CAS-004 Practice Test 39 — 15 Questions

Question 1

A security architect is designing a microsegmentation strategy for a data center hosting legacy and modern applications. The architect must ensure that workloads can only communicate with explicitly authorized peers and that policy follows the workload even if it is migrated between hosts. Which two of the following controls best meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Host-based firewall agents that enforce allow-list rules based on workload identity tags.. Microsegmentation requires policy that is based on workload identity and portable across hosts. Host-based firewall agents with identity-tag rules and an SDN overlay enforcing label-based policy both deliver explicit peer authorization and follow workloads during migration. VLAN ACLs, a single perimeter zone, and 802.1X either tie policy to topology or address admission rather than ongoing east-west control.

Answer

VLAN segmentation with ACLs applied at the core switch.

Answer

A next-generation firewall with a single perimeter zone for all internal servers.

Answer

802.1X port-based network access control for all server NICs.

Question 2

A security architect is designing a network segmentation scheme for a containerized workload running on a Kubernetes cluster. The requirement is to enforce least-privilege communication between microservices at Layer 3 and Layer 4, and to ensure that only explicitly allowed traffic can flow between pods, even within the same namespace. Which of the following should the architect implement?

Accepted Answer

Kubernetes Network Policies with a default-deny ingress and egress policy.. To enforce least-privilege communication between microservices at Layer 3 and Layer 4, the architect needs a mechanism that controls pod-to-pod traffic based on labels and ports. Kubernetes Network Policies with a default-deny stance provide exactly that: a whitelist model where only explicitly permitted flows are allowed. This prevents unauthorized lateral movement even within the same namespace and is the native, CNI-supported solution for microsegmentation in Kubernetes.

Answer

Pod Security Admission with the restricted profile applied to all namespaces.

Answer

A web application firewall (WAF) placed in front of the ingress controller.

Answer

Istio service mesh with mutual TLS (mTLS) enabled between all sidecars.

Question 3

A financial services firm is designing its identity architecture for a Zero Trust program. Auditors require that authentication strength be continuously evaluated and that a compromised endpoint lose access to sensitive trading applications even after the user has already authenticated. The security architect must select TWO capabilities that directly support continuous, context-aware authorization decisions. (Choose two.)

Accepted Answer

Continuous access evaluation that revokes active sessions when risk signals change. Continuous access evaluation and device posture attestation together give the policy engine live signals to make and revisit authorization decisions. Continuous access evaluation enforces revocation the moment risk changes, while posture attestation supplies the endpoint trust data that fuels those decisions. Combined, they ensure that a compromised device loses access to sensitive applications mid-session, satisfying the auditors' requirement.

Answer

A single sign-on portal that caches user credentials for the trading session

Answer

Password complexity rules requiring rotation every 30 days for all identities

Answer

Longer-lived refresh tokens to reduce reauthentication prompts for trading users

Question 4

A security architect is designing a data loss prevention (DLP) strategy for a hybrid environment where sensitive records are stored on-premises and synchronized to a SaaS productivity suite. The architect needs to ensure that policy enforcement follows the data regardless of location and that violations are detected before data leaves the organization. Which TWO of the following capabilities are most critical to achieve these goals? (Choose two.)

Accepted Answer

Endpoint DLP agents with content-aware rules on managed workstations.. Inline CASB inspection enforces DLP policy at the cloud egress point, while endpoint DLP agents enforce policy at the source on managed devices. Together they cover both network and local egress paths, ensuring that sensitive data is inspected and blocked before it leaves the organization and that policy follows the data across hybrid locations.

Answer

Full-disk encryption (FDE) on all endpoints and servers storing sensitive records.

Answer

Security information and event management (SIEM) correlation of DLP alerts.

Answer

Network segmentation between the on-premises data center and the SaaS provider.

Question 5

A healthcare provider must ensure that electronic protected health information (ePHI) stored in a public cloud object storage bucket is unreadable to the cloud provider and remains confidential even if the provider's infrastructure is compromised. The security architect wants to use a customer-managed key that never leaves the organization's on-premises hardware security module (HSM). Which approach should the architect implement?

Accepted Answer

Use client-side encryption with a key stored in an on-premises HSM, encrypting data before it is uploaded to the bucket. Client-side encryption with keys held in an on-premises HSM ensures that data is encrypted before it reaches the cloud, so the provider only stores ciphertext and never possesses the key. This architecture preserves confidentiality even if the provider's infrastructure is breached, which is essential for ePHI under strict regulatory requirements.

Answer

Configure default encryption on the bucket using a provider-managed key and enable versioning

Answer

Enable provider-side encryption with a customer-provided key (SSE-C) and upload the key with each object request

Answer

Implement bucket policies that restrict access to a specific VPC endpoint and enable access logging

Question 6

A security architect is designing a platform for a hospital network. Clinical staff must access patient records from managed workstations, while third-party billing contractors use unmanaged personal laptops. The architect wants a single architecture that continuously validates device posture and user identity before granting access to each microservice, regardless of network location. Which approach should the architect implement?

Accepted Answer

Implement a zero trust architecture using a policy engine and policy enforcement points at each microservice.. A zero trust architecture with a policy engine and enforcement points at each microservice continuously validates identity and device posture for every request, independent of network location. This single architecture covers managed clinical workstations and unmanaged contractor laptops alike, unlike network-centric controls that authenticate once and then trust the connection. Per-microservice enforcement also limits lateral movement if a device is compromised.

Answer

Deploy a next-generation firewall with VLAN segmentation for clinical and contractor traffic.

Answer

Establish an IPsec VPN concentrator that assigns contractors to a restricted subnet.

Answer

Configure 802.1X port-based authentication on all wired switch ports.

Question 7

A security engineer is hardening a containerized workload platform against attacks that escape a container and reach the host kernel. The team wants to reduce the kernel attack surface available to each container without breaking application functionality. Which TWO measures BEST accomplish this? (Choose two.)

Accepted Answer

Apply a seccomp profile that allows only the system calls the application actually uses and denies the rest by default.. Default-deny seccomp profiles and least-privilege capability sets both operate at the kernel boundary and remove entire classes of privileged operations from containerized processes. Together they ensure that even a fully exploited application lacks the system calls and capabilities needed to reach host kernel interfaces, which is precisely the attack surface reduction the team requires.

Answer

Run the container runtime with the Docker socket mounted into every container so the platform can manage sibling containers.

Answer

Disable mandatory access control frameworks such as AppArmor or SELinux so the application is not blocked by policy denials.

Answer

Set the container to run as the root user inside its namespace to avoid file permission problems during deployment.

Question 8

A healthcare provider is designing a data protection scheme for patient records stored in a cloud object store. Regulatory requirements mandate that encryption keys never leave the organization's on-premises hardware security modules (HSMs), while the cloud provider must still be able to perform server-side encryption on upload. The architect needs a key management approach that satisfies both constraints. Which of the following should the architect implement?

Accepted Answer

External key store backed by on-premises HSMs integrated with the cloud KMS. An external key store keeps the root key material inside the organization's HSMs while allowing the cloud KMS to call out for encrypt and decrypt operations, so server-side encryption still occurs without the provider holding plaintext keys. This satisfies the dual constraint of regulatory key residency and provider-side encryption. The other approaches either place key custody with the provider or shift encryption to the client, breaking one of the two requirements.

Answer

Provider-managed customer master keys stored in the cloud KMS

Answer

Client-side encryption with locally generated data keys

Answer

Envelope encryption using a customer-provided key uploaded to the KMS

Question 9

A security architect is reviewing the network design for a new branch office. The organization wants to ensure that all traffic from the branch is inspected for malware and that users are authenticated before accessing cloud applications, regardless of their location. Which technology should the architect recommend?

Accepted Answer

A Secure Access Service Edge (SASE) solution with integrated secure web gateway and zero trust network access. SASE delivers converged network and security services from the cloud, including secure web gateway for malware inspection and zero trust network access for user authentication. It enforces policy consistently for users anywhere, without backhauling traffic. This directly satisfies the branch office requirements for inspection and authentication before cloud access.

Answer

A remote access VPN concentrator at headquarters with split tunneling disabled

Answer

A software-defined wide area network (SD-WAN) overlay with local internet breakout

Answer

A next-generation firewall (NGFW) at the branch perimeter with IPsec VPN to headquarters

Question 10

A security architect is designing segmentation for a manufacturing network where legacy programmable logic controllers cannot be patched or run endpoint agents. The architect wants to prevent a compromised business workstation from initiating connections to the controllers while still allowing the controllers to send telemetry to a historian server. Which of the following design elements best achieves this objective?

Accepted Answer

A unidirectional gateway enforcing one-way data flow from the controller network out to the historian. A unidirectional gateway enforces that data can flow only from the protected controller network outward, so telemetry reaches the historian while no inbound path exists from the business network. This protects unpatched controllers that cannot run agents or be hardened, precisely matching the constraint that a compromised workstation must never initiate connections to them.

Answer

Network address translation between the business network and the controller subnet with private addressing

Answer

An intrusion prevention system deployed inline on the business network with industrial protocol signatures

Answer

A stateful firewall rule permitting any internal source to reach the controller subnet on the industrial protocol port

Question 11

A security architect is designing a hybrid identity solution for a company that wants to enforce device-based conditional access for Microsoft 365. Employees use personal Android and iOS devices, and the company wants to ensure that only compliant devices can access email and SharePoint. The architect must minimize on-premises infrastructure and avoid a full VPN. Which solution should the architect recommend?

Accepted Answer

Deploy Microsoft Entra ID with Conditional Access policies that require device compliance, and enroll devices in Microsoft Intune.. Microsoft Entra ID Conditional Access combined with Intune device compliance is the correct approach because it enforces device-based access decisions for cloud applications without requiring on-premises infrastructure or a full VPN. Conditional Access evaluates signals such as device compliance state and can block or grant access to Microsoft 365 accordingly, while Intune manages device configuration and compliance for both Android and iOS.

Answer

Configure a full-tunnel VPN that routes all mobile traffic through the corporate network and enforce network access control (NAC) at the edge.

Answer

Implement Active Directory Federation Services (AD FS) with a Web Application Proxy and require certificate-based authentication for all devices.

Answer

Use Microsoft Entra ID with Security Defaults enabled and require multi-factor authentication (MFA) for all users.

Question 12

A software company wants to ensure that every container image deployed to production is free of known critical vulnerabilities and is cryptographically signed by its build pipeline. The security architect must implement controls that verify the signature and vulnerability status before the container runtime starts the image. Which of the following should the architect implement?

Accepted Answer

A Kubernetes admission controller that validates image signatures and vulnerability scan results before allowing a pod to run.. The requirement is to verify image signatures and vulnerability status before the container runtime starts the image. A Kubernetes admission controller enforces these checks at pod creation, rejecting non-compliant images. SAST analyzes code, registry scanning only alerts, and runtime agents act after startup, so none provide the required pre-runtime enforcement.

Answer

A container image scanner in the registry with automated alerts to the security team.

Answer

A runtime security agent that monitors container behavior and kills suspicious processes.

Answer

A static application security testing (SAST) tool integrated into the CI pipeline.

Question 13

A security architect for a healthcare provider must ensure that a new patient portal can exchange data with an external partner's system without the two organizations having to share or manage each other's identity credentials. The portal must support SAML assertions, provide centralized session revocation, and allow attribute-based authorization decisions at the relying party. Which of the following should the architect implement?

Accepted Answer

Deploy an identity federation gateway that consumes SAML assertions from the partner IdP and maps attributes to local authorization roles.. Federating identities through a gateway that consumes SAML assertions allows the portal to trust the partner's identity provider without exchanging credentials. Attributes carried in assertions can drive authorization decisions locally, and SAML single logout supports centralized session termination. The other approaches either require shared or duplicated credentials, lack SAML support, or expose internal directory services to an external party, none of which meet the stated interoperability and revocation requirements.

Answer

Configure the partner as a trusted certificate authority in the portal's internal PKI and issue client certificates to partner users.

Answer

Publish the portal's user directory as an LDAP endpoint and require partner applications to bind directly against it during authentication.

Answer

Create duplicate local accounts for every partner user in the portal's directory and synchronize passwords on a nightly schedule.

Question 14

A global retailer is deploying a microsegmentation strategy in its data center to limit lateral movement after a breach. The security architect must enforce policy based on workload identity and allow only required east-west flows, even when workloads are migrated between hosts. Which of the following should be implemented?

Accepted Answer

Host-based firewalls with workload identity labels and a central policy controller.. Host-based firewalls with identity labels and a central policy controller enforce microsegmentation based on workload identity rather than IP addresses. This design allows only necessary east-west flows and automatically follows workloads during migration, which is essential in a dynamic data center where lateral movement must be contained.

Answer

VLAN segmentation with ACLs applied on the core switches.

Answer

A next-generation firewall (NGFW) deployed at the data center perimeter.

Answer

802.1X port-based network access control on all switch ports.

Question 15

A retail company is designing a new payment processing environment and wants to reduce the scope of its PCI DSS assessment. The architect proposes isolating the cardholder data environment from the rest of the corporate network so that most systems fall outside the audit boundary. Which of the following design approaches best supports this goal?

Accepted Answer

A segmented enclave with strict ingress and egress controls, dedicated management, and no shared authentication with corporate systems. Isolating the cardholder data environment in a segmented enclave with strict ingress and egress filtering, dedicated administration, and no shared authentication lets assessors treat the surrounding corporate network as out of scope. This directly reduces the number of systems subject to the audit while keeping a defensible, monitored boundary around the payment systems that handle card data.

Answer

Outsourcing card processing to a validated service provider while keeping card data in local point-of-sale databases

Answer

A flat network with VLANs for logical separation and a shared domain for authentication

Answer

Encrypting card data at rest in the corporate data warehouse and granting broad read access to analysts