CAS-004 Practice Test 4 — 10 Questions

Question 1

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

Accepted Answer

Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.. Option C is correct because a Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Answer

Store the private keys in an encrypted database on a separate database server.

Answer

Use a software-based key vault that runs on the same operating system as the web server.

Answer

Store the private keys in a local file with restricted permissions on the application server.

Question 2

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Accepted Answer

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.. Option C is correct because the iptables rules show a default FORWARD policy of ACCEPT, but the INPUT chain has a default policy of DROP. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that only return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the FORWARD chain's default policy.

Answer

New connections from the internet to 10.0.1.0/24 are allowed.

Answer

All traffic is allowed by default because the policy is ACCEPT.

Answer

The rules apply to incoming traffic on the firewall itself.

Question 3

A network administrator is configuring a firewall rule set. The requirement is to allow inbound HTTPS traffic from the internet to a web server at 10.1.1.10, and to allow the web server to respond. All other inbound traffic should be blocked. Which rule set accomplishes this?

Accepted Answer

Allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound. Option B is correct because HTTPS uses TCP port 443, and the rule set correctly allows inbound TCP 443 to the web server at 10.1.1.10, permits the server's outbound responses (stateful or explicit), and then denies all other inbound traffic. This matches the requirement to allow only HTTPS traffic from the internet while blocking everything else.

Answer

Allow inbound TCP 80 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Answer

Deny all inbound; allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10

Answer

Allow inbound TCP 22 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Question 4

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 5

A company is designing a new data center with high availability requirements. The network team proposes using virtualized network functions (VNFs) on commodity hardware to reduce costs. Which security consideration is MOST important when implementing this design?

Accepted Answer

Isolate VNFs to prevent lateral movement if one VNF is compromised. Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Answer

Ensure VNFs are deployed across multiple physical hosts for redundancy

Answer

Encrypt all traffic between VNFs to prevent eavesdropping

Answer

Implement quality of service (QoS) to guarantee bandwidth for critical VNFs

Question 6

Match each automation security concept with its correct description.

Answer

Immutable infrastructure

Answer

Infrastructure as Code

Answer

Secret management

Answer

Container orchestration

Question 7

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

Accepted Answer

Exposure of sensitive credentials in the image layers. Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Answer

Use of untrusted base image

Answer

Privilege escalation via SUID binaries

Answer

Dependency confusion from unpinned packages

Question 8

A security engineer needs to implement a solution that will detect and block command-and-control (C2) traffic from malware on the internal network. The solution must be able to inspect encrypted traffic and operate at the network layer. Which of the following is the BEST choice?

Accepted Answer

Deploy a next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering.. A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

Answer

Implement a web application firewall (WAF) to filter outbound HTTP/HTTPS traffic.

Answer

Install a network-based intrusion detection/prevention system (IDS/IPS) with signature updates.

Answer

Use endpoint detection and response (EDR) agents on all workstations and servers.

Question 9

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

Accepted Answer

Check if the host is configured as a mail server in the organization's asset database.. Option B is correct because the first step in investigating potential data exfiltration over TCP port 25 (SMTP) is to verify whether the host is authorized to send email. If the host is a legitimate mail server, the traffic may be normal; if not, it could indicate malware or a misconfigured application exfiltrating data via SMTP. This aligns with the CAS-004 objective of validating asset roles before escalating to containment.

Answer

Submit a change request to implement an email content filter.

Answer

Block the outbound traffic on the firewall to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the host to detect any malware.

Question 10

A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?

Accepted Answer

Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.. Option D is correct because the attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.

Answer

Enforce a minimum password complexity policy for all users.

Answer

Require multi-factor authentication for all SSH logins.

Answer

Implement rate limiting on SSH connections per source IP.