CAS-004 Practice Test 46 — 15 Questions

Question 1

A multinational corporation is deploying a new application that will be accessed by employees, partners, and customers. The security architecture must support single sign-on (SSO) across different identity providers (IdPs) while maintaining strict access control based on user attributes such as role, location, and device posture. The company uses Active Directory for employees, a cloud IdP for partners, and self-registration for customers. The architect needs to design a centralized policy enforcement point that can evaluate access requests from multiple IdPs and enforce dynamic access policies before granting access to the application.

Which of the following is the BEST architectural approach?

Accepted Answer

Implement an externalized authorization management system (e.g., OAuth 2.0 with OpenID Connect) using a policy decision point (PDP) and a policy enforcement point (PEP) at the application gateway. It uses an externalized authorization management system with a Policy Decision Point (PDP) and Policy Enforcement Point (PEP) at the application gateway, which decouples authentication from authorization. This architecture allows centralized, attribute-based access control (ABAC) across multiple IdPs (Active Directory, cloud IdP, self-registration) while supporting SSO via OAuth 2.0 and OpenID Connect. The PDP evaluates dynamic policies based on user attributes (role, location, device posture) and the PEP enforces the decision before granting access, meeting the requirement for strict, context-aware access control.

Answer

Deploy a SAML/WS-Federation federation server that authenticates users and then passes the identity to the application for authorization

Answer

Have each IdP enforce its own access policies and pass the authorization decision via SAML assertions

Answer

Configure a reverse proxy to authenticate users from any IdP and pass their identity to the application

Question 2

A security engineer is hardening a Linux server. Which TWO of the following are best practices for preventing privilege escalation attacks?

Accepted Answer

Apply kernel hardening with sysctl. Option B is correct because applying kernel hardening with sysctl (e.g., setting kernel.kptr_restrict, kernel.dmesg_restrict, kernel.yama.ptrace_scope, and disabling unprivileged user namespaces) reduces the kernel attack surface and blocks common privilege-escalation vectors such as kernel pointer leaks and ptrace-based injection. Option C is correct because running SELinux in enforcing mode confines processes with mandatory access control (type enforcement, domain transitions), so even if an attacker exploits a service, the policy limits what the compromised domain can do and prevents escalation to unconfined root. Option A is wrong because disabling all non-root accounts is not a hardening practice; it breaks accountability and least privilege, and root-only access increases risk rather than preventing escalation. Option D is wrong because removing the SUID bit from all binaries indiscriminately breaks legitimate tools like sudo, passwd, and ping; SUID should be audited and minimized, not globally stripped. Option E is wrong because restricting cron to root alone does not prevent privilege escalation and can conflict with legitimate per-user or system maintenance jobs; cron should instead be permission-controlled and monitored.

Answer

Disable all user accounts except root

Answer

Remove the SUID bit from all binaries

Answer

Restrict cron jobs to root only

Question 3

An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?

Accepted Answer

Include a right-to-audit clause that covers subcontractors. To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

Answer

Use only vendors that are SOC 2 certified

Answer

Reduce reliance on vendors by bringing services in-house

Answer

Conduct penetration tests on all fourth parties directly

Question 4

Which of the following best describes the security benefit of using an API gateway in a microservices architecture?

Accepted Answer

It enforces security policies such as authentication and rate limiting centrally. An API gateway sits in front of microservices and acts as a single entry point for all client requests, making it the ideal enforcement point for cross-cutting security controls. Centralizing authentication (e.g., OAuth2/JWT validation), authorization, rate limiting, and threat protection at the gateway means individual microservices don't each need to reimplement these policies. This reduces attack surface and ensures consistent policy enforcement across the entire API estate.

Answer

It eliminates the need for input validation in individual microservices

Answer

It encrypts all data between the client and server using mTLS

Answer

It automatically load balances traffic to ensure high availability

Question 5

The engineer needs to prevent brute-force attacks while allowing legitimate access. Which security control is MOST effective?

Accepted Answer

Implement fail2ban with a threshold of 5 attempts per minute. Fail2ban is a security tool that monitors log files for suspicious patterns, such as repeated failed login attempts, and dynamically updates firewall rules to block the offending IP addresses. Implementing fail2ban with a threshold of 5 attempts per minute effectively mitigates brute-force attacks by temporarily or permanently banning IPs that exceed the threshold, while allowing legitimate users to access the system. This is more effective than the other options because it actively responds to brute-force behavior.

Answer

Disable root login

Answer

Change SSH port to 2222

Answer

Implement IP whitelist for 10.0.0.0/8

Question 6

A security architect is evaluating a SASE solution. Which component of SASE is primarily responsible for inspecting encrypted traffic for threats?

Accepted Answer

Secure web gateway (SWG). The Secure Web Gateway (SWG) is the SASE component that proxies outbound user web traffic and performs full TLS inspection, URL filtering, malware scanning, and DLP on decrypted content. Because it terminates and re-originates TLS sessions, it can inspect encrypted traffic for threats. This is its core function within the SASE stack.

Answer

Zero Trust Network Access (ZTNA)

Answer

Next-generation firewall (NGFW)

Answer

SD-WAN edge

Question 7

During a penetration test, the tester has gained initial access to a web server and wants to perform lateral movement to reach a database server. The tester enumerates the network and finds that the web server has two network interfaces: one connected to a DMZ and one to an internal network. The database server is on the internal network. Which TWO techniques could the tester use to pivot from the web server to the database server? (Choose TWO.)

Accepted Answer

Use SSH tunneling to create a local forward to the database server's port. Option A is correct because SSH local port forwarding (ssh -L) lets the tester tunnel traffic from their machine through the compromised web server to reach the database server's port on the internal network, effectively pivoting across the dual-homed host. Option E is correct because Metasploit's 'route add' command (e.g., route add ) configures the framework to route traffic for the internal subnet through the existing Meterpreter session on the web server, enabling pivoting to the database server. Option B is incorrect because SQL injection targets a database through a vulnerable web application and does not provide network-level pivoting from the web server to the internal database server. Option C is incorrect because a reverse shell only establishes command-and-control back to the tester's machine; it does not route traffic into the internal network. Option D is incorrect because a keylogger passively captures credentials on the web server and does not create a pivot path to the database server.

Answer

Perform a SQL injection attack against the database server

Answer

Deploy a reverse shell from the web server to the tester's machine

Answer

Install a keylogger on the web server to capture database credentials

Question 8

Which TWO of the following are key components of a successful incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation (Option B) is the foundational phase that ensures the organization has the tools, policies, and trained personnel ready before an incident occurs. Detection and Analysis (Option E) is the second phase, focusing on identifying and validating security incidents through monitoring, alerting, and forensic analysis.

Answer

Vulnerability scanning

Answer

Patch management

Answer

User training

Question 9

Which of the following is a cloud-native security control provided by a cloud service provider to manage user permissions and access to resources?

Accepted Answer

Identity and Access Management (IAM). IAM is the cloud-native service that manages identities, roles, and permissions, controlling who can do what on which resources. It is the foundational access control plane in every major cloud provider (AWS IAM, Azure Entra ID/RBAC, GCP IAM). The question asks specifically about managing user permissions and access, which is IAM's core purpose.

Answer

Virtual Private Cloud (VPC)

Answer

CloudTrail

Answer

Key Management Service (KMS)

Question 10

A security team is developing a data classification policy. Which TWO of the following elements should be included in the policy to ensure effective data governance?

Accepted Answer

Handling requirements for each classification level, including storage and transmission. Option E is correct because a data classification policy must define the criteria used to assign data into categories such as public, internal, and confidential, which is the foundational step that enables consistent labeling and governance across the organization. Option A is correct because once data is classified, the policy must specify handling requirements for each classification level, including how data is stored and transmitted, so that controls are applied proportionately to the data's sensitivity. Together, E and A establish the 'what' (classification criteria) and the 'how' (handling rules) that make a classification policy operational and enforceable. Option B is not the best fit because retention and disposal schedules are typically covered in a separate data retention policy, even though they relate to governance. Option C is not included because specific encryption algorithms are technical implementation details usually defined in cryptographic standards rather than in a classification policy. Option D is not included because DLP rules are operational enforcement mechanisms configured in tools, not policy-level classification elements.

Answer

Data retention and disposal schedules

Answer

Encryption algorithms to be used for data at rest

Answer

Data loss prevention (DLP) rules

Question 11

A DevOps team is implementing a CI/CD pipeline for a Java application. They want to ensure that all dependencies are scanned for known vulnerabilities before deployment. Which type of tool should they integrate into the pipeline?

Accepted Answer

Software Composition Analysis (SCA). Software Composition Analysis (SCA) is the correct tool because it specifically analyzes open-source and third-party libraries (dependencies) for known vulnerabilities by cross-referencing them against databases like the National Vulnerability Database (NVD). In a CI/CD pipeline for a Java application, SCA tools (e.g., OWASP Dependency-Check, Snyk) scan build artifacts such as pom.xml or build.gradle to identify vulnerable components before deployment.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 12

A web application generates an Ansible playbook from user input as shown. What is the primary security risk?

Accepted Answer

The user input could be crafted to execute arbitrary Ansible modules.. The application directly incorporates user input into an Ansible playbook without sanitization or validation. An attacker can inject arbitrary YAML or Ansible module directives (e.g., `shell`, `command`, `raw`) to execute unauthorized commands on managed hosts. This is a classic injection vulnerability specific to automation frameworks, not a generic injection type.

Answer

The application is vulnerable to SQL injection.

Answer

The application is vulnerable to LDAP injection.

Answer

The playbook may fail to run if input contains special characters.

Question 13

Which of the following certificate types is most appropriate for an organization that needs to validate the identity of individuals for email encryption and signing?

Accepted Answer

S/MIME certificate. S/MIME certificates are specifically designed for securing email. Client certificates are for authentication. Code signing is for software. DV certificates are for websites.

Answer

Domain Validation (DV) certificate

Answer

Client authentication certificate

Answer

Code signing certificate

Question 14

A security engineer needs to deploy a host-based intrusion detection system (HIDS) on a critical Linux server without impacting performance. Which configuration is MOST appropriate?

Accepted Answer

Install OSSEC agent with file integrity monitoring and log analysis only.. OSSEC in agent mode with file integrity monitoring (FIM) and log analysis provides host-based intrusion detection with minimal performance overhead because it uses periodic checksums and log tailing rather than inline packet inspection. This configuration detects unauthorized file changes and suspicious log events without the latency and CPU cost of deep packet inspection or real-time antivirus scanning on a critical server.

Answer

Install Snort in inline mode on the server.

Answer

Enable Windows Defender on the Linux server.

Answer

Deploy ClamAV with real-time scanning and OSSEC.

Question 15

During a security review, you find that a web application uses a Content Security Policy (CSP) header with the value: 'default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com;'. Which attack is the application still vulnerable to?

Accepted Answer

Cross-site scripting (XSS) via inline script injection. The CSP includes 'unsafe-inline' in the script-src directive, which explicitly allows inline scripts. This bypasses the primary protection CSP offers against XSS, as an attacker can inject malicious JavaScript directly into the HTML (e.g., via a <script> tag or event handler) without violating the policy. The 'self' source only restricts external scripts to the same origin, but inline scripts remain permitted, leaving the application vulnerable to stored, reflected, or DOM-based XSS attacks.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Man-in-the-middle (MITM) attack due to CDN inclusion