CAS-004 Practice Test 50 — 15 Questions

Question 1

A security engineer is evaluating options for securing firmware updates on IoT devices. Which TWO methods provide integrity verification of the update?

Accepted Answer

Hash-based message authentication code (HMAC). HMAC (C) is correct because it uses a cryptographic hash function combined with a secret key to produce a message authentication code, allowing the recipient to verify both the integrity of the firmware update and its authenticity, since any modification to the firmware would change the resulting HMAC value. Digital signature verification (D) is correct because it uses asymmetric cryptography (e.g., RSA or ECDSA) to sign the firmware hash with a private key, and the device verifies the signature with the corresponding public key, providing strong integrity and authenticity assurance that the update has not been tampered with. Obfuscation (A) only makes code harder to read and does not provide any cryptographic integrity check, so it cannot detect modification. AES encryption (B) provides confidentiality, not integrity verification, unless combined with a separate integrity mechanism such as an AEAD mode, which is not stated here. Secure Boot (E) is a boot-time process that verifies the integrity of the boot chain using signatures, but it is not itself a method for verifying the integrity of a firmware update payload during the update process.

Answer

Obfuscation of the firmware code

Answer

AES encryption of the firmware

Answer

Secure Boot

Question 2

An engineer reviews the TLS configuration for a web server, which includes the following line:
ssl_verify_client optional;
Which of the following is a security concern present in this configuration?

Accepted Answer

The server does not require client certificates for authentication.. The directive ssl_verify_client optional; means the server will request a client certificate but will not require it; if the client does not present one, the connection still proceeds. This weakens mutual TLS authentication because clients are not forced to authenticate with certificates, allowing unauthenticated access.

Answer

The cipher suite does not include perfect forward secrecy (PFS).

Answer

The configuration supports outdated TLS 1.2 protocols.

Answer

The private key is stored in an accessible location.

Question 3

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

Accepted Answer

Organizational policy violation. The employee's action directly violates the company's internal security policy requiring VPN for all remote access. This is a policy violation, not a legal or regulatory one, as the company has established a mandatory rule that the employee failed to follow. The use of a personal device without VPN to access company email is a clear breach of organizational policy, which is a governance issue within the company's risk management framework.

Answer

Legal violation

Answer

Standards violation

Answer

Regulatory compliance violation

Question 4

An organization is using the FAIR model to quantify risk. Which of the following is a primary component of the FAIR taxonomy?

Accepted Answer

Loss event frequency and loss magnitude. The FAIR (Factor Analysis of Information Risk) taxonomy decomposes risk into two primary factors: Loss Event Frequency (LEF) — how often a loss event is expected to occur — and Loss Magnitude (LM) — how much loss each event would cause. These two top-level factors are then further decomposed (e.g., LEF into threat event frequency and vulnerability; LM into primary and secondary loss). LEF and LM are the canonical first-level components of the FAIR ontology.

Answer

Inherent risk and residual risk

Answer

Annualized loss expectancy and single loss expectancy

Answer

Threat event frequency and vulnerability

Question 5

During a third-party risk assessment, an organization discovers that a cloud service provider (CSP) stores data in a jurisdiction with conflicting privacy laws. The organization's legal team advises that this could expose the organization to regulatory penalties. Which of the following contractual clauses would best address this compliance risk?

Accepted Answer

Include a Data Processing Agreement (DPA) that requires data to be stored only in approved jurisdictions.. A Data Processing Agreement (DPA) is the correct contractual mechanism to enforce data residency restrictions. By requiring the CSP to store data only in approved jurisdictions, the DPA directly addresses the compliance risk of conflicting privacy laws and potential regulatory penalties, as it legally binds the provider to specific geographic data handling requirements.

Answer

Insert a right-to-audit clause allowing the organization to inspect the CSP's facilities.

Answer

Negotiate a service-level agreement (SLA) guaranteeing 99.99% uptime.

Answer

Require the CSP to sign a business associate agreement (BAA) under HIPAA.

Question 6

A security engineer is designing a secure hybrid cloud connection between an on-premises data center and AWS. Which service provides a dedicated, private network connection that bypasses the public internet?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated, private physical network connection from an on-premises data center to AWS, bypassing the public internet entirely. It is provisioned through a Direct Connect location or partner and offers consistent latency and higher bandwidth than internet-based options. This is the only option that guarantees a private, non-internet path by design.

Answer

Site-to-Site VPN

Answer

Transit Gateway

Answer

VPC Peering

Question 7

A security architect is designing a cryptographic system for a government agency that must protect classified data for the next 30 years. The agency is concerned about the threat from quantum computers. Which NIST post-quantum cryptography algorithm is recommended for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is the NIST-selected post-quantum algorithm for key encapsulation (KEM), standardized as FIPS 203 (ML-KEM). It is designed to resist attacks from both classical and quantum computers, making it appropriate for long-lived classified data. CRYSTALS-Dilithium is for digital signatures, not key encapsulation, and the classical algorithms (ECDH, RSA) are vulnerable to Shor's algorithm on a sufficiently powerful quantum computer.

Answer

ECDH with NIST P-384

Answer

CRYSTALS-Dilithium

Answer

RSA-4096

Question 8

A security administrator is evaluating ways to improve endpoint detection and response (EDR) capabilities. Which TWO of the following approaches would most effectively enhance the detection of fileless malware attacks?

Accepted Answer

Monitor PowerShell script block logging and execution events.. Option A is correct because fileless malware frequently abuses PowerShell to execute malicious code in memory, and enabling PowerShell script block logging (Event ID 4104) plus execution events (Event ID 4103/4104) captures the actual script content and commands, giving EDR the telemetry needed to detect these in-memory attacks. Option C is correct because fileless techniques typically spawn processes from unusual parents (e.g., winword.exe launching powershell.exe or wmic.exe), so monitoring process creation chains and parent-child relationships via tools like Sysmon (Event ID 1) or Windows Security Event ID 4688 exposes these anomalous execution patterns. Option B is not the best fit because a NIDS inspects network traffic and cannot see in-memory or script-based execution on the endpoint, so it misses the core of fileless attacks. Option D is not ideal because FIM only detects changes to files on disk, whereas fileless malware resides in memory and leaves little or no file artifacts. Option E is not the best choice because signature- and ML-based antivirus primarily targets known or file-based malware and often fails against fileless techniques that never write a malicious file to disk.

Answer

Install a network intrusion detection system (NIDS) to inspect traffic.

Answer

Enable file integrity monitoring (FIM) on critical system files.

Answer

Deploy advanced antivirus with machine learning signatures.

Question 9

An organization is implementing a Secure Access Service Edge (SASE) architecture. Which of the following is a key component of SASE?

Accepted Answer

Cloud Access Security Broker (CASB). SASE (Secure Access Service Edge) converges networking (SD-WAN) with a stack of cloud-delivered security services, and CASB is one of its core security pillars alongside SWG, ZTNA, and FWaaS. CASB provides visibility and control over cloud application usage, enforces DLP, and detects shadow IT — functions that SASE delivers from a globally distributed edge. DMZ, IPS, and VPN are traditional on-premises or point-solution constructs that SASE is explicitly designed to replace or absorb, not core defining components.

Answer

Demilitarized Zone (DMZ)

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Question 10

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

Accepted Answer

AWS Config. AWS Config is the service purpose-built for continuously assessing, auditing, and evaluating AWS resource configurations against desired baselines. It records configuration changes, evaluates them against Config Rules (including SOC 2-aligned conformance packs), and flags noncompliant resources. This directly maps to SOC 2's change management, monitoring, and configuration control criteria. CloudTrail, WAF, and Shield serve different purposes — API activity logging, web attack filtering, and DDoS mitigation respectively — none of which provide configuration compliance assessment.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Shield

Question 11

An organization is implementing SSH hardening for server access. Which configuration change most effectively reduces the attack surface against brute-force and credential theft?

Accepted Answer

Enable public-key authentication and disable password authentication.. Public-key authentication replaces the shared secret (password) with an asymmetric key pair, so there is no reusable credential an attacker can brute-force or steal via phishing/keylogging. Disabling password authentication also eliminates the entire class of credential-guessing attacks against SSH. This is the single most impactful hardening step because it removes the attack vector rather than merely slowing it down.

Answer

Change the default SSH port from 22 to a high-numbered port.

Answer

Set MaxAuthTries to 6 to limit login attempts.

Answer

Use TCP wrappers to restrict source IP addresses.

Question 12

A security manager is reviewing Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for the security program. Which of the following is an example of a KRI?

Accepted Answer

Number of critical vulnerabilities exceeding the risk appetite threshold. A Key Risk Indicator (KRI) measures risk exposure and whether it is approaching or exceeding the organization's risk appetite — the number of critical vulnerabilities exceeding the risk appetite threshold is a direct measure of unacceptable risk exposure. KRIs are forward-looking indicators that signal when risk levels are becoming dangerous.

Answer

Mean time to detect (MTTD) security incidents

Answer

Percentage of systems patched within 30 days

Answer

Number of security incidents per month

Question 13

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

Accepted Answer

Apply network policies to isolate workloads.. Network policies in Kubernetes act as a firewall for pods, controlling ingress and egress traffic at the IP address or port level (OSI layer 3 or 4). By default, all pods can communicate with each other; applying network policies enforces least-privilege segmentation, which is a core security best practice for container orchestration platforms.

Answer

Use privileged containers for system services.

Answer

Disable all security contexts to avoid restrictions.

Question 14

An organization is adopting SASE to converge network and security functions. Which component of SASE provides secure web gateway (SWG) capabilities?

Accepted Answer

Secure Web Gateway. Secure Web Gateway (SWG) is itself the SASE component that provides SWG capabilities — it filters web traffic, enforces URL categorization, blocks malicious content, and applies acceptable-use policies. In SASE architectures, SWG is one of the core security pillars delivered from the cloud edge, alongside CASB, ZTNA, and FWaaS. ZTNA, SD-WAN, and CASB serve different functions and do not deliver SWG's web filtering and threat inspection.

Answer

ZTNA

Answer

SD-WAN

Answer

CASB

Question 15

A security architect is designing a zero trust architecture for a financial services company. Which component is MOST critical to enforce identity-centric access control in a zero trust model?

Accepted Answer

Software-defined perimeter. A software-defined perimeter (SDP) is the most critical component for enforcing identity-centric access control in zero trust because it creates a 'black cloud' where resources are invisible until users and devices are authenticated and authorized. SDP uses a controller that brokers connections based on identity, device posture, and policy, rather than network location. This directly implements the zero trust principle of 'never trust, always verify' at the access layer.

Answer

Network firewall

Answer

Intrusion prevention system

Answer

VPN concentrator