CAS-004 Practice Test 36 — 15 Questions

Question 1

The exhibit shows results from a CIS Controls assessment. Based on the findings, which control deficiency poses the greatest risk to the organization and should be prioritized for remediation?

Accepted Answer

Network monitoring and defense (Control 13) because it has the lowest overall score and intrusion detection is missing. Option C is correct because the network monitoring and defense control has the lowest overall score (1/5), and within it, intrusion detection is completely unimplemented (0/5), leaving the organization blind to active attacks. Option A is wrong because data protection has a higher overall score (2/5) and its subcontrols are partially implemented. Option B is wrong because incident response has a score of 3/5, which is relatively better, and the plan is fully in place; testing can be improved but is not as critical. Option D is wrong because data encryption at rest is already highly implemented (4/5).

Answer

Incident response (Control 8) because testing is only at 1/5

Answer

Data protection (Control 3) because sensitive data inventory is not implemented

Answer

Data encryption at rest (Subcontrol 3.2) because it received a score of 4/5, indicating room for improvement

Question 2

A cloud security team uses AWS and has configured a virtual private cloud (VPC) with a public subnet for a web application. The web servers in the public subnet have security groups that allow inbound HTTP/HTTPS from 0.0.0.0/0. The security team receives an alert that an EC2 instance in the public subnet is making outbound connections to an IP address that is listed on a threat intelligence feed as a known mining pool. The instance's security group allows all outbound traffic. The team suspects the instance is compromised and running cryptocurrency mining malware. Which of the following should be the FIRST action to take?

Accepted Answer

Isolate the instance by revoking its security group egress rules temporarily to prevent further communication.. Option D is correct because isolating the instance by revoking its security group egress immediately cuts off the communication to the mining pool, containing the threat. Option A (terminating) loses evidence. Option B (investigating) allows the attack to continue. Option C (temporary rule blocking specific IP) may not block future connections.

Answer

Start a full antivirus scan on the instance and monitor the network logs.

Answer

Take a forensic snapshot of the instance and then terminate it.

Answer

Modify the security group inbound rules to block traffic from the miner IP only.

Question 3

Refer to the exhibit. A security analyst notices that the pod is running with a service account token mounted. Which security best practice should be implemented to reduce the risk of token theft in container environments?

Accepted Answer

Set automountServiceAccountToken to false in the pod spec.. Option B is correct because setting automountServiceAccountToken to false in the pod spec prevents the automatic mounting of the service account token, reducing the risk of theft. Option A is incorrect because disabling the entire service account may break functionality if the pod needs API access; the goal is to prevent token exposure while still allowing explicit token mounting if necessary. Option C is incorrect because changing the container runtime does not address token mounting. Option D is incorrect because storing the token in a secret and mounting it increases exposure rather than reducing it.

Answer

Store the token in a Kubernetes secret and mount it.

Answer

Use a different container runtime.

Answer

Disable the service account for the pod.

Question 4

A security analyst is reviewing a CI/CD pipeline configuration. The pipeline uses a containerized application and includes automated security scanning. Which TWO practices should be implemented to ensure container immutability and reduce the attack surface?

Accepted Answer

Run containers with read-only root filesystem.. Option B is correct because running containers with a read-only root filesystem enforces immutability, preventing any modifications at runtime. Option D is correct because scanning images for vulnerabilities at build time reduces the attack surface by catching issues before deployment. Option A is incorrect because using the same base image for all environments does not directly relate to immutability or attack surface reduction. Option C is incorrect because storing credentials in environment variables is insecure and should be avoided. Option E is incorrect because running containers as root weakens security and increases attack surface.

Answer

Use the same base image for all environments.

Answer

Run containers as root.

Answer

Store credentials in environment variables.

Question 5

Refer to the exhibit. A security analyst notices that users from the internet can reach the web server at 10.0.1.100 on port 443, but they cannot reach it on port 8443. What is the most likely cause?

Accepted Answer

The web server is not listening on port 8443. The firewall ACL permits both ports, so the firewall is not the issue. The most likely cause is that the web server is not listening on port 8443. Option A is incorrect because the ACL permits it. Option C is incorrect because the ACL order is fine. Option D is incorrect because the ACL permits any source.

Answer

The ACL only permits traffic from specific source IPs

Answer

The firewall rule order is incorrect

Answer

The firewall is blocking all traffic on port 8443

Question 6

A security engineer is hardening a Linux server. Which TWO of the following are best practices for preventing privilege escalation attacks?

Accepted Answer

Apply kernel hardening with sysctl. Options B and E are correct. SELinux (B) provides mandatory access control that restricts processes, and kernel hardening with sysctl (E) reduces the attack surface. Option A is incorrect because removing all SUID bits may break essential system functionality. Option C is incorrect because disabling all non-root user accounts is impractical and violates least privilege. Option D is incorrect because restricting cron jobs to root only is not directly related to privilege escalation prevention.

Answer

Disable all user accounts except root

Answer

Remove the SUID bit from all binaries

Answer

Restrict cron jobs to root only

Question 7

A security analyst is reviewing web server logs and notices repeated requests to URLs containing sequences like '/../../../etc/shadow' and '/../../../etc/passwd'. Which TWO actions should the analyst take as part of the immediate incident response process?

Accepted Answer

Check for successful exploitation by reviewing file access logs. The correct actions are A and D. Blocking the source IP at the firewall (A) helps prevent further exploitation attempts. Checking for successful exploitation (D) is critical to determine if any files were accessed or exfiltrated. Running antivirus (B) is not directly relevant to a directory traversal attack. Rebuilding the server from a known good state (C) is premature without investigation. Disabling the web server (E) is too disruptive and unnecessary if the threat is contained.

Answer

Run a full antivirus scan on the web server

Answer

Rebuild the web server from a known good backup

Answer

Disable the web server until a patch is applied

Question 8

Based on the iptables exhibit, a security analyst has received an alert that an external IP (203.0.113.5) is attempting to connect to TCP port 3389 on the server. Which of the following best describes the current rule set's treatment of this traffic?

Accepted Answer

The connection will be logged and then dropped by the default policy. The correct answer is B. The rule set has a LOG rule for tcp dpt:3389 from any source, which will log the packet but not explicitly accept or drop it; since the policy in the INPUT chain is DROP, the packet will be dropped after being logged. Option A is incorrect because the LOG rule does not drop, only logs. Option C is incorrect because there is no ACCEPT rule for 3389. Option D is incorrect because the default policy is DROP.

Answer

The connection will be allowed through because there is no explicit DROP rule

Answer

The connection will be accepted because there is a LOG rule

Answer

The connection will be logged and then dropped by the LOG rule

Question 9

A company's Jenkins pipeline builds container images by mounting the Docker socket from the host into the Jenkins container (Docker-in-Docker). An auditor flags this as a security risk because it gives the Jenkins container root access to the host's Docker daemon. The development team wants to maintain the same functionality without the risk. Which alternative should they implement?

Accepted Answer

Configure the Jenkins Kubernetes plugin to launch dynamic pod agents that build images without needing a Docker socket.. Using the Kubernetes plugin with dynamic agents isolates builds without exposing the host Docker socket. Option B is correct. Option A (DooD) still requires Docker socket access. Option C stops automation. Option D is a different approach but doesn't solve the immediate issue.

Answer

Replace Jenkins with Ansible to build and deploy containers.

Answer

Disable the pipeline and require manual builds on a dedicated build server.

Answer

Use Docker-outside-of-Docker (DooD) by mounting the Docker socket into a sibling container.

Question 10

An organization uses Ansible to automate server configuration for a hybrid cloud environment. The security team requires that sensitive data such as API keys and passwords are not exposed in the Ansible playbooks or logs. The Ansible control node is shared among several administrators. What is the best approach to protect these secrets?

Accepted Answer

Use Ansible Vault to encrypt the secret variables and restrict access to the vault password file.. Ansible Vault encrypts sensitive data within playbooks. Option A is correct. Plaintext (B) is insecure. Environment variables (C) can be logged. Removing secrets (D) is impractical.

Answer

Store secrets in plaintext in a separate file and set restrictive file permissions.

Answer

Remove all secrets from automation and require manual entry during each playbook run.

Answer

Define secrets as environment variables on the control node and reference them in playbooks.

Question 11

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. Option D (Implement parameterized queries in the application code) is the most effective long-term fix, but since the development team is slow, the best immediate control is to add a WAF rule to block SQL injection patterns. Option A (Disable the search feature) is too disruptive. Option B (Increase IDS sensitivity) would only detect, not prevent. Option C (Segment the database server) is good but does not address the vulnerability at the application layer.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 12

An organization has recently migrated its on-premises data center to a public cloud. The security team notices that several virtual machines (VMs) in the same subnet are communicating with each other without any restrictions. The company policy requires that only specific application traffic (e.g., database queries from web servers) be allowed between VMs, and all other inter-VM traffic must be blocked to comply with a zero-trust model. The cloud provider offers native security group and network ACL features. The architect must design a solution that enforces the policy with minimal administrative overhead and supports future expansion.

Which of the following is the BEST course of action?

Accepted Answer

Place all VMs in the same subnet and configure security groups that only allow necessary inter-VM traffic (e.g., web-to-db), with a default deny rule. Using security groups (instance-level firewalls) allows per-VM permit rules and denies by default, meeting zero-trust requirements. Option B is wrong because network ACLs are stateless and require rules for both directions, increasing complexity. Option C is wrong because moving to different VPCs breaks application connectivity unnecessarily. Option D is wrong because a third-party firewall is an additional cost and complexity without clear benefit over native security groups.

Answer

Move each application tier to a separate VPC and use VPC peering with strict routing policies

Answer

Place all VMs in the same subnet and configure network ACLs with explicit allow rules for required traffic and a deny-all rule for other traffic

Answer

Keep all VMs in the same subnet but deploy a third-party next-generation firewall as a virtual appliance to inspect and filter inter-VM traffic

Question 13

A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?

Accepted Answer

Use EDR to identify the process or service generating the outbound connections on the web server.. Option C (Check EDR telemetry on the host to identify the process making the outbound connections) is the best first step because it provides visibility into the exact source of the traffic. Option A (Block the outbound HTTPS rule immediately) may disrupt legitimate traffic and does not help identify the scope. Option B (Enable full SSL inspection on the firewall) is resource-intensive and can be deployed later. Option D (Isolate the host from the network) is a containment step but should follow identification to ensure proper forensic collection.

Answer

Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.

Answer

Isolate the web server from the network to prevent further data exfiltration.

Answer

Immediately remove the outbound HTTPS rule to block the traffic.

Question 14

A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?

Accepted Answer

Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.. Option B (Review microsegmentation firewall rules for the application's subnet) is the most direct step because the architect suspects the microsegmentation rules are blocking traffic. Option A (Deploy a VPN) would bypass zero-trust principles. Option C (Increase log verbosity) is a diagnostic step but not the first action. Option D (Reset user credentials) is unrelated to the issue.

Answer

Deploy a VPN to provide a secure tunnel for remote users.

Answer

Reset the affected users' credentials and force them to re-authenticate.

Answer

Increase logging verbosity on the identity-aware proxy to capture more details.

Question 15

You are a SOC analyst at a mid-sized company. The SIEM alerts on anomalous outbound traffic from a finance workstation to an external IP address never seen before. The workstation belongs to an employee in the accounts payable department. The alert shows that 500 MB of data was transferred via SMB over the internet, which is unusual because internal file shares are normally used. The employee is currently logged in and is in a meeting across the building. The initial triage confirms the workstation is not domain-joined and has been bypassing corporate firewall rules using a personal VPN. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the workstation by disabling the network port or using endpoint security tools to block connectivity.. Option C is correct because you must contain the exfiltration by disconnecting the workstation from the network. This stops the data transfer and prevents further damage. Option A is premature without containment. Option B may be necessary but not first. Option D could alert the potential insider.

Answer

Escalate the incident to the incident response team lead.

Answer

Contact the employee's manager to discuss the situation.

Answer

Interview the employee about the suspicious activity.

CAS-004 Practice Test 36 — 15 Questions

Exhibit

CAS-004 Practice Test 36 — 15 Questions

Exhibit