CAS-004 Practice Test 46 — 15 Questions

Question 1

A penetration tester is conducting a test against a web application. The client has defined rules of engagement that prohibit any denial of service attacks. The tester discovers an endpoint that is vulnerable to command injection. Which THREE of the following actions should the tester take to validate the vulnerability while staying within scope? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the echo command to write a file on the server. To validate command injection without causing damage, the tester should use non-destructive commands like ping, echo, and whoami. Deleting files or performing DoS would violate rules of engagement.

Answer

Delete a random system file to observe impact

Answer

Flood the endpoint with multiple requests to test resilience

Question 2

A penetration tester is planning a test against a web application. The rules of engagement specify that the tester must not disrupt production services. Which TWO reconnaissance techniques are considered passive and would be appropriate for initial information gathering without impacting the target? (Select TWO.)

Accepted Answer

WHOIS lookup on the domain. OSINT uses publicly available information and WHOIS queries are passive, as they do not interact with the target system directly.

Answer

Port scanning the target network

Answer

Vulnerability scanning

Answer

Social engineering attacks

Question 3

A network administrator is configuring a firewall to block traffic from a specific IP address range. The firewall uses ACLs. Which ACL entry would deny traffic from 192.168.1.0/24?

Accepted Answer

deny ip 192.168.1.0 0.0.0.255 any. In Cisco ACL syntax, the wildcard mask 0.0.0.255 matches all addresses in the 192.168.1.0/24 network. The 'deny ip 192.168.1.0 0.0.0.255 any' entry blocks any IP traffic from the source subnet 192.168.1.0 through 192.168.1.255 to any destination.

Answer

deny ip 192.168.1.0 0.0.0.0 any

Answer

deny ip 192.168.1.0 0.0.0.127 any

Answer

deny ip 192.168.1.0 255.255.255.0 any

Question 4

When conducting a vendor risk assessment, which contractual clause is most important for ensuring ongoing visibility into the vendor's security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to perform or request audits of the vendor's controls, providing ongoing assurance.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 5

A security engineer is configuring SSH for a jump host used to access critical servers. The engineer wants to restrict the cryptographic algorithms to the most secure options. Which of the following should be DISABLED?

Accepted Answer

Diffie-Hellman group-exchange with SHA-1. Diffie-Hellman group-exchange with SHA-1 is weak and should be disabled in favor of stronger key exchange algorithms.

Answer

AES-256-CTR

Answer

Ed25519 for host keys

Answer

HMAC-SHA2-256

Question 6

Which document in a security policy hierarchy provides specific step-by-step instructions for performing a task?

Accepted Answer

Procedure. A procedure details the exact steps to implement a policy, standard, or guideline.

Answer

Guideline

Answer

Standard

Answer

Policy

Question 7

A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?

Accepted Answer

Incorporating privacy controls during the initial system architecture. Privacy by design integrates privacy into the system design from the start, not as an afterthought.

Answer

Encrypting data at rest only

Answer

Performing an annual privacy audit

Answer

Providing privacy training to employees

Question 8

Under the GDPR, which of the following is a data subject right?

Accepted Answer

Right to erasure (right to be forgotten). The GDPR grants data subjects the right to request deletion of their personal data under certain conditions.

Answer

Right to transfer data across borders without restriction

Answer

Right to unlimited processing

Answer

Right to sell data

Question 9

An organization's security policy defines that all sensitive data must be encrypted. However, a business unit has a legacy application that cannot support encryption without a major rewrite. The risk owner decides to accept the risk. This is an example of which risk treatment strategy?

Accepted Answer

Risk acceptance. Risk acceptance is acknowledging the risk and deciding to tolerate it without additional controls, often documented in a risk register.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 10

An organization is adopting the NIST Risk Management Framework (RMF). During which step would the security team select and implement security controls, and how does this map to the organization's governance structure?

Accepted Answer

Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.. In NIST RMF, Step 2 (Select) and Step 3 (Implement) involve selecting controls from NIST SP 800-53 and implementing them. This aligns with governance through the risk executive function.

Answer

Step 4: Assess — controls are evaluated for effectiveness.

Answer

Step 1: Prepare — the organization establishes risk management roles and responsibilities.

Answer

Step 5: Authorize — a senior official accepts the risk.

Question 11

An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to audit the vendor's controls and verify compliance.

Answer

Non-disclosure agreement (NDA)

Answer

Service-level agreement (SLA) for uptime

Answer

Data processing agreement (DPA)

Question 12

A security manager is reviewing Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for the security program. Which of the following is an example of a KRI?

Accepted Answer

Number of critical vulnerabilities exceeding the risk appetite threshold. KRIs measure risk levels, such as the number of critical vulnerabilities that exceed the risk appetite threshold. KPIs measure performance, like patch compliance percentage.

Answer

Mean time to detect (MTTD) security incidents

Answer

Percentage of systems patched within 30 days

Answer

Number of security incidents per month

Question 13

Which of the following is a key difference between a security guideline and a security procedure?

Accepted Answer

Guidelines are recommended; procedures are mandatory. A guideline suggests best practices and is not mandatory, while a procedure provides step-by-step instructions that are mandatory.

Answer

Both are equally enforceable

Answer

Procedures are high-level; guidelines are detailed

Answer

Guidelines are mandatory; procedures are optional

Question 14

Which of the following risk treatment options involves transferring the financial impact of a risk to a third party, such as through insurance?

Accepted Answer

Transfer. Risk transfer shifts the financial burden to another party, e.g., purchasing cyber insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 15

An organization has implemented a risk treatment plan that includes purchasing cyber insurance for potential data breach costs. Which risk treatment option does this represent?

Accepted Answer

Risk transfer. Cyber insurance transfers the financial risk to an insurance company, which is risk transfer.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance