CAS-004 Practice Test 42 — 15 Questions

Question 1

An analyst needs to automate the extraction of indicators of compromise (IOCs) from log files generated by various systems. Which scripting language is most commonly used for cross-platform log parsing and automation due to its extensive library support?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Python. Python is the correct answer because it is a cross-platform scripting language with extensive standard libraries (e.g., `re` for regex, `json`, `csv`, `logging`) and third-party packages (e.g., `pandas`, `yara-python`, `stix2`) that simplify parsing diverse log formats and automating IOC extraction. Its portability across Windows, Linux, and macOS makes it ideal for environments with heterogeneous systems, unlike platform-specific alternatives.

Answer

PowerShell

Answer

Bash

Answer

JavaScript

Question 2

A security analyst discovers that an employee has been using a personal USB drive to transfer sensitive customer data from a workstation to a home computer. This violates the company's data handling policy. According to the company's incident response plan, which of the following is the FIRST step the analyst should take?

Accepted Answer

Isolate the workstation from the network. The first priority in any incident response is containment to prevent further data loss or network propagation. Isolating the workstation from the network (Option B) immediately stops the employee from exfiltrating additional data and prevents any potential lateral movement by malware that might be on the USB drive. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Perform a forensic analysis of the workstation

Answer

Escalate the incident to the data protection officer (DPO)

Answer

Notify law enforcement

Question 3

A company is adopting container security best practices. Which TWO actions should be implemented to reduce the attack surface of container images? (Select TWO.)

Accepted Answer

Set the container filesystem as read-only where possible.. Setting the container filesystem as read-only (A) reduces the attack surface by preventing attackers from writing malicious files or modifying system binaries within the container, even if they gain code execution. This enforces immutability and aligns with the principle of least privilege, as most containers do not need to write to their own filesystem at runtime.

Answer

Disable vulnerability scanning to optimize build time.

Answer

Store secrets in environment variables.

Answer

Run containers with the root user to simplify permissions.

Question 4

An organization needs to ensure that evidence collected during a forensic investigation remains intact and admissible in court. Which process is most critical for maintaining the integrity of digital evidence?

Accepted Answer

Maintaining an unbroken chain of custody. Chain of custody documents every person who handled the evidence, from collection to presentation in court, ensuring that evidence has not been tampered with. This is essential for admissibility.

Answer

Storing evidence in a secure locker

Answer

Using write-blockers when imaging drives

Answer

Hashing the evidence with SHA-256

Question 5

Refer to the exhibit. A security administrator finds this IAM policy attached to a Lambda execution role. What is the most critical security risk?

Accepted Answer

The Lambda has full IAM management capabilities. The IAM policy grants the Lambda execution role the `iam:*` action, which includes all IAM operations such as creating, modifying, and deleting IAM users, roles, and policies. This effectively gives the Lambda full administrative control over IAM, allowing it to escalate privileges, create backdoor access, or disrupt the entire AWS account's identity and access management. Such broad permissions violate the principle of least privilege and represent a critical security risk.

Answer

The Lambda can invoke any other Lambda

Answer

The Lambda can assume any role

Answer

The Lambda can access any S3 bucket

Question 6

A security audit reveals that Docker containers are built with multiple unnecessary layers and utilities. Which practice reduces the attack surface of the container image?

Accepted Answer

Use a base image with only the required packages. Using a base image with only the required packages directly reduces the attack surface by eliminating unnecessary binaries, libraries, and services that could contain vulnerabilities. This practice aligns with the principle of minimalism in container security, where every extra package increases the potential for exploitation. Unlike multi-stage builds or RUN command consolidation, this approach targets the root cause: the contents of the image itself.

Answer

Use multi-stage builds

Answer

Combine multiple RUN commands into one

Answer

Delete the apt cache in the Dockerfile

Question 7

A security analyst is investigating a phishing campaign targeting the organization. The threat intelligence team has provided indicators such as email subject lines, sender domains, and attachment hashes. However, the analyst notices that these IOCs change rapidly and are only effective for a short period. Which type of threat intelligence would provide more durable and actionable information for defending against this campaign?

Accepted Answer

TTP-based threat intelligence. TTP-based intelligence focuses on the adversary's behavior, such as tactics, techniques, and procedures, which are more stable over time compared to fast-changing IOCs like hashes and domains. This aligns with the ATT&CK framework.

Answer

STIX/TAXII feeds

Answer

IoC-based threat intelligence

Answer

Strategic threat intelligence

Question 8

Which TWO are required by PCI DSS for all merchants?

Accepted Answer

Maintain a vulnerability management program. PCI DSS Requirement 6 mandates a vulnerability management program that includes secure development and patch management. Requirement 11 requires regular vulnerability scans and penetration testing. Requirement 3.4 requires cardholder data at rest to be rendered unreadable via encryption, truncation, tokenization, or hashing. Both are core, mandatory requirements for all merchants, regardless of size or transaction volume.

Answer

Implement network segmentation

Answer

Store CVV codes

Answer

Use only tokenization

Question 9

Match each security tool to its purpose.

Accepted Answer

SIEM: Centralized log management and real-time event correlation. Correct matches: SIEM provides centralized log analysis, IDS monitors for malicious activity, and firewalls enforce traffic rules. Common confusions include mixing SIEM and firewall functions.

Answer

SIEM: Blocks malicious traffic by inspecting packet headers

Answer

IDS: Scans systems for known vulnerabilities

Answer

Firewall: Collects logs from multiple sources for analysis

Question 10

A large financial organization is migrating its on-premises authentication infrastructure to a cloud-based identity provider (IdP) to support a hybrid workforce. Currently, on-premises Active Directory is used with smart cards for authentication. The cloud IdP will support SAML 2.0 and OAuth 2.0. The security team requires that all authentication to cloud applications be protected by hardware-backed keys and that user credentials never leave the on-premises network. The solution must also support FIDO2 authentication for passwordless logins. During a pilot, users report that after authenticating to the cloud IdP using their smart cards, they are prompted again for credentials when accessing certain cloud applications. The logs show that the cloud IdP is issuing multiple authentication requests to the on-premises AD Federation Services (AD FS). The CISO is concerned about performance and security of repeated authentication. As a security architect, what is the best course of action?

Accepted Answer

Configure AD FS to pass through the smart card certificate to the cloud IdP and enable seamless SSO by using the certificate as a security token.. Configuring AD FS to pass through the smart card certificate to the cloud IdP allows the cloud IdP to accept the certificate as a valid security token, enabling seamless SSO. This eliminates repeated authentication prompts by establishing a trust relationship between AD FS and the cloud IdP. It keeps credentials on-premises and supports hardware-backed keys (smart cards) and FIDO2 authentication. Option A is wrong because deploying an HSM with AD FS improves key security but does not solve the repeated authentication chaining problem; the cloud IdP still needs to trust the token. Option B is wrong because caching tokens on a reverse proxy introduces security risks (e.g., token theft) and does not address the trust issue. Option C is wrong because conditional access policies based on device compliance do not prevent the authentication chaining; the cloud IdP will still require authentication from AD FS for non-compliant devices.

Answer

Deploy a hardware security module (HSM) on-premises and integrate it with AD FS to perform certificate-based authentication and issue short-lived tokens.

Answer

Implement a reverse proxy to cache authentication tokens and replay them to cloud applications.

Answer

Implement a conditional access policy in the cloud IdP to skip authentication for trusted devices based on device compliance.

Question 11

Which TWO of the following are essential characteristics of a hardware security module (HSM)? (Select TWO.)

Accepted Answer

Hardware acceleration of cryptographic operations.. HSMs are dedicated hardware appliances that offload cryptographic operations from the main CPU, providing hardware acceleration for algorithms such as AES, RSA, and ECC. This acceleration is critical for high-throughput environments like TLS termination or code signing, where software-based cryptography would create a performance bottleneck.

Answer

Virtualization of the hardware root of trust.

Answer

Integration with public key infrastructure (PKI) to replace certificate authorities.

Answer

User authentication and authorization.

Question 12

In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?

Accepted Answer

Run a vulnerability scanner and fail the build on critical findings. Integrating a vulnerability scanner into the CI/CD pipeline and failing the build on critical findings directly reduces the attack surface by preventing deployment of images with known exploitable vulnerabilities. This aligns with the principle of secure software supply chain management, where automated security gates are essential for containerized environments.

Answer

Use the 'latest' tag for the base image to get latest patches

Answer

Store the Dockerfile in a private repository only

Answer

Install all available packages inside the container

Question 13

A financial services company is implementing a risk management framework. The security team has identified that the current encryption algorithm for customer data in transit is deprecated. According to NIST SP 800-53, which of the following is the MOST appropriate step to address this finding?

Accepted Answer

Update the encryption algorithm to a FIPS 140-2 validated one. NIST SP 800-53 requires that cryptographic algorithms used to protect data in transit must be FIPS 140-2 validated. A deprecated algorithm (e.g., DES, RC4, or 3DES) is no longer considered secure and must be replaced with a current, approved algorithm such as AES-256 or ChaCha20. Updating the encryption algorithm directly remediates the security finding and aligns with the risk management framework's requirement to maintain adequate security controls.

Answer

Implement compensating controls such as network segmentation

Answer

Accept the risk because the algorithm is still functional

Answer

Transfer the risk by purchasing cyber insurance

Question 14

An incident responder is analyzing a compromised server. Which THREE indicators are MOST likely to confirm a successful attack?

Accepted Answer

Corrupted system files. Corrupted system files (A) are a strong indicator of a successful attack because many malware variants, such as ransomware or rootkits, intentionally modify or encrypt critical system files (e.g., DLLs, executables) to maintain persistence or cause damage. The incident responder would detect this via file integrity monitoring (FIM) tools like Tripwire or by comparing file hashes against known-good baselines, revealing unauthorized changes that confirm compromise.

Answer

Multiple failed login attempts

Answer

High CPU usage due to legitimate processes

Question 15

Which THREE of the following are key components of a zero-trust security architecture? (Select THREE).

Accepted Answer

Micro-segmentation. Micro-segmentation is a core component of zero-trust architecture because it divides the network into isolated zones, each requiring separate authentication and authorization for any cross-zone traffic. This enforces the 'never trust, always verify' principle by preventing lateral movement even if an attacker compromises a single segment, unlike traditional flat networks where internal traffic is implicitly trusted.

Answer

VPN concentrator

Answer

Implicit trust for internal network traffic