CAS-004 Practice Test 49 — 15 Questions

Question 1

During a business continuity planning meeting, the team identifies several critical systems. Which THREE of the following are key components of a Business Impact Analysis (BIA)? (Select THREE.)

Accepted Answer

Mission-essential functions. A is correct because mission-essential functions are a core component of a Business Impact Analysis (BIA). The BIA identifies and prioritizes critical business processes and the resources required to support them, directly linking to mission-essential functions to determine the impact of their disruption. This ensures continuity planning focuses on the most vital operations first.

Answer

Inventory of all hardware assets

Answer

Threat modeling of likely attack vectors

Question 2

An organization uses a hardware security module (HSM) to protect cryptographic keys. Which aspect of key management does an HSM primarily address?

Accepted Answer

Secure key storage and cryptographic operations. HSMs provide tamper-resistant hardware for secure key generation, storage, and operations, ensuring that private keys are never exposed in plaintext outside the device.

Answer

Key rotation

Answer

Key escrow

Answer

Digital certificate issuance

Question 3

Based on the iptables exhibit, a security analyst has received an alert that an external IP (203.0.113.5) is attempting to connect to TCP port 3389 on the server. Which of the following best describes the current rule set's treatment of this traffic?

Accepted Answer

The connection will be logged and then dropped by the default policy. The rule set has a LOG rule for tcp dpt:3389 from any source, which will log the packet but not explicitly accept or drop it; since the policy in the INPUT chain is DROP, the packet will be dropped after being logged. Option A is incorrect because the LOG rule does not drop, only logs. Option C is incorrect because there is no ACCEPT rule for 3389. Option D is incorrect because the default policy is DROP.

Answer

The connection will be allowed through because there is no explicit DROP rule

Answer

The connection will be accepted because there is a LOG rule

Answer

The connection will be logged and then dropped by the LOG rule

Question 4

A security architect is designing a network segmentation strategy for a multi-tenant cloud environment. Which of the following is the MOST effective technique to isolate tenant workloads while maintaining manageability?

Accepted Answer

Virtual private clouds (VPCs) with separate subnets. Virtual private clouds (VPCs) with separate subnets provide native, tenant-level isolation in a multi-tenant cloud environment by creating logically isolated network segments with their own IP address space, routing tables, and security policies. This approach is the most effective because it scales easily, integrates with cloud-native security controls (e.g., security groups, network ACLs), and maintains manageability through centralized orchestration without requiring per-tenant hardware or complex overlay configurations.

Answer

Host-based iptables

Answer

Stateful firewall rules

Answer

VLAN tagging

Question 5

A vulnerability scanner reports a critical vulnerability on a critical server with a CVSS v3.1 base score of 9.8. The server cannot be patched immediately due to vendor constraints. Which of the following should the security team implement as a compensating control?

Accepted Answer

Isolate the server on a separate network segment with strict firewall rules. When a patch cannot be applied, compensating controls such as network segmentation, firewall rules, or WAF can reduce risk. Network isolation is a common compensating control.

Answer

Disable the server until a patch is available

Answer

Increase monitoring of the server

Answer

Apply a workaround provided by the vendor

Question 6

A penetration tester is performing a test against a web application. During active reconnaissance, the tester discovers that the application discloses version numbers in HTTP headers. Which phase of the penetration testing lifecycle does this activity belong to?

Accepted Answer

Reconnaissance. Active reconnaissance involves directly interacting with the target to gather information, such as by sending probes and analyzing responses. Discovering version numbers via HTTP headers is a form of active reconnaissance because the tester is making requests and inferring information from the responses.

Answer

Post-exploitation

Answer

Exploitation

Answer

Reporting

Question 7

An organization is developing a security policy hierarchy. Which TWO of the following correctly represent the typical order from highest to lowest level in a policy framework? (Select TWO.)

Accepted Answer

Policy, Standard, Guideline, Procedure. The policy hierarchy typically is: Policy (high-level requirements), Standard (mandatory rules), Guideline (recommended practices), Procedure (step-by-step instructions). The correct order is Policy then Procedure is not correct; Policy, Standard, Guideline, Procedure is the full order.

Answer

Policy, Procedure, Guideline, Standard

Answer

Guideline, Policy, Standard, Procedure

Answer

Standard, Policy, Procedure, Guideline

Question 8

A security engineer is evaluating a new Hardware Security Module (HSM) for a financial application that requires FIPS 140-2 Level 3 compliance. Which TWO features are required for Level 3 validation? (Select TWO.)

Accepted Answer

Tamper-evident coatings or seals on the HSM. FIPS 140-2 Level 3 requires tamper-evident coatings or seals and identity-based authentication (e.g., passwords, biometrics). Level 2 requires tamper-evident coatings but not identity-based. Level 4 requires tamper detection and zeroization.

Answer

Encryption of all data at rest

Answer

Role-based access control

Answer

Environmental failure protection

Question 9

An organization needs to ensure compliance with GDPR regarding data subject access requests. What is the MOST important control to implement?

Accepted Answer

Implement a process to respond to access requests within one month. GDPR Article 12(3) requires organizations to respond to data subject access requests without undue delay and at the latest within one month. The most important control is a documented process that ensures timely identification, validation, and fulfillment of these requests, as failure to meet the deadline constitutes a direct compliance violation. Without this process, technical controls like encryption alone cannot satisfy the regulatory requirement for a verifiable response.

Answer

Encrypt all personal data at rest and in transit

Answer

Minimize the collection of personal data

Answer

Appoint a Data Protection Officer (DPO)

Question 10

A SOC analyst notices that a containerized application is making unexpected outbound connections. The container runs with minimal privileges. Which step should the analyst take first to investigate without compromising the environment?

Accepted Answer

Capture a network packet dump from the host and correlate with container logs.. Capturing a network packet dump from the host allows the analyst to observe the unexpected outbound connections without altering the container's state or risking privilege escalation. By correlating the packet capture (e.g., using tcpdump or Wireshark) with container logs, the analyst can identify the destination IPs, ports, and protocols involved while maintaining the container's minimal privileges and preserving forensic integrity.

Answer

Restore the container from a trusted image and re-deploy.

Answer

Use `docker exec` to attach a shell and run network diagnostic commands.

Answer

Immediately kill the container and analyze its filesystem from a backup.

Question 11

A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)

Accepted Answer

Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.. A TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.

Answer

Apply Kubernetes network policies to restrict pod-to-pod communication.

Answer

Configure RPM package signing for all container images.

Question 12

A security architect is designing a public key infrastructure (PKI). Which component is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority. The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Answer

Validation Authority

Answer

Certificate Repository

Answer

Registration Authority

Question 13

A company is implementing a new cloud-based SaaS application and needs to ensure compliance with GDPR. The security team is tasked with updating the data protection impact assessment (DPIA). Which of the following should the team prioritize?

Accepted Answer

Assessing the types of personal data processed and the risks to data subjects. Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing personal data that is likely to result in high risk to individuals. The core requirement is to systematically assess the types of personal data being processed, the necessity and proportionality of the processing, and the risks to data subjects' rights and freedoms. This directly aligns with option A, as the DPIA must identify and mitigate privacy risks before the SaaS application goes live.

Answer

Defining data retention schedules for all data types

Answer

Conducting a vulnerability scan of the SaaS application

Answer

Reviewing the cloud provider's SLA for uptime guarantees

Question 14

Which of the following is a secure method for storing secrets (e.g., API keys, passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service. A dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provides encryption at rest and in transit, automatic rotation, fine-grained access control via IAM policies, and audit logging. This prevents secrets from being exposed in configuration files, environment dumps, or version control, which is essential for cloud-native applications that must adhere to the principle of least privilege and compliance standards like SOC 2 or PCI DSS.

Answer

Encode secrets in base64 in configuration files

Answer

Store secrets in environment variables

Answer

Hardcode secrets in the source code

Question 15

An organization wants to implement a hardware security module (HSM) to protect cryptographic keys. Which of the following is a primary benefit of using an HSM?

Accepted Answer

Tamper-resistant key storage. An HSM provides tamper-resistant key storage by using physical and logical safeguards, such as tamper switches, epoxy potting, and zeroization circuits, that destroy cryptographic keys if an attacker attempts to access the hardware. This ensures that private keys remain secure even if the device is compromised, which is a primary requirement for compliance with standards like FIPS 140-2 Level 3 or 4. Software-based storage cannot offer the same level of physical protection against extraction attacks.

Answer

Faster key generation than software

Answer

Reduced network latency for encryption

Answer

Automatic cloud backup of keys