CAS-004 Practice Questions 2 — 50 Questions

Question 1

A DevOps team is implementing a CI/CD pipeline for a Java application. They want to ensure that all dependencies are scanned for known vulnerabilities before deployment. Which type of tool should they integrate into the pipeline?

Accepted Answer

Software Composition Analysis (SCA). Software Composition Analysis (SCA) is the correct tool because it specifically analyzes open-source and third-party libraries (dependencies) for known vulnerabilities by cross-referencing them against databases like the National Vulnerability Database (NVD). In a CI/CD pipeline for a Java application, SCA tools (e.g., OWASP Dependency-Check, Snyk) scan build artifacts such as pom.xml or build.gradle to identify vulnerable components before deployment.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 2

During a security review, you find that a web application uses a Content Security Policy (CSP) header with the value: 'default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com;'. Which attack is the application still vulnerable to?

Accepted Answer

Cross-site scripting (XSS) via inline script injection. Option B is correct because the CSP includes 'unsafe-inline' in the script-src directive, which explicitly allows inline scripts. This bypasses the primary protection CSP offers against XSS, as an attacker can inject malicious JavaScript directly into the HTML (e.g., via a <script> tag or event handler) without violating the policy. The 'self' source only restricts external scripts to the same origin, but inline scripts remain permitted, leaving the application vulnerable to stored, reflected, or DOM-based XSS attacks.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Man-in-the-middle (MITM) attack due to CDN inclusion

Question 3

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Accepted Answer

Use try-except blocks to handle exceptions gracefully. Option A is correct because using try-except blocks in Python allows the script to catch and handle exceptions (e.g., missing environment variables, API call failures) gracefully without crashing. This is a fundamental secure coding practice that prevents unhandled errors from exposing sensitive information or causing unpredictable behavior in automated compliance checks.

Answer

Use os.system() to run shell commands for resource management

Answer

Hardcode API tokens as fallback if environment variables are missing

Answer

Log the API tokens for troubleshooting purposes

Question 4

Which of the following best describes the primary security benefit of using immutable infrastructure in a containerized environment?

Accepted Answer

It prevents unauthorized modifications to running containers.. Immutable infrastructure ensures that once a container image is built and deployed, it is never modified in place. If a change is needed, a new image is built and deployed, replacing the old container entirely. This prevents unauthorized or unplanned modifications to running containers, which is the primary security benefit because it eliminates configuration drift and reduces the attack surface from runtime tampering.

Answer

It reduces resource consumption by reusing containers.

Answer

It automates patching of container images.

Answer

It eliminates the need for container security scanning.

Question 5

Which TWO of the following are key elements of a data classification policy?

Accepted Answer

Handling and labeling procedures. Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Answer

Acceptable use guidelines for company devices

Answer

Backup frequency and retention periods

Answer

Encryption algorithms and key lengths

Question 6

A security analyst is reviewing a web application's authentication mechanism. Which of the following are best practices to prevent session hijacking? (Select TWO.)

Accepted Answer

Regenerate session ID upon successful login. Regenerating the session ID upon successful login (option A) is a critical defense against session fixation attacks, where an attacker forces a known session ID on a user before authentication. By issuing a new, server-generated session ID after login, the application ensures that any pre-authentication session ID controlled by an attacker becomes invalid. This practice is recommended by OWASP and aligns with RFC 6265 session management guidelines.

Answer

Set the session timeout to 5 minutes

Answer

Use the same session ID before and after authentication

Answer

Store session tokens in localStorage

Question 7

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

Accepted Answer

Use parameterized queries or input sanitization for any user-supplied data. Option B is correct because input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.

Answer

Hardcode API keys into the script for simplicity

Answer

Run the script with root privileges to ensure it has access to all images

Answer

Store credentials in a world-readable configuration file

Question 8

A security analyst is reviewing the results of a vulnerability scan and identifies a critical vulnerability in a legacy application that cannot be patched because it is no longer supported by the vendor. The application is critical for business operations. Which of the following risk treatment strategies should the organization implement?

Accepted Answer

Risk acceptance with compensating controls such as network segmentation and strict access controls.. Option D is correct because when a legacy application cannot be patched due to vendor end-of-life, the organization must accept the residual risk while implementing compensating controls. Network segmentation (e.g., VLANs, ACLs) and strict access controls (e.g., least privilege, MFA) reduce the attack surface and contain potential exploitation, aligning with the risk acceptance strategy under the NIST SP 800-37 risk management framework.

Answer

Risk transfer by purchasing cyber insurance to cover potential losses.

Answer

Risk mitigation by applying a vendor-supplied patch.

Answer

Risk avoidance by decommissioning the application and migrating to a new system.

Question 9

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Accepted Answer

Reset the service account password and revoke any active tokens.. Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Answer

Check the workstation logs for signs of malware.

Answer

Notify law enforcement and the organization's legal department.

Answer

Restore the affected files from a known good backup.

Question 10

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 11

A security architect is designing a web application that handles sensitive user data. To protect against cross-site scripting (XSS) attacks, which of the following should be implemented?

Accepted Answer

Implement input validation and output encoding. Input validation and output encoding are the primary defenses against XSS because they prevent malicious scripts from being interpreted by the browser. Input validation rejects or sanitizes dangerous characters (e.g., <, >, &) at the point of entry, while output encoding (e.g., HTML entity encoding) ensures that any user-supplied data rendered in the page is treated as text, not executable code. This directly addresses the root cause of XSS—untrusted data being injected into the DOM.

Answer

Implement Content Security Policy (CSP)

Answer

Use HTTPS for all communications

Answer

Deploy a Web Application Firewall (WAF)

Question 12

Which of the following is the BEST practice for securely storing secrets (e.g., database passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service with encryption and access policies. Option C is correct because cloud-native applications should rely on a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) that encrypts secrets at rest and in transit, enforces fine-grained access policies via IAM, and supports automatic rotation. This approach decouples secrets from code and infrastructure, eliminating the risks of exposure through version control, logs, or misconfigured permissions.

Answer

Embed the secrets in the application's source code

Answer

Store them in environment variables

Answer

Store them in a configuration file with restricted file permissions

Question 13

A security architect is evaluating a web application that uses JSON Web Tokens (JWTs) for authentication. The application uses an RSA256 asymmetric signing algorithm. The architect discovers that the JWT library accepts tokens with the algorithm set to 'none' if the public key is not provided during verification. Which of the following attacks is most likely to succeed if the application does not enforce algorithm validation?

Accepted Answer

Signature exclusion attack using the 'none' algorithm. Option B is correct because the JWT library accepts tokens with the algorithm set to 'none' when the public key is not provided during verification. This allows an attacker to forge a JWT with the 'none' algorithm, bypassing signature verification entirely. The attack succeeds because the application fails to enforce a whitelist of allowed algorithms, as recommended by RFC 7518.

Answer

Algorithm confusion (key confusion) attack where the attacker uses the public key as an HMAC secret

Answer

Timing attack to brute-force the private key

Answer

Header injection attack to modify the JWT header

Question 14

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

Accepted Answer

Apply network policies to isolate workloads.. Network policies in Kubernetes act as a firewall for pods, controlling ingress and egress traffic at the IP address or port level (OSI layer 3 or 4). By default, all pods can communicate with each other; applying network policies enforces least-privilege segmentation, which is a core security best practice for container orchestration platforms.

Answer

Use privileged containers for system services.

Answer

Disable all security contexts to avoid restrictions.

Question 15

An organization is implementing a DevSecOps pipeline. Which of the following are essential security controls to include? (Select TWO.)

Accepted Answer

Implement SAST in the build phase. SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

Answer

Conduct annual penetration testing

Answer

Use network segmentation for production

Answer

Disable security scanning to speed up deployments

Question 16

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Accepted Answer

Run the container with a non-root user and drop all capabilities. Option B is correct because running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 17

A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)

Accepted Answer

Conducting static application security testing (SAST) during coding. Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.

Answer

Performing penetration testing only after production deployment

Answer

Implementing runtime application self-protection (RASP) in development

Answer

Deploying a web application firewall (WAF) in staging

Question 18

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

Accepted Answer

Organizational policy violation. Option D is correct because the employee's action directly violates the company's internal security policy requiring VPN for all remote access. This is a policy violation, not a legal or regulatory one, as the company has established a mandatory rule that the employee failed to follow. The use of a personal device without VPN to access company email is a clear breach of organizational policy, which is a governance issue within the company's risk management framework.

Answer

Legal violation

Answer

Standards violation

Answer

Regulatory compliance violation

Question 19

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Accepted Answer

Permitted and required uses of PHI. A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

Answer

Indemnification clause for breaches

Answer

Requirement to store data in the United States

Question 20

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

Accepted Answer

The policy violates the principle of least privilege. Option C is correct because the IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Answer

The policy restricts access to specific resources

Answer

The policy does not enable logging

Answer

The policy does not allow any actions