CAS-004 Practice Test 37 — 15 Questions

Question 1

A company uses an API gateway to manage their microservices. Which security control should the gateway enforce to prevent abuse from excessive API calls?

Accepted Answer

Rate limiting. Rate limiting is the API gateway control that caps the number of requests a client can make within a defined time window (e.g., 100 requests/minute), directly preventing abuse from excessive API calls, brute-force attempts, and denial-of-service. It is enforced at the gateway before requests reach backend microservices.

Answer

JWT verification

Answer

Input validation

Answer

OAuth 2.0

Question 2

An organization is adopting a DevSecOps approach and wants to integrate security early in the development lifecycle. Which practice involves creating visual representations of threats and identifying potential attack vectors during the design phase?

Accepted Answer

Threat modeling. Threat modeling is a structured process that visually maps system components, data flows, and trust boundaries to identify potential threats and attack vectors during the design phase. It aligns with DevSecOps by shifting security left, enabling teams to address risks before code is written. Frameworks like STRIDE and tools like Microsoft Threat Modeling Tool are commonly used to create these visual representations.

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Answer

Runtime application self-protection (RASP)

Question 3

A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.

Answer

Site-to-site VPN over the internet

Answer

AWS Client VPN

Answer

AWS Transit Gateway with internet gateway

Question 4

A security team is hardening a Kubernetes cluster. Which resource should be used to define fine-grained rules for which pods can communicate with each other?

Accepted Answer

NetworkPolicy. NetworkPolicy is the Kubernetes resource used to define fine-grained rules for pod-to-pod communication. It acts as a firewall for pods, allowing or denying traffic based on labels, namespaces, and ports. This is essential for microsegmentation and hardening cluster security.

Answer

Admission Controller

Answer

PodSecurityPolicy

Answer

RBAC

Question 5

Drag and drop the steps to implement a DLP policy to prevent credit card data exfiltration via email into the correct order.

Accepted Answer

1. Classify data, 2. Create policy, 3. Define match condition, 4. Set action, 5. Enable and test. DLP implementation: classify data, create policy, define match condition, set action, then enable and test.

Answer

1. Create policy, 2. Classify data, 3. Define match condition, 4. Set action, 5. Enable and test

Answer

1. Define match condition, 2. Classify data, 3. Create policy, 4. Set action, 5. Enable and test

Answer

1. Classify data, 2. Create policy, 3. Enable and test, 4. Define match condition, 5. Set action

Question 6

A risk assessment report is being prepared for senior management. Which TWO of the following should be included to effectively communicate risk?

Accepted Answer

Risk register with scores. Option B (Risk register with scores) is correct because a risk register provides senior management with a structured, prioritized view of identified risks, their likelihood and impact scores, and current status, which is essential for informed decision-making at an executive level. Option C (Executive summary) is correct because senior management needs a concise, high-level overview of the most significant risks, key findings, and recommended actions, enabling them to grasp the risk posture quickly without wading through technical detail. Option A (Remediation deadlines) is not appropriate as a primary communication element for senior management, since deadlines are operational details better suited to tactical plans or project schedules rather than strategic risk communication. Option D (Names of employees responsible) is not included because attributing risk ownership to specific individuals is a management/accountability detail that does not effectively convey the nature or severity of risk to executives. Option E (Detailed control configurations) is not included because granular technical settings are far too low-level for senior management and belong in technical documentation or audit workpapers, not executive risk reporting.

Answer

Remediation deadlines

Answer

Names of employees responsible

Answer

Detailed control configurations

Question 7

A security architect is designing a key management system for a multinational corporation that must comply with FIPS 140-3 Level 3. The system will store long-term asymmetric private keys used for digital signatures. The architect must ensure that the private keys are protected against physical extraction and that cryptographic operations are performed within a tamper-responsive environment. Which of the following is the MOST appropriate solution?

Accepted Answer

Use a Hardware Security Module (HSM) that is FIPS 140-3 Level 3 validated for key storage and cryptographic operations.. FIPS 140-3 Level 3 requires tamper-responsive physical security and identity-based authentication. An HSM validated to this level provides a hardened environment that detects and responds to tampering, such as by zeroizing keys. It also performs cryptographic operations internally, preventing key exposure. Software keystores, TPMs, and Level 2 cloud KMS solutions do not meet the tamper-responsive and physical extraction resistance requirements for Level 3.

Answer

Implement a Trusted Platform Module (TPM) 2.0 on each server to store private keys and perform signing operations.

Answer

Store private keys in a cloud key management service (KMS) that uses FIPS 140-2 Level 2 validated hardware.

Answer

Store private keys in a software-based keystore encrypted with a passphrase and implement strict access controls.

Question 8

Which of the following is a key principle of the zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust is built on the principle 'never trust, always verify' — no user, device, or network segment is implicitly trusted based on location. Every access request must be authenticated, authorized, and continuously validated regardless of whether it originates inside or outside the traditional perimeter. This is the foundational tenet articulated in NIST SP 800-207.

Answer

Trust all internal traffic

Answer

Verify once, trust forever

Answer

Trust but verify

Question 9

A company's security policy requires all sensitive data to be encrypted at rest. However, a business unit requests an exception to store certain data unencrypted due to performance constraints. Which document should govern the exception process?

Accepted Answer

Security policy. The security policy is the overarching document that defines the organization's security requirements and typically includes provisions for exceptions, including the process for requesting, reviewing, and approving exceptions to policy. Since the requirement to encrypt sensitive data at rest originates from the security policy, any exception to that requirement must be governed by the same policy's exception process. The security policy should specify who can approve exceptions, under what conditions, and for how long.

Answer

Risk treatment plan

Answer

Acceptable use policy

Answer

Data classification standard

Question 10

A security analyst is using a SOAR platform to automate response to phishing emails reported by users. The playbook should perform the following actions in order: (1) extract indicators from the email, (2) query threat intelligence feeds for reputation, (3) if malicious, block the sender's domain at the email gateway and delete the email from all user inboxes. Which type of playbook step is most appropriate for step 3?

Accepted Answer

Action step. Step 3 involves performing concrete actions: blocking the sender's domain and deleting the email. In SOAR playbooks, these are action steps that execute response activities.

Answer

Playbook trigger

Answer

Output step

Answer

Conditional step

Question 11

A financial services company uses a continuous integration/continuous delivery (CI/CD) pipeline to deploy microservices. The security team wants to ensure that no secrets (e.g., API keys, database passwords) are hard-coded in source code repositories. Which tool or practice is most appropriate for detecting secrets before they are committed?

Accepted Answer

Implement a pre-commit hook using git-secrets or similar. A pre-commit hook using a tool like git-secrets scans staged changes for patterns matching common secret formats (e.g., AWS keys, passwords) before the commit is finalized. This prevents secrets from ever entering the local repository, which is the earliest and most effective point of control. Unlike later-stage scans, pre-commit hooks catch issues before they are pushed to shared branches or CI/CD pipelines.

Answer

Run dynamic application security testing (DAST) on deployed apps

Answer

Perform static application security testing (SAST) in the build pipeline

Answer

Deploy runtime application self-protection (RASP)

Question 12

Which THREE of the following are key components of a zero-trust security architecture? (Select THREE).

Accepted Answer

Micro-segmentation. Micro-segmentation (B) is a core zero-trust component because it divides the network into granular zones and enforces policy between workloads, preventing lateral movement even after a breach. Least privilege access control (D) is essential since zero trust grants only the minimum permissions needed for a specific task, typically enforced through just-in-time and just-enough-access policies rather than broad standing rights. Continuous monitoring of user and device behavior (E) is required because zero trust never assumes trust permanently; it continuously validates identity, device posture, and context through telemetry and analytics to make real-time access decisions. By contrast, a VPN concentrator (A) reflects the traditional perimeter model of granting broad network access once authenticated, which contradicts zero-trust principles. Implicit trust for internal network traffic (C) is the exact opposite of zero trust, which assumes no implicit trust based on network location and verifies every request explicitly.

Answer

VPN concentrator

Answer

Implicit trust for internal network traffic

Question 13

An organization is adopting a SASE architecture to provide secure access to cloud applications. Which component is essential for enforcing security policies based on user identity and device posture?

Accepted Answer

Zero Trust Network Access (ZTNA). Zero Trust Network Access (ZTNA) is essential for enforcing security policies based on user identity and device posture in a SASE architecture. ZTNA provides secure, identity-based access to applications, ensuring that only authenticated and authorized users with compliant devices can connect, regardless of location.

Answer

Firewall as a Service (FWaaS)

Answer

Secure Web Gateway (SWG)

Answer

Cloud Access Security Broker (CASB)

Question 14

A financial institution manages customer data through a web application built on a LAMP stack. The application uses a third-party library for PDF generation that was patched last year. Recently, the security team discovered that an attacker exploited an unpatched vulnerability in the library to execute arbitrary code on the server. The library vendor has released an update, but the development team is concerned that updating the library will break several custom features that rely on its internal API. The CIO wants to minimize risk while maintaining business continuity. The application is critical to daily operations, and any downtime would result in significant revenue loss. Which course of action should the security analyst recommend?

Accepted Answer

Implement a web application firewall (WAF) with a custom rule to block known attack patterns against the library, and then schedule the patch for the next maintenance window. It balances risk mitigation with business continuity. A WAF with a custom rule can block the specific attack patterns targeting the unpatched library, providing immediate protection without disrupting the application. Scheduling the patch for the next maintenance window ensures that the update is applied in a controlled manner, allowing time to test and address any compatibility issues with custom features. This approach minimizes downtime and revenue loss while addressing the vulnerability.

Answer

Disable the PDF generation feature entirely until the library can be updated in the next quarterly release

Answer

Deploy a virtual private network (VPN) for all access to the server and restrict input to only trusted IPs

Answer

Immediately apply the vendor's patch and then test all features in a staging environment for a month before production rollout

Question 15

Match each authentication protocol or method to its characteristic.

Accepted Answer

Kerberos: Uses tickets and symmetric key cryptography.. Correct matches: Kerberos uses tickets and symmetric keys for authentication; SAML uses XML assertions for single sign-on; OAuth provides delegated authorization via tokens. Common confusions include mixing cryptographic methods and confusing authorization with authentication.

Answer

Kerberos: Uses certificates and asymmetric keys.

Answer

SAML: Used for OAuth 2.0 token exchange.

Answer

OAuth: Authenticates users with passwords.