CAS-004 Practice Test 45 — 15 Questions

Question 1

An IoT device uses a Trusted Platform Module (TPM) 2.0 for secure boot and attestation. Which THREE of the following functions does the TPM provide to support these security features?

Accepted Answer

Platform Configuration Registers (PCRs) for storing measurements. Option B is correct because TPM 2.0 provides Platform Configuration Registers (PCRs), which are shielded registers used to store cryptographic measurements (hashes) of firmware, boot loaders, and OS components during secure boot, forming the basis for integrity verification. Option D is correct because sealed storage binds a decryption key to specific PCR values, so the protected data can only be unsealed when the platform's measurements match the expected known-good state, enforcing secure boot integrity. Option E is correct because remote attestation relies on the TPM_Quote command, which signs the current PCR values with an Attestation Identity Key (AIK) so a remote verifier can confirm the device's boot state. Option A is not correct because TPM 2.0 is not designed for accelerated bulk symmetric encryption; it only offers limited cryptographic operations and is far too slow for that purpose. Option C is not correct because, although TPM 2.0 includes a hardware random number generator, it is not one of the functions specifically supporting secure boot and attestation as described in this scenario.

Answer

Accelerated symmetric encryption

Answer

Hardware random number generation

Question 2

An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?

Accepted Answer

AH in tunnel mode. IPsec AH (Authentication Header) provides data integrity and authentication but not confidentiality (no encryption). Tunnel mode encapsulates the entire IP packet, which is suitable for site-to-site VPNs. Since confidentiality is not a concern, AH in tunnel mode is the correct choice. ESP would provide confidentiality, which is unnecessary here.

Answer

ESP in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 3

What is the primary benefit of using infrastructure as code (IaC) tools like Terraform for cloud resource provisioning?

Accepted Answer

It provides a declarative language to define resources, enabling version control and repeatability.. Infrastructure as Code (IaC) tools like Terraform use a declarative language (HCL) to define cloud resources in configuration files. This approach enables version control (e.g., Git), repeatable deployments, and consistent environments, which are the primary benefits of IaC over manual provisioning.

Answer

It reduces cloud costs by optimizing resource usage.

Answer

It eliminates the need for manual configuration management.

Answer

It automatically applies security patches to resources.

Question 4

A threat hunter hypothesizes that a sophisticated attacker is using DNS tunneling for command and control. Which data source would most likely confirm this activity?

Accepted Answer

DNS query logs from authoritative/internal DNS servers. DNS tunneling encodes command-and-control data inside DNS queries and responses, so the authoritative or internal DNS server logs are the only data source that captures the full query strings, TXT/NULL record payloads, and response sizes needed to confirm the activity. These logs reveal anomalies such as unusually long subdomain labels, high-entropy hostnames, and excessive query volume to a single domain.

Answer

Network flow data (NetFlow)

Answer

Endpoint antivirus alerts

Answer

Web proxy logs

Question 5

A security engineer needs to implement a solution that will detect and block command-and-control (C2) traffic from malware on the internal network. The solution must be able to inspect encrypted traffic and operate at the network layer. Which of the following is the BEST choice?

Accepted Answer

Deploy a next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering.. A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

Answer

Implement a web application firewall (WAF) to filter outbound HTTP/HTTPS traffic.

Answer

Install a network-based intrusion detection/prevention system (IDS/IPS) with signature updates.

Answer

Use endpoint detection and response (EDR) agents on all workstations and servers.

Question 6

A security team needs to automate the enforcement of cloud security policies across multiple accounts in AWS. They want a solution that uses code to define policies and automatically remediate violations. Which approach best meets these requirements?

Accepted Answer

Use AWS Config with managed rules and custom Lambda functions for auto-remediation.. AWS Config with managed rules and custom Lambda functions enables automated enforcement of security policies across multiple AWS accounts. This approach uses code to define policies and automatically remediate violations via Lambda, meeting the requirement for automation and code-defined policies. Option A (boto3 scripts) is manual and not fully automated; Option C (GuardDuty) is reactive and focuses on threats, not policy enforcement; Option D (CSPM) is a third-party tool, not a code-defined approach within AWS.

Answer

Write Python boto3 scripts that run on a schedule to check and update security groups.

Answer

Enable AWS GuardDuty and rely on its threat detection alerts.

Answer

Deploy a third-party cloud security posture management (CSPM) tool like Prisma Cloud.

Question 7

A company wants to automate the creation of IAM roles and policies in AWS using infrastructure as code. Which tool is specifically designed for provisioning cloud infrastructure across multiple providers?

Accepted Answer

Terraform. Terraform is a IaC tool focused on provisioning resources across cloud providers. Docker handles containers, Ansible is configuration management, and Jenkins is CI/CD.

Answer

Jenkins

Answer

Docker

Answer

Ansible

Question 8

An organization is migrating to an immutable infrastructure model for its containerized applications. Which practice is essential to ensure the integrity of the immutable infrastructure?

Accepted Answer

Image scanning and signing in the CI/CD pipeline. In an immutable infrastructure model, containers are never modified after deployment — instead, new images replace old ones. Therefore, integrity must be enforced at build time: scanning images for vulnerabilities and cryptographically signing them in the CI/CD pipeline ensures only trusted, verified artifacts are deployed. This shifts security left and guarantees that what runs in production is exactly what was tested and approved.

Answer

Regular patching of running containers

Answer

Runtime security monitoring with seccomp

Answer

Use of configuration management tools like Ansible

Question 9

A vulnerability has a CVSS base score of 9.8. The vulnerability is present on a server that is not exposed to the internet but is accessible to internal users with valid credentials. Which CVSS metric should be adjusted to reflect the reduced risk?

Accepted Answer

Environmental score. The Environmental Score allows customization based on specific organizational context, such as modified access requirements.

Answer

None, the base score should be used as-is

Answer

Temporal score

Answer

Base score

Question 10

Which of the following is a primary function of a Cloud Access Security Broker (CASB)?

Accepted Answer

Enforce security policies between users and cloud applications. A CASB sits between users and cloud applications and enforces security policies such as data loss prevention, access control, encryption, and compliance monitoring. Its core purpose is to provide visibility and control over cloud service usage, which is exactly what Option C describes.

Answer

Scan container images for vulnerabilities

Answer

Provide IAM for cloud infrastructure

Answer

Monitor network traffic at the packet level

Question 11

A company is adopting a DevOps model and wants to integrate security into CI/CD pipelines. Which of the following is the MOST effective approach?

Accepted Answer

Automated security scanning in the pipeline with fail-fast. Automated security scanning in the pipeline with fail-fast is the most effective approach because it integrates security checks (e.g., SAST, DAST, dependency scanning) directly into the CI/CD workflow, enabling immediate detection and blocking of vulnerabilities before they reach production. This aligns with DevSecOps principles by shifting security left, reducing remediation costs, and ensuring that insecure code fails the build automatically, preventing deployment of vulnerable artifacts.

Answer

Annual vulnerability scans

Answer

Post-deployment security testing

Answer

Manual security reviews before each release

Question 12

An organization wants to reduce the attack surface of its web servers by ensuring only necessary modules are enabled. Which practice directly supports this goal?

Accepted Answer

Application whitelisting and module disablement. Application whitelisting and module disablement. This practice directly reduces the attack surface by ensuring only authorized applications and necessary modules are enabled, eliminating unnecessary services that could be exploited. Option A (Patch management) addresses vulnerabilities in existing software but does not remove unused modules. Option C (Regular backups) focuses on data recovery, not attack surface reduction. Option D (Multi-factor authentication) strengthens access control but does not limit enabled modules or applications.

Answer

Patch management

Answer

Regular backups

Answer

Multi-factor authentication

Question 13

Which THREE of the following are common techniques to mitigate side-channel attacks?

Accepted Answer

Implement constant-time algorithms for cryptographic operations. Option B is correct because constant-time algorithms execute the same sequence of operations regardless of secret values, eliminating the data-dependent timing variations that timing side-channel attacks exploit. Option C is correct because adding noise to power consumption or electromagnetic emissions masks the correlation between a device's physical leakage and the secret data being processed, which is the core of power-analysis and EM side-channel attacks. Option D is correct because making memory access patterns independent of secret data (e.g., via oblivious access or cache-line-aligned constant-time lookups) prevents cache-timing attacks that infer secrets from which cache lines are accessed. Option A is not a common mitigation: disabling CPU caching is impractical, severely degrades performance, and is not a standard countermeasure. Option E is not correct because random delays only add probabilistic noise to timing and are generally considered weak and insufficient against modern statistical timing attacks, unlike true constant-time execution.

Answer

Disable CPU caching to prevent cache timing attacks

Answer

Use random delays in code execution paths

Question 14

A multinational retailer must comply with the EU General Data Protection Regulation for its European customers and with several U.S. state privacy laws for its American customers. The privacy team wants a single internal control framework that satisfies the strictest common denominator across all jurisdictions. Which approach should the privacy team take?

Accepted Answer

Adopt the requirements of the EU General Data Protection Regulation as the baseline control set and map additional state-law obligations onto it.. Harmonizing around the most stringent applicable regime gives the retailer one control set that satisfies every jurisdiction, since stricter requirements generally encompass weaker ones. Layering jurisdiction-specific obligations onto that baseline closes residual gaps, such as opt-out rights unique to certain state laws, while avoiding the cost and inconsistency of parallel compliance programs.

Answer

Implement each jurisdiction's requirements as a separate, fully independent control set managed by a regional compliance officer.

Answer

Apply the least restrictive state privacy law as the baseline because it imposes the fewest operational changes.

Answer

Defer framework selection until each regulator publishes an approved cross-mapping, then adopt that mapping verbatim.

Question 15

After containing a confirmed security incident, the incident response team must plan for eradication. What must be done before eradication begins?

Accepted Answer

Determine the root cause of the incident. Before eradication, the incident response team must determine the root cause of the incident. This is essential to ensure that all components of the threat are identified and removed, and to prevent reoccurrence. Eradication involves removing the threat, but without understanding the root cause, the team might miss additional backdoors or persistence mechanisms.

Answer

Conduct a full forensic analysis of all systems

Answer

Begin eradication immediately to minimize dwell time

Answer

Notify law enforcement agencies