CAS-004 Practice Questions 2 — 50 Questions

Question 1

An organization is implementing a hardware security module (HSM) to protect cryptographic keys used for code signing. The HSM is required to meet a government standard for physical security and tamper resistance. Which FIPS 140 security level must the HSM achieve to provide tamper-evident coatings and tamper response mechanisms?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIPS 140-2 Level 3. FIPS 140-2 Level 3 requires tamper-evident coatings and tamper response mechanisms that zeroize keys upon tampering. Level 2 requires tamper-evident coatings but no response, Level 4 is for extreme environments.

Answer

FIPS 140-2 Level 4

Answer

FIPS 140-2 Level 2

Answer

FIPS 140-2 Level 1

Question 2

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Accepted Answer

Disable TLS 1.0 and enable TLS 1.2 only. The vulnerability being remediated is likely the use of outdated TLS 1.0, which is deprecated by PCI DSS and has known weaknesses (e.g., POODLE, BEAST). Disabling TLS 1.0 and enabling only TLS 1.2 directly addresses the cryptographic protocol weakness, ensuring compliance with PCI DSS requirement 4.1 (use of strong cryptography). This is the most appropriate action because it removes the insecure protocol entirely rather than isolating or compensating for it.

Answer

Move the host to a separate VLAN

Answer

Apply a compensating control such as an API gateway

Answer

Accept the risk because the CVSS score is below 8.0

Question 3

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). SBOMs list all components and their versions; dependency analysis identifies vulnerabilities in those components.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration

Question 4

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Accepted Answer

Reset the service account password and revoke any active tokens.. Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Answer

Check the workstation logs for signs of malware.

Answer

Notify law enforcement and the organization's legal department.

Answer

Restore the affected files from a known good backup.

Question 5

A security administrator is configuring SSH for a jump host used to access critical servers. Which of the following is the most secure configuration option to restrict authentication and reduce the attack surface?

Accepted Answer

Allow only key-based authentication. Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

Answer

Enable root login with a strong password

Answer

Allow only SSH protocol version 2

Answer

Change the default port to 2222

Question 6

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 7

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

Accepted Answer

In the DMZ. A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

Answer

In the management network

Answer

In the database tier

Answer

Inside the internal network

Question 8

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 9

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

Accepted Answer

Implement short-lived access tokens with refresh tokens that are automatically rotated. Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Answer

Extend the session token expiration time to reduce the frequency of re-authentication

Answer

Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture

Answer

Reduce the number of authentication factors required for re-authentication

Question 10

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. The best course of action because it directly addresses both security issues: cross-region replication of KMS master keys eliminates the single point of failure, and restricting health check ports to internal IP ranges reduces exposure. Option A is incorrect because it replaces TLS with IPsec (unnecessary) and adds complexity. Option C consolidates to one region, which defeats the purpose of multi-region deployment for availability and disaster recovery. Option D embeds keys in code, violating key management best practices. Option B minimizes latency and cost while ensuring security.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely

Question 11

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 12

An organization is implementing a governance framework to ensure that security controls are aligned with business objectives. Which of the following frameworks is specifically designed for this purpose?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed to align IT governance and security controls with business objectives by providing a comprehensive framework that links business goals to IT goals and enablers. It focuses on governance of enterprise IT (GEIT), ensuring that security investments and controls directly support strategic business outcomes, unlike other frameworks that are more operational or compliance-focused.

Answer

NIST SP 800-53

Answer

ITIL 4

Answer

ISO/IEC 27001

Question 13

An organization uses an EDR solution and wants to detect ransomware that encrypts files and then deletes volume shadow copies. Which EDR detection technique would be most effective for this behavior?

Accepted Answer

Behavioral detection for mass file modifications and vssadmin.exe execution. Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Answer

Signature-based detection using file hashes

Answer

Allowlisting of trusted applications

Answer

Network traffic analysis to detect C2 communication

Question 14

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 15

A security architect is designing a zero trust architecture for a corporate network. Which principle is fundamental to the zero trust model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every access request must be verified regardless of origin.

Answer

Trust based on device compliance

Answer

Trust based on network location

Answer

Trust but verify

Question 16

During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period of time. SOC 2 Type II reports on the effectiveness of controls over a period of time.

Answer

The vendor's financial stability

Answer

The vendor's compliance with privacy laws

Answer

The vendor's penetration test results

Question 17

Which of the following is a primary benefit of using a Web Application Firewall (WAF) in front of a web application?

Accepted Answer

It filters malicious HTTP requests and can block common web exploits. A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model and inspects HTTP/HTTPS traffic for malicious payloads. It uses a combination of signature-based detection, behavioral analysis, and rule sets (e.g., OWASP ModSecurity Core Rule Set) to filter out common web exploits such as SQL injection, cross-site scripting (XSS), and path traversal. By intercepting and blocking malicious requests before they reach the web application, a WAF provides a critical layer of defense without requiring changes to the application code.

Answer

It encrypts all traffic between client and server

Answer

It prevents all types of attacks against the application

Answer

It performs static code analysis on the application

Question 18

A security architect is designing deception technologies to detect and delay attackers. Which TWO of the following are examples of deception technologies that can be deployed? Select TWO.

Accepted Answer

Honeytokens. Honeypots and honeytokens are classic deception technologies. Honeypots mimic real systems, and honeytokens are fake data objects.

Answer

Security Information and Event Management (SIEM)

Answer

Vulnerability scanner

Answer

Intrusion Prevention System (IPS)

Question 19

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

Accepted Answer

Pod Security Policies. Pod Security Policies (or Pod Security Admission) enforce security standards for pods, such as preventing privileged containers.

Answer

Secrets management

Answer

Network policies

Answer

RBAC

Question 20

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. Using a shared symmetric key means any service with the key can forge tokens, compromising authentication integrity.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set