CAS-004 Practice Test 38 — 15 Questions

Question 1

A large enterprise is implementing a SOAR platform to automate incident response. The security team wants to create a playbook for handling phishing emails reported by users. The playbook should: 1) validate the reported email by checking headers and attachments, 2) automatically block the sender's domain at the email gateway if malicious, 3) create a ticket, and 4) send an automated response to the user. Which of the following describes the best approach to design this playbook?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.. It combines automated triage (extracting indicators) with a manual approval step before blocking, which balances efficiency and accuracy. This approach reduces false positives while still automating most of the workflow. Option A is incorrect because it relies entirely on manual investigation, defeating automation. Option B is risky because it blocks without validation, potentially causing false positives. Option D is overly aggressive and may disrupt business communications.

Answer

Create a ticket and route it to a junior analyst for manual investigation, then close after user acknowledgement.

Answer

Immediately sandbox the attachment and block the sender's domain if the sandbox reports malicious behavior.

Answer

Automatically delete the email from all users' inboxes and send a warning to the organization.

Question 2

An organization is implementing a SOAR solution to automate responses to common incidents. They want to create a playbook for phishing email handling. Which of the following actions should be automated in the playbook after a user reports a suspicious email?

Accepted Answer

Extract URLs and attachments, query threat intel feeds, and if malicious, block indicators and isolate the affected endpoint. A SOAR playbook for phishing should automate initial triage actions such as extracting indicators and checking against threat intelligence, then isolating the user's system if malicious.

Answer

Call the user to confirm they clicked the link

Answer

Send a warning email to all users

Answer

Immediately delete the email from all user inboxes

Question 3

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. Conducting a single PIA that addresses both GDPR and CCPA requirements is the most efficient and effective approach. GDPR requires Data Protection Impact Assessments (DPIAs) for high-risk processing, while CCPA mandates risk assessments for certain activities. A single PIA can map both regulations' requirements, identify overlapping controls, and ensure comprehensive compliance. Option A is wrong because separate PIAs would be redundant and could lead to inconsistencies or gaps. Option B is wrong because skipping PIAs for existing processing violates both regulations' requirements to review ongoing activities. Option D is wrong because PIAs are required for any processing that poses risks to privacy, not only high-risk data, and GDPR requires DPIAs for specified high-risk processing but also recommends them for other activities; however, the best practice is to conduct PIAs broadly to demonstrate accountability.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data

Question 4

A company is migrating its applications to a SaaS model. Which of the following should be included in the contract to ensure secure data handling?

Accepted Answer

Data encryption at rest and in transit. Data encryption at rest and in transit is a fundamental security requirement for protecting sensitive data in a SaaS environment. Encryption at rest (e.g., AES-256) ensures data stored on the provider's servers is unreadable if physically compromised, while encryption in transit (e.g., TLS 1.2/1.3) protects data as it moves between the client and the SaaS platform. This directly addresses secure data handling, which is the core concern of the question.

Answer

Right to audit

Answer

Indemnification clause

Answer

SLA for uptime

Question 5

A company uses a microservices architecture with Docker containers orchestrated by Kubernetes. Developers push code to a Git repository, which triggers a CI/CD pipeline using Jenkins. The pipeline builds Docker images and pushes them to a private registry (Harbor). Recently, a critical vulnerability (CVE-2024-XXXX) was discovered in the base image of several containers. The security team wants to ensure that only images that pass vulnerability scans are deployed to production. The pipeline currently builds and pushes images without any security check. Developers are responsible for updating base images, but this has been inconsistent. Which action should the security team take?

Accepted Answer

Configure Jenkins to run Trivy scans on each built image and fail the pipeline if vulnerabilities exceed a defined threshold, and only allow images that pass to be pushed to the production registry. It integrates vulnerability scanning directly into the CI/CD pipeline. By running Trivy as a step after the image is built but before it is pushed to the production registry, the pipeline can fail if the vulnerability count or severity exceeds a defined threshold. This ensures that only images that pass the security scan are deployed to production. Option A (manual updates) is unreliable and does not enforce policy. Option B (Harbor webhook) would block pulls but does not prevent the push of vulnerable images; the image would already be in the registry. Option D (PodSecurity admission) controls what runs in Kubernetes but does not assess vulnerability severity and operates too late; the image would already be built and pushed.

Answer

Require developers to manually check their images and update base images

Answer

Implement a webhook in Harbor to automatically scan all images upon push and block vulnerable images from being pulled

Answer

Use Kubernetes PodSecurity admission to block containers with high-severity vulnerabilities

Question 6

A web application generates an Ansible playbook from user input as shown. What is the primary security risk?

Accepted Answer

The user input could be crafted to execute arbitrary Ansible modules.. The application directly incorporates user input into an Ansible playbook without sanitization or validation. An attacker can inject arbitrary YAML or Ansible module directives (e.g., `shell`, `command`, `raw`) to execute unauthorized commands on managed hosts. This is a classic injection vulnerability specific to automation frameworks, not a generic injection type.

Answer

The application is vulnerable to SQL injection.

Answer

The application is vulnerable to LDAP injection.

Answer

The playbook may fail to run if input contains special characters.

Question 7

A financial services company is implementing a zero-trust architecture. The security architect needs to ensure that all network traffic between application tiers is inspected and logged regardless of source location. Which of the following should be implemented?

Accepted Answer

Implement microsegmentation using a next-generation firewall. Microsegmentation using a next-generation firewall (NGFW) is the correct approach because it enforces granular, per-application-tier security policies that inspect and log all traffic regardless of source location. NGFWs provide deep packet inspection (DPI), application-level visibility, and logging capabilities, which are essential for zero-trust architecture where no implicit trust is granted to any network segment.

Answer

Deploy a site-to-site VPN across all tiers

Answer

Use a single, centralized firewall for all traffic

Answer

Place all application servers in a DMZ

Question 8

A security administrator needs to secure remote access for employees using personal devices. The company requires that company data be encrypted and that the device be wiped if lost. Which solution best meets these requirements?

Accepted Answer

Deploy a mobile device management (MDM) solution that enforces device encryption and supports remote wipe.. Mobile device management (MDM) solutions are specifically designed to enforce security policies on personal devices, including mandatory device encryption (e.g., AES-256 for data at rest) and the ability to perform a remote wipe (factory reset) to destroy company data if the device is lost or stolen. This directly addresses the requirement to protect company data on unmanaged, employee-owned devices.

Answer

Use network access control (NAC) to allow only compliant devices onto the network.

Answer

Require employees to connect via a corporate VPN and use two-factor authentication.

Answer

Implement remote desktop protocol (RDP) gateways for all remote access.

Question 9

An organization is deploying a new wireless network for employees and guests. The security policy requires that all wireless traffic be encrypted using AES-CCMP, and that clients must authenticate using 802.1X with EAP-TLS. Which of the following wireless security standards should be implemented?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (D) is the correct choice because it supports AES-CCMP encryption and 802.1X authentication with EAP-TLS. WPA2-Enterprise uses a RADIUS server for centralized authentication, allowing per-user credentials via EAP methods, and mandates CCMP (AES-based) for data confidentiality and integrity, meeting all stated security policy requirements.

Answer

WPA2-Personal

Answer

WEP

Answer

WPA3-Enterprise

Question 10

A small business wants to achieve compliance with PCI DSS. Which approach should they take to minimize the scope of the assessment?

Accepted Answer

Segment the cardholder data environment from the corporate network. Segmenting the cardholder data environment (CDE) from the corporate network using firewalls or VLANs physically or logically isolates systems that store, process, or transmit cardholder data. This reduces the number of systems and network segments that fall under PCI DSS assessment scope, because only devices within the CDE segment must comply with the full set of requirements. By minimizing the attack surface and the number of controls to validate, segmentation directly lowers the cost and complexity of the assessment.

Answer

Implement a tokenization service

Answer

Encrypt all cardholder data at rest

Answer

Train employees on security awareness

Question 11

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker used DNS tunneling to exfiltrate data. Which THREE network traffic indicators would support this hypothesis? (Select THREE.)

Accepted Answer

Large DNS response packets (greater than 512 bytes). DNS tunneling uses DNS queries to exfiltrate data, often characterized by high volume of queries, unusual domain names, and abnormally large DNS packets. Data sent in clear text (unencrypted) over HTTP is not typical of DNS tunneling.

Answer

A sudden increase in failed login attempts

Answer

Unencrypted HTTP traffic to external IPs

Question 12

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Accepted Answer

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.. The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.

Answer

New connections from the internet to 10.0.1.0/24 are allowed.

Answer

All traffic is allowed by default because the policy is ACCEPT.

Answer

The rules apply to incoming traffic on the firewall itself.

Question 13

A security analyst is reviewing a web application's authentication mechanism. Which of the following are best practices to prevent session hijacking? (Select TWO.)

Accepted Answer

Regenerate session ID upon successful login. Regenerating the session ID upon successful login (option A) is a critical defense against session fixation attacks, where an attacker forces a known session ID on a user before authentication. By issuing a new, server-generated session ID after login, the application ensures that any pre-authentication session ID controlled by an attacker becomes invalid. This practice is recommended by OWASP and aligns with RFC 6265 session management guidelines.

Answer

Set the session timeout to 5 minutes

Answer

Use the same session ID before and after authentication

Answer

Store session tokens in localStorage

Question 14

A security engineer is configuring a TLS 1.3 connection between a web server and client. Which feature is unique to TLS 1.3 and provides reduced latency for returning clients?

Accepted Answer

0-RTT. TLS 1.3 includes a 0-RTT (zero round-trip time) feature that allows a client to send data immediately with the first message to a server it has previously connected to, reducing latency.

Answer

Cipher suite negotiation

Answer

Forward secrecy

Answer

Mutual authentication

Question 15

A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?

Accepted Answer

Use EDR to identify the process or service generating the outbound connections on the web server.. The best first step because using EDR to identify the process or service generating the outbound connections provides immediate visibility into the source of the unusual traffic without disrupting the potential evidence. This allows the architect to determine if the traffic is malicious (e.g., a compromised process) or benign (e.g., a legitimate update). Once the process is identified, further steps like SSL inspection, isolation, or rule modification can be taken based on the findings. Option A (SSL inspection) is resource-intensive and premature without first understanding the process. Option C (isolation) may destroy forensic evidence and is a containment step that should follow identification. Option D (removing the rule) could disrupt legitimate applications and does not help identify the scope.

Answer

Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.

Answer

Isolate the web server from the network to prevent further data exfiltration.

Answer

Immediately remove the outbound HTTPS rule to block the traffic.