CAS-004 Practice Test 39 — 15 Questions

Question 1

During a security assessment, an analyst discovers that an HSM used for key generation is FIPS 140-2 Level 2 compliant. The organization requires a higher level of physical security to prevent tampering. Which upgrade would best address this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upgrade to FIPS 140-2 Level 3. FIPS 140-2 Level 3 requires tamper-evident coatings and physical security mechanisms. Level 4 is even higher but may be overkill. Moving to Level 2 is same. Level 1 has no physical security. Software-based TPM is not equivalent.

Answer

Implement a TPM 2.0 instead

Answer

Upgrade to FIPS 140-2 Level 4

Answer

Use a software-based key store

Question 2

A security engineer is hardening a Linux web server. The team requires that the web server process cannot run with root privileges and that any file it writes must have minimal permissions. Which two controls should be implemented together? (Select TWO).

Accepted Answer

Run the web server process under a dedicated non-privileged user account. Running the web server process under a dedicated non-privileged user account (Option A) ensures that even if the process is compromised, the attacker does not gain root privileges. This is a fundamental principle of least privilege, typically implemented by creating a system user (e.g., 'www-data' or 'httpd') with no login shell and assigning ownership of web directories to that user.

Answer

Place the web server in a chroot jail

Answer

Enable SELinux in enforcing mode with a targeted policy for the web server

Answer

Use file capability bounding sets to limit the web server's capabilities

Question 3

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. The development team is slow to fix the SQL injection vulnerability in code, so an immediate control is needed. Adding a WAF rule (option C) can block common SQL injection payloads at the perimeter without code changes, minimizing performance impact and maintaining defense in depth. Option A (disable search) is too disruptive. Option B (isolate database server) is a good defense-in-depth measure but does not address the vulnerability at the application layer. Option D (increase IDS sensitivity) only detects, not prevents. Therefore, C is the most effective immediate control.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 4

A security engineer is hardening SSH server configuration. Which TWO options improve security? (Select TWO.)

Accepted Answer

Restrict allowed key exchange algorithms to strong ones. Restricting key exchange algorithms to strong ones (B) prevents downgrade attacks and ensures only secure cryptographic methods are used. Using key-based authentication only (C) eliminates password-based vulnerabilities such as brute-force and credential theft. Option D (disable root login) is also a security best practice but is not one of the two required selections in this question. Option A weakens security by allowing weak ciphers, and option E introduces password authentication which increases attack surface.

Answer

Allow all cipher suites for compatibility

Answer

Disable root login via SSH

Answer

Enable password authentication for convenience

Question 5

Which THREE of the following are common vulnerabilities in IoT devices? (Select THREE.)

Accepted Answer

Hardcoded credentials. Hardcoded credentials (Option B) are a common IoT vulnerability because manufacturers often embed default usernames and passwords (e.g., 'admin/admin') into device firmware for ease of deployment. Attackers can exploit these static credentials via SSH, Telnet, or web interfaces to gain unauthorized access, as seen in Mirai botnet attacks. This violates the principle of least privilege and secure credential management.

Answer

Large storage capacity

Answer

High compute power

Question 6

You are the compliance officer for a financial institution that must adhere to the Payment Card Industry Data Security Standard (PCI DSS). During a quarterly vulnerability scan, you discover that several critical vulnerabilities in the cardholder data environment (CDE) were not remediated within the required 30-day window. Additionally, the most recent penetration test report shows that a segmentation control between the CDE and the corporate network is not functioning as intended. The next PCI DSS assessment is in two months. Which of the following remediation actions should be prioritized FIRST to maintain compliance?

Accepted Answer

Re-establish correct segmentation between CDE and corporate network. The segmentation control failure is the most critical issue because it directly undermines the scope of the PCI DSS assessment. If the CDE is not properly isolated from the corporate network, the entire corporate network could be considered in-scope for PCI DSS, drastically increasing compliance requirements. Re-establishing correct segmentation first restores the intended security boundary and reduces the risk of a non-compliant assessment in two months.

Answer

Implement a compensating control for the segmentation failure and document it

Answer

Immediately patch all critical vulnerabilities in the CDE

Answer

Request an extension from the acquirer for the next assessment

Question 7

A security architect is designing a data classification scheme. Which of the following is the MOST effective way to ensure consistent labeling across the organization?

Accepted Answer

Automated classification based on data content.. Automated classification based on data content is the most effective method for ensuring consistent labeling across an organization because it removes human error and subjectivity. By using content inspection, pattern matching, and metadata analysis, the system can apply labels uniformly based on predefined rules, such as detecting credit card numbers (PCI-DSS) or personally identifiable information (PII). This approach enforces policy without relying on individual user judgment, which is critical for large-scale compliance.

Answer

Implementing DLP solutions.

Answer

Manual labeling by data owners.

Answer

User training and awareness.

Question 8

A threat hunter wants to identify potential lateral movement within the network. Which data source is LEAST useful for this purpose?

Accepted Answer

DNS query logs. Windows Event ID 4624 (Logon) from domain controllers records successful authentication events, which can indicate lateral movement when an account logs into multiple systems. Event ID 4648 (Logon with explicit credentials) shows when credentials are used explicitly to connect to another system, a common lateral movement technique. Event ID 5140 (File share accessed) logs access to file shares, often used for data staging or tool transfer during lateral movement. DNS query logs primarily show domain name resolution requests. While unusual DNS queries might indicate command-and-control or data exfiltration, they are less directly indicative of lateral movement between hosts because lateral movement typically involves authentication or resource access events rather than DNS lookups. Therefore, DNS query logs are the least useful data source for identifying lateral movement.

Answer

Windows Event ID 4624 (Logon) from domain controllers

Answer

Windows Event ID 4648 (Logon with explicit credentials)

Answer

Windows Event ID 5140 (File share accessed)

Question 9

An organization is implementing a DevSecOps pipeline. Which of the following are essential security controls to include? (Select TWO.)

Accepted Answer

Implement SAST in the build phase. SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

Answer

Conduct annual penetration testing

Answer

Use network segmentation for production

Answer

Disable security scanning to speed up deployments

Question 10

A multinational corporation must comply with both the EU's GDPR and the California Consumer Privacy Act (CCPA). Which of the following scenarios would cause a conflict between these regulations?

Accepted Answer

GDPR requires explicit consent for data processing, while CCPA allows opt-out for data sale. GDPR mandates explicit consent for processing personal data (Article 7), while CCPA provides a right to opt out of the sale of personal information (Section 1798.120). This creates a direct conflict: a company subject to both must decide whether to obtain explicit consent (GDPR) or rely on an opt-out mechanism (CCPA) for data sales, as the two approaches are incompatible in practice.

Answer

One regulation requires breach notification, the other does not

Answer

CCPA imposes data minimization, while GDPR does not

Answer

Both require data access rights for individuals

Question 11

A small business uses a single on-premise server running a custom application and a SQL database. The IT manager is concerned about data loss due to hardware failure. The company has a backup tape drive but often forgets to change tapes. The RTO is 24 hours and RPO is 4 hours. Which of the following is the BEST improvement to meet the RPO/RTO requirements?

Accepted Answer

Use a cloud-based backup service with hourly incremental backups.. Cloud-based backup services with hourly incremental backups can meet a 4-hour RPO by capturing changes every hour, and the RTO of 24 hours is achievable through rapid restoration from the cloud. This eliminates the human error of forgetting to change tapes and provides automated, off-site data protection against hardware failure.

Answer

Purchase a second identical server and set up failover clustering.

Answer

Switch to daily differential backups and store tapes offsite.

Answer

Implement a RAID 1 mirroring for the server's hard drives.

Question 12

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?

Accepted Answer

Implement data mapping to track personal data across systems and jurisdictions.. Options A and B are correct. GDPR and CCPA both require understanding of personal data flows (data mapping - A) and categorizing data to apply appropriate controls (data classification - B). Data mapping is explicitly required for records of processing activities under GDPR and for consumer requests under CCPA. Data classification helps determine which data is subject to regulations and apply necessary protections. Option C (DLP) is a technical control that supports compliance but is not a governance control. Option D (retention schedule) is important but more specific to GDPR's storage limitation and not as central for CCPA. Option E (SIEM) is a monitoring tool, not a governance control.

Answer

Deploy data loss prevention (DLP) technology to monitor data exfiltration.

Answer

Define a data retention schedule that automatically deletes data after a set period.

Answer

Integrate a security information and event management (SIEM) system for log analysis.

Question 13

An organization uses Kubernetes to orchestrate containers. Which practice enhances the security of pod-to-pod communication?

Accepted Answer

Implement network policies that restrict ingress and egress traffic based on labels.. Network policies in Kubernetes act as a firewall for pods, allowing you to define ingress and egress rules based on labels, namespaces, or IP blocks. By default, all pod-to-pod traffic is allowed; implementing network policies restricts this traffic to only what is explicitly permitted, thereby enhancing security by enforcing the principle of least privilege.

Answer

Expose all pods via NodePort services.

Answer

Use ClusterIP services for all internal traffic.

Answer

Rely on the default Kubernetes network configuration.

Question 14

A company is implementing a new vendor risk management program. Which of the following is the BEST approach to assess third-party security controls?

Accepted Answer

Use a standardized security questionnaire and conduct on-site audits. Using a standardized security questionnaire combined with on-site audits provides a thorough and objective assessment of a vendor's security controls, covering policies, procedures, and technical implementation. Option A is incorrect because financial stability does not directly reflect security posture; a financially stable vendor may still have weak security. Option C is incorrect because relying solely on a vendor's self-assessment is biased and may not reveal actual vulnerabilities. Option D is incorrect because only reviewing public breach reports is reactive and misses details about current security practices.

Answer

Check the vendor’s financial stability

Answer

Rely on the vendor’s self-assessment questionnaire

Answer

Review only public breach reports about the vendor

Question 15

A security architect is designing a secure enclave for processing classified data. Which TWO of the following controls are essential for ensuring data confidentiality in such an enclave? (Select TWO.)

Accepted Answer

Data diodes for one-way data transfer from the enclave to external networks. Full-disk encryption protects data at rest on enclave workstations, ensuring confidentiality if a device is lost or stolen. Data diodes enforce one-way data transfer, preventing unauthorized exfiltration of classified data from the enclave. Option C (air gap) is a physical security measure but not a control per se; the question asks for controls. Option D (SCAP) is for vulnerability assessment, not directly confidentiality. Option E is about availability, not confidentiality.

Answer

Physical air gap between the enclave and other networks

Answer

Security Content Automation Protocol (SCAP) vulnerability scanning

Answer

Redundant power supplies and cooling