CAS-004 Practice Test 40 — 15 Questions

Question 1

A security architect is designing a data loss prevention (DLP) program for a global enterprise that uses Microsoft 365, endpoint devices, and a custom web application. The requirement is to detect and block sensitive data exfiltration across all three channels while minimizing false positives caused by legitimate business data that resembles regulated data. The architect needs a control that classifies data consistently and applies policy at the point of egress. Which of the following BEST meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply sensitivity labels with unified DLP policies that use exact data match and trainable classifiers across Microsoft 365, endpoints, and the custom application.. Sensitivity labels with unified DLP policies classify data persistently and apply consistent enforcement across Microsoft 365, endpoints, and integrated applications. Exact data match and trainable classifiers improve accuracy by matching real regulated records and learning business context, which reduces false positives while blocking exfiltration at egress points across all channels.

Answer

Require full-disk encryption on all endpoints and enforce TLS for all data in transit to external destinations.

Answer

Implement database activity monitoring on all repositories and alert on bulk read operations of sensitive tables.

Answer

Deploy network DLP appliances at each internet egress point and configure regex patterns for regulated data types.

Question 2

A security analyst is investigating a phishing campaign targeting the organization. The threat intelligence team has provided indicators such as email subject lines, sender domains, and attachment hashes. However, the analyst notices that these IOCs change rapidly and are only effective for a short period. Which type of threat intelligence would provide more durable and actionable information for defending against this campaign?

Accepted Answer

TTP-based threat intelligence. TTP-based threat intelligence focuses on the adversary's tactics, techniques, and procedures — the behavioral patterns behind an attack — rather than volatile artifacts like subject lines or hashes. Because TTPs describe how attackers operate (e.g., MITRE ATT&CK techniques such as spearphishing attachment T1566.001), they remain relevant even when IOCs rotate. This makes them far more durable and actionable for building detections and defenses against an ongoing campaign.

Answer

STIX/TAXII feeds

Answer

IoC-based threat intelligence

Answer

Strategic threat intelligence

Question 3

A security architect is designing a zero trust network access (ZTNA) solution for a company with remote workers. The architect must ensure that access to internal applications is granted based on user identity and device posture, without exposing applications to the internet. Which TWO design elements are essential for this ZTNA implementation? (Choose two.)

Accepted Answer

An outbound-only connection from the application to the trust broker, so the application is never directly exposed to the internet.. ZTNA requires a trust broker to authenticate users and devices and enforce access policies, and it relies on outbound-only connections from applications to the broker to avoid exposing them to the internet. Together, these elements ensure that access is granted based on identity and device posture rather than network location, which is the core of zero trust.

Answer

A public DNS record that maps each internal application to a routable IP address for direct access.

Answer

A next-generation firewall (NGFW) in the DMZ that performs deep packet inspection on all inbound traffic to internal applications.

Answer

A site-to-site VPN between each remote worker's home router and the corporate data center.

Question 4

A security architect is designing a zero trust architecture for a company with a large remote workforce. The requirement is to verify device health and user identity for every session to internal applications, regardless of network location, and to prevent session hijacking after initial authentication. Which of the following BEST meets these requirements?

Accepted Answer

Implement a zero trust network access (ZTNA) service that continuously evaluates identity and device posture and issues per-session, context-bound tokens.. ZTNA continuously evaluates identity and device posture and issues per-session tokens bound to context, so every access request is verified regardless of network location. Because tokens are tied to the session and device context, a stolen token cannot be replayed elsewhere, which directly prevents session hijacking after initial authentication.

Answer

Require all remote users to connect through a cloud access security broker (CASB) that applies data loss prevention policies to cloud applications.

Answer

Use a reverse proxy with mutual TLS client certificates and enforce certificate revocation checks at each connection.

Answer

Deploy a VPN concentrator with split tunneling and require users to authenticate with a username and password plus a one-time code.

Question 5

A security engineer is designing a secure enclave for processing sensitive personally identifiable information (PII). The enclave must protect data at rest and in use, and must support attestation to verify its integrity. Which THREE technologies should the engineer incorporate? (Choose three.)

Accepted Answer

AMD Secure Encrypted Virtualization (SEV). AMD Secure Encrypted Virtualization (SEV) (B) is correct because it encrypts each VM's memory with a per-VM AES key managed by the AMD Secure Processor, protecting data in use and supporting remote attestation of the VM's launch integrity. ARM TrustZone (C) is correct because it partitions the SoC into a secure world and normal world, isolating sensitive PII processing and enabling attestation of trusted applications within the secure enclave. Intel Software Guard Extensions (SGX) (D) is correct because it creates hardware-isolated enclaves (secure enclaves) whose memory is encrypted and inaccessible to the OS/hypervisor, and it provides remote attestation via quoting enclaves to verify enclave integrity. TPM (A) is not the right fit because it primarily provides sealed storage, measured boot, and platform attestation for data at rest, but it does not create an execution enclave that protects data in use. HSM (E) is not the right fit because it safeguards cryptographic keys and performs crypto operations, but it does not provide a general-purpose trusted execution environment for processing PII in use.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 6

A security architect is designing a network for a company that requires high availability and confidentiality for data in transit between two data centers. The company wants to use a protocol that operates at the network layer, supports perfect forward secrecy (PFS), and can be implemented in hardware for high throughput. Which protocol BEST meets these requirements?

Accepted Answer

IPsec with IKEv2. IPsec with IKEv2 operates at the network layer, supports perfect forward secrecy through Diffie-Hellman, and is widely implemented in hardware for high throughput. The other protocols either operate at higher layers or are not typically hardware-accelerated for site-to-site network-layer encryption.

Answer

Secure Shell (SSH) tunneling

Answer

Datagram Transport Layer Security (DTLS)

Answer

Transport Layer Security (TLS) 1.3

Question 7

A systems administrator is hardening a Linux server that stores regulated data. The requirement is that the server's filesystem must detect unauthorized modification of files at rest, including offline tampering with the disk. Which control BEST meets this requirement?

Accepted Answer

Enable dm-verity on the filesystem so that reads are validated against a signed hash tree.. dm-verity provides cryptographic verification of filesystem blocks against a signed hash tree, so any offline modification of the disk causes verification to fail when the data is read. Encryption, integrity monitoring, and filesystem attributes each address different threats and none of them reliably detects offline tampering of the protected volume.

Answer

Deploy file integrity monitoring that hashes files and compares them against a known-good baseline on a schedule.

Answer

Enable full-disk encryption with LUKS using a passphrase entered at boot.

Answer

Set the immutable attribute on critical files using chattr +i and restrict root access.

Question 8

A government agency is designing a system that processes highly sensitive data on a need-to-know basis. The security architect must ensure that access decisions consider the user's clearance level, the data's classification label, and the user's current role, and that users cannot change their own labels. Which of the following access control models best fits these requirements?

Accepted Answer

Mandatory access control, where the system compares the subject's clearance and the object's classification label and enforces the result.. Mandatory access control is designed for environments where the system, not the user, manages sensitivity labels and clearance levels. It compares the subject's clearance to the object's classification and enforces the result, which directly implements need-to-know. Role-based and discretionary models lack this mandatory label comparison, and attribute-based access control, while flexible, does not inherently guarantee that labels remain outside user control.

Answer

Role-based access control, where permissions are assigned to roles and users are placed into roles by their manager.

Answer

Discretionary access control, where data owners set permissions on the objects they own.

Answer

Attribute-based access control, where a policy evaluates any combination of user, resource, and environment attributes.

Question 9

A security engineer is designing a hybrid encryption solution for a messaging application. The requirement is that each message must be encrypted with a unique symmetric key, and that symmetric key must be delivered to the recipient without exposing it to the server. The solution must also support sender authentication. Which combination of cryptographic mechanisms BEST satisfies these requirements?

Accepted Answer

Encrypt the message with AES-256-GCM using a randomly generated key, encrypt that key with the recipient's RSA public key, and sign the ciphertext with the sender's RSA private key.. Hybrid encryption combines asymmetric and symmetric cryptography to meet confidentiality, integrity, and authentication goals. A random AES-GCM key per message ensures unique symmetric keys, RSA key wrapping delivers that key confidentially to the recipient, and a sender signature binds the message to the sender's identity. The other options either leak key material, use impractical direct asymmetric encryption, or omit sender authentication.

Answer

Use Diffie-Hellman key exchange to establish a shared secret, encrypt the message with that secret using AES-256-GCM, and rely on the shared secret itself to authenticate the sender.

Answer

Encrypt the message with AES-256-CBC using a key derived from the sender's password, and include the password hash in the message header for verification.

Answer

Encrypt the message directly with the recipient's RSA public key, and have the recipient verify authenticity by comparing a SHA-256 hash sent alongside the ciphertext.

Question 10

A security architect is designing a microservices-based application deployed on a Kubernetes cluster. The architect must ensure that inter-service communication is encrypted, mutually authenticated, and that services can be authorized based on their identity. Which of the following should the architect implement to meet these requirements?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) and identity-based authorization policies.. A service mesh with mTLS provides transparent encryption and mutual authentication for all service-to-service communication, using verifiable identities. Its authorization policies can enforce access based on those identities, which is essential for zero-trust microservices. The other options either lack encryption, mutual authentication, or are limited to external traffic, failing to secure east-west communication.

Answer

Use Kubernetes Secrets to store TLS certificates and manually configure each service to use them.

Answer

Implement an API gateway that terminates TLS and performs authentication for all inbound traffic.

Answer

Configure Kubernetes Network Policies to allow only specific pod-to-pod traffic.

Question 11

A security architect is designing a data loss prevention (DLP) program for a global enterprise that uses Microsoft 365, endpoint devices, and a custom web application. The requirement is to detect and block sensitive data exfiltration across all three channels while minimizing false positives caused by legitimate business data that resembles regulated data. The architect needs a control that classifies data consistently and applies policy at the point of egress. Which of the following BEST meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a per-tenant data encryption key wrapped by a key encryption key, and destroy the wrapped data key to erase that tenant.. Envelope encryption with a unique wrapped data key per tenant provides both cryptographic isolation and efficient cryptographic erasure. Destroying a single wrapped data key makes that tenant's ciphertext unrecoverable while leaving the key encryption key and all other tenants untouched. This avoids full-database re-encryption and ensures that one key compromise cannot cascade across tenants.

Answer

Encrypt all tenant data with a single database master key and rely on row-level access controls to isolate tenants.

Answer

Encrypt each tenant's data with a key derived from the tenant identifier using PBKDF2, and rotate the derivation salt to erase the tenant.

Answer

Store each tenant's data in a separate database encrypted with a shared HSM-backed key, and delete rows to erase a tenant.

Question 12

A security architect is designing segmentation for an industrial control network that runs Modbus/TCP between engineering workstations and programmable logic controllers. The architect wants to prevent an attacker who compromises a workstation from issuing unauthorized write commands to the controllers, while avoiding disruption of legitimate polling traffic. Which control BEST addresses the specific risk?

Accepted Answer

Implement a deep packet inspection device that understands the protocol and blocks write function codes from workstations.. The risk is a compromised workstation sending unauthorized write commands over a legitimate protocol. Only a control that inspects the industrial protocol at the application layer can distinguish reads from writes and block the dangerous function codes while allowing polling. Address, port, and device-authentication controls operate below that layer and cannot enforce command-level policy.

Answer

Apply network address translation so controllers are not directly reachable from the workstation subnet.

Answer

Enable 802.1X port-based authentication on the switches that connect the controllers.

Answer

Deploy a stateful firewall that permits only the workstation-to-controller TCP port used by the protocol.

Question 13

A security analyst observes anomalous outbound network traffic from a server that normally only performs internal functions. According to the incident response plan, what should the analyst do first?

Accepted Answer

Follow the incident response plan. The incident response plan defines the authorized sequence of actions for handling a suspected incident, including triage, escalation, and containment criteria. Following the plan first ensures the analyst acts within policy and preserves evidence rather than making unilateral decisions. Containment, shutdown, or dismissal are all steps that the plan itself dictates when and how to perform.

Answer

Contain the server by disconnecting it from the network

Answer

Immediately shut down the server

Answer

Ignore the traffic as it might be a false positive

Question 14

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

Accepted Answer

Identity-based access policies. Identity-based access policies are essential for zero-trust micro-segmentation because they authorize every request based on the verified identity of the user, device, or workload — not on network location. In a multi-cloud zero-trust model, policy decisions follow the identity (via IAM, OIDC, SPIFFE, or mTLS) so that workloads are segmented by who they are, not where they sit. This is the core of identity-centric micro-segmentation.

Answer

VPN concentrators

Answer

Network address translation

Answer

Perimeter firewalls

Question 15

A security engineer is configuring a wireless network for a corporate office. The network must support 802.1X authentication with EAP-TLS, and the engineer wants to ensure that only devices with valid certificates issued by the corporate CA can connect. Which of the following should the engineer configure on the RADIUS server to enforce this requirement?

Accepted Answer

Configure EAP-TLS and validate client certificates against the corporate CA.. EAP-TLS is the only method that mandates client-side certificates, allowing the RADIUS server to validate them against the corporate CA. This ensures that only devices with certificates from that CA can connect. The other methods either rely on user credentials, tunneled legacy authentication, or PACs, none of which enforce device certificate validation.

Answer

Enable PEAP with MSCHAPv2 and require domain credentials.

Answer

Deploy EAP-FAST with PACs and require machine authentication.

Answer

Implement EAP-TTLS with a tunneled authentication protocol and check user group membership.