CAS-004 Practice Test 41 — 15 Questions

Question 1

A security architect is designing a data classification scheme. Which TWO of the following are commonly used classification levels? (Select TWO.)

Accepted Answer

Confidential. Common data classification levels include Public (no harm if disclosed), Internal (limited internal use), Confidential (sensitive, limited access), and Restricted (highly sensitive).

Answer

Unclassified

Answer

For Official Use Only

Answer

Top Secret

Question 2

Based on the exhibit, what vulnerability is present in the firewall rule?

Accepted Answer

Overly permissive service specification. The firewall rule permits 'any' as the service, meaning all TCP/UDP ports and protocols are allowed through. This is overly permissive because it bypasses the principle of least privilege, exposing the internal network to unnecessary traffic and potential attacks. A proper rule should specify only required services (e.g., TCP/443 for HTTPS) to minimize the attack surface.

Answer

Source IP range is too broad

Answer

No logging is enabled

Answer

Missing application ID control

Question 3

An organization is migrating its on-premises monolithic application to a containerized microservices architecture on a Kubernetes cluster. The development team has created a set of Docker images that are stored in a private registry. The security team requires that all container images be scanned for vulnerabilities before deployment. The current CI/CD pipeline uses Jenkins to build images, push them to the registry, and then deploy to Kubernetes via kubectl. The scanning is performed by a tool that generates a report, but developers have been ignoring critical vulnerabilities and deploying anyway. The security team wants to enforce a policy that blocks deployment if the image has any critical or high-severity vulnerabilities. Additionally, the cluster must ensure that containers run with the least privilege and that secrets are not exposed in environment variables. The operations team is concerned about performance overhead from runtime security monitoring.

Which of the following approaches best addresses these requirements while minimizing operational overhead?

Accepted Answer

Implement admission controller webhooks that check vulnerability scan results from the registry before allowing pod creation, and use a service mesh with mutual TLS to encrypt secrets.. Admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure. Option B is incorrect because aborting the Jenkins build does not prevent deployment from other sources (e.g., direct kubectl) and secrets mounted as volumes are still vulnerable to compromise. Option C is incorrect because runtime security agents incur performance overhead and do not block deployment upfront; they monitor activity but don't prevent vulnerable images from being scheduled. Option D is incorrect because network policies do not address vulnerability scanning or secret protection; they only control pod-to-pod communication.

Answer

Use a custom script in Jenkins to parse the scan report and abort the build if vulnerabilities are found, and store secrets in Kubernetes secrets mounted as volumes.

Answer

Deploy a runtime security agent that monitors container activity and rejects pods that contain known vulnerability signatures, and use Kubernetes RBAC to limit permissions.

Answer

Configure a network policy in Kubernetes to restrict pod-to-pod communication, and use a static analysis tool during development to find coding flaws.

Question 4

A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?

Accepted Answer

Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.. The attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.

Answer

Enforce a minimum password complexity policy for all users.

Answer

Require multi-factor authentication for all SSH logins.

Answer

Implement rate limiting on SSH connections per source IP.

Question 5

An organization is evaluating its cloud service provider's security posture as part of third-party risk management. Which regulatory framework requires the organization to ensure that the provider has appropriate technical and organizational measures to protect personal data?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) explicitly requires that data controllers (the organization) ensure that data processors (the cloud service provider) implement appropriate technical and organizational measures to protect personal data. This is mandated under Article 28 of the GDPR, which governs the relationship between controllers and processors, including contractual obligations for security measures. The regulation applies to any organization handling personal data of EU residents, regardless of where the cloud provider is located.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 6

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

Accepted Answer

Check if the host is configured as a mail server in the organization's asset database.. The first step in investigating potential data exfiltration over TCP port 25 (SMTP) is to verify whether the host is authorized to send email. If the host is a legitimate mail server, the traffic may be normal; if not, it could indicate malware or a misconfigured application exfiltrating data via SMTP. This aligns with the CAS-004 objective of validating asset roles before escalating to containment.

Answer

Submit a change request to implement an email content filter.

Answer

Block the outbound traffic on the firewall to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the host to detect any malware.

Question 7

A SOC analyst is investigating an alert from the EDR system indicating that a user's workstation made multiple failed login attempts to a sensitive server, followed by a successful login from an unusual IP address. The analyst suspects a brute force attack. Which type of threat hunting methodology is being used?

Accepted Answer

Hypothesis-driven hunting. This is hypothesis-driven threat hunting, as the analyst starts with a hypothesis (brute force attack) and then searches for evidence to confirm or deny it based on the alert.

Answer

TTP-driven hunting

Answer

IoC-driven hunting

Answer

Baseline-driven hunting

Question 8

A security architect is reviewing the network security controls for a critical industrial control system (ICS) environment. The architect must select two controls that are most effective at preventing unauthorized access to the ICS network from the corporate IT network, while still allowing necessary monitoring traffic. Which TWO controls should be implemented? (Choose two.)

Accepted Answer

Deploy a unidirectional gateway (data diode) between the networks. A unidirectional gateway (data diode) physically enforces one-way data flow, ensuring that no traffic can originate from the corporate IT network into the ICS network. This prevents unauthorized access while allowing monitoring data (e.g., syslog, SNMP traps) to be sent out from the ICS side. It is the most effective control for preventing any inbound attack vectors while preserving outbound monitoring traffic.

Answer

Configure a site-to-site VPN from the corporate network to the ICS network

Answer

Implement a network-based intrusion prevention system (IPS) on the ICS network

Answer

Segment the networks using VLANs only

Question 9

Which TWO of the following are secure coding practices to prevent SQL injection?

Accepted Answer

Using an ORM that automatically parameterizes queries. Object-Relational Mapping (ORM) frameworks like Hibernate or Entity Framework, when configured to use parameterized queries, automatically separate SQL code from data. This prevents an attacker from injecting malicious SQL statements because user input is always treated as a parameter value, never as executable code. The ORM's internal query builder generates parameterized SQL statements under the hood, ensuring that even if input contains SQL metacharacters, they are safely escaped or bound.

Answer

Escaping all single quotes in user input

Answer

Validating input against a whitelist of allowed characters

Answer

Using stored procedures that accept user input directly

Question 10

A security architect is designing a microservices application that uses JWTs for authentication. Which of the following is the most critical security concern regarding JWT handling?

Accepted Answer

The server not validating the JWT's 'alg' header properly. A failure to validate the JWT's 'alg' header can allow an attacker to change the algorithm to 'none' or from an asymmetric algorithm (e.g., RS256) to a symmetric one (e.g., HS256), potentially bypassing signature verification. This vulnerability, known as a JWT algorithm confusion attack, is a critical security concern because it directly undermines the integrity and authenticity of the token, which is the core security mechanism for authentication in microservices.

Answer

Token expiration not being enforced

Answer

The JWT being transmitted over HTTP instead of HTTPS

Answer

The JWT containing personally identifiable information (PII)

Question 11

A development team wants to deploy a microservices application using containers. They need a solution to automate the deployment, scaling, and management of the containers across a cluster. Which technology is most suitable?

Accepted Answer

Kubernetes with Helm charts.. Kubernetes is designed for orchestrating containerized applications at scale, providing automated deployment, scaling, and management across a cluster. Helm charts simplify package management on Kubernetes. Option A (VMware vSphere with container support) focuses on virtualized infrastructure management rather than container orchestration across a cluster. Option B (Jenkins with Docker plugins) is a CI/CD tool, not an orchestrator. Option C (Docker Compose with manual scaling) is intended for single-host multi-container applications and does not automate scaling across a cluster.

Answer

VMware vSphere with container support.

Answer

Jenkins with Docker plugins.

Answer

Docker Compose with manual scaling.

Question 12

A security engineer is implementing a solution to securely store and manage cryptographic keys for a fleet of IoT devices. The devices have limited processing power and cannot perform asymmetric operations. Which of the following is the BEST approach?

Accepted Answer

Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.. IoT devices with limited processing power cannot efficiently perform asymmetric operations, so pre-provisioning keys from a cloud-based HSM during manufacturing ensures secure key generation and storage without burdening the device. The HSM provides tamper-resistant key generation and lifecycle management, and the keys are injected into the device's secure storage (e.g., eFuse or secure element) before deployment, eliminating the need for on-device asymmetric cryptography.

Answer

Install a Trusted Platform Module (TPM) in each device to store keys on the device.

Answer

Use a cloud KMS to generate and wrap keys, then store the wrapped key in the device.

Answer

Store keys in obfuscated form in the device firmware and use a custom algorithm for encryption.

Question 13

During a third-party risk assessment, an organization discovers that a cloud service provider (CSP) stores data in a jurisdiction with conflicting privacy laws. The organization's legal team advises that this could expose the organization to regulatory penalties. Which of the following contractual clauses would best address this compliance risk?

Accepted Answer

Include a Data Processing Agreement (DPA) that requires data to be stored only in approved jurisdictions.. A Data Processing Agreement (DPA) is the correct contractual mechanism to enforce data residency restrictions. By requiring the CSP to store data only in approved jurisdictions, the DPA directly addresses the compliance risk of conflicting privacy laws and potential regulatory penalties, as it legally binds the provider to specific geographic data handling requirements.

Answer

Insert a right-to-audit clause allowing the organization to inspect the CSP's facilities.

Answer

Negotiate a service-level agreement (SLA) guaranteeing 99.99% uptime.

Answer

Require the CSP to sign a business associate agreement (BAA) under HIPAA.

Question 14

A network administrator is configuring a firewall to allow only necessary traffic to a web server. The server should be accessible from the internet on port 443 and from a management subnet on port 22. Which firewall rule ensures least privilege?

Accepted Answer

Allow traffic from any to port 443, and from management subnet to port 22; deny all else. It explicitly allows only the required traffic (HTTPS on port 443 from any source, SSH on port 22 from the management subnet) and then denies all other traffic by default. This follows the principle of least privilege by ensuring no unintended services or sources are permitted, which is the core goal of firewall rule design.

Answer

Allow traffic from management subnet to port 443 and any to port 22

Answer

Allow traffic from any source to ports 443 and 22

Answer

Allow all traffic to the server, then block specific ports

Question 15

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Accepted Answer

Include a manual approval step for high-impact actions.. High-impact automated actions, such as blocking a critical server or deleting user accounts, can cause significant collateral damage if triggered by a false positive. Including a manual approval step ensures a human verifies the alert before irreversible or disruptive actions are taken, aligning with the principle of least privilege and incident response best practices.

Answer

Execute all actions immediately to minimize damage.

Answer

Use the same playbook for all incident types.