CAS-004 Practice Exam 51 — 20 Questions

Question 1

Based on the exhibit, which security issue does this IAM policy represent?

Accepted Answer

Overly permissive resource access. The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.

Answer

No versioning configured

Answer

Missing server-side encryption

Answer

Insufficient logging and monitoring

Question 2

An organization is migrating to an immutable infrastructure model for its containerized applications. Which practice is essential to ensure the integrity of the immutable infrastructure?

Accepted Answer

Image scanning and signing in the CI/CD pipeline. Immutable infrastructure means that components are replaced rather than modified. Image scanning ensures that only secure, approved images are deployed, preventing tampered or vulnerable images from running.

Answer

Regular patching of running containers

Answer

Runtime security monitoring with seccomp

Answer

Use of configuration management tools like Ansible

Question 3

A security analyst is reviewing the firewall rules. Which of the following best describes the rule set's effect?

Accepted Answer

HTTP is allowed from any source. The rule set includes an explicit permit rule for HTTP traffic from any source, which overrides the default deny policy. Since the default input policy is set to DROP (or DENY), only traffic matching a permit rule is allowed; HTTP is explicitly permitted, making option A correct.

Answer

Default input policy is ACCEPT

Answer

ICMP is logged

Answer

SSH is allowed from any source

Question 4

A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)

Accepted Answer

Dropping all capabilities (CAP_DROP=ALL). Dropping all capabilities with `CAP_DROP=ALL` removes all Linux capabilities from the container, effectively preventing any process inside from performing privileged operations such as changing user IDs, mounting filesystems, or accessing kernel features that could lead to privilege escalation. This is a fundamental container security best practice, as capabilities are the primary mechanism for granting fine-grained privileges to container processes.

Answer

Enabling SELinux

Answer

Using host networking

Answer

Mounting /var/run/docker.sock

Question 5

An enterprise is adopting a DevOps model and wants to integrate security into the CI/CD pipeline. The security architect recommends adding automated security testing. Which phase of the pipeline should static application security testing (SAST) be introduced to minimize rework?

Accepted Answer

During the build phase after code commit. SAST scans source code or compiled binaries for vulnerabilities without executing the application. Introducing SAST during the build phase, immediately after code commit and before artifacts are packaged, allows developers to catch and fix security flaws early when remediation cost is lowest, aligning with the 'shift left' principle in DevOps.

Answer

During the production deployment phase

Answer

After the code is promoted to production

Answer

During runtime in the staging environment

Question 6

An organization is deploying hardware security modules (HSMs) to protect cryptographic keys used for digital signatures. Which attack vector is most effectively mitigated by using an HSM compared to storing keys in software?

Accepted Answer

Key extraction from memory dumps. HSMs are designed to store cryptographic keys in tamper-resistant hardware, preventing attackers from extracting keys via memory dumps. Unlike software-based storage, where keys reside in volatile or non-volatile memory and can be read through process memory inspection or cold boot attacks, HSMs ensure keys never leave the secure boundary in plaintext form.

Answer

Side-channel attacks on the host CPU

Answer

Man-in-the-middle attacks on cryptographic operations

Answer

Brute-force attacks on key strength

Question 7

A security engineer needs to implement a solution that will detect and block command-and-control (C2) traffic from malware on the internal network. The solution must be able to inspect encrypted traffic and operate at the network layer. Which of the following is the BEST choice?

Accepted Answer

Deploy a next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering.. A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

Answer

Implement a web application firewall (WAF) to filter outbound HTTP/HTTPS traffic.

Answer

Install a network-based intrusion detection/prevention system (IDS/IPS) with signature updates.

Answer

Use endpoint detection and response (EDR) agents on all workstations and servers.

Question 8

A large healthcare organization has implemented a zero-trust network architecture (ZTNA) to secure access to its electronic health record (EHR) system. The architecture uses a software-defined perimeter (SDP) where all users must authenticate and be authorized before accessing the EHR. The EHR system is hosted in a private cloud and communicates with a legacy billing system that cannot support modern authentication protocols. The billing system is accessed by a small number of finance employees via a dedicated VPN. Recently, an auditor discovered that a finance employee's credentials were compromised, and the attacker used the VPN to access the billing system and exfiltrate patient billing data. The security architect must prevent such lateral movement while maintaining access for legitimate users. Which of the following is the BEST course of action?

Accepted Answer

Implement a jump server with multi-factor authentication (MFA) and session recording, and restrict the VPN to only allow access to the jump server. A jump server with MFA and session recording creates a controlled, auditable choke point that prevents lateral movement from the VPN to the billing system. By restricting the VPN to only allow access to the jump server, the attacker cannot directly reach the billing system even with compromised VPN credentials, and MFA adds an additional layer of authentication. Session recording provides forensic evidence for post-incident analysis, addressing the auditor's concern without requiring the legacy billing system to support modern protocols.

Answer

Apply micro-segmentation to isolate the billing system and allow only finance VLAN traffic

Answer

Remove the VPN and allow finance employees to access the billing system directly via RDP over the internet

Answer

Upgrade the billing system to support OAuth 2.0 and integrate it with the ZTNA SDP

Question 9

A security engineer is writing a Python script to automate the revocation of compromised credentials across multiple cloud services. Which of the following is the most critical security consideration when implementing this script?

Accepted Answer

Use a secrets management service to store API keys.. Storing API keys in a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) prevents hardcoding credentials in the script, which is a critical security practice for automation. Even with least privilege, if the API key is exposed in plaintext (e.g., in source code or logs), an attacker can reuse it across services. Secrets management also enables rotation, auditing, and dynamic access control, directly addressing the risk of credential compromise in multi-cloud revocation scripts.

Answer

Ensure the script runs with the least privilege necessary.

Answer

Log all actions performed by the script.

Answer

Run the script from a hardened bastion host.

Question 10

Which of the following best describes the purpose of the STIX and TAXII standards in threat intelligence sharing?

Accepted Answer

They standardize the format and exchange of cyber threat intelligence. STIX (Structured Threat Information Expression) is a language for describing threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol for exchanging that intelligence. Together they enable automated sharing of threat data.

Answer

They are tools for analyzing malware behavior in a sandbox environment

Answer

They are used to automatically patch vulnerabilities based on threat feeds

Answer

They provide a framework for conducting incident response exercises

Question 11

A security architect is designing a Kubernetes cluster for a government agency that requires high security and compliance with FedRAMP. The cluster will host microservices processing sensitive data. Which TWO configurations are most critical for hardening the Kubernetes environment? (Choose TWO.)

Accepted Answer

Implementing Role-Based Access Control (RBAC). RBAC (Role-Based Access Control) restricts user and service account permissions, enforcing least privilege. Network policies control pod-to-pod communication, enabling micro-segmentation. Pod security policies (now replaced by Pod Security Standards) are important but less critical than RBAC and network policies. Image scanning and runtime security are important but are container security measures, not Kubernetes-specific hardening.

Answer

Deploying runtime security with seccomp and AppArmor

Answer

Enabling container image scanning

Answer

Using admission controllers like PodSecurityPolicy

Question 12

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

Accepted Answer

Exposure of sensitive credentials in the image layers. Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Answer

Use of untrusted base image

Answer

Privilege escalation via SUID binaries

Answer

Dependency confusion from unpinned packages

Question 13

An organization wants to implement a zero-trust architecture for remote access. Which of the following is the MOST important component?

Accepted Answer

Micro-segmentation. Micro-segmentation is the most important component for zero-trust remote access because it enforces granular, identity-based access controls that limit lateral movement within the network. Unlike perimeter-based models, zero-trust assumes no implicit trust, and micro-segmentation ensures that even after authentication, each remote session is isolated to only the specific resources required, reducing the attack surface.

Answer

RAID 5

Answer

Syslog server

Answer

VPN concentrator

Question 14

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

Accepted Answer

Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.. Tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.

Answer

Aggregate all logs from all sources and create a single correlation rule for each attack type.

Answer

Use the default correlation rules provided by the SIEM vendor without modification.

Answer

Block all traffic from external IP addresses that are not on the organization's whitelist.

Question 15

A SOC team is implementing a SOAR platform to automate responses to phishing emails. The team wants to create a playbook that, upon detection of a phishing email, automatically quarantines the email from all mailboxes and blocks the sender's domain. Which type of playbook action is being described?

Accepted Answer

Automated action. Automated response actions are executed by the SOAR platform without human intervention, such as quarantining and blocking.

Answer

Advisory action

Answer

Manual action

Answer

Semi-automated action

Question 16

An organization is implementing a risk management framework and wants to align with a standard that emphasizes a continuous, iterative process for identifying, assessing, and responding to risk. Which framework is most appropriate?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) describes a continuous process that includes steps like categorize, select, implement, assess, authorize, and monitor.

Answer

FAIR

Answer

ISO 27005

Answer

COBIT

Question 17

A vulnerability management team is prioritizing patches for a large number of vulnerabilities discovered in a quarterly scan. A critical vulnerability in a widely used application has a CVSS base score of 9.8, but it is not currently being exploited in the wild and the application is not directly exposed to the internet. According to CVSS scoring principles, which factors should the team consider to adjust the priority?

Accepted Answer

Environmental metrics such as collateral damage potential and target distribution. CVSS environmental metrics allow organizations to modify the base score based on the specific context, such as the asset's value and exposure. This helps prioritize vulnerabilities that pose the greatest risk to the organization.

Answer

The number of other vulnerabilities in the same software product

Answer

The age of the vulnerability since its disclosure

Answer

Temporal metrics including exploit code maturity and remediation level

Question 18

A security administrator needs to automate the process of revoking access for terminated employees across multiple cloud services. Which scripting approach would best minimize the risk of errors and ensure consistent execution?

Accepted Answer

Use a configuration management tool like Ansible with a playbook that calls cloud provider modules using encrypted vault files for credentials.. Ansible playbooks with encrypted vault files provide idempotent, repeatable automation across multiple cloud services without exposing credentials in plaintext. The use of dedicated cloud provider modules (e.g., aws_iam, gcp_iam) abstracts API complexities and ensures consistent revocation logic, minimizing human error compared to ad-hoc scripting.

Answer

Create a shell script that relies on environment variables containing API keys.

Answer

Write a Python script using separate API calls for each service with hardcoded credentials.

Answer

Manually execute commands each time an employee is terminated.

Question 19

A security architect is designing a segmentation strategy for a multi-tier web application. The public-facing web servers must communicate only with application servers, and application servers must communicate only with database servers. The architect wants to use a firewall that can inspect application-layer traffic to prevent SQL injection attacks. Which firewall type should be deployed between the application tier and the database tier?

Accepted Answer

Next-generation firewall (NGFW) with intrusion prevention. A next-generation firewall (NGFW) with intrusion prevention is the correct choice because it can perform deep packet inspection (DPI) at the application layer, allowing it to detect and block SQL injection payloads within database queries. Unlike simpler firewalls, an NGFW integrates signature-based and behavioral IPS engines that can identify malicious SQL patterns (e.g., 'OR 1=1') in traffic between the application and database tiers, providing the required application-layer inspection.

Answer

Packet filtering firewall

Answer

Stateful firewall

Answer

Web application firewall (WAF)

Question 20

A large enterprise recently migrated its critical applications to a hybrid cloud environment. The security team is concerned about the risk of privileged account abuse. They have implemented a privileged access management (PAM) solution that rotates passwords for service accounts after each use. However, during a incident response drill, the team discovers that an attacker who compromised a jump server was able to access multiple administrative consoles without re-authentication. Investigation reveals that the PAM solution uses session recording but does not enforce session termination; instead, it relies on the lifecycle of the token issued during initial authentication. The attacker captured a valid token and reused it from a different machine. Which of the following is the most effective remediation?

Accepted Answer

Implement token-binding by including the client's TLS certificate in the token. Token binding (RFC 8471) cryptographically ties the token to the client's TLS session, preventing an attacker from replaying a captured token from a different machine. Since the PAM solution does not enforce session termination, binding the token to the client's TLS certificate ensures that even if the token is stolen, it cannot be reused from any other endpoint, directly addressing the root cause of the token reuse attack.

Answer

Require multi-factor authentication at each console access

Answer

Shorten the token lifetime to 30 seconds

Answer

Deploy a host-based intrusion detection system on the jump server