CAS-004 Practice Test 43 — 15 Questions

Question 1

A security administrator is implementing a new policy that requires all employees to use multi-factor authentication (MFA) for accessing cloud applications. The administrator wants to choose an MFA method that is resistant to phishing attacks. Which of the following MFA methods should the administrator select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIDO2 security keys. FIDO2 security keys are phishing-resistant because they use public-key cryptography and the authentication is bound to the specific origin. Even if a user is directed to a phishing site, the key will not authenticate to the fraudulent domain. Other methods like SMS, push notifications, and TOTP are vulnerable to real-time phishing or interception, so FIDO2 is the most secure choice for this requirement.

Answer

Push notifications with number matching

Answer

Time-based one-time passwords (TOTP) generated by an authenticator app

Answer

SMS-based one-time codes

Question 2

A financial services company is conducting a risk assessment for a new online banking platform. The risk team must prioritize identified risks. Which TWO of the following factors are most critical in determining the priority for risk treatment? (Choose two.)

Accepted Answer

Potential impact on business objectives. Risk prioritization hinges on assessing the likelihood of a risk event and its potential impact on business objectives. These two factors form the basis of risk scoring (e.g., risk = likelihood × impact) and guide where to focus treatment efforts. Cost, vendor market share, and vulnerability counts are secondary or irrelevant to determining which risks are most urgent for the online banking platform.

Answer

Number of open vulnerabilities

Answer

Vendor's market share

Answer

Cost of the security control

Question 3

A financial services firm operates in several countries and must demonstrate that its security controls are effective and independently validated for regulators and enterprise customers. Executives want a report that auditors can rely on regarding the design and operating effectiveness of controls over a period of time. Which document should the security team provide?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the appropriate artifact because it attests to both the design and operating effectiveness of controls across a defined period. Type I reports only cover design at a point in time, and the other documents do not provide period-wide control testing evidence.

Answer

SOC 2 Type I report

Answer

SOC 3 general use report

Answer

ISO/IEC 27001 certificate

Question 4

A security manager is reviewing the organization's risk register and notes that a critical vulnerability in a legacy application has been accepted for two years. The business owner argues that the cost of remediation exceeds the potential loss. The security manager must present an alternative that aligns with the organization's risk appetite while addressing the residual risk. Which of the following is the BEST recommendation?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring to reduce the likelihood and impact of exploitation.. Compensating controls reduce residual risk when remediation is not feasible, aligning with the organization's risk appetite by lowering likelihood and impact without the full cost of replacing the legacy system. Risk transfer, acceptance without action, and avoidance all fail to address the residual risk appropriately in this context.

Answer

Transfer the risk by purchasing cyber insurance that covers losses from exploitation of the legacy application.

Answer

Avoid the risk by decommissioning the legacy application immediately, regardless of business impact.

Answer

Accept the risk permanently and document the business owner's decision in the risk register without further action.

Question 5

A software company is pursuing ISO/IEC 27001 certification. The ISMS scope covers its cloud-hosted product and corporate IT. An auditor requests evidence that management reviews the ISMS at planned intervals. Which artifact should the security manager provide?

Accepted Answer

Management review meeting minutes with inputs, decisions, and actions. Clause 9.3 of ISO/IEC 27001 mandates that top management review the ISMS at planned intervals, considering status of actions, changes, performance feedback, and risk assessment results. Documented minutes capturing inputs, decisions, and resulting actions are the direct evidence auditors seek. Other artifacts such as internal audit reports or the Statement of Applicability may feed the review but do not demonstrate that it took place.

Answer

The latest internal audit report and nonconformity log

Answer

Business continuity and disaster recovery test results

Answer

The Statement of Applicability listing implemented controls

Question 6

A multinational retailer operates under GDPR for its EU customers and must demonstrate accountability to supervisory authorities. The Chief Privacy Officer wants a mechanism that documents, on an ongoing basis, which processing activities occur, what data categories are involved, and how long each is retained. Which GDPR instrument should the privacy team maintain to satisfy this requirement?

Accepted Answer

Records of Processing Activities (RoPA) under Article 30. The Records of Processing Activities is the Article 30 accountability instrument that captures processing purposes, data categories, recipients, retention, and safeguards in one maintained register. A DPIA analyses a single high-risk activity, while SCCs and BCRs are cross-border transfer mechanisms. Only the RoPA provides the persistent, organization-wide documentation the retailer needs to show supervisory authorities how EU personal data is handled and retained.

Answer

Standard Contractual Clauses (SCCs)

Answer

Binding Corporate Rules (BCRs)

Answer

Data Protection Impact Assessment (DPIA)

Question 7

A security architect is designing a new system that processes sensitive customer data. The organization must comply with multiple regulations, including GDPR and PCI DSS. The architect needs to ensure that data protection controls are integrated from the outset. Which approach best aligns with the principle of privacy by design?

Accepted Answer

Conduct a data protection impact assessment (DPIA) before development begins.. Conducting a data protection impact assessment before development begins is a core privacy by design practice. It proactively identifies privacy risks and ensures controls are integrated into the system architecture from the start. Encryption after deployment, default settings, and consent are either reactive or insufficient to meet the principle of privacy by design.

Answer

Obtain consent from all customers for data processing.

Answer

Rely on the cloud provider's default security settings.

Answer

Implement encryption for data at rest after the system is deployed.

Question 8

A financial services firm is undergoing a SOC 2 Type II examination. The auditor asks the CISO to demonstrate that the organization continuously monitors whether the controls described in the system description operated effectively throughout the review period. Which activity should the CISO present as the primary evidence supporting this requirement?

Accepted Answer

Collecting and retaining timestamped system-generated logs and control execution records across the entire audit period. SOC 2 Type II differs from Type I because it reports on control operating effectiveness over a period rather than design at a point in time. The strongest evidence is contemporaneous, system-generated, and timestamped, covering the full window. Signed questionnaires, single penetration tests, and policy manuals only show intent or a snapshot, so they cannot demonstrate that the described controls ran effectively on an ongoing basis.

Answer

Delivering the organization's information security policy manual and a list of planned future controls

Answer

Scheduling a one-time penetration test two weeks before the auditor's fieldwork begins

Answer

Providing a completed security questionnaire signed by the CISO on the last day of the audit period

Question 9

A security architect is designing a new cloud-based system that must comply with the Payment Card Industry Data Security Standard (PCI DSS). The architect needs to ensure that cardholder data is protected both at rest and in transit. Which TWO of the following controls are required by PCI DSS to protect cardholder data in this scenario? (Choose two.)

Accepted Answer

Render primary account numbers (PAN) unreadable anywhere they are stored.. PCI DSS explicitly requires encrypting cardholder data during transmission over open, public networks (Requirement 4) and rendering stored PAN unreadable (Requirement 3). These two controls directly protect data in transit and at rest. WAF, physical access, and vulnerability scans are important but do not specifically fulfill the data protection requirements for those states.

Answer

Restrict physical access to cardholder data storage systems.

Answer

Conduct quarterly external and internal vulnerability scans.

Answer

Implement a web application firewall (WAF) in front of all public-facing web servers.

Question 10

A newly hired Chief Information Security Officer is establishing a governance structure and wants to define who is accountable for accepting residual risk that exceeds the organization's stated risk appetite. According to common governance practice, which role holds that accountability?

Accepted Answer

The board of directors or an executive risk committee with authority delegated by the board.. Governance accountability for accepting risk beyond the approved appetite belongs to the board of directors or a delegated executive risk committee. Operational and assurance roles support risk management but do not own the decision to retain risk at the enterprise level.

Answer

The internal audit director who reports findings to the audit committee.

Answer

The third-party managed security service provider under the outsourcing agreement.

Answer

The security operations center manager who oversees day-to-day monitoring and incident response.

Question 11

A retail company is building a new mobile application that will collect customer location data. The legal team asks the security manager to ensure the design follows privacy by design principles from the earliest stages. Which action best demonstrates privacy by design in this scenario?

Accepted Answer

Perform a privacy impact assessment and design data minimization controls before development begins. Privacy by design means embedding privacy into systems and processes from the outset, not retrofitting it later. An early privacy impact assessment combined with data minimization controls during design directly implements that principle. The other actions either collect excessive data, react after release, or rely on a single control that does not address purpose limitation and minimization, so they do not meet the legal team's request.

Answer

Add a privacy policy link to the application store listing after the application is released

Answer

Encrypt location data at rest and assume that encryption alone satisfies privacy requirements

Answer

Collect precise location data continuously so that future marketing features have a rich data set

Question 12

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a NIST-approved post-quantum cryptographic algorithm designed for key encapsulation (KEM), selected in the NIST PQC standardization process. It is based on module learning with errors (MLWE) and provides secure key exchange resistant to quantum attacks. RSA-4096 and ECDHE are classical algorithms vulnerable to quantum computers, and CRYSTALS-Dilithium is designed for digital signatures, not key encapsulation.

Answer

RSA-4096

Answer

ECDHE

Answer

CRYSTALS-Dilithium

Question 13

A financial institution is adopting a risk management framework based on NIST SP 800-37. The CISO wants to ensure that risk responses are integrated into the enterprise architecture. Which of the following activities best supports this integration during the Risk Response step?

Accepted Answer

Mapping selected security controls to specific architectural components and documenting the relationships.. Mapping selected security controls to architectural components is the key activity that integrates risk responses into enterprise architecture. NIST SP 800-37's Risk Response step involves selecting controls, allocating them to systems, and documenting how they are implemented. By explicitly linking controls to architecture, the organization ensures that risk mitigation is designed into systems rather than bolted on later. This supports traceability and continuous monitoring.

Answer

Developing a risk register that lists identified risks and their owners.

Answer

Performing a business impact analysis (BIA) to identify critical business processes.

Answer

Conducting a tabletop exercise to validate the effectiveness of the risk response plan.

Question 14

A multinational retailer must demonstrate compliance with the EU General Data Protection Regulation while also honoring local data-residency laws in a country where it operates. Legal counsel advises that a single global retention schedule cannot satisfy both regimes. Which governance artifact should the security manager produce to reconcile these competing obligations?

Accepted Answer

A records retention and residency matrix mapping each data category to jurisdictional requirements. Where global retention rules collide with local residency mandates, the organization needs a structured mapping of each data category to the retention period and permitted location required by every jurisdiction involved. A retention and residency matrix makes the conflicts visible and provides auditable, differentiated handling, whereas privacy assessments, use policies, and continuity plans address risk, behavior, and availability rather than reconciling legal obligations.

Answer

An updated acceptable use policy signed by all employees who handle customer data

Answer

A business continuity plan that documents failover of the retailer's EU data centers

Answer

A data protection impact assessment covering the retailer's cross-border transfers

Question 15

A financial services firm is selecting a cloud provider to host regulated customer data. The vendor risk team wants contractual language that lets the firm independently verify the provider's security posture over time rather than relying only on the provider's self-reported questionnaires. (Choose two.)

Accepted Answer

A clause requiring the provider to deliver current SOC 2 Type II reports at least annually. Ongoing independent visibility into a provider's security posture requires contractual rights that produce evidence rather than self-reporting. A right-to-audit establishes the legal ability to inspect and test controls, and a requirement for current SOC 2 Type II reports supplies recurring auditor-attested evidence of control effectiveness. Uptime SLAs, liability caps, and pricing clauses govern availability, financial exposure, and cost, none of which verify how the provider actually secures regulated data.

Answer

A limitation-of-liability cap tied to twelve months of fees

Answer

A service level agreement specifying 99.99% uptime credits

Answer

A most-favored-nation pricing clause