CAS-004 Practice Test 48 — 15 Questions

Question 1

A company is conducting a vendor risk assessment and receives a SOC 2 Type II report from a cloud service provider. The report covers a 12-month period and includes an opinion on the effectiveness of controls. Which of the following is the primary benefit of using this report?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It offers an independent assessment of control effectiveness over time. SOC 2 Type II reports provide an independent auditor's opinion on the effectiveness of controls over a period, which helps the company assess the vendor's security posture without conducting its own audit.

Answer

It guarantees the vendor is compliant with all regulations

Answer

It eliminates the need for a right-to-audit clause

Answer

It provides real-time monitoring data from the vendor

Question 2

A security architect is evaluating hardware security modules (HSMs) for a new PKI deployment. The HSM must be compliant with FIPS 140-2 Level 3. Which of the following is a requirement for Level 3 that distinguishes it from Level 2?

Accepted Answer

Identity-based authentication for operators. FIPS 140-2 Level 3 requires tamper-evident enclosures with active tamper response mechanisms (e.g., erasing keys) and identity-based authentication. Level 2 requires tamper-evident coatings or seals but not active response. Level 4 is more stringent.

Answer

Cryptographic boundary includes all critical components

Answer

Environmental failure protections

Answer

Physical security mechanisms that provide tamper evidence

Question 3

A company is deploying IoT sensors that require secure firmware updates over the air (OTA). To ensure integrity and authenticity of the firmware, which of the following should be implemented?

Accepted Answer

Code signing with a trusted certificate. Code signing with digital signatures ensures firmware integrity and authenticity. Encryption alone does not guarantee authenticity. Hash verification ensures integrity but not authenticity. Secure boot ensures only signed firmware runs but does not protect the update process itself.

Answer

Secure boot on the device

Answer

Hash verification only

Answer

Encryption of the firmware image

Question 4

A company is implementing a Privileged Access Management (PAM) solution to manage admin credentials. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provisioning grants rights only when needed, reducing standing privileges.

Answer

Session recording

Answer

Password vaulting

Answer

Break-glass accounts

Question 5

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

Accepted Answer

It ensures consistent and repeatable security configurations. Infrastructure as code (IaC) enables security configurations to be defined in declarative or procedural scripts (e.g., Terraform, AWS CloudFormation, Ansible). This ensures that every deployment applies the exact same security settings (e.g., firewall rules, IAM policies, encryption at rest) without drift, making configurations consistent and repeatable across environments. The primary benefit is eliminating manual, error-prone processes that lead to configuration inconsistencies.

Answer

It eliminates the need for security testing

Answer

It allows unapproved changes to be deployed faster

Answer

It increases manual oversight of security settings

Question 6

A PKI administrator is concerned about the risk of a compromised issuing CA. Which certificate transparency feature helps detect unauthorized certificate issuance?

Accepted Answer

Certificate Transparency logs. Certificate Transparency (CT) requires all certificates to be publicly logged in CT logs. This allows domain owners and CAs to monitor for misissuance.

Answer

CRL distribution points

Answer

OCSP stapling

Answer

Key usage extensions

Question 7

A threat hunter is looking for signs of a ransomware attack that encrypts files and drops a ransom note. The hunter decides to search for processes that have modified many files in a short period. Which threat hunting methodology is being used?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about a threat and then searches for evidence. The hunter is hypothesizing about ransomware behavior.

Answer

TTP-driven hunting

Answer

Machine learning-driven hunting

Answer

IoC-driven hunting

Question 8

A company is implementing a passwordless authentication solution using FIDO2/WebAuthn. What is the primary security advantage of this approach over traditional password-based authentication?

Accepted Answer

It prevents phishing attacks by using cryptographic keys.. FIDO2 uses public key cryptography, so private keys never leave the device, preventing credential theft.

Answer

It allows users to share passwords securely.

Answer

It reduces server storage requirements.

Answer

It eliminates the need for multi-factor authentication.

Question 9

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Accepted Answer

Use ECDSA P-384 for authentication. IKEv2, AES-256-GCM for encryption, and ECDSA for authentication provide strong security. AES-128 is weaker, SHA-1 is deprecated, and IKEv1 is legacy.

Answer

Use SHA-1 for integrity

Answer

Use IKEv1 instead of IKEv2

Question 10

A security architect is designing a data classification scheme. Which of the following is the highest level of sensitivity that would typically require the most stringent controls?

Accepted Answer

Restricted. Restricted data is the most sensitive and requires the highest level of protection.

Answer

Public

Answer

Internal

Answer

Confidential

Question 11

A security architect is designing a secure boot chain for an IoT device. Which THREE components are essential to ensure the integrity of the firmware update process? (Select THREE.)

Accepted Answer

Firmware update files signed with a private key. A secure boot chain requires that the bootloader verifies the firmware signature using a public key stored in read-only memory. The firmware must be signed by a trusted entity, and updates must be delivered over a secure channel (e.g., TLS) to prevent tampering. Encryption of firmware at rest is not essential for integrity; integrity verification is through signatures. Rolling back to a previous version should be prevented, but that is a separate concern.

Answer

A mechanism to prevent firmware rollback to older versions

Answer

Encryption of firmware at rest on the device

Question 12

A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)

Accepted Answer

Record and monitor all privileged sessions. Just-in-time (JIT) access provisioning grants privileges only when needed, reducing standing privileges. Session recording and monitoring provides audit trails. Break-glass accounts provide emergency access with controls. MFA for all users is a general practice, but for PAM, JIT, session monitoring, and break-glass are specific. Password rotation is good but not a core PAM practice compared to the others.

Answer

Enforce multi-factor authentication for all users

Answer

Require periodic password rotation for all service accounts

Question 13

An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?

Accepted Answer

AH in tunnel mode. AH provides authentication and integrity without encryption. Transport mode is used for end-to-end communication, while tunnel mode is for gateway-to-gateway. Since this is between sites (gateways), tunnel mode is appropriate. AH in transport mode is for host-to-host. ESP provides confidentiality. AH in tunnel mode is correct.

Answer

ESP in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 14

A security engineer is analyzing a serverless application that uses AWS Lambda. Which of the following is the most critical security concern when the function processes external input?

Accepted Answer

The function may be vulnerable to injection attacks if input is not sanitized. The most critical security concern is injection attacks (option A). In serverless applications, unsanitized external input can lead to serious vulnerabilities such as SQL injection or command injection, compromising the entire application. Option B (timeout) is a functional setting and not a security issue. Option C (environment variables) is a standard practice and secure if handled correctly. Option D (custom runtime) is irrelevant to security; the default runtime is perfectly acceptable.

Answer

The function has a timeout of 5 minutes

Answer

The function uses environment variables for configuration

Answer

The function does not use a custom runtime

Question 15

A security analyst needs to write a script that detects changes to critical files across a fleet of Linux servers. Which approach is most efficient and secure?

Accepted Answer

Use an agentless tool like OSSEC with a central manager to report file integrity changes.. OSSEC is a host-based intrusion detection system (HIDS) specifically designed for file integrity monitoring (FIM). Its agentless mode uses SSH to connect to remote servers, retrieve file hashes, and compare them against a known baseline stored on a central manager. This approach is both efficient (centralized reporting, no per-server cron jobs) and secure (encrypted communication, tamper-proof baseline storage).

Answer

Use a cron job on each server running a Python script that checks file hashes.

Answer

Enable Linux auditd on each server and forward logs to a SIEM for analysis.

Answer

Deploy a centralized log server and parse syslog for file modifications.