CAS-004 Practice Test 47 — 15 Questions

Question 1

A security team is selecting key risk indicators (KRIs) for the organization's cybersecurity program. Which of the following is an example of a KRI that provides a leading indicator of risk?

Accepted Answer

Number of unpatched critical vulnerabilities. KRIs ideally should be leading indicators that predict future risk. Number of unpatched critical vulnerabilities is a leading indicator because it indicates potential for future exploitation. MTTD is lagging (measures past incidents). Patch compliance % is a KPI, not necessarily a risk indicator. Number of incidents is lagging.

Answer

Mean time to detect (MTTD) for security incidents

Answer

Number of security incidents reported last month

Answer

Percentage of systems with antivirus installed

Question 2

An organization is implementing a vendor risk management program and is reviewing a contract that includes a right-to-audit clause. Which THREE of the following are common elements that should be verified during such an audit? (Select THREE.)

Accepted Answer

Access control mechanisms. Right-to-audit allows the customer to verify vendor compliance. Common audit areas include security controls, data handling, incident response, and access controls.

Answer

Employee satisfaction surveys

Answer

Vendor's financial stability

Question 3

A compliance officer is preparing for an audit and needs to collect evidence. Which TWO of the following are considered acceptable forms of audit evidence? (Select TWO.)

Accepted Answer

Written security policies. Audit evidence includes system logs (factual records) and policy documentation (proof of requirements).

Answer

Screenshots of unofficial reports

Answer

Verbal statements from employees

Answer

Assumptions about system configurations

Question 4

A security assessor is reviewing a containerized application. Which three of the following practices help secure the container runtime environment? (Select the three best options.)

Accepted Answer

Run the container with a read-only root filesystem. Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Answer

Use the latest base image from Docker Hub

Question 5

A financial institution must comply with the Sarbanes-Oxley Act (SOX). Which of the following is a primary focus of SOX compliance?

Accepted Answer

Accuracy and reliability of financial reporting. SOX focuses on internal controls over financial reporting (ICFR) and requires management to assess and report on the effectiveness of these controls, which includes IT controls that impact financial data.

Answer

Security of credit card transactions

Answer

Privacy of health information

Answer

Protection of personally identifiable information (PII)

Question 6

During a vendor risk assessment, a third-party vendor refuses to provide a SOC 2 report but offers a completed security questionnaire. The vendor handles sensitive customer data. Which of the following is the BEST course of action?

Accepted Answer

Require a right-to-audit clause to conduct an on-site assessment.. If a vendor refuses to provide independent audit evidence, the organization should consider the risk level. For sensitive data, a SOC 2 report is a strong control. The organization should require a right-to-audit clause to perform its own assessment, as the questionnaire alone may be insufficient.

Answer

Immediately terminate the relationship.

Answer

Lower the data classification to reduce risk.

Answer

Accept the questionnaire as sufficient evidence.

Question 7

A security analyst is defining key risk indicators (KRIs) for the security program. Which TWO of the following are examples of KRIs? (Select TWO.)

Accepted Answer

Number of unpatched critical vulnerabilities. KRIs are metrics that indicate risk levels. Number of unpatched critical vulnerabilities and number of security incidents are direct risk indicators.

Answer

Percentage of employees who completed security awareness training

Answer

Time to patch critical systems

Answer

Budget spent on security tools

Question 8

A security manager is reviewing the organization's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest level of authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The typical hierarchy is: policy (high-level, mandatory), standard (specific requirements), guideline (recommendations), procedure (step-by-step instructions).

Answer

Guideline, Policy, Procedure, Standard

Answer

Standard, Policy, Procedure, Guideline

Answer

Procedure, Guideline, Standard, Policy

Question 9

A security analyst is reviewing metrics for the security program. Which metric best measures the effectiveness of incident response processes?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to remediate an incident, indicating response efficiency.

Answer

Mean time to detect (MTTD)

Answer

Patch compliance percentage

Answer

Number of vulnerabilities by severity

Question 10

Which of the following is a key difference between compliance and security?

Accepted Answer

Compliance typically represents a minimum bar, while security seeks best practice. Compliance focuses on meeting minimum legal or regulatory requirements, while security aims for best practices to protect assets beyond what is required.

Answer

Compliance is voluntary, security is mandatory

Answer

Compliance is proactive, security is reactive

Answer

Security only applies to technical controls, compliance to administrative

Question 11

An organization is using the FAIR model to quantify risk. Which of the following is a primary component of the FAIR taxonomy?

Accepted Answer

Loss event frequency and loss magnitude. FAIR decomposes risk into loss event frequency and loss magnitude. These are core components used to calculate risk.

Answer

Inherent risk and residual risk

Answer

Annualized loss expectancy and single loss expectancy

Answer

Threat event frequency and vulnerability

Question 12

A security analyst calculates the annual loss expectancy (ALE) for a critical asset. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the annual loss expectancy?

Accepted Answer

$10,000. ALE = SLE × ARO = $50,000 × 0.2 = $10,000. Annual loss expectancy represents the expected monetary loss per year from a risk.

Answer

$0

Answer

$50,200

Answer

$250,000

Question 13

During a security assessment, a penetration tester discovers that a web application's session tokens are predictable. The application uses a custom session management system. Which of the following is the MOST effective remediation to ensure secure session tokens?

Accepted Answer

Generate session tokens using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy.. Predictable session tokens arise from insufficient randomness. Using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy ensures that tokens are statistically unpredictable and resistant to brute-force or guessing attacks, which is the foundational requirement for secure session management per NIST SP 800-63B and OWASP guidelines.

Answer

Regenerate the session token on each page request.

Answer

Implement a short session timeout of 5 minutes.

Answer

Generate tokens using HMAC-SHA256 of a timestamp and a secret key.

Question 14

A security architect is designing a web application that handles sensitive user data. To protect against cross-site scripting (XSS) attacks, which of the following should be implemented?

Accepted Answer

Implement input validation and output encoding. Input validation and output encoding are the primary defenses against XSS because they prevent malicious scripts from being interpreted by the browser. Input validation rejects or sanitizes dangerous characters (e.g., <, >, &) at the point of entry, while output encoding (e.g., HTML entity encoding) ensures that any user-supplied data rendered in the page is treated as text, not executable code. This directly addresses the root cause of XSS—untrusted data being injected into the DOM.

Answer

Implement Content Security Policy (CSP)

Answer

Use HTTPS for all communications

Answer

Deploy a Web Application Firewall (WAF)

Question 15

An organization's containerized application is deployed on Kubernetes. The security team wants to enforce that containers run with the least privilege and cannot access the host file system. Which Kubernetes security mechanism should be configured?

Accepted Answer

Pod Security Policy (PSP) with readOnlyRootFilesystem and runAsNonRoot. Pod Security Policy (PSP) is a Kubernetes admission controller that enforces security constraints on pods, such as preventing access to the host file system (via `readOnlyRootFilesystem`) and requiring containers to run as a non-root user (`runAsNonRoot`). This directly aligns with the least privilege principle and the requirement to block host file system access.

Answer

Secrets management with Vault

Answer

Role-based access control (RBAC) for service accounts

Answer

Network policies to restrict egress traffic