CAS-004 Practice Test 44 — 15 Questions

Question 1

An organization is deploying a containerized application on Kubernetes and must enforce that only approved container images are allowed to run, and that containers cannot escalate privileges. Which combination of controls should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admission controllers with image signing and PodSecurityPolicy. Admission controllers intercept requests to the Kubernetes API server; PodSecurityPolicy (now replaced by Pod Security Standards) can enforce privilege escalation restrictions. Image signing ensures only approved images are run. Seccomp and AppArmor are runtime security profiles, but they don't enforce image approval. RBAC controls user access, not image approval. Network policies control traffic, not image approval.

Answer

Seccomp and AppArmor profiles with RBAC

Answer

Kubernetes network policies and RBAC

Answer

Container image scanning and network policies

Question 2

Which of the following is a key principle of the zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust operates on the principle of never trust, always verify, requiring continuous authentication and authorization for every access request, regardless of location.

Answer

Trust all internal traffic

Answer

Verify once, trust forever

Answer

Trust but verify

Question 3

An organization is migrating critical workloads to the cloud and must comply with FedRAMP. Which cloud service model provides the most customer control over security configuration while still leveraging the provider's FedRAMP authorization?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives the customer control over OS, applications, and security configurations, while the provider manages the physical infrastructure. FedRAMP authorization can cover the IaaS layer.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 4

In a zero trust architecture, which concept ensures that an attacker who compromises one segment cannot move laterally to other segments?

Accepted Answer

Micro-segmentation. Micro-segmentation divides the network into small, isolated segments and enforces granular access controls, preventing lateral movement.

Answer

Software-defined perimeter

Answer

Defense-in-depth layering

Answer

Identity-centric access

Question 5

A security architect is evaluating Cloud Security Posture Management (CSPM) tools. Which TWO capabilities are typically provided by CSPM? (Choose two.)

Accepted Answer

Detection of compliance violations. CSPM tools continuously monitor cloud environments for misconfigurations and compliance violations, and they provide remediation guidance.

Answer

Web application firewall (WAF) management

Answer

Vulnerability scanning of container images

Answer

DDoS protection

Question 6

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

Accepted Answer

seccomp. seccomp (secure computing mode) allows filtering of system calls, reducing the kernel attack surface.

Answer

AppArmor

Answer

chroot

Answer

SELinux

Question 7

Which of the following is a benefit of using an immutable infrastructure approach?

Accepted Answer

Elimination of configuration drift. Immutable infrastructure means servers are never modified after deployment; instead, they are replaced with new instances. This eliminates configuration drift and ensures consistency.

Answer

Reduced need for configuration management

Answer

Easier manual patching of running servers

Answer

Lower cost due to reusable hardware

Question 8

A company uses a CASB to monitor cloud application usage. Which primary function does a CASB provide for enforcing security policies between users and cloud services?

Accepted Answer

Policy enforcement point for cloud services. A CASB acts as an intermediary to enforce security policies such as access control, data loss prevention, and threat protection between users and cloud services.

Answer

Encryption key management for cloud storage

Answer

Vulnerability scanning of cloud infrastructure

Answer

Workload protection runtime monitoring

Question 9

A company is implementing a secure SDLC and wants to integrate application security testing early. Which THREE tools are most appropriate for shift-left security? (Select THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST scans source code early, SCA identifies open-source vulnerabilities, and IAST combines static and dynamic analysis within the CI/CD pipeline. DAST and RASP are typically run later or in production.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 10

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which THREE algorithms are currently selected for standardization? (Select THREE).

Accepted Answer

CRYSTALS-Kyber. NIST has selected CRYSTALS-Kyber (for key encapsulation), CRYSTALS-Dilithium (for digital signatures), and FALCON (for digital signatures, with SPHINCS+ as a backup) for standardization. RSA and ECDH are not quantum-resistant.

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

RSA-4096

Question 11

A company is migrating critical workloads to AWS and must secure data at rest. They need to maintain control over the encryption keys. Which service should they use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated Hardware Security Modules (HSMs) that allow customers to maintain full control over their encryption keys. Unlike AWS KMS, where AWS manages the underlying hardware, CloudHSM gives customers exclusive ownership and management of keys, meeting the requirement to maintain control over encryption keys.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Question 12

Which TWO of the following are key benefits of using a software-defined perimeter (SDP) in a zero trust architecture? (Select TWO.)

Accepted Answer

Reduces the attack surface by hiding network resources. SDP hides network infrastructure and enforces identity-based access, reducing the attack surface and preventing lateral movement.

Answer

Automates patch management

Answer

Eliminates the need for encryption

Answer

Simplifies network architecture by removing firewalls

Question 13

A security engineer is hardening a Kubernetes environment. Which THREE of the following are effective controls for securing the cluster? (Select THREE.)

Accepted Answer

Enabling Pod Security Admission (PSA) to enforce pod security standards. RBAC controls API access, Pod Security Standards (or admission controllers) enforce pod security, and Network Policies restrict pod communication. All three are Kubernetes-native controls for cluster hardening.

Answer

Configuring load balancers for high availability

Answer

Installing antivirus on all nodes

Question 14

A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?

Accepted Answer

Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].. Setting `runAsNonRoot: true` prevents the container from running as the root user, `readOnlyRootFilesystem: true` prevents writes to the container's root filesystem, and dropping all Linux capabilities with `drop: ['ALL']` removes all kernel privileges. Together, these three settings at the pod security context level drastically reduce the attack surface for container escape attacks by eliminating common privilege escalation vectors.

Answer

Set runAsNonRoot: false and readOnlyRootFilesystem: true.

Answer

Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].

Answer

Set privileged: true and readOnlyRootFilesystem: false.

Question 15

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. An IPsec VPN tunnel creates an encrypted, site-to-site connection between the AWS VPC and the on-premises network, ensuring encryption in transit and minimizing internet exposure by using the VPN gateway as the endpoint. Option B is correct because AWS Direct Connect provides a dedicated, private network connection that bypasses the internet entirely, reducing exposure and supporting encryption via optional MACsec or IPsec, while maintaining low latency and consistent bandwidth.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.