CAS-004 Practice Test 37 — 15 Questions

Question 1

A mid-sized healthcare organization processes protected health information (PHI) and must comply with HIPAA and the GDPR for its EU patients. The organization uses a hybrid cloud environment with on-premises servers and AWS. Recently, an employee's laptop was stolen containing unencrypted PHI. The incident response team was activated. The security architect must determine the best course of action to address compliance obligations. The organization has a data classification policy, but it is not consistently enforced. A business continuity plan exists but has not been tested in two years. The CEO is concerned about reputational damage and legal liability. Which of the following should the security architect recommend FIRST?

Accepted Answer

Notify affected patients and relevant regulatory authorities per breach notification rules. Option B is correct because the primary obligation under both HIPAA and GDPR is to notify affected individuals and authorities within prescribed timeframes (72 hours for GDPR, but HIPAA allows up to 60 days). Notifying demonstrates compliance and mitigates legal risk. Option A is wrong because updating the classification policy is important but is a secondary, long-term task; immediate notification is legally required. Option C is wrong because buying cyber insurance is reactive and does not fulfill notification requirements; it addresses financial risk but not compliance. Option D is wrong while encryption would have prevented this incident, implementing encryption now will not address the current breach; notification must come first.

Answer

Purchase cyber liability insurance to cover potential fines and legal costs

Answer

Implement full-disk encryption on all laptops and mobile devices immediately

Answer

Update the data classification policy to require encryption of all PHI on endpoints

Question 2

An organization is migrating its on-premises monolithic application to a containerized microservices architecture on a Kubernetes cluster. The development team has created a set of Docker images that are stored in a private registry. The security team requires that all container images be scanned for vulnerabilities before deployment. The current CI/CD pipeline uses Jenkins to build images, push them to the registry, and then deploy to Kubernetes via kubectl. The scanning is performed by a tool that generates a report, but developers have been ignoring critical vulnerabilities and deploying anyway. The security team wants to enforce a policy that blocks deployment if the image has any critical or high-severity vulnerabilities. Additionally, the cluster must ensure that containers run with the least privilege and that secrets are not exposed in environment variables. The operations team is concerned about performance overhead from runtime security monitoring.

Which of the following approaches best addresses these requirements while minimizing operational overhead?

Accepted Answer

Implement admission controller webhooks that check vulnerability scan results from the registry before allowing pod creation, and use a service mesh with mutual TLS to encrypt secrets.. Option A is correct because admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure. Option B is incorrect because aborting the Jenkins build does not prevent deployment from other sources (e.g., direct kubectl) and secrets mounted as volumes are still vulnerable to compromise. Option C is incorrect because network policies do not address vulnerability scanning or secret protection. Option D is incorrect because runtime security agents incur performance overhead and do not block deployment upfront.

Answer

Use a custom script in Jenkins to parse the scan report and abort the build if vulnerabilities are found, and store secrets in Kubernetes secrets mounted as volumes.

Answer

Deploy a runtime security agent that monitors container activity and rejects pods that contain known vulnerability signatures, and use Kubernetes RBAC to limit permissions.

Answer

Configure a network policy in Kubernetes to restrict pod-to-pod communication, and use a static analysis tool during development to find coding flaws.

Question 3

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. Option A addresses both issues: cross-region replication ensures KMS availability, and restricting health check ports reduces exposure. Option B increases risk by consolidating to one region. Option C embeds keys in code, violating security best practices. Option D replaces TLS with IPsec, which is unnecessary and adds complexity.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely

Question 4

A financial company is expanding its hybrid cloud architecture. They have an AWS VPC connected to an on-premises network via an IPsec VPN using IKEv2. The on-premises firewall is a Cisco ASA. Recently, users report intermittent connectivity to cloud resources. The security team reviews logs and finds the following message on the ASA: 'no matching crypto map entry for traffic from on-prem to cloud'. The team also suspects potential data leakage due to occasional unencrypted traffic. The corporate policy requires all traffic between environments to be encrypted. The engineer has verified that the IKEv2 proposals match on both sides. The cloud side uses a virtual private gateway with a static route to the on-premises network. Which of the following should the engineer do FIRST to resolve the issue?

Accepted Answer

Check the crypto map configuration on the Cisco ASA and ensure it matches the peer IP and proxy IDs. Option B is correct because the error message directly indicates a crypto map mismatch. Checking and adjusting the crypto map on the ASA to match the peer IP and proxy IDs will resolve the issue. Option A is incorrect because IKEv2 policies already match. Option C is too drastic and not the first step. Option D could actually cause connectivity issues if NAT traversal is required.

Answer

Disable NAT traversal on both VPN endpoints

Answer

Reconfigure the IKEv2 policies on both sides to use different encryption algorithms

Answer

Replace the VPN connection with AWS Direct Connect for dedicated bandwidth

Question 5

A mid-sized e-commerce company has recently experienced a data breach where customer payment card information was exfiltrated. The security team has identified that the breach originated from a compromised web server that was part of a PCI DSS compliant environment. The server was running outdated software and had several known vulnerabilities. Post-incident analysis reveals that the attacker exploited a SQL injection vulnerability in the order-tracking feature. The incident response team followed NIST SP 800-61 guidelines: they contained the threat, eradicated the malicious code, and restored the server from a known clean backup. However, two weeks after the restoration, the same server is again showing signs of similar malicious activity. The server is still in production and handling credit card transactions. Which of the following is the MOST effective course of action to prevent this recurring compromise?

Accepted Answer

Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.. The correct answer is C. The root cause is a code-level vulnerability (SQLi) that was not fixed. Just patching the OS or rebuilding with the same software will not remove the vulnerability. The application code must be reviewed and the SQLi flaw remediated. Option A (replacing the server) does not fix the underlying code. Option B (network segmentation) only contains but does not fix the application vulnerability. Option D (increasing monitoring) is reactive and does not prevent exploitation.

Answer

Replace the web server with a new server running the latest OS and web server version, then redeploy the same web application code.

Answer

Implement network segmentation to isolate the web server and restrict outbound traffic to only essential services.

Answer

Increase logging and deploy a WAF in front of the server with rules to block common SQLi patterns.

Question 6

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

Accepted Answer

Block top secret content and allow confidential content with an override requiring a business justification. Option D is correct because it aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Answer

Encrypt all emails containing any sensitive data and allow delivery

Answer

Block both top secret and confidential content with no override

Answer

Block top secret content and allow confidential content with an audit log

Question 7

A small business has a single physical server running multiple virtual machines (VMs) using Type 2 hypervisor software on a Windows Server host. The host is not joined to a domain. The VMs include an Active Directory domain controller, a file server, and a web server. The company recently suffered a ransomware attack that encrypted all data on the file server VM. The IT administrator restored the file server from a backup, but the ransomware returned within hours. Analysis shows that the ransomware is now spreading to other VMs. The administrator suspects that the hypervisor host itself may be compromised. Which of the following is the MOST effective immediate action to contain the spread and secure the environment?

Accepted Answer

Disconnect the physical host from the network immediately.. Option B is correct because immediately disconnecting the physical host from the network is the most effective immediate action to contain the spread of ransomware. Since the host is compromised and the Type 2 hypervisor runs on top of a Windows Server OS, the attacker can pivot from the host to any VM via the virtual switch. Cutting network connectivity stops all lateral movement and outbound command-and-control traffic, buying time for forensic analysis and remediation.

Answer

Run a full antivirus scan on the host operating system.

Answer

Apply the latest security patches to the hypervisor software.

Answer

Restore all VMs from known clean backups taken before the attack.

Question 8

A large enterprise has deployed a security information and event management (SIEM) system that ingests logs from all critical servers, network devices, and endpoints. The SIEM is configured to correlate events and generate alerts for suspicious activities. Recently, the SOC team has been overwhelmed by a high volume of false positive alerts, particularly from the web server farm. The false positives are mainly triggered by legitimate web crawling and scanning activities from partners and internal tools. The SOC manager wants to reduce false positives without missing real threats. As the security architect, you are asked to recommend a solution. Which of the following is the BEST course of action?

Accepted Answer

Create allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules.. Option D is correct because creating allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules directly addresses the root cause: false positives from trusted entities. This approach preserves detection sensitivity for unknown or malicious sources while suppressing alerts from pre-vetted IPs, reducing alert fatigue without compromising security coverage.

Answer

Increase the event threshold for web server alerts to reduce sensitivity.

Answer

Disable logging of successful requests on the web servers to reduce log volume.

Answer

Tune the SIEM to use more aggressive deduplication and aggregation globally.

Question 9

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Accepted Answer

Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes. Option D is correct because the database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Answer

Immediately block the external IP address at the perimeter firewall

Answer

Disable the database server's network interface

Answer

Review the database server's recent application logs for any anomalies

Question 10

Match each automation security concept (left) with its corresponding best practice (right).

Answer

Scan container images for vulnerabilities before deployment

Answer

Never modify a running instance; redeploy instead

Answer

Store all configuration files in version control

Answer

Use a dedicated vault service to store credentials

Question 11

A global e-commerce company processes payment card data and is required to comply with PCI DSS. During a quarterly vulnerability scan, the security team discovers that a web application firewall (WAF) rule is blocking legitimate traffic, causing transaction failures. The WAF is a critical compensating control for a known vulnerability in the application that cannot be patched for 90 days. The compliance officer is concerned about maintaining PCI DSS compliance while ensuring business continuity. The security team proposes temporarily disabling the WAF to restore service while they fine-tune the rules. Which of the following is the BEST action?

Accepted Answer

Temporarily modify the WAF rule set to allow legitimate traffic while maintaining security, and schedule a permanent fix within 24 hours.. Option B is correct because fine-tuning the WAF rules quickly is the best approach to restore service while maintaining security. Option A is wrong because disabling the WAF would remove the compensating control and violate PCI DSS requirement 6.6. Option C is wrong because relying solely on network segmentation may not provide equivalent protection. Option D is wrong because accepting risk without a compensating control is not permitted under PCI DSS.

Answer

Segment the affected application from the rest of the network and remove the WAF from the data path.

Answer

Disable the WAF immediately to restore service and document the decision as a risk acceptance.

Answer

Accept the risk of transaction failures and keep the WAF in place until the rules are fully tested.

Question 12

A large healthcare organization has implemented a zero-trust network architecture (ZTNA) to secure access to its electronic health record (EHR) system. The architecture uses a software-defined perimeter (SDP) where all users must authenticate and be authorized before accessing the EHR. The EHR system is hosted in a private cloud and communicates with a legacy billing system that cannot support modern authentication protocols. The billing system is accessed by a small number of finance employees via a dedicated VPN. Recently, an auditor discovered that a finance employee's credentials were compromised, and the attacker used the VPN to access the billing system and exfiltrate patient billing data. The security architect must prevent such lateral movement while maintaining access for legitimate users. Which of the following is the BEST course of action?

Accepted Answer

Implement a jump server with multi-factor authentication (MFA) and session recording, and restrict the VPN to only allow access to the jump server. Option C is correct because a jump server with MFA and session recording creates a controlled, auditable choke point that prevents lateral movement from the VPN to the billing system. By restricting the VPN to only allow access to the jump server, the attacker cannot directly reach the billing system even with compromised VPN credentials, and MFA adds an additional layer of authentication. Session recording provides forensic evidence for post-incident analysis, addressing the auditor's concern without requiring the legacy billing system to support modern protocols.

Answer

Apply micro-segmentation to isolate the billing system and allow only finance VLAN traffic

Answer

Remove the VPN and allow finance employees to access the billing system directly via RDP over the internet

Answer

Upgrade the billing system to support OAuth 2.0 and integrate it with the ZTNA SDP

Question 13

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a public-facing e-commerce site. The site has been experiencing intermittent false positives that block legitimate customers during checkout. The WAF is deployed in blocking mode with a rule set that includes SQL injection and cross-site scripting (XSS) signatures. The engineer notices that legitimate credit card numbers containing the string 'OR' are being blocked. The site uses HTTPS and input validation on the server side. Which of the following actions would BEST resolve the false positives while maintaining security?

Accepted Answer

Disable the specific signature that matches the string 'OR' in the SQL injection rule set.. Option B is correct because the false positive is caused by a specific SQL injection signature that matches the string 'OR' within legitimate credit card numbers. Disabling only that signature preserves the WAF's protection against actual SQL injection and XSS attacks while eliminating the false positive. The server-side input validation and HTTPS provide additional layers of defense, so removing the entire rule or switching to detection mode would unnecessarily weaken security.

Answer

Remove the WAF and rely on server-side input validation alone.

Answer

Change the WAF from blocking mode to detection mode.

Answer

Add a custom rule to allow all traffic to the checkout page.

Question 14

Match each container security concept with its correct description.

Answer

Container runtime security

Answer

Image signing

Answer

Secrets management

Answer

Orchestration security

Answer

Enforces system call filtering and access controls at runtime

Answer

Ensures container images are not tampered with using cryptographic hashes

Answer

Safely injects credentials into containerized applications at runtime

Answer

Manages network segmentation and pod security policies in clusters

Question 15

A company's development team uses a CI/CD pipeline hosted in a public cloud. The pipeline builds container images, pushes them to a private registry, and deploys them to a Kubernetes cluster. A security engineer must ensure that only signed and vulnerability-scanned images are deployed. The engineer has configured the registry to require signatures and the CI/CD pipeline to scan images. However, deployments are still failing because unsigned images are being pulled. The engineer discovers that developers can push images directly to the registry bypassing the CI/CD pipeline and that Kubernetes nodes can pull images without signature verification. Which of the following should the engineer implement to enforce image signing and scanning?

Accepted Answer

Restrict registry write access to the CI/CD service account and enable image signature verification via admission controller in Kubernetes.. Option C is correct because it addresses both root causes: restricting registry write access to only the CI/CD service account prevents developers from bypassing the pipeline, and enabling image signature verification via an admission controller (e.g., using Kubernetes ImagePolicyWebhook or a tool like Cosign with OCI signatures) ensures that only signed and scanned images are allowed to run in the cluster. This combination enforces the security policy at both the registry and the cluster level, closing the gaps identified in the scenario.

Answer

Implement a manual approval step in the pipeline for each deployment.

Answer

Use network policies to block all outbound traffic from developer workstations to the container registry.

Answer

Configure the CI/CD pipeline to perform vulnerability scanning after every build.