CAS-004 Practice Exam 51 — 20 Questions

Question 1

A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Hardware Security Module (HSM) for key management. A Hardware Security Module (HSM) is a tamper-resistant physical device that generates, stores, and uses cryptographic keys within its protected boundary, never exposing the private key in plaintext. For a root CA — the trust anchor of the entire PKI — an HSM provides FIPS 140-2 Level 3 (or higher) assurance, key backup/recovery controls, and audit logging that no software-based or portable storage method can match. This is the industry-standard approach for high-assurance root CA key protection.

Answer

Store the key in an encrypted file on a secure server

Answer

Generate the key on a dedicated virtual machine

Answer

Keep the key on a smart card stored in a safe

Question 2

A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?

Accepted Answer

Direct Connect / ExpressRoute. Direct Connect (AWS) and ExpressRoute (Azure) provide dedicated private circuits from on-premises to the cloud provider, bypassing the public internet entirely. This delivers predictable low latency, higher bandwidth, and stronger security than internet-based options. It directly satisfies the 'private connectivity, bypassing the public internet' requirement.

Answer

Site-to-site VPN over the internet

Answer

Private link (e.g., AWS PrivateLink)

Answer

SD-WAN with internet breakout

Question 3

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption. In the shared responsibility model for cloud security, the customer is always responsible for the security of their data, including classification and encryption. This includes determining data sensitivity, applying appropriate encryption at rest and in transit, and managing encryption keys. The cloud provider is responsible for security of the cloud (physical, network, hypervisor), while the customer is responsible for security in the cloud.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 4

A security architect is designing a defense-in-depth strategy for a web application. Which combination of controls provides overlapping protection against SQL injection attacks?

Accepted Answer

Input validation and parameterized queries. Input validation and parameterized queries provide overlapping, defense-in-depth protection against SQL injection: input validation rejects malformed or malicious input at the application boundary, while parameterized queries ensure user input is treated as data, not executable SQL, even if validation is bypassed. Together they address the root cause of SQLi at multiple layers.

Answer

Encryption and hashing

Answer

Intrusion detection system (IDS) and antivirus

Answer

Web application firewall (WAF) and network segmentation

Question 5

An organization is implementing a hybrid cloud architecture and must ensure secure connectivity between its on-premises network and a public cloud VPC. The traffic includes sensitive data that must not traverse the internet. The solution must provide high bandwidth and low latency. Which connectivity option should the architect choose?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection between on-premises and AWS that does not traverse the internet, delivering high bandwidth and consistent low latency. It is the only option that satisfies both the 'must not traverse the internet' and 'high bandwidth, low latency' requirements.

Answer

Site-to-Site VPN over the internet

Answer

AWS Client VPN

Answer

Internet gateway with encryption

Question 6

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. SBOM and dependency analysis are specifically designed to inventory open-source components and their transitive dependencies, then cross-reference them against vulnerability databases like the NVD or OSV. This directly addresses the need to identify vulnerabilities in third-party libraries, which is a core part of software supply chain security. Unlike code analysis tools that focus on first-party code, SBOM-driven scanning targets the exact problem of open-source component risk.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 7

During a third-party risk assessment, a security architect discovers that a vendor's data retention policy does not align with the organization's legal requirements. Which of the following is the BEST course of action?

Accepted Answer

Request the vendor to update its retention policy to align with legal requirements.. The vendor's data retention policy must comply with the organization's legal requirements, such as GDPR or HIPAA, which mandate specific data lifecycle controls. Requesting the vendor to update its policy is the most direct and effective way to achieve compliance, as it addresses the root cause without prematurely terminating a business relationship or relying on compensating controls that may not fully satisfy regulatory obligations.

Answer

Accept the risk and document it in the risk register.

Answer

Immediately terminate the vendor contract.

Answer

Implement compensating controls to enforce data deletion after the required period.

Question 8

An organization is implementing network segmentation to limit lateral movement. It wants to isolate application tiers at the virtual network level in a cloud environment. Which technology enforces policies on east-west traffic between VMs in different subnets?

Accepted Answer

Micro-segmentation. Micro-segmentation enforces security policies at the virtual network level, isolating workloads (e.g., VMs in different subnets) and controlling east-west traffic between them. It typically uses distributed firewalls or security groups applied to individual workloads, allowing granular policy enforcement regardless of subnet boundaries. This directly limits lateral movement by ensuring that even if an attacker compromises one VM, they cannot freely communicate with others.

Answer

Transport Layer Security (TLS)

Answer

Virtual Private Network (VPN)

Answer

Secure Access Service Edge (SASE)

Question 9

A security architect is designing a secure connection between an on-premises data center and a cloud provider's virtual network. The connection must be private, low-latency, and not traverse the public internet. Which solution should they recommend?

Accepted Answer

Direct Connect / ExpressRoute. Direct Connect (AWS) and ExpressRoute (Azure) are dedicated private circuits from the on-premises data center to the cloud provider's network, providing low-latency, high-bandwidth connectivity that never traverses the public internet. This matches all three stated requirements: private, low-latency, and no public internet traversal.

Answer

Software-Defined WAN (SD-WAN)

Answer

Cloud Access Security Broker (CASB)

Answer

Site-to-site VPN over the internet

Question 10

A company uses a multi-cloud strategy with workloads in AWS and Azure. They need a centralized solution to enforce consistent security policies across both cloud environments. Which type of tool should they deploy?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM continuously monitors cloud configurations against security benchmarks and compliance frameworks across multiple providers, providing a centralized view and policy enforcement for misconfigurations, drift, and compliance violations in AWS and Azure. This directly addresses the need for consistent security policy enforcement across both clouds.

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Security Information and Event Management (SIEM)

Question 11

Which of the following is a core principle of the Zero Trust security model?

Accepted Answer

Never trust, always verify. The core principle of Zero Trust is 'never trust, always verify,' which means that no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Every access request must be authenticated, authorized, and encrypted before access is granted. This principle eliminates implicit trust based on network location.

Answer

Perimeter-based trust

Answer

Trust based on network location

Answer

Trust but verify

Question 12

A company is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run in the cluster. Which Kubernetes resource should be used to enforce policies on what containers can run, including image source restrictions?

Accepted Answer

Admission controllers. Admission controllers intercept requests to the Kubernetes API server before objects are persisted, and can validate or mutate them — including rejecting pods whose images come from unauthorized registries or lack required signatures. This is the correct enforcement point for cluster-wide policy on what containers may run.

Answer

Role-Based Access Control (RBAC)

Answer

Network policies

Answer

Seccomp profiles

Question 13

An organization is implementing a Secure Access Service Edge (SASE) architecture to support remote workers. Which key capability does SASE provide that traditional VPNs lack?

Accepted Answer

Identity-based access with zero trust principles. SASE converges networking and security functions into a cloud-delivered service, with zero trust network access (ZTNA) as a core pillar. Unlike traditional VPNs that grant broad network-level access after authentication, SASE enforces identity-based, context-aware access policies per application or resource. This aligns with zero trust principles: never trust, always verify, and least-privilege access.

Answer

Software-defined WAN (SD-WAN) functionality

Answer

Network-layer encryption using IPsec

Answer

Web content filtering and DLP

Question 14

A company is developing a new mobile app that will process users' biometric data for authentication. The legal team is concerned about compliance with the GDPR's data protection by design. Which of the following is the MOST appropriate control to implement?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) before development.. Conducting a Data Protection Impact Assessment (DPIA) before development is the most appropriate control because GDPR Article 35 mandates a DPIA when processing biometric data is likely to result in high risk to individuals' rights and freedoms. This aligns with the principle of data protection by design (Article 25), requiring privacy considerations to be embedded into the development process from the outset, not added later.

Answer

Obtain explicit consent from users before data collection.

Answer

Store biometric data in hashed form on the device.

Answer

Implement strong encryption for data in transit and at rest.

Question 15

A security architect is designing a zero trust architecture for a financial institution. Which principle is fundamental to the zero trust model?

Accepted Answer

Assume breach and verify explicitly. The fundamental principle of zero trust is 'assume breach and verify explicitly,' meaning no user or device is trusted by default, regardless of location. Every access request must be authenticated and authorized based on multiple factors, and least privilege is enforced. This principle is core to zero trust architecture as defined by NIST SP 800-207.

Answer

Trust but verify all network traffic

Answer

Use VPNs for all remote access

Answer

Perimeter-based security is sufficient

Question 16

A system administrator is configuring a Linux server to host a web application. Which file permission should be set for the private SSL key?

Accepted Answer

600. The private SSL key must be protected from unauthorized access because it is used to decrypt traffic and establish trust. Setting permissions to 600 (owner read/write only) ensures that only the root or the application user who owns the key can read it, preventing other users or processes from extracting the key material.

Answer

644

Answer

444

Answer

755

Question 17

A company is deploying a RESTful API that handles sensitive financial data. Which of the following should be implemented to ensure data integrity during transmission?

Accepted Answer

TLS 1.3. TLS 1.3 ensures data integrity during transmission by providing transport-layer encryption with authenticated encryption (AEAD), which guarantees that any tampering with the ciphertext will be detected upon decryption. For a RESTful API handling sensitive financial data, TLS 1.3 is the correct choice because it protects the entire HTTP payload in transit, preventing man-in-the-middle attacks from modifying or replaying data.

Answer

Input validation

Answer

JSON Web Token (JWT) authentication

Answer

API rate limiting

Question 18

A software development team is adopting a DevSecOps approach. Which of the following practices best integrates security into the continuous integration pipeline?

Accepted Answer

Running static application security testing (SAST) on every code commit. Running static application security testing (SAST) on every code commit integrates security directly into the continuous integration (CI) pipeline by automatically analyzing source code for vulnerabilities (e.g., SQL injection, buffer overflows) before the build is compiled. This shift-left approach ensures that security checks are performed as early as possible, aligning with DevSecOps principles of continuous security validation without manual intervention.

Answer

Conducting annual security training for developers

Answer

Using a vulnerability scanner on production servers

Answer

Performing penetration testing after each release

Question 19

An organization needs to ensure compliance with GDPR regarding data subject access requests. What is the MOST important control to implement?

Accepted Answer

Implement a process to respond to access requests within one month. GDPR Article 12(3) requires organizations to respond to data subject access requests without undue delay and at the latest within one month. The most important control is a documented process that ensures timely identification, validation, and fulfillment of these requests, as failure to meet the deadline constitutes a direct compliance violation. Without this process, technical controls like encryption alone cannot satisfy the regulatory requirement for a verifiable response.

Answer

Encrypt all personal data at rest and in transit

Answer

Minimize the collection of personal data

Answer

Appoint a Data Protection Officer (DPO)

Question 20

A security administrator is configuring SSH for a jump host used to access critical servers. Which of the following is the most secure configuration option to restrict authentication and reduce the attack surface?

Accepted Answer

Allow only key-based authentication. Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

Answer

Enable root login with a strong password

Answer

Allow only SSH protocol version 2

Answer

Change the default port to 2222