CAS-004 Practice Test 5 — 10 Questions

Question 1

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Accepted Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Perform manual code review, Step 4: Document and communicate findings. Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Answer

Step 1: Run automated scanning tools, Step 2: Understand the codebase, Step 3: Perform manual code review, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Perform manual code review, Step 3: Run automated scanning tools, Step 4: Document and communicate findings

Answer

Step 1: Understand the codebase, Step 2: Run automated scanning tools, Step 3: Document and communicate findings, Step 4: Perform manual code review

Question 2

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

Accepted Answer

The key length is insufficient against modern attacks. A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.

Answer

The firmware is not encrypted

Answer

The signature algorithm is obsolete

Answer

The signing key is not rotated

Question 3

Which three options are best practices for writing secure scripts? (Choose three.)

Accepted Answer

Use parameterized inputs to prevent injection attacks.. Parameterized inputs (also known as prepared statements or parameterized queries) separate SQL or shell command logic from user-supplied data, ensuring that input is treated strictly as data, not executable code. This prevents injection attacks such as SQL injection or command injection, which occur when untrusted input is concatenated directly into a command string. In scripting languages like Python, using `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))` instead of string formatting eliminates the risk of an attacker breaking out of the intended syntax.

Answer

Log all errors and warnings for debugging.

Answer

Hardcode sensitive credentials in the script.

Question 4

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Accepted Answer

All requests to the bucket are denied regardless of source IP.. The S3 bucket policy includes an explicit Deny statement that denies all actions (s3:*) for all principals (*), effectively blocking any request regardless of source IP. Even though there is an Allow statement permitting GetObject from the 10.0.0.0/8 range, the explicit Deny overrides it due to the policy evaluation logic where Deny takes precedence over Allow. Therefore, all requests to the bucket are denied.

Answer

Requests from outside 10.0.0.0/8 are allowed to read objects.

Answer

All requests from IPs in 10.0.0.0/8 are allowed to read objects.

Answer

Only anonymous requests are denied.

Question 5

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.

Question 6

A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?

Accepted Answer

Security information and event management (SIEM) with behavior analytics. A SIEM with User and Entity Behavior Analytics (UEBA) is most effective for reducing MTTD because it baselines normal behavior and detects anomalies in real time, enabling early detection of threats. Full disk encryption (B) protects data at rest but does not aid detection. A DLP system (C) focuses on preventing data exfiltration, not broad detection. A NIDS (D) relies on signature matching, which can miss novel or subtle attacks and typically has a higher detection latency than behavior analytics.

Answer

Full disk encryption software

Answer

Data loss prevention (DLP) system

Answer

Network-based intrusion detection system (NIDS)

Question 7

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

Accepted Answer

The certificate uses the SHA-1 hash algorithm. The certificate uses the SHA-1 hash algorithm, which is cryptographically broken and vulnerable to collision attacks. SHA-1 is deprecated by major browsers and the CA/Browser Forum, and its use in TLS certificates poses a significant security risk because an attacker could forge a certificate with the same hash.

Answer

The RSA key length is 2048 bits

Answer

The certificate is self-signed

Answer

The validity period is only one year

Question 8

A security engineer is evaluating the use of AES-256-GCM for encrypting sensitive data in transit. They note that the Additional Authenticated Data (AAD) field is empty. What is the security implication?

Accepted Answer

The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.. In AES-256-GCM, the Additional Authenticated Data (AAD) provides context binding, ensuring that the ciphertext is authentic only within a specific context (e.g., a particular session or transaction). When AAD is empty, an attacker who has access to multiple valid ciphertexts (each with its own context) could potentially swap them without detection, leading to a mix-and-match attack. The cipher still provides authentication (via the authentication tag) and confidentiality, but without AAD, the binding to the intended context is lost. Option B is wrong because missing AAD does not directly affect protection against man-in-the-middle attacks; the cipher still provides integrity and authentication. Option C is wrong because AES-256-GCM provides authentication through its GMAC authentication tag, even without AAD. Option D is wrong because AAD has no impact on key recovery; GCM is secure against key recovery attacks regardless of AAD.

Answer

The cipher is still secure, but missing AAD offers no additional protection against man-in-the-middle attacks.

Answer

The encryption provides no authentication because AAD is missing.

Answer

The cipher becomes vulnerable to key recovery attacks because AAD is missing.

Question 9

A small business uses Puppet for configuration management on Linux servers. They are now migrating to containers and want to maintain security. The operations team is unfamiliar with containers. The security team insists on automated vulnerability scanning of container images before deployment. What should be the company's first step?

Accepted Answer

Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.. The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.

Answer

Deploy a Kubernetes cluster and migrate all applications.

Answer

Discontinue using Puppet and switch entirely to container-based configurations.

Answer

Train the operations team on Docker and Kubernetes fundamentals.

Question 10

A security analyst is reviewing a CI/CD pipeline configuration. The pipeline uses a containerized application and includes automated security scanning. Which TWO practices should be implemented to ensure container immutability and reduce the attack surface?

Accepted Answer

Run containers with read-only root filesystem.. Running containers with a read-only root filesystem enforces immutability, preventing any modifications at runtime. Option B is correct because scanning images for vulnerabilities at build time reduces the attack surface by catching issues before deployment. Option C is incorrect because using the same base image for all environments does not directly relate to immutability or attack surface reduction and may ignore environment-specific security needs. Option D is incorrect because running containers as root weakens security and increases the attack surface. Option E is incorrect because storing credentials in environment variables is insecure and should be avoided.

Answer

Use the same base image for all environments.

Answer

Run containers as root.

Answer

Store credentials in environment variables.