CAS-004 Practice Test 48 — 15 Questions

Question 1

A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)

Accepted Answer

Conducting static application security testing (SAST) during coding. Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.

Answer

Performing penetration testing only after production deployment

Answer

Implementing runtime application self-protection (RASP) in development

Answer

Deploying a web application firewall (WAF) in staging

Question 2

Which TWO are key metrics used in business continuity planning?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is a key metric in business continuity planning because it defines the maximum acceptable downtime for a system or service after a disruption. It directly drives the design of failover mechanisms, backup strategies, and resource allocation to meet the target recovery time. Without a defined RTO, continuity plans lack a measurable goal for restoring operations.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Question 3

A company is conducting a vendor risk assessment and receives a SOC 2 Type II report from a cloud service provider. The report covers a 12-month period and includes an opinion on the effectiveness of controls. Which of the following is the primary benefit of using this report?

Accepted Answer

It offers an independent assessment of control effectiveness over time. A SOC 2 Type II report provides an independent auditor's opinion on the effectiveness of a service organization's controls over a period of time (here, 12 months). This temporal coverage is the key benefit: it demonstrates that controls operated effectively throughout the period, not just on a single date. For vendor risk assessment, this gives assurance about sustained control performance rather than a point-in-time snapshot.

Answer

It guarantees the vendor is compliant with all regulations

Answer

It eliminates the need for a right-to-audit clause

Answer

It provides real-time monitoring data from the vendor

Question 4

During a secure SDLC, a security architect wants to identify design flaws early. Which activity is most appropriate for the design phase?

Accepted Answer

Threat modeling. Threat modeling is a structured design-phase activity that identifies potential threats, attack vectors, and design weaknesses before code is written. It uses frameworks like STRIDE or PASTA to map data flows and trust boundaries, surfacing architectural flaws early when they're cheapest to fix. This aligns exactly with the goal of identifying design flaws during the design phase.

Answer

Penetration testing

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Question 5

A web developer is designing an e-commerce application that stores customer payment information. The application runs on a cloud platform and uses a relational database. During a security review, the auditor identifies that the database admin credentials are hardcoded in the application configuration file. The developer must implement a solution that eliminates hardcoded credentials and enables automatic rotation of secrets. Which course of action should the developer take?

Accepted Answer

Use a secrets management service to store and rotate the credentials dynamically. A secrets management service (e.g., Google Secret Manager, AWS Secrets Manager, Azure Key Vault) stores credentials securely and provides automatic rotation, eliminating hardcoded secrets. The application retrieves secrets at runtime via API, and rotation can be scheduled or triggered.

Answer

Replace the database with one that supports certificate-based authentication

Answer

Encrypt the configuration file using the application's built-in encryption

Answer

Store the credentials in environment variables and use a scheduled script to change them

Question 6

A penetration tester is performing a test against a web application. The rules of engagement prohibit any denial of service (DoS) attacks. Which of the following actions is most likely prohibited by this restriction?

Accepted Answer

Using a tool to send thousands of requests to overwhelm the server. Using a tool to send thousands of requests to overwhelm the server is a denial-of-service (DoS) attack, which is explicitly prohibited by the rules of engagement. This action aims to exhaust server resources, causing service unavailability.

Answer

Performing a SQL injection that deletes a table

Answer

Exploiting a file upload vulnerability to upload a web shell

Answer

Running a directory brute-force tool

Question 7

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Accepted Answer

Runtime protection. Runtime protection (D) is essential because a CWPP must continuously monitor executing processes, detect malicious behavior such as fileless attacks or cryptomining, and block threats in real time across VMs, containers, and serverless workloads in hybrid environments. Vulnerability management (E) is equally essential since CWPPs must scan workloads for missing patches, misconfigurations, and known CVEs (e.g., via agents or agentless snapshots) to prioritize remediation before exploitation. Options A, B, and C, while valuable security disciplines, are typically delivered by SIEM, IAM, and DLP platforms respectively, and are not the defining workload-protection capabilities of a CWPP.

Answer

Security information and event management

Answer

Identity and access management

Answer

Data loss prevention

Question 8

An organization is designing a PKI to issue certificates to thousands of IoT devices. Which architectural decision will BEST support automated certificate lifecycle management?

Accepted Answer

Automated enrollment using SCEP. Automated enrollment using SCEP (Simple Certificate Enrollment Protocol) is the best choice because it enables scalable, automated certificate issuance and renewal for thousands of IoT devices without manual intervention. SCEP is widely supported by IoT devices and integrates with PKI to streamline lifecycle management, including renewal and revocation.

Answer

Online root CA with self-signed certificates

Answer

Using a public CA for all IoT devices

Answer

Offline root CA with manual issuance

Question 9

A security administrator needs to ensure that only authorized devices can access the corporate network. Which technology would best enforce this requirement at the network access layer?

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control (NAC) that authenticates devices before granting access to the network. It ensures that only authorized devices can connect to a switch port or wireless access point, enforcing access control at the network access layer.

Answer

TLS 1.3

Answer

IPsec VPN

Answer

DNSSEC

Question 10

A security architect is evaluating a SASE solution. Which capability is expected to be part of a SASE platform?

Accepted Answer

Secure web gateway (SWG). Secure Web Gateway (SWG) is one of the core converged capabilities of a SASE platform, alongside CASB, ZTNA, FWaaS, and SD-WAN. SASE merges network and security functions into a cloud-delivered service, and SWG provides web filtering, malware inspection, and policy enforcement for user web traffic. It is explicitly expected in a SASE architecture.

Answer

Intrusion prevention system (IPS) at the data center

Answer

Network segmentation via VLANs

Answer

Virtual private network (VPN) concentrator

Question 11

A security team is hardening a Kubernetes cluster. Which control should be implemented to restrict a container's system calls to only those required by the application?

Accepted Answer

Seccomp. Seccomp (secure computing mode) is a Linux kernel feature that filters the system calls a process can make, using a BPF-based profile to allow or deny specific syscalls. In Kubernetes, seccomp profiles are applied via the securityContext.seccompProfile field (or the older seccomp.security.alpha.kubernetes.io/pod annotation), restricting a container to only the syscalls its application requires. This directly matches the requirement to limit a container's system calls.

Answer

AppArmor

Answer

Network policies

Answer

Pod security policies

Question 12

An organization wants to enforce consistent security policies across multiple cloud providers (AWS, Azure, GCP). Which tool is designed to continuously monitor and remediate misconfigurations in cloud environments?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM (Cloud Security Posture Management) tools are purpose-built to continuously scan multi-cloud environments (AWS, Azure, GCP) against benchmarks like CIS, NIST, and PCI DSS, detecting misconfigurations such as public S3 buckets, overly permissive IAM roles, or unencrypted storage. They provide automated remediation workflows and drift detection across providers, which is exactly what the organization needs for consistent policy enforcement. CASB, SIEM, and CWPP address different layers (data access, log correlation, workload runtime) and do not natively deliver cross-cloud configuration posture management.

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 13

A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?

Accepted Answer

It prevents attackers from establishing persistence by modifying system files. Immutable infrastructure means servers are never patched or modified in place; instead, a new image is built and instances are replaced. This prevents attackers from establishing persistence via modified system files, backdoors, or rootkits, because any tampering is discarded when the instance is recycled. It also makes the deployed state deterministic and auditable.

Answer

It eliminates all security vulnerabilities in the infrastructure

Answer

It removes the need for vulnerability scanning of base images

Answer

It simplifies compliance by eliminating the need for patching

Question 14

A company is migrating to a public cloud and wants to ensure they understand their security responsibilities. According to the shared responsibility model, which of the following is typically the responsibility of the cloud customer?

Accepted Answer

Identity and access management. Under the shared responsibility model, the cloud customer is always responsible for their own data, identities, and access management, including IAM policies, users, roles, and credentials. The provider secures the underlying infrastructure, but the customer controls who can access what within their tenant. IAM is therefore a customer responsibility across IaaS, PaaS, and SaaS.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure security

Question 15

Which cryptographic best practice ensures that a private key remains protected even if the server it is stored on is compromised?

Accepted Answer

Storing keys in a hardware security module (HSM). A hardware security module (HSM) is a dedicated physical device that securely generates, stores, and manages cryptographic keys, ensuring the private key never leaves the tamper-resistant hardware. Even if the server is compromised, the attacker cannot extract the key from the HSM. This provides the strongest protection for private keys.

Answer

Encrypting keys with AES-256

Answer

Using short key rotation intervals

Answer

Using strong key derivation functions