CAS-004 Practice Test 43 — 15 Questions

Question 1

A container orchestration platform uses secrets management. Which two methods are recommended for injecting secrets into containers? (Choose two.)

Accepted Answer

Use Kubernetes Secrets mounted as files.. Kubernetes Secrets can be mounted as files into a container's filesystem, allowing applications to read sensitive data (e.g., passwords, tokens) from a file path rather than exposing them in environment variables or image layers. This approach keeps secrets out of the container image and reduces the risk of accidental exposure through logs or process listings.

Answer

Store secrets in environment variables in the container image.

Answer

Hardcode secrets in the application source code.

Answer

Pass secrets via command-line arguments in the Dockerfile.

Question 2

Drag and drop the steps to configure a host-based firewall (Windows Defender Firewall) to block all inbound traffic except RDP into the correct order.

Accepted Answer

Open Windows Defender Firewall with Advanced Security console, create an inbound rule to allow RDP, enable the rule, set default inbound action to block, test the configuration.. Firewall configuration: open console, create allow rule for RDP, ensure it's enabled, then set default block, and test.

Answer

Open the console, create an inbound rule to allow RDP, set default inbound action to block, enable the rule, test.

Answer

Open the console, set default inbound action to block, create an inbound rule to allow RDP, enable the rule, test.

Answer

Set default inbound action to block, open the console, create an inbound rule to allow RDP, enable the rule, test.

Question 3

Refer to the exhibit. A system administrator creates a systemd service to run a daily patching script. Which security concern is most prevalent?

Accepted Answer

The script runs as root. Running the script as root (User=root) is the most prevalent security concern because it grants the script unrestricted system access. If the patching script is compromised or contains a vulnerability, an attacker could gain full control over the host, escalate privileges, or persist across reboots. The principle of least privilege dictates that services should run with the minimum necessary permissions, typically a dedicated non-root user account.

Answer

The service restarts on failure

Answer

The script location is non-standard

Answer

The service depends on the network

Question 4

A multinational corporation is adopting a zero trust architecture for its enterprise network. The security team is evaluating mechanisms to enforce granular access controls and segment workloads. Which TWO components are most critical for implementing a zero trust model? (Choose TWO.)

Accepted Answer

Micro-segmentation. Micro-segmentation and identity-centric access controls are foundational to zero trust. Micro-segmentation isolates workloads, while identity-centric controls ensure that access is based on user/device identity rather than network location. SASE is a broader framework, and VPNs are often replaced by zero trust. Perimeter firewalls contradict the zero trust principle of assuming no implicit trust.

Answer

Secure Access Service Edge (SASE)

Answer

Perimeter-based firewalls

Answer

Software-defined perimeter (SDP)

Question 5

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

Accepted Answer

IaaS. In IaaS, the customer manages the OS, applications, and data, while the provider secures the physical infrastructure. SOC 2 compliance requires customer to handle many controls.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 6

An organization is adopting a DevSecOps approach and wants to integrate security early in the development lifecycle. Which practice involves creating visual representations of threats and identifying potential attack vectors during the design phase?

Accepted Answer

Threat modeling. Threat modeling is a structured approach to identify and prioritize potential threats, often using diagrams like data flow diagrams, during the design phase of the SDLC.

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Answer

Runtime application self-protection (RASP)

Question 7

An organization is implementing a software-defined perimeter (SDP) for zero trust network access. Which THREE characteristics are typical of an SDP architecture? (Choose three.)

Accepted Answer

Applications are invisible to unauthorized users. SDP hides infrastructure, requires authentication before connectivity, and creates per-session encrypted tunnels.

Answer

Relies on IP-based allowlists

Answer

Uses a single shared firewall for all traffic

Question 8

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

Accepted Answer

Isolating workloads at the virtual network interface level with granular security policies. Micro-segmentation creates isolated zones for each workload, enabling granular security policies that restrict lateral movement even within the same network segment.

Answer

Creating a single perimeter around the entire network

Answer

Using VLANs to separate departments

Answer

Implementing a VPN for remote access

Question 9

Which of the following best describes the security benefit of using an API gateway in a microservices architecture?

Accepted Answer

It enforces security policies such as authentication and rate limiting centrally. An API gateway provides a centralized point for enforcing security policies like authentication, rate limiting, and input validation. This reduces the attack surface by offloading these responsibilities from individual services. Option A is incorrect because input validation is still needed at the service level for defense-in-depth. Option B is incorrect because encryption is typically handled by TLS, not solely the gateway. Option D is incorrect because load balancing is a traffic management function, not a direct security benefit.

Answer

It eliminates the need for input validation in individual microservices

Answer

It encrypts all data between the client and server using mTLS

Answer

It automatically load balances traffic to ensure high availability

Question 10

A company is implementing a defense-in-depth strategy for its web application. Which THREE of the following are layers that should be included? (Select THREE.)

Accepted Answer

Application security controls (WAF, input validation). Defense in depth uses multiple security layers: network controls, application security, and data protection are key layers.

Answer

Single sign-on (SSO) without MFA

Answer

Physical security of the data center

Question 11

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

Accepted Answer

SWG. SWG (Secure Web Gateway) is the SASE component that provides security inspection for all traffic, regardless of user location, by enforcing policies and protecting against web-based threats. It inspects all outbound traffic from users, whether on-premises or remote, to ensure security compliance.

Answer

ZTNA

Answer

CASB

Answer

SD-WAN

Question 12

A company uses an API gateway to manage their microservices. Which security control should the gateway enforce to prevent abuse from excessive API calls?

Accepted Answer

Rate limiting. Rate limiting restricts the number of requests a client can make in a given period, preventing abuse.

Answer

JWT verification

Answer

Input validation

Answer

OAuth 2.0

Question 13

A security analyst is investigating an API that uses JSON Web Tokens (JWT) for authentication. Which field in a JWT contains the token expiration time?

Accepted Answer

exp. The 'exp' (expiration) claim in the JWT payload specifies the time after which the token is no longer valid, preventing replay attacks.

Answer

iss

Answer

iat

Answer

sub

Question 14

A security team is hardening a Kubernetes cluster. Which resource should be used to define fine-grained rules for which pods can communicate with each other?

Accepted Answer

NetworkPolicy. Kubernetes NetworkPolicies allow ingress/egress rules controlling pod-to-pod communication.

Answer

Admission Controller

Answer

PodSecurityPolicy

Answer

RBAC

Question 15

A security architect is evaluating a CSPM tool for a multi-cloud environment. Which TWO capabilities should the architect consider essential for the CSPM? (Choose two.)

Accepted Answer

Continuous compliance monitoring against frameworks like CIS. CSPM automates security compliance and configuration monitoring across cloud environments.

Answer

Vulnerability scanning of container images

Answer

Real-time web application firewall

Answer

Data loss prevention for cloud storage