CAS-004 Practice Test 50 — 15 Questions

Question 1

An organization wants to ensure that its employees understand their responsibilities regarding data protection. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Conduct regular security awareness training with assessments. The most effective because it combines regular, recurring training with assessments that verify comprehension, ensuring employees actively engage with data protection responsibilities rather than passively receiving information. This aligns with the continuous improvement cycle required by frameworks like NIST SP 800-50 and GDPR Article 39, which mandate ongoing awareness programs and demonstrable understanding. Assessments provide measurable evidence of employee competence, which is critical for compliance audits and reducing human-error-related breaches.

Answer

Include a clause in the employment contract

Answer

Post posters in common areas

Answer

Distribute a data protection policy annually via email

Question 2

An organization wants to implement a solution that ensures data cannot be read if a storage device is physically stolen. Which encryption approach BEST meets this requirement?

Accepted Answer

Full disk encryption (FDE) on the storage device. Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Answer

Transport Layer Security (TLS) for network traffic

Answer

File-level encryption on sensitive documents

Answer

Database column-level encryption for stored data

Question 3

A security engineer is designing a secure wireless network for a corporate office. Which TWO configurations should be implemented to maximize security?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise (Option B) is correct because it provides the highest level of wireless security by mandating the use of Simultaneous Authentication of Equals (SAE) for key exchange, which eliminates pre-shared key vulnerabilities and offers forward secrecy. It also supports 192-bit cryptographic strength when using CNSA Suite mode, making it resistant to offline dictionary attacks and brute-force attempts, which is essential for a corporate environment.

Answer

WPA2-PSK

Answer

MAC address filtering

Answer

Disable SSID broadcast

Question 4

A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?

Accepted Answer

Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.. Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted. Since the identity-aware proxy is correctly configured and SSO is working, but access is still failing, and the architect suspects microsegmentation rules are blocking traffic, the most direct first step is to review those rules. Option A (Deploy a VPN) would bypass zero-trust principles and is not the first step. Option B (Reset credentials) does not address the suspected firewall issue. Option D (Increase logging) is a diagnostic step but should come after checking the likely cause.

Answer

Deploy a VPN to provide a secure tunnel for remote users.

Answer

Reset the affected users' credentials and force them to re-authenticate.

Answer

Increase logging verbosity on the identity-aware proxy to capture more details.

Question 5

During a security review, you find that a web application uses a Content Security Policy (CSP) header with the value: 'default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com;'. Which attack is the application still vulnerable to?

Accepted Answer

Cross-site scripting (XSS) via inline script injection. The CSP includes 'unsafe-inline' in the script-src directive, which explicitly allows inline scripts. This bypasses the primary protection CSP offers against XSS, as an attacker can inject malicious JavaScript directly into the HTML (e.g., via a <script> tag or event handler) without violating the policy. The 'self' source only restricts external scripts to the same origin, but inline scripts remain permitted, leaving the application vulnerable to stored, reflected, or DOM-based XSS attacks.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Man-in-the-middle (MITM) attack due to CDN inclusion

Question 6

Which THREE of the following are common vulnerabilities found in web applications according to the OWASP Top 10 2021? (Select THREE.)

Accepted Answer

Cryptographic Failures. The OWASP Top 10 2021 lists three categories that correspond directly to the options: A02:2021 Cryptographic Failures (option A), A01:2021 Broken Access Control (option B), and A10:2021 Server-Side Request Forgery (option C). Option D (SQL Injection) is not a standalone category in the 2021 list; it falls under A03:2021 Injection, which is broader and includes various injection types. Option E (Remote Code Execution via buffer overflow) is not listed as a distinct category in the OWASP Top 10 2021. Therefore, the correct three answers are A, B, and C.

Answer

SQL Injection

Answer

Remote Code Execution (RCE) via buffer overflow

Question 7

An organization is architecting a hybrid cloud environment with AWS and on-premises resources. Which THREE considerations are essential for meeting data residency requirements? (Choose three.)

Accepted Answer

Selecting the correct AWS region for data storage. Data residency requires control over data location. AWS region selection determines physical storage location. Data classification policies enforce where data can reside. Encryption keys stored in a specific region ensure data remains under jurisdictional control.

Answer

Using only on-premises storage for all data

Answer

Using a global AWS account without region constraints

Question 8

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

Accepted Answer

Enable content trust and require signatures on all images. Enabling content trust (e.g., Docker Content Trust or Notary) cryptographically signs container images, ensuring that only images signed by a trusted publisher can be deployed. This directly enforces integrity and authenticity in the CI/CD pipeline, preventing unauthorized or tampered images from reaching production.

Answer

Implement a private container registry with access controls

Answer

Run vulnerability scanning on all images before deployment

Answer

Use an admission controller that checks image labels

Question 9

An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?

Accepted Answer

Rewrite the database query to use parameterized prepared statements.. Parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.

Answer

Deploy a web application firewall (WAF) to filter malicious payloads.

Answer

Move all database queries to stored procedures.

Answer

Implement client-side input validation to block special characters.

Question 10

A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.. A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.

Answer

Deploy IPsec tunnels between each pair of services using pre-shared keys.

Answer

Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.

Answer

Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.

Question 11

Which TWO of the following are key components of a successful incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation (Option B) is the foundational phase that ensures the organization has the tools, policies, and trained personnel ready before an incident occurs. Detection and Analysis (Option E) is the second phase, focusing on identifying and validating security incidents through monitoring, alerting, and forensic analysis.

Answer

Vulnerability scanning

Answer

Patch management

Answer

User training

Question 12

A security architect is designing a secure software development pipeline. The organization wants to ensure that code is thoroughly analyzed before deployment. Which TWO of the following should be integrated into the pipeline to identify vulnerabilities early? (Select TWO.)

Accepted Answer

Static application security testing (SAST). SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code without executing it, scanning for vulnerabilities like SQL injection, buffer overflows, and insecure cryptographic functions. Integrating SAST early in the pipeline (shift-left) allows developers to fix issues before compilation, reducing remediation cost and risk. SCA (Software Composition Analysis) identifies known vulnerabilities in third-party libraries and open-source components by comparing dependency versions against databases like the National Vulnerability Database (NVD). Both tools are non-intrusive and can be automated in CI/CD pipelines to catch flaws before deployment.

Answer

Fuzz testing

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Question 13

Which of the following are accurate descriptions for the given container security concepts? (Select all that apply.)

Accepted Answer

Enforces system call filtering and access controls at runtime. The correct descriptions are: E (Container runtime security: enforces system call filtering and access controls at runtime using tools like AppArmor and Seccomp), F (Image signing: ensures container images are not tampered with using cryptographic hashes via signatures), G (Secrets management: safely injects credentials into containerized applications at runtime using tools like Vault), and H (Orchestration security: manages network segmentation and pod security policies in clusters as seen in Kubernetes). Options A through D name the security concepts but are not descriptions themselves.

Answer

Container runtime security

Answer

Image signing

Answer

Secrets management

Answer

Orchestration security

Question 14

Drag and drop the steps to perform a forensic acquisition of a hard drive using FTK Imager into the correct order.

Accepted Answer

Step 1: Connect write-blocker to suspect hard drive. Step 2: Connect write-blocker to forensic workstation. Step 3: Launch FTK Imager and create a forensic image. Step 4: Verify hash integrity.. Forensic acquisition requires write-blocking first, then using FTK Imager to create a forensic image, ensuring integrity with hash verification.

Answer

Step 1: Connect write-blocker to forensic workstation. Step 2: Connect write-blocker to suspect hard drive. Step 3: Launch FTK Imager and create a forensic image. Step 4: Verify hash integrity.

Answer

Step 1: Connect write-blocker to suspect hard drive. Step 2: Launch FTK Imager and create a forensic image. Step 3: Connect write-blocker to forensic workstation. Step 4: Verify hash integrity.

Answer

Step 1: Connect write-blocker to suspect hard drive. Step 2: Connect write-blocker to forensic workstation. Step 3: Verify hash integrity. Step 4: Launch FTK Imager and create a forensic image.

Question 15

An organization is implementing a privacy by design approach for a new customer-facing application. Which of the following actions best exemplifies this principle?

Accepted Answer

Minimizing data collection to only what is necessary for the application's function. Privacy by design means embedding privacy into the design and architecture of systems, not as an afterthought. Data minimization (collecting only what is necessary) is a key principle.

Answer

Adding a privacy notice to the application post-launch

Answer

Conducting a privacy impact assessment after the application is deployed

Answer

Encrypting data at rest and in transit