CAS-004 Practice Exam 52 — 20 Questions

Question 1

A company is adopting a secure software development lifecycle (SDLC). Which two practices are most effective for identifying vulnerabilities early in the development process? (Select TWO.)

Accepted Answer

Regular code reviews with security focus. Option C (regular code reviews with security focus) is correct because peer review of source code during development catches insecure patterns, logic flaws, and missing input validation before code is merged, making it an early-phase practice in a secure SDLC. Option D (SAST integrated into the IDE) is correct because static analysis examines source code without executing it and, when embedded in the developer's IDE, flags vulnerabilities such as injection flaws or hardcoded secrets at the moment of coding, which is the earliest practical detection point. Option A (RASP) is not correct here because RASP instruments a running application to detect and block attacks at runtime, which is a production protection mechanism rather than an early development-phase identification practice. Option B (DAST) is not correct because it tests a deployed, running application from the outside, so it occurs later in the lifecycle and cannot inspect source code early. Option E (penetration testing after deployment) is not correct because it is a post-deployment, point-in-time assessment that identifies vulnerabilities only after the code is already in production.

Answer

Runtime application self-protection (RASP)

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing after deployment

Question 2

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

Accepted Answer

Implement short-lived access tokens with refresh tokens that are automatically rotated. Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Answer

Extend the session token expiration time to reduce the frequency of re-authentication

Answer

Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture

Answer

Reduce the number of authentication factors required for re-authentication

Question 3

A security analyst is reviewing a third-party assessment report and notes that the vendor's encryption algorithms are outdated. The contract requires the vendor to follow industry best practices. Which of the following is the BEST response?

Accepted Answer

Request the vendor to upgrade encryption algorithms to current standards.. The contract requires the vendor to follow industry best practices, and outdated encryption algorithms (e.g., DES, RC4, or 3DES) are no longer considered secure or compliant with standards like NIST SP 800-131A or PCI DSS. The best response is to formally request the vendor to upgrade to current, approved algorithms such as AES-256 or ChaCha20, as this directly addresses the non-compliance with the contractual requirement. This action aligns with the governance and risk management process of enforcing contractual security obligations.

Answer

Conduct a penetration test on the vendor's system.

Answer

Terminate the contract immediately.

Answer

Accept the risk because the vendor is technically compliant with the contract.

Question 4

You are the compliance officer for a financial institution that must adhere to the Payment Card Industry Data Security Standard (PCI DSS). During a quarterly vulnerability scan, you discover that several critical vulnerabilities in the cardholder data environment (CDE) were not remediated within the required 30-day window. Additionally, the most recent penetration test report shows that a segmentation control between the CDE and the corporate network is not functioning as intended. The next PCI DSS assessment is in two months. Which of the following remediation actions should be prioritized FIRST to maintain compliance?

Accepted Answer

Re-establish correct segmentation between CDE and corporate network. The segmentation control failure is the most critical issue because it directly undermines the scope of the PCI DSS assessment. If the CDE is not properly isolated from the corporate network, the entire corporate network could be considered in-scope for PCI DSS, drastically increasing compliance requirements. Re-establishing correct segmentation first restores the intended security boundary and reduces the risk of a non-compliant assessment in two months.

Answer

Implement a compensating control for the segmentation failure and document it

Answer

Immediately patch all critical vulnerabilities in the CDE

Answer

Request an extension from the acquirer for the next assessment

Question 5

A healthcare organization is implementing HIPAA Security Rule safeguards. Which TWO of the following are required administrative safeguards? (Choose TWO.)

Accepted Answer

Security management process.. Option A, Security management process, is correct because 45 CFR 164.308(a)(1) requires it as an administrative safeguard: covered entities must conduct a risk analysis, implement risk management, have a sanction policy, and review information system activity. Option D, Assigned security responsibility, is correct because 45 CFR 164.308(a)(2) requires the covered entity to designate a security official responsible for developing and implementing the security policies and procedures. Option B, Encryption of ePHI at rest, is not a required administrative safeguard; under 45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii) encryption is an addressable implementation specification under Technical Safeguards. Option C, Unique user identification, is a Technical Safeguard under 45 CFR 164.312(a)(2)(i), not an administrative safeguard. Option E, Facility access controls, is a Physical Safeguard under 45 CFR 164.310(a)(1), not an administrative safeguard.

Answer

Encryption of ePHI at rest.

Answer

Unique user identification.

Answer

Facility access controls.

Question 6

An organization uses AWS, Azure, and GCP for different workloads. They want a single tool to manage infrastructure consistently across all providers. Which approach is most appropriate?

Accepted Answer

Use Terraform with provider plugins. Terraform is an infrastructure-as-code tool that uses provider plugins to interact with the APIs of AWS, Azure, GCP, and hundreds of other services. This allows a single declarative configuration language (HCL) to manage resources consistently across all three cloud providers, making it the most appropriate choice for multi-cloud infrastructure management.

Answer

Use Azure Resource Manager templates

Answer

Write provider-specific scripts in PowerShell

Answer

Use AWS CloudFormation

Question 7

A security architect is implementing a zero trust model for a financial services company. The goal is to prevent lateral movement in the data center. Which approach best achieves this objective?

Accepted Answer

Deploying micro-segmentation to isolate workloads and enforce granular policies. Micro-segmentation isolates workloads and enforces granular, identity- and label-based policies on east-west traffic, which directly prevents lateral movement inside the data center. In a zero trust model, micro-segmentation operationalizes the 'never trust, always verify' principle at the workload level, so a compromised host cannot freely reach other workloads. This is the most direct and effective control for the stated objective of stopping lateral movement.

Answer

Using a software-defined perimeter to hide network resources

Answer

Implementing identity-centric access controls across all resources

Answer

Applying defense-in-depth layering by adding multiple security controls

Question 8

A SOC team is implementing a SOAR platform to automate responses to phishing emails. The team wants to create a playbook that, upon detection of a phishing email, automatically quarantines the email from all mailboxes and blocks the sender's domain. Which type of playbook action is being described?

Accepted Answer

Automated action. Automated response actions are executed by the SOAR platform without human intervention, such as quarantining and blocking.

Answer

Advisory action

Answer

Manual action

Answer

Semi-automated action

Question 9

Which THREE of the following are required for PCI DSS compliance regarding cardholder data?

Accepted Answer

Maintain a vulnerability management program.. PCI DSS Requirement 5 mandates that entities must maintain a vulnerability management program that includes deploying anti-malware software on all systems commonly affected by malicious software, as well as performing regular vulnerability scans and applying security patches. This requirement ensures that cardholder data environments are protected against known vulnerabilities that could be exploited by attackers.

Answer

Store cardholder data after authorization.

Answer

Implement multifactor authentication for all physical access to data centers.

Question 10

A company is developing a secure software development lifecycle (SDLC) and wants to integrate security testing early. Which THREE techniques should be used to find vulnerabilities in code during development? (Choose three.)

Accepted Answer

Threat modeling. Threat modeling (C) is correct because it is a design-phase activity that systematically identifies threats, attack surfaces, and mitigations before code is written, making it a foundational shift-left technique. SAST (E) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find flaws such as injection sinks and insecure coding patterns directly in the IDE or CI pipeline. DAST (D) is correct because it tests the running application from the outside, exercising inputs and runtime behavior to uncover vulnerabilities like authentication and configuration flaws that static analysis may miss. Penetration testing (A) is not one of the three because it is typically a later, point-in-time adversarial assessment rather than an early development-phase code-testing technique, and SBOM analysis (B) is a supply-chain inventory and component-transparency practice, not a method for finding vulnerabilities in first-party code during development.

Answer

Penetration testing

Answer

Software Bill of Materials (SBOM) analysis

Question 11

An organization discovers that a third-party vendor has a subcontractor that processes its data. The organization did not have a contract with the subcontractor. This is an example of which type of risk?

Accepted Answer

Fourth-party risk. Fourth-party risk refers to the risk introduced by a vendor's subcontractors or sub-processors — parties with whom the organization has no direct contractual relationship. Since the organization has no contract with the subcontractor, this is a classic fourth-party risk scenario.

Answer

Residual risk

Answer

Third-party risk

Answer

Supply chain risk

Question 12

A company is deploying IoT sensors in a harsh environment. The sensors have limited processing power and memory. Which of the following cryptographic algorithms is most suitable for ensuring data confidentiality with minimal overhead?

Accepted Answer

ChaCha20-Poly1305. ChaCha20-Poly1305 is a stream cipher that is fast in software, especially on devices without AES hardware acceleration, and provides authenticated encryption with low overhead.

Answer

RSA-4096

Answer

SHA-256

Answer

AES-256-GCM

Question 13

A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?

Accepted Answer

The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.. A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.

Answer

The container image is from a public registry and should use a private one.

Answer

The container runs as non-root, but root access is required for certain operations.

Answer

The container allows privilege escalation, which should be disabled.

Question 14

During an incident response, the team must perform containment actions. Which TWO actions are considered proper containment? (Select exactly 2.)

Accepted Answer

Isolate affected systems from the network. Option A (Isolate affected systems from the network) is correct because network isolation is a classic containment technique that stops the spread of malware or an intruder's lateral movement while preserving the system state for later forensic analysis. Option C (Disable compromised user accounts) is correct because disabling or locking the compromised accounts cuts off the attacker's authenticated access path, preventing further unauthorized activity during containment. Option B (Notify law enforcement) is not containment; it is an external communication/coordination step that typically occurs during or after containment, not a technical control. Option D (Back up the affected systems) is not containment; it is evidence preservation or recovery preparation, and backing up a compromised system without isolation can propagate malware. Option E (Patch all vulnerabilities on affected systems) is not containment; patching is a remediation/eradication activity performed after the threat is contained, and applying patches to a live compromised host can destroy forensic evidence.

Answer

Notify law enforcement

Answer

Back up the affected systems

Answer

Patch all vulnerabilities on affected systems

Question 15

An organization is setting up a PKI with a three-tier hierarchy (root CA, issuing CA, and registration authority). Which TWO of the following are best practices for securing the root CA?

Accepted Answer

Keep the root CA offline and physically secured. Option D is correct because the root CA should be kept offline and physically secured so its private key is never exposed to network-based attacks; it is only brought online for rare operations such as signing the issuing CA's certificate. Option E is correct because storing the root CA private key in a hardware security module (HSM) protects it with tamper-resistant hardware, enforces key non-exportability, and supports secure cryptographic operations. Option A is wrong because exposing the root CA to the network for certificate requests increases its attack surface and violates the offline-root best practice. Option B is wrong because CRL distribution points belong on the issuing CA (and end-entity certificates), not on the offline root CA. Option C is wrong because end-entity certificates should be issued by the issuing CA, not directly by the root CA, to preserve the hierarchy and limit root key exposure.

Answer

Allow the root CA to be accessible over the network for certificate requests

Answer

Enable CRL distribution points on the root CA

Answer

Use the root CA to issue end-entity certificates directly

Question 16

A company is merging with another company that has a different security posture. The CISO wants to integrate the two security programs quickly. Which of the following is the MOST critical first step?

Accepted Answer

Establish a joint governance committee. Establishing a joint governance committee is the most critical first step because it creates the decision-making authority and accountability structure needed to integrate two distinct security programs. Without a unified governance body, efforts to align policies, select tools, or assess risk lack coordination, ownership, and executive sponsorship. This committee ensures that subsequent activities—such as policy harmonization and risk assessment—are prioritized, resourced, and executed consistently across both organizations. In M&A integration, governance is the foundation that enables all other security integration tasks.

Answer

Align security policies and standards

Answer

Implement the same security tools across the enterprise

Answer

Conduct a joint risk assessment

Question 17

Which of the following is the MOST effective way to detect unauthorized changes to critical files?

Accepted Answer

File integrity monitoring. File integrity monitoring (FIM) is the most effective method for detecting unauthorized changes to critical files because it uses cryptographic hashing (e.g., SHA-256) to create a baseline of file states and then periodically re-computes hashes to identify any alterations. Unlike other security controls, FIM specifically focuses on the integrity of file content, metadata, and permissions, providing immediate alerts when a deviation from the baseline occurs.

Answer

Antivirus software

Answer

Intrusion detection system

Answer

Regular backups

Question 18

During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?

Accepted Answer

Perform a memory capture using a tool like DumpIt or winpmem. Memory capture is the correct first step because running processes, active network connections, and encryption keys exist only in volatile memory (RAM) and are lost on shutdown or reboot. Tools like DumpIt or winpmem preserve this state, including the process-to-connection mapping needed to identify which process initiated the encrypted channels. The order of volatility in digital forensics dictates that RAM be collected before disk or logs, since it is the most transient evidence.

Answer

Export the Windows event logs related to network activity

Answer

Execute a network scan from the compromised host to identify active connections

Answer

Capture a full disk image using FTK Imager

Question 19

A security architect is designing a network segmentation strategy for a multi-tier web application. The web servers must be accessible from the internet, while the application and database servers must only be accessible from the web tier. Which architecture best meets these requirements?

Accepted Answer

Deploy web servers in a DMZ, application servers in an internal network, and database servers in a separate restricted network with firewall rules allowing only necessary traffic.. It implements a classic three-tier DMZ architecture: web servers in a DMZ (publicly accessible), application servers in an internal network (accessible only from the DMZ), and database servers in a restricted backend network (accessible only from the application tier). This layered segmentation enforces the principle of least privilege and uses firewall rules to control traffic between each tier, ensuring that internet-facing components cannot directly reach sensitive data stores.

Answer

Use a single VLAN with access control lists to restrict traffic between servers.

Answer

Place all servers in the same subnet and use host-based firewalls for isolation.

Answer

Use a VPN concentrator for all external access and place all servers in a private subnet.

Question 20

A company is implementing a new cloud-based SaaS application and needs to ensure compliance with GDPR. The security team is tasked with updating the data protection impact assessment (DPIA). Which of the following should the team prioritize?

Accepted Answer

Assessing the types of personal data processed and the risks to data subjects. Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing personal data that is likely to result in high risk to individuals. The core requirement is to systematically assess the types of personal data being processed, the necessity and proportionality of the processing, and the risks to data subjects' rights and freedoms. This directly aligns with option A, as the DPIA must identify and mitigate privacy risks before the SaaS application goes live.

Answer

Defining data retention schedules for all data types

Answer

Conducting a vulnerability scan of the SaaS application

Answer

Reviewing the cloud provider's SLA for uptime guarantees