CAS-004 Practice Test 49 — 15 Questions

Question 1

A security architect is designing a PKI for a large organization. The architect wants to ensure that private keys are stored securely and that cryptographic operations are performed in a tamper-resistant environment. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hardware Security Module (HSM). An HSM is a dedicated, tamper-resistant hardware appliance that generates, stores, and uses cryptographic keys without ever exposing them to the host OS or application memory. It provides FIPS 140-2/3 validated key protection and performs crypto operations (signing, encryption, key wrapping) inside the secure boundary. For a PKI requiring secure private key storage and tamper-resistant cryptographic operations at scale, an HSM (or cloud HSM service) is the correct answer.

Answer

Trusted Platform Module (TPM)

Answer

Software-based keystore

Answer

Key Management Service (KMS) in the cloud

Question 2

A security architect is implementing defense-in-depth for a critical application. Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system. An intrusion detection system (IDS) is a detective control because it monitors network or host activity and generates alerts when it identifies suspicious or malicious behavior, allowing security teams to respond. Detective controls are designed to identify and log incidents after or during their occurrence, rather than preventing them outright. Encryption, ACLs, and firewalls are preventive controls that stop unauthorized access or protect data before an incident occurs.

Answer

Data encryption

Answer

Access control list

Answer

Firewall

Question 3

A security engineer is hardening an SSH server. The policy requires disabling all legacy algorithms and using only modern, secure cryptography. Which THREE of the following configurations should the engineer apply?

Accepted Answer

Set HMAC algorithms to use only SHA-2 or stronger.. Option A is correct because configuring the MAC (HMAC) list to SHA-2 or stronger (e.g., hmac-sha2-256, hmac-sha2-512) removes weak legacy integrity algorithms such as hmac-md5 and hmac-sha1, which are vulnerable to collision and downgrade attacks. Option D is correct because disabling password authentication and permitting only public-key authentication eliminates brute-force and credential-replay risks, since SSH keys provide stronger, non-reusable cryptographic proof of identity. Option E is correct because restricting KEX algorithms to curve25519-sha256 uses modern elliptic-curve Diffie-Hellman with strong forward secrecy, excluding outdated groups like diffie-hellman-group1-sha1. Option B is wrong because SSH protocol version 1 is deprecated and insecure (vulnerable to MITM and CRC-32 attacks); only SSH-2 should be allowed. Option C is wrong because enabling direct root login with a password violates least-privilege and hardening best practices, exposing the most privileged account to brute-force attacks.

Answer

Allow only SSH protocol version 1 for compatibility.

Answer

Enable root login with password for administrative convenience.

Question 4

A security architect is implementing an API gateway to protect microservices. Which security capability is uniquely provided by an API gateway compared to a traditional web application firewall (WAF)?

Accepted Answer

Rate limiting per API consumer. Rate limiting per API consumer is a capability unique to API gateways because the gateway understands API keys, OAuth tokens, and consumer identities, allowing it to enforce quotas and throttling on a per-client basis. A traditional WAF operates at the network/HTTP layer and inspects traffic patterns for attacks but does not natively identify API consumers or apply per-consumer quotas. This makes per-consumer rate limiting the distinguishing capability in this comparison.

Answer

TLS termination

Answer

SQL injection prevention

Answer

Cross-site scripting (XSS) filtering

Question 5

A company is required to comply with FedRAMP for its cloud deployment. Which of the following is a key requirement for FedRAMP compliance?

Accepted Answer

Third-party assessment by an accredited organization. FedRAMP requires that cloud service offerings undergo an independent third-party assessment by a FedRAMP-accredited Third Party Assessment Organization (3PAO) to validate security controls against NIST SP 800-53. This assessment is a cornerstone of the FedRAMP authorization process, ensuring an unbiased evaluation before a Joint Authorization Board (JAB) or agency grants an Authority to Operate (ATO). While continuous monitoring and incident response are also required, the key differentiator is the mandatory third-party assessment.

Answer

Continuous monitoring and incident response

Answer

Implementation of AES-256 encryption for all data

Answer

Annual penetration testing by internal team

Question 6

A company uses Kubernetes for container orchestration. Which security control should be implemented to enforce that only specific images from a trusted registry can run in the cluster?

Accepted Answer

Admission controller (e.g., OPA/Gatekeeper). An admission controller such as OPA/Gatekeeper intercepts API server requests before objects are persisted and can enforce policies — including image registry allow-lists — so only images from trusted registries are admitted to the cluster. Gatekeeper's ConstraintTemplates and Constraints let you write Rego policies that validate image fields in Pod specs.

Answer

Pod security admission (PSA)

Answer

Network policies

Answer

RBAC roles

Question 7

A security operations center (SOC) is evaluating a new EDR solution. Which three capabilities are essential for effective endpoint detection and response? (Select THREE).

Accepted Answer

Behavioral analysis to detect anomalies. Option B is correct because behavioral analysis is the core of EDR: it baselines normal process, file, registry, and network activity and flags deviations (e.g., anomalous parent-child process chains, suspicious PowerShell usage) that signature-based tools miss, enabling detection of unknown or fileless threats. Option C is correct because EDR must not only detect but respond; automated containment capabilities such as isolating the host from the network, terminating or suspending malicious processes, and quarantining files are essential to stop lateral movement and reduce dwell time. Option D is correct because continuous, real-time telemetry collection from endpoints (process creation, command-line arguments, file and registry modifications, network connections) is the foundational data source that feeds both detection analytics and post-incident investigation. Option A is not correct because network firewall management is a network-perimeter control, not an endpoint detection and response capability, even though EDR may integrate with firewalls for containment. Option E is not correct because vulnerability scanning identifies known weaknesses for patch prioritization and is typically a separate VM tool, not a core EDR detection-and-response function.

Answer

Network firewall management

Answer

Vulnerability scanning of endpoints

Question 8

A company uses a SIEM with User Behavior Analytics (UBA). The UBA generates an alert when a user accesses sensitive data at unusual hours. Which type of correlation rule is being applied?

Accepted Answer

Anomaly-based correlation. Anomaly-based correlation establishes a baseline of normal behavior and alerts when activity deviates from that baseline. Accessing sensitive data at unusual hours is a deviation from the user's typical access pattern, which is exactly what UBA anomaly detection flags. This is distinct from threshold, signature, and trend rules, which rely on fixed counts, known patterns, or long-term statistical drift respectively.

Answer

Threshold-based correlation

Answer

Signature-based correlation

Answer

Trend-based correlation

Question 9

A security operations center (SOC) analyst is investigating a potential malware infection on a workstation. The analyst wants to perform static analysis on a suspicious executable. Which tool or technique is most appropriate for examining the executable without executing it?

Accepted Answer

Use the strings command to extract readable ASCII and Unicode strings. Static analysis involves examining an executable without running it. The strings command extracts readable ASCII and Unicode strings from a binary, which can reveal URLs, IP addresses, error messages, and other indicators without executing the code. This is a safe and quick method for initial triage of suspicious files.

Answer

Run the executable in a sandbox

Answer

Use a memory forensics tool like Volatility

Answer

Perform a network traffic capture

Question 10

A security analyst is reviewing CVSS scores for vulnerability prioritization. Which TWO of the following are component metric groups in CVSS v3?

Accepted Answer

Temporal. In CVSS v3, the score is built from three metric groups: Base, Temporal, and Environmental. Option B (Temporal) is correct because it is one of the three metric groups, capturing characteristics that change over time such as Exploit Code Maturity, Remediation Level, and Report Confidence. Option D (Environmental) is also correct because it is a metric group that lets analysts customize the score based on their own environment, including Confidentiality/Integrity/Availability Requirements and modified base metrics. The unmarked options do not belong because Impact, Exploitability, and Attack Vector are not metric groups; Impact and Exploitability are Base metric sub-scores, and Attack Vector is a single Base metric, not a group.

Answer

Impact

Answer

Exploitability

Answer

Attack Vector

Question 11

In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?

Accepted Answer

Run a vulnerability scanner and fail the build on critical findings. Integrating a vulnerability scanner into the CI/CD pipeline and failing the build on critical findings directly reduces the attack surface by preventing deployment of images with known exploitable vulnerabilities. This aligns with the principle of secure software supply chain management, where automated security gates are essential for containerized environments.

Answer

Use the 'latest' tag for the base image to get latest patches

Answer

Store the Dockerfile in a private repository only

Answer

Install all available packages inside the container

Question 12

During a risk assessment, a residual risk is identified as high. What should be the NEXT step?

Accepted Answer

Implement additional controls to reduce the risk to an acceptable level. When residual risk remains high after applying controls, the correct next step is to implement additional controls to reduce it to an acceptable level. This aligns with the risk treatment process in NIST SP 800-37, where residual risk must be evaluated against the organization's risk appetite and, if unacceptable, further mitigation is required. Simply transferring, ignoring, or accepting a high residual risk without analysis violates governance principles.

Answer

Transfer the risk to a third party

Answer

Ignore the risk because it is residual

Answer

Accept the residual risk as is

Question 13

A company is required to comply with PCI DSS. What is the primary purpose of conducting quarterly network vulnerability scans?

Accepted Answer

To detect and remediate vulnerabilities in a timely manner. The primary purpose of quarterly network vulnerability scans under PCI DSS is to detect and remediate vulnerabilities in a timely manner. PCI DSS Requirement 11.2 mandates quarterly internal and external vulnerability scans to identify security weaknesses and address them before they can be exploited. This proactive approach helps maintain a secure network environment.

Answer

To ensure firewall rules are correctly configured

Answer

To verify encryption strength

Answer

To monitor user access logs

Question 14

Which TWO of the following are valid techniques to mitigate the risk of side-channel attacks on cryptographic implementations? (Select exactly 2.)

Accepted Answer

Implementing constant-time algorithms to avoid timing variations.. Option C is correct because side-channel attacks such as timing attacks exploit measurable differences in execution time that depend on secret data; implementing constant-time algorithms ensures that branches, memory access patterns, and instruction counts do not vary with secret values, thereby removing the timing signal an attacker could correlate with the key. Option E is correct because power-analysis attacks (SPA/DPA) exploit variations in a device's power consumption correlated with the data being processed; adding noise or using power-analysis-resistant logic (e.g., masking, hiding, dual-rail logic) decorrelates the power trace from the secret, directly mitigating that side channel. Option A is not appropriate because obfuscating source code does not change the underlying physical or timing leakage of the implementation and is easily defeated by reverse engineering. Option B does not belong because a CSPRNG ensures key unpredictability and strength against brute-force or prediction attacks, but it does nothing to prevent leakage through timing, power, or electromagnetic side channels. Option D is also incorrect because increasing key length to 4096 bits only raises the computational cost of brute-force attacks and does not address information leakage exploited by side-channel analysis.

Answer

Obfuscating the source code of the cryptographic library.

Answer

Using a cryptographically secure random number generator for key generation.

Answer

Increasing the key length to 4096 bits.

Question 15

A company wants to protect sensitive data stored in a public cloud bucket. Which of the following is the MOST effective control to prevent accidental public exposure?

Accepted Answer

Apply resource-based policies with explicit deny for public access. Resource-based policies with an explicit deny for public access are the most effective control because they override any allow statements that might inadvertently grant public access. In cloud providers like AWS, an explicit deny in a bucket policy takes precedence over all other permissions, ensuring that even if other settings (like ACLs) allow public access, the deny blocks it. This directly prevents accidental exposure by enforcing a strict boundary on who can access the bucket.

Answer

Enable bucket logging

Answer

Implement lifecycle policies

Answer

Use server-side encryption