answer

Temporarily modify the WAF rule set to allow legitimate traffic while maintaining security, and schedule a permanent fix within 24 hours.. It balances the need for business continuity with the requirement to maintain the WAF as a compensating control for the unpatched vulnerability. By temporarily modifying the WAF rule set to allow legitimate traffic while still blocking malicious traffic, the team preserves the security control and avoids a compliance violation. Scheduling a permanent fix within 24 hours ensures the change is temporary and documented, aligning with PCI DSS change control and risk management requirements. This approach avoids the extremes of disabling the WAF entirely or allowing transaction failures.

Answer

Segment the affected application from the rest of the network and remove the WAF from the data path.

Answer

Disable the WAF immediately to restore service and document the decision as a risk acceptance.

Answer

Accept the risk of transaction failures and keep the WAF in place until the rules are fully tested.

Question 15

A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?

Accepted Answer

Authenticate and authorize every device and user for every resource access, and encrypt all communication.. Zero trust is built on the principle of 'never trust, always verify.' This means every device and user must be authenticated and authorized for each resource access, regardless of network location, and all communication should be encrypted to protect data in transit. This eliminates implicit trust based on network perimeter and enforces least-privilege access.

Answer

Place all resources on the internal network and rely on perimeter firewalls.

Answer

Implement VLANs to separate traffic based on user roles.

Answer

Use a VPN to secure all remote access to the corporate network.