CAS-004 Practice Test 47 — 15 Questions

Question 1

Which TWO of the following are primary goals of security operations monitoring? (Choose two.)

Accepted Answer

Maintain situational awareness of the security posture. Security operations monitoring (SOC) is fundamentally about continuous visibility and rapid detection, so option B, maintaining situational awareness of the security posture, is correct because monitoring aggregates logs, alerts, and telemetry to give defenders an ongoing, holistic view of the environment's health and risk state. Option E, detecting security incidents in near real-time, is also correct because the core purpose of monitoring tools like SIEM, IDS/IPS, and EDR is to identify anomalous or malicious activity as it happens so responders can act within the incident response lifecycle. Option A does not belong because patch deployment is a vulnerability and configuration management function (e.g., WSUS, SCCM, Intune), not a monitoring goal. Option C does not belong because vulnerability scanning is a proactive assessment activity (e.g., Nessus, Qualys) that identifies weaknesses rather than continuously monitoring for active incidents. Option D does not belong because regulatory compliance is an outcome or driver that monitoring data may support, but it is not itself a primary goal of security operations monitoring.

Answer

Automate patch deployment

Answer

Conduct vulnerability scans

Answer

Ensure compliance with regulatory standards

Question 2

A security architect is reviewing firewall rules for a new application tier. Which TWO of the following principles should be applied when designing the firewall policy? (Choose two.)

Accepted Answer

Implement stateful packet inspection. Allowing only necessary ports and protocols (E) implements least privilege, and implementing stateful packet inspection (C) enables intelligent traffic filtering. Default allow (D) is insecure, static IPs (B) are not a design principle, and logging (A) is operational, not a design principle.

Answer

Log all denied traffic

Answer

Use static IP addresses for all servers

Answer

Default allow all traffic

Question 3

A security analyst calculates the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, SLE = $50,000 and ARO = 0.2, so ALE = $50,000 * 0.2 = $10,000. This represents the expected monetary loss per year from the risk.

Answer

$50,200

Answer

$2,500

Answer

$250,000

Question 4

A company wants to implement certificate pinning for its mobile application to prevent man-in-the-middle attacks. Which of the following is the BEST practice when implementing certificate pinning?

Accepted Answer

Pin the public key of the server certificate. Pinning the public key rather than the entire certificate allows for certificate renewal without invalidating the pin.

Answer

Disable certificate pinning after the first successful connection

Answer

Pin the root CA certificate only

Answer

Pin the entire certificate chain

Question 5

Which THREE of the following are required components of a Business Continuity Plan (BCP) per ISO 22301?

Accepted Answer

Scope and policy for business continuity. Option B is correct because ISO 22301 requires the BCMS to define its scope and establish a business continuity policy that sets the organization's objectives, commitments, and top-management direction for continuity. Option E is correct because the Business Impact Analysis (BIA) is a mandatory core element of ISO 22301; it identifies critical business functions, dependencies, and the maximum tolerable period of disruption (MTPD) that drive recovery priorities and objectives. Option D is correct because ISO 22301 requires documented communication and notification arrangements, including internal and external stakeholder warning, escalation, and crisis communication procedures during and after a disruption. Option A is not a required BCP component per ISO 22301 because detailed technical IT recovery procedures belong to IT disaster recovery planning (e.g., ISO/IEC 27031), which supports but is distinct from the business continuity management system. Option C is not required because vulnerability scanner configuration is a technical security control from vulnerability management, not a BCP element under ISO 22301.

Answer

Detailed technical recovery procedures for IT systems

Answer

Vulnerability scanner configuration

Question 6

A company is implementing API security for its web services. Which THREE of the following are considered best practices for securing APIs? (Select THREE).

Accepted Answer

Validate all input. Option B (Validate all input) is correct because input validation defends against injection attacks such as SQL injection and cross-site scripting (XSS) by ensuring data conforms to expected formats, types, and lengths before processing. Option D (Implement rate limiting) is correct because throttling requests per client or API key mitigates brute-force, credential-stuffing, and denial-of-service abuse, and protects backend resources from being overwhelmed. Option E (Use OAuth 2.0 for authorization) is correct because OAuth 2.0 provides delegated, token-based authorization with scoped access, allowing APIs to grant limited permissions without exposing user credentials. Option A does not belong because relying solely on symmetric encryption for data at rest ignores transport security, key management, and other layers of defense. Option C does not belong because WPA3 is a Wi-Fi (802.11) security standard for wireless LANs, not a transport encryption mechanism for web APIs, which should use TLS.

Answer

Rely solely on symmetric encryption for data at rest

Answer

Use WPA3 for transport encryption

Question 7

A security architect is designing a network segmentation strategy for a data center to reduce the attack surface. Which TWO of the following are best practices for implementing effective network segmentation?

Accepted Answer

Use VLANs to logically isolate traffic between different security zones.. VLANs (IEEE 802.1Q) provide Layer 2 isolation between security zones by segmenting broadcast domains, preventing traffic from crossing zone boundaries without a Layer 3 device (router/firewall). This reduces the attack surface by containing lateral movement within a single VLAN and enforcing access control at the gateway.

Answer

Deploy network access control (NAC) to authenticate devices before granting network access.

Answer

Place all external-facing services in a single shared DMZ segment.

Answer

Allow any-to-any communication within each security zone to avoid performance bottlenecks.

Question 8

An organization is implementing a governance framework to ensure that security controls are aligned with business objectives. Which of the following frameworks is specifically designed for this purpose?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed to align IT governance and security controls with business objectives by providing a comprehensive framework that links business goals to IT goals and enablers. It focuses on governance of enterprise IT (GEIT), ensuring that security investments and controls directly support strategic business outcomes, unlike other frameworks that are more operational or compliance-focused.

Answer

NIST SP 800-53

Answer

ITIL 4

Answer

ISO/IEC 27001

Question 9

Which automation security concept coordinates the deployment, scaling, and management of containers?

Accepted Answer

Container orchestration. Container orchestration is the automation security concept that specifically handles the deployment, scaling, and management of containers. Tools like Kubernetes, Docker Swarm, and Amazon ECS coordinate container lifecycles, including scheduling, health monitoring, and scaling. While other options are related to automation and security, only container orchestration directly addresses the operational coordination of containers at scale.

Answer

Immutable infrastructure

Answer

Infrastructure as Code

Answer

Secret management

Question 10

A security architect is evaluating Cloud Security Posture Management (CSPM) tools. Which TWO capabilities are typically provided by CSPM? (Choose two.)

Accepted Answer

Detection of compliance violations. Option A (Detection of compliance violations) is correct because CSPM tools continuously assess cloud environments against regulatory and industry benchmarks such as CIS, PCI DSS, HIPAA, and NIST, flagging misconfigurations and policy breaches that constitute compliance violations. Option E (Continuous monitoring of cloud resource configurations) is correct because the core function of CSPM is to continuously discover and monitor cloud resources (e.g., storage buckets, IAM policies, security groups) across providers like AWS, Azure, and GCP, detecting drift and risky configuration changes in near real time. Option B is incorrect because WAF management is a web application protection function typically handled by dedicated WAF services or WAAP platforms, not CSPM. Option C is incorrect because container image vulnerability scanning belongs to container security or vulnerability management tools (e.g., Trivy, Clair, or cloud-native registries), not CSPM. Option D is incorrect because DDoS protection is a network-layer availability control provided by services such as AWS Shield or Azure DDoS Protection, which is outside the CSPM scope of posture and compliance assessment.

Answer

Web application firewall (WAF) management

Answer

Vulnerability scanning of container images

Answer

DDoS protection

Question 11

A security architect is designing a zero trust architecture for a corporate network. Which principle is fundamental to the zero trust model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every access request must be verified regardless of origin.

Answer

Trust based on device compliance

Answer

Trust based on network location

Answer

Trust but verify

Question 12

A company is implementing a risk management framework to comply with PCI DSS. Which type of control is a firewall rule that blocks all inbound traffic except HTTP and HTTPS?

Accepted Answer

Preventive. A firewall rule that blocks all inbound traffic except HTTP (port 80) and HTTPS (port 443) is a preventive control because it actively enforces a security policy by denying unauthorized traffic before it can reach internal systems. This aligns with PCI DSS Requirement 1, which mandates a firewall configuration to restrict inbound traffic to only necessary services, thereby reducing the attack surface. Preventive controls are designed to stop security incidents from occurring, which is exactly what this rule accomplishes by filtering traffic at the network layer.

Answer

Corrective

Answer

Compensating

Answer

Detective

Question 13

A financial institution needs to ensure that transaction logs are tamper-proof after creation. Which solution should be implemented?

Accepted Answer

Cryptographic hashing with chain hashing. Chain hashing (also known as hash chaining or blockchain-style linking) ensures tamper-proof logs by including the cryptographic hash of the previous log entry in the current entry. This creates an immutable chain: any modification to a prior entry changes its hash, breaking the chain for all subsequent entries, making tampering immediately detectable. Unlike simple hashing of individual entries, chain hashing ties the entire log sequence together, providing integrity and non-repudiation of the log's chronological order.

Answer

Access control lists

Answer

Encryption with AES

Answer

Digital signatures on each log entry

Question 14

A security engineer is hardening a Kubernetes environment. Which THREE of the following are effective controls for securing the cluster? (Select THREE.)

Accepted Answer

Enabling Pod Security Admission (PSA) to enforce pod security standards. Option B is correct because Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces the Privileged, Baseline, and Restricted Pod Security Standards at the namespace level, preventing pods from running with dangerous settings like privileged containers or hostPath mounts. Option C is correct because RBAC (Role-Based Access Control) restricts who can perform which verbs on which API resources via Roles/ClusterRoles and RoleBindings/ClusterRoleBindings, directly limiting unauthorized API server access and privilege escalation. Option D is correct because Network Policies are the native Kubernetes mechanism (enforced by a CNI such as Calico or Cilium) to control ingress and egress traffic between pods and namespaces, providing workload segmentation and limiting lateral movement. Option A is not a security control—load balancers configured for high availability address availability and resilience, not confidentiality, integrity, or access control. Option E is not appropriate for Kubernetes hardening: node-level antivirus does not secure the cluster's control plane, API access, or pod-level isolation, and containerized workloads are typically immutable and scanned via image scanning instead.

Answer

Configuring load balancers for high availability

Answer

Installing antivirus on all nodes

Question 15

An organization wants to implement passwordless authentication for its employees using FIDO2/WebAuthn. What is a primary security advantage of this approach over traditional password-based MFA?

Accepted Answer

It is resistant to phishing attacks because credentials are bound to the origin.. FIDO2 uses public key cryptography; the private key never leaves the user's device, so phishing attacks cannot steal credentials. This provides strong resistance to phishing.

Answer

It eliminates the need for a second factor.

Answer

It allows users to reuse the same credential across multiple websites.

Answer

It does not require any client-side hardware.