CAS-004 Practice Test 41 — 15 Questions

Question 1

A security engineer is hardening a Linux bastion host that provides administrative access to production servers. The organization requires that all administrative sessions be cryptographically bound to a hardware-backed credential and that session recordings be tamper-evident. Which TWO controls BEST satisfy these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a session recording solution that writes audit logs to a remote syslog server protected by TLS and stores a hash chain of each session.. Hardware-backed authentication and tamper-evident recording are distinct requirements that need complementary controls. FIDO2-backed sk-ssh-ed25519 keys bind administrative sessions to a physical authenticator, while remote TLS-protected logging with a hash chain ensures session recordings cannot be altered undetectably. Together they satisfy both the credential-binding and recording-integrity objectives without relying on weaker password or SMS mechanisms.

Answer

Enable PasswordAuthentication and enforce a 20-character complexity policy with quarterly rotation.

Answer

Configure sshd to permit only keyboard-interactive authentication with one-time passwords delivered by SMS.

Answer

Store session recordings locally on the bastion host in a directory writable only by root, and rely on file permissions for integrity.

Question 2

A security engineer is designing a system that must protect data at rest on a database server. The organization requires that the encryption keys never leave a hardware module and that the module be resistant to physical tampering. The engineer deploys a hardware security module (HSM) that is validated to FIPS 140-2 Level 3. Which of the following BEST describes the security property provided by this validation level?

Accepted Answer

It provides tamper-evident physical mechanisms and identity-based authentication to access cryptographic keys.. FIPS 140-2 Level 3 validation requires tamper-evident physical mechanisms and identity-based authentication, ensuring that keys remain within a hardened hardware boundary and that only authenticated operators can access them. This matches the stated requirements of keys never leaving the module and resistance to physical tampering. Levels 1 and 2 lack these physical protections, while Level 4 adds environmental protections beyond what is needed here.

Answer

It provides zeroization of keys when the module is powered down, but does not require any authentication for administrative access.

Answer

It provides the highest level of physical security with environmental failure protection and formal method verification.

Answer

It provides a software-only cryptographic module that can be deployed on any commodity server without hardware dependencies.

Question 3

A security engineer is configuring an internal certificate authority that must issue end-entity certificates to servers on a private network. Corporate policy requires that the CA's private key never reside on a network-connected host, and that certificate issuance be a deliberate, low-volume operation. Which of the following should the engineer implement to BEST meet these requirements?

Accepted Answer

Configure an offline root CA that signs an online issuing subordinate CA, which in turn issues end-entity certificates.. Keeping the root CA offline and delegating routine issuance to an online subordinate CA separates the trust anchor from day-to-day operations. The root key is only used to sign the subordinate CA certificate, so it can stay on an isolated host, while the subordinate handles end-entity certificates. This limits exposure and matches the policy of deliberate, low-volume root signing.

Answer

Configure a cross-certified bridge CA that exchanges certificates with external partners using automated enrollment.

Answer

Issue self-signed certificates directly to each server and distribute them to clients through a configuration management tool.

Answer

Deploy a single online root CA that issues all end-entity certificates and keeps its key in a network HSM.

Question 4

A security engineer is deploying a zero trust architecture for a hybrid cloud environment. The organization wants to enforce least privilege access to internal APIs. The engineer must select TWO mechanisms that provide continuous authentication and authorization for each API request. (Choose two.)

Accepted Answer

Mutual TLS (mTLS) with short-lived client certificates issued by an internal CA.. Continuous authentication and authorization in zero trust require identity-based mechanisms that evaluate every request. Mutual TLS with short-lived certificates verifies the client's identity cryptographically, while a service mesh sidecar enforces per-request authorization policies based on workload identity. Together, they ensure that each API call is authenticated and authorized based on dynamic policy, not static network trust.

Answer

OAuth 2.0 access tokens with a one-hour expiry and no refresh tokens.

Answer

Static API keys stored in a configuration file and rotated every 90 days.

Answer

IP allowlisting based on the source subnet of the API caller.

Question 5

A security architect is designing a microservices-based application deployed on containers in a Kubernetes cluster. The architect needs to implement controls that protect the application from lateral movement in case a container is compromised. Which TWO of the following controls best achieve this goal? (Choose two.)

Accepted Answer

Use a service mesh to enforce mutual TLS (mTLS) between all services and apply authorization policies based on service identity.. Default-deny network policies restrict pod-to-pod traffic to only what is explicitly allowed, and a service mesh with mutual TLS and authorization policies enforces identity-based communication between services. Together, these controls limit an attacker's ability to move laterally from a compromised container. RBAC, privileged containers, and secrets in environment variables do not prevent network-based lateral movement and may even increase risk.

Answer

Enable role-based access control (RBAC) for the Kubernetes API and grant each service account the minimum permissions required.

Answer

Store all application secrets in environment variables within the container images to simplify deployment.

Answer

Run all containers as privileged to ensure they have the necessary permissions to perform their functions.

Question 6

A security administrator is hardening a web server and wants to ensure that browsers cannot be tricked into sending requests over plain HTTP after an initial HTTPS visit. The administrator also wants to prevent protocol-downgrade attacks against the site. Which response header should be configured?

Accepted Answer

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Strict-Transport-Security tells the browser to rewrite future requests for the domain to HTTPS and to refuse insecure connections for the max-age window, which blocks downgrade attacks. The other headers address resource loading, framing, and referrer leakage respectively, none of which enforce transport security or prevent a fallback to HTTP.

Answer

Content-Security-Policy: default-src 'self'

Answer

X-Frame-Options: DENY

Answer

Referrer-Policy: no-referrer

Question 7

A security architect is designing a cross-domain solution that must move data between a classified network and an unclassified network. The requirement is to enforce a formally verified, non-bypassable policy that prevents any high-to-low leakage, while still permitting a controlled release of approved structured data. Which design element is MOST appropriate to satisfy this requirement?

Accepted Answer

A high-assurance cross-domain guard with a formally verified security kernel that filters and downgrades approved structured records. Only a high-assurance cross-domain guard with a formally verified security kernel can enforce a non-bypassable information-flow policy and simultaneously release approved structured records. Firewalls and content-filtering proxies lack formal verification and structured-data transformation, and a data diode addresses flow direction rather than content policy. The guard is purpose-built for this multi-level release requirement.

Answer

A content-filtering proxy that performs deep packet inspection and blocks known malicious signatures

Answer

A stateful packet-filtering firewall with an explicit deny-all rule between the two enclaves

Answer

A data diode that permits only unidirectional physical-layer transmission from the unclassified to the classified network

Question 8

A security engineer is implementing a network access control (NAC) solution that must authenticate users and devices before granting access to the corporate network. The organization wants to use a protocol that supports both authentication and authorization and can carry attributes such as VLAN assignment and ACLs. The engineer decides to use RADIUS. Which of the following statements about RADIUS is correct?

Accepted Answer

RADIUS uses UDP ports 1812 for authentication and 1813 for accounting.. RADIUS uses UDP ports 1812 for authentication and 1813 for accounting as assigned by IANA. It encrypts only the password field, not the whole packet, and it requires EAP encapsulation to support EAP methods. Understanding these details is essential for proper NAC implementation.

Answer

RADIUS encrypts the entire authentication packet, including attributes, using a shared secret.

Answer

RADIUS supports the EAP framework natively without any additional encapsulation.

Answer

RADIUS operates at the application layer and uses TCP for reliable delivery.

Question 9

A security team is deploying a zero trust architecture for an enterprise campus. The design must verify every request as though it originated from an untrusted network and must limit lateral movement after a workstation compromise. Which TWO capabilities are essential to this design? (Choose two.)

Accepted Answer

Microsegmentation of workloads so that east-west traffic is denied by default and allowed only by explicit policy.. Zero trust replaces location-based trust with continuous, per-session evaluation of identity and device posture, enforced by policy decision and enforcement points. Microsegmentation supports that model by denying east-west traffic by default and permitting only explicitly authorized flows, which together prevent an intruder from moving freely.

Answer

Implicit trust for traffic originating from the internal corporate VLAN.

Answer

A VPN concentrator that grants full internal access after a single successful login.

Answer

A flat internal network with 802.1X port authentication at the access layer.

Question 10

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

Accepted Answer

In the DMZ. A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

Answer

In the management network

Answer

In the database tier

Answer

Inside the internal network

Question 11

A security architect is designing a just-in-time (JIT) privileged access management (PAM) solution. Which TWO of the following are key characteristics of JIT access?

Accepted Answer

Access rights are automatically revoked after use or expiry.. Option B is correct because a defining property of JIT PAM is that elevated rights are time-bound and automatically revoked once the task completes or the approved window expires, eliminating lingering standing privileges. Option D is correct because JIT access grants privileges on-demand only when needed, for a limited duration, rather than provisioning them permanently in advance. Together, B and D capture the core JIT model: just-in-time, just-enough, and time-limited elevation. Option A is wrong because JIT privileges are temporary, not permanent, even if approval workflows are involved. Option C is wrong because break-glass accounts are an emergency fallback mechanism, not a defining characteristic of JIT access itself. Option E is wrong because standing privileges for routine tasks directly contradict the JIT principle of eliminating always-on access.

Answer

Privileges are permanent but require approval each time.

Answer

Break-glass accounts are used for emergency access.

Answer

Users have standing privileges for routine tasks.

Question 12

A security architect is designing a network segmentation strategy for a data center that hosts both web servers and database servers. The architect wants to ensure that if a web server is compromised, the attacker cannot directly access the database servers. The architect plans to implement microsegmentation using software-defined networking (SDN). Which TWO of the following are essential components to achieve this goal? (Choose two.)

Accepted Answer

A hypervisor-based firewall that inspects traffic between virtual machines.. Microsegmentation with SDN requires a centralized policy controller to define and distribute security rules, and a hypervisor-based firewall to enforce those rules between virtual machines. Together, they enable granular, dynamic segmentation that prevents lateral movement. HSMs, network taps, and perimeter NGFWs serve other purposes and do not provide the necessary internal enforcement.

Answer

A next-generation firewall (NGFW) at the perimeter of the data center.

Answer

A network tap or SPAN port for traffic monitoring and analysis.

Answer

A hardware security module (HSM) to store encryption keys for VPN tunnels.

Question 13

A development team wants to deploy a microservices application using containers. They need a solution to automate the deployment, scaling, and management of the containers across a cluster. Which technology is most suitable?

Accepted Answer

Kubernetes with Helm charts.. Kubernetes is the de facto standard for container orchestration, providing automated deployment, scaling, and management of containerized applications across a cluster. Helm charts add package management, templating, and release versioning, which are essential for managing complex microservices deployments. Together, they directly address the requirement to automate deployment, scaling, and management across a cluster.

Answer

VMware vSphere with container support.

Answer

Jenkins with Docker plugins.

Answer

Docker Compose with manual scaling.

Question 14

A security analyst is reviewing a packet capture of suspicious traffic that uses a custom protocol over TCP. The analyst needs to determine the application-layer payload and session flow to identify potential data exfiltration. Which tool is MOST appropriate for this task?

Accepted Answer

Wireshark. Wireshark is the correct choice because it enables deep packet inspection, protocol dissection, and TCP stream reassembly, which are essential for analyzing custom protocols and identifying data exfiltration. The other tools lack the granular payload analysis and session reconstruction capabilities required for this task.

Answer

Nmap

Answer

tcpdump

Answer

NetFlow

Question 15

A security operations center (SOC) has deployed a SOAR platform to automate phishing response. An analyst wants to ensure that when a phishing email is reported, the platform automatically extracts all URLs from the email body and headers, submits them to a threat intelligence service, and then quarantines the email if any URL is malicious. Which SOAR component should the analyst configure to define this sequence of actions?

Accepted Answer

Playbook. The requirement is to define an automated sequence of actions triggered by a phishing report. A playbook in SOAR is exactly this: a workflow that can include conditional logic, integrations with threat intelligence, and actions like quarantine. The other components either support execution, document procedures, or track cases but do not define the automation logic.

Answer

Case management system

Answer

Orchestration engine

Answer

Runbook