CAS-004 Practice Test 38 — 15 Questions

Question 1

A company uses a CASB to monitor cloud application usage. Which primary function does a CASB provide for enforcing security policies between users and cloud services?

Accepted Answer

Policy enforcement point for cloud services. A CASB (Cloud Access Security Broker) acts as a policy enforcement point (PEP) that sits between users and cloud service providers, intercepting traffic to apply security policies such as authentication, authorization, data loss prevention (DLP), and compliance controls. It provides visibility and control over cloud application usage, ensuring that only authorized actions and data flows are permitted. Unlike other cloud security tools, the CASB's primary role is to enforce policies in real time, not to manage keys or scan for vulnerabilities. Thus, option C correctly identifies the core function.

Answer

Encryption key management for cloud storage

Answer

Vulnerability scanning of cloud infrastructure

Answer

Workload protection runtime monitoring

Question 2

A security architect is designing a hybrid environment in which on-premises applications must consume APIs hosted in a public cloud. The architect wants to ensure that if the primary cloud region fails, API consumers continue to receive responses without changing client configuration. Which design element BEST satisfies this requirement?

Accepted Answer

Deploy a global server load balancing tier that performs health-checked DNS failover across regional API endpoints.. Continuity across regions for API consumers is achieved by abstracting endpoints behind a health-aware global load balancing layer that removes failed regions from resolution and returns healthy ones. Caching, versioning, and single-region reverse proxies all leave the consumer dependent on the failed region or require client changes, so they do not meet the requirement.

Answer

Configure a forward proxy on the on-premises network that caches API responses for the duration of the outage.

Answer

Place the API behind a reverse proxy that terminates TLS and inspects request payloads for malicious content.

Answer

Implement API versioning so consumers can switch to an alternate endpoint when the primary region becomes unavailable.

Question 3

A security architect is designing a data loss prevention (DLP) program for a multinational retailer that processes payment card data and personally identifiable information. The program must discover sensitive data at rest across on-premises file shares and cloud storage, and it must prevent sensitive data from leaving the organization through email and web uploads. Which two capabilities are essential for this program? (Choose two.)

Accepted Answer

Content inspection using pattern matching and data classifiers to identify regulated data types.. A functioning DLP program needs both accurate identification of regulated content and an enforcement point where policy can act. Content inspection with classifiers supplies the identification, while egress enforcement at email and web gateways supplies the prevention. Encryption, SIEM correlation, and segmentation are valuable controls but do not deliver either of the two required DLP capabilities.

Answer

Security information and event management (SIEM) correlation of DLP alerts with threat intelligence feeds.

Answer

Full-disk encryption on all endpoint devices and servers that store regulated data.

Answer

Network segmentation of the cardholder data environment using internal firewalls.

Question 4

A security architect at a financial services firm must ensure that virtual machine workloads on a private cloud cannot execute unauthorized binaries, even if an attacker gains root access. The solution must enforce policy at the hypervisor layer without relying on agents inside the guest OS. Which of the following should the architect implement?

Accepted Answer

Virtual machine introspection (VMI) with hypervisor-enforced integrity monitoring. Hypervisor-based introspection enforces policy outside the guest OS, so even root-level malware cannot disable the control. It provides tamper-resistant visibility and can prevent execution of unauthorized binaries, meeting the agentless and root-resistant requirements. Agent-based tools and log correlation are either bypassable or detective only.

Answer

File integrity monitoring (FIM) of /usr/bin on each virtual machine

Answer

Security information and event management (SIEM) correlation with guest OS logs

Answer

Host-based intrusion prevention system (HIPS) installed on each guest OS

Question 5

A financial services firm runs its customer portal on a Kubernetes cluster in AWS. During a penetration test, an attacker who compromised a front-end pod moved laterally to a database pod by directly connecting to its IP address, even though no NetworkPolicy existed. The security architect must implement a control that enforces least-privilege communication between pods and blocks all unauthorized east-west traffic by default. Which of the following should the architect implement?

Accepted Answer

Configure a Kubernetes NetworkPolicy with a default-deny ingress rule and explicit allow rules for required pod-to-pod flows.. The requirement is to enforce least-privilege pod-to-pod communication and block unauthorized east-west traffic by default. Kubernetes NetworkPolicy is the native control that operates at the pod level and can implement a default-deny posture with explicit allow rules. Node-level Security Groups and egress gateways do not provide pod-level segmentation, and mTLS without authorization policy does not deny connections.

Answer

Enable AWS Security Groups for the worker nodes and restrict inbound rules to the node CIDR block.

Answer

Deploy a service mesh sidecar proxy and enforce mutual TLS between all services.

Answer

Apply egress-only internet gateway rules to prevent pods from reaching external networks.

Question 6

A financial services company is designing a hybrid cloud environment. The security architect must ensure that data in transit between the on-premises data center and the cloud provider is protected against interception and that the cloud provider cannot read the data. The company also needs to meet strict compliance requirements for key management. Which of the following should the architect implement to BEST meet these requirements?

Accepted Answer

Deploy a customer-managed VPN gateway with hardware security modules (HSMs) for key storage and use IPsec with customer-managed certificates.. The requirement is to protect data in transit from interception and ensure the cloud provider cannot read it, while meeting strict key management compliance. A customer-managed VPN gateway with HSMs and customer-managed certificates ensures that encryption keys are controlled by the company, not the provider. IPsec provides strong encryption, and HSMs offer secure key storage, satisfying both security and compliance.

Answer

Implement a dedicated AWS Direct Connect connection with MACsec encryption.

Answer

Use TLS 1.3 with mutual authentication for all data transfers and store private keys in a cloud-based key management service.

Answer

Configure a site-to-site VPN using IPsec with pre-shared keys managed by the cloud provider.

Question 7

Match each security feature to its description.

Accepted Answer

Multi-Factor Authentication (MFA): Requires two or more verification factors to grant access.. These features are covered in identity and access management and data protection domains.

Answer

Multi-Factor Authentication (MFA): Assigns permissions based on a user's role within the organization.

Answer

Role-Based Access Control (RBAC): Requires two or more verification factors to grant access.

Question 8

A company is implementing a passwordless authentication solution using FIDO2/WebAuthn. What is the primary security advantage of this approach over traditional password-based authentication?

Accepted Answer

It prevents phishing attacks by using cryptographic keys.. FIDO2/WebAuthn uses public-key cryptography where the private key never leaves the authenticator (e.g., a security key or platform authenticator), and the origin is cryptographically bound to the credential. This origin binding means a phishing site with a different domain cannot trigger the authenticator to sign the challenge, effectively preventing credential phishing. Traditional passwords, by contrast, can be captured and replayed by phishing proxies.

Answer

It allows users to share passwords securely.

Answer

It reduces server storage requirements.

Answer

It eliminates the need for multi-factor authentication.

Question 9

A security architect at a defense contractor must protect Controlled Unclassified Information (CUI) that flows between an on-premises data center and a government cloud enclave. The requirement states that data must remain confidential even if a cloud provider's hypervisor is compromised, and the provider must not be able to access plaintext at any layer. The architect needs a control that cryptographically isolates tenant workloads from the provider and from other tenants. Which of the following BEST satisfies this requirement?

Accepted Answer

Implement confidential computing using hardware-based trusted execution environments (TEEs) such as AMD SEV-SNP or Intel TDX.. Confidential computing with hardware TEEs encrypts guest memory using CPU-managed keys, so the hypervisor and provider administrators cannot read plaintext even during processing. The other controls protect keys, data in transit, or data at rest, but none prevent plaintext exposure in memory when the hypervisor is compromised, which is the specific threat in this scenario.

Answer

Encrypt all CUI at rest with customer-managed keys stored in a separate key management service outside the provider's control.

Answer

Deploy hardware security modules (HSMs) in the cloud provider's data center to store tenant encryption keys.

Answer

Require TLS 1.3 with mutual authentication for all data in transit between the data center and the cloud enclave.

Question 10

A security architect is designing a system that must process sensitive personal data. The organization wants to ensure that even if the database is compromised, the data remains unreadable to the attacker. The architect also needs to support searching on a specific field without decrypting the entire dataset. Which cryptographic approach best meets these requirements?

Accepted Answer

Application-level encryption with deterministic encryption for the searchable field. Application-level encryption with deterministic encryption for the searchable field ensures that data is encrypted before storage and remains unreadable if the database is compromised. Deterministic encryption allows equality searches on that field without decrypting the entire dataset. Other methods either leave data readable in memory, prevent searching, or introduce a separate high-value target.

Answer

Transparent data encryption (TDE) on the database

Answer

Hashing the sensitive data with a salt

Answer

Tokenization of all sensitive fields with a centralized token vault

Question 11

A security architect is evaluating a third-party SaaS provider for a critical business function. The provider will process sensitive customer data and must demonstrate compliance with the organization's security requirements. The architect needs to obtain assurance about the provider's security controls without conducting an on-site audit. Which of the following should the architect request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent validation of control effectiveness over a period, directly addressing the need for assurance without an on-site audit. It is the standard mechanism for assessing SaaS providers' security and compliance posture.

Answer

Self-attestation questionnaire completed by the provider

Answer

SOC 2 Type I report

Answer

Penetration test summary from the provider

Question 12

A security architect at a healthcare provider must ensure that electronic protected health information (ePHI) stored in an on-premises Microsoft SQL Server database is unreadable if the physical media is stolen. The organization has strict performance requirements and cannot tolerate application changes or key management outside its own hardware security modules (HSMs). Which SQL Server feature BEST meets these requirements?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) encrypts the database files at rest without requiring application changes and supports key protection through an HSM via Extensible Key Management. The other options either require application modifications or do not encrypt data at rest, leaving the stolen media scenario unresolved.

Answer

Dynamic Data Masking (DDM)

Answer

Always Encrypted with secure enclaves

Answer

Row-Level Security (RLS)

Question 13

A security architect at a financial services firm is designing the network for a new containerized trading platform. The platform must enforce Layer 7 policy, provide mutual TLS between all microservices, and eliminate the need to reconfigure each application for cryptographic identity. Which architecture should the architect implement?

Accepted Answer

A service mesh that uses sidecar proxies to intercept all service-to-service traffic and perform mutual TLS. The service mesh architecture uses sidecar proxies to intercept all service-to-service communication, enabling transparent mutual TLS and Layer 7 policy enforcement without modifying application code. This satisfies the demand for cryptographic identity across microservices and eliminates per-application reconfiguration, making it the appropriate design for a containerized trading platform.

Answer

A VPN concentrator that creates an encrypted overlay network between all container hosts

Answer

A network intrusion prevention system (NIPS) deployed inline at the cluster edge

Answer

An API gateway that terminates TLS and routes requests to backend microservices

Question 14

A healthcare provider must allow clinicians to access a SaaS electronic health record from unmanaged personal devices without installing agents. The security architect needs to enforce contextual access decisions based on device posture, user identity, and location, while keeping the EHR session isolated from the local browser. Which of the following should the architect implement?

Accepted Answer

A Secure Access Service Edge (SASE) platform with a remote browser isolation (RBI) component and identity-based policies.. The need is agentless access from unmanaged devices with contextual decisions and session isolation. A SASE platform with remote browser isolation and identity-based policies enforces access based on user, device posture, and location while keeping the EHR session in a cloud container. VDI, API-mode CASB, and NGFW each address parts of the problem but fail to deliver the combined agentless, contextual, isolated access.

Answer

A next-generation firewall (NGFW) with TLS inspection and application control.

Answer

A cloud access security broker (CASB) in API mode with data loss prevention policies.

Answer

A virtual desktop infrastructure (VDI) environment hosted in the provider's data center.

Question 15

A security administrator is reviewing an architecture diagram for a new web application. The diagram shows the application servers in a private subnet, a database in a separate private subnet, and a public load balancer in a public subnet. The administrator wants to ensure that the application servers can retrieve software updates from the internet without being directly reachable from it. Which of the following should the administrator recommend?

Accepted Answer

Place a NAT gateway in a public subnet and route the application subnet's outbound traffic through it.. A NAT gateway located in a public subnet lets private application servers initiate outbound connections for updates while blocking unsolicited inbound connections from the internet. This preserves the private subnet's isolation and keeps the application tier unreachable externally. Direct internet gateway attachment, public IP assignment, and placing egress components in the database tier all either expose the servers or violate the intended tier separation.

Answer

Configure the application servers to use a proxy server hosted in the database subnet for all outbound update requests.

Answer

Assign public IP addresses to the application servers and use a security group that permits only outbound port 443.

Answer

Attach an internet gateway directly to the application server subnet and allow outbound traffic on port 443.