CAS-004 Practice Exam 52 — 20 Questions

Question 1

Based on the exhibit, what type of attack is most likely occurring?

Accepted Answer

Brute-force attack. The exhibit shows multiple failed SSH login attempts from various IP addresses with different usernames, which is characteristic of a brute-force attack. Option D is correct. Option A (MITM) is incorrect because there is no evidence of intercepted communication. Option B (phishing) is incorrect as it involves social engineering, not direct authentication attempts. Option C (DDoS) is incorrect because the traffic is aimed at authentication, not overwhelming the network.

Answer

Man-in-the-middle (MITM) attack

Answer

Phishing attack

Answer

Distributed denial-of-service (DDoS) attack

Question 2

Which TWO of the following are best practices for securing a database server?

Accepted Answer

Disable default accounts. Disabling default accounts (e.g., 'sa' in SQL Server, 'root' in MySQL) is a critical hardening step because these accounts have well-known SIDs/names and are often targeted by automated attacks. Attackers can exploit default credentials to gain administrative access, so removing or renaming them reduces the attack surface.

Answer

Install sample databases for testing

Answer

Enable remote access from any IP

Answer

Use simple passwords for ease of administration

Question 3

An organization is implementing a zero trust architecture and needs to enforce identity-centric access for all resources. Which THREE components are essential to this approach?

Accepted Answer

User and entity behavior analytics (UEBA). Zero trust requires strong identity verification (MFA), dynamic policy enforcement (PEP), and continuous monitoring (UEBA).

Answer

Network segmentation

Answer

Virtual private network (VPN)

Question 4

A small business is designing a defense-in-depth strategy for its e-commerce website. The web server is hosted in a cloud provider and handles credit card transactions. Which of the following additional controls best complements the existing firewall and IDS?

Accepted Answer

Implement a web application firewall (WAF). A web application firewall (WAF) is the correct complement because it specifically protects against application-layer attacks (e.g., SQL injection, cross-site scripting) that a network firewall and IDS cannot block. Since the e-commerce site handles credit card transactions, a WAF is critical for PCI DSS compliance and to filter malicious HTTP/HTTPS traffic targeting the web application logic.

Answer

Set up a security information and event management (SIEM) system

Answer

Add a load balancer with SSL termination

Answer

Deploy a network-based antivirus on the web server

Question 5

Drag and drop the steps to implement a DLP policy to prevent credit card data exfiltration via email into the correct order.

Accepted Answer

1. Classify data, 2. Create policy, 3. Define match condition, 4. Set action, 5. Enable and test. DLP implementation: classify data, create policy, define match condition, set action, then enable and test.

Answer

1. Create policy, 2. Classify data, 3. Define match condition, 4. Set action, 5. Enable and test

Answer

1. Define match condition, 2. Classify data, 3. Create policy, 4. Set action, 5. Enable and test

Answer

1. Classify data, 2. Create policy, 3. Enable and test, 4. Define match condition, 5. Set action

Question 6

An analyst is examining a memory dump with Volatility and finds a suspicious process that has no parent process (parent PID 0). Which technique is the malware likely using to hide?

Accepted Answer

Process hollowing. Process hollowing replaces the memory of a legitimate process with malicious code. The parent PID 0 indicates that the process was spawned by the kernel, which can occur after hollowing.

Answer

Rootkit

Answer

DLL injection

Answer

WMI persistence

Question 7

The exhibit shows results from a CIS Controls assessment. Based on the findings, which control deficiency poses the greatest risk to the organization and should be prioritized for remediation?

Accepted Answer

Network monitoring and defense (Control 13) because it has the lowest overall score and intrusion detection is missing. The network monitoring and defense control (Control 13) has the lowest overall score (1/5), and within it, intrusion detection is completely unimplemented (0/5), leaving the organization blind to active attacks. Option A is wrong because incident response (Control 8) has a score of 3/5, which is higher, and testing at 1/5 is a partial implementation; while testing is low, the overall risk is lower than network monitoring. Option C is wrong because data protection (Control 3) has a score of 2/5 with some subcontrols partially implemented; the missing sensitive data inventory is concerning but not as critical as the lack of network monitoring. Option D is wrong because data encryption at rest (Subcontrol 3.2) has a score of 4/5, indicating it's already highly implemented and not a priority.

Answer

Incident response (Control 8) because testing is only at 1/5

Answer

Data protection (Control 3) because sensitive data inventory is not implemented

Answer

Data encryption at rest (Subcontrol 3.2) because it received a score of 4/5, indicating room for improvement

Question 8

A vulnerability management team is prioritizing patches for a set of critical vulnerabilities. Vulnerability A has a CVSS base score of 9.8, vulnerability B has a CVSS base score of 7.5, and vulnerability C has a CVSS base score of 8.2. However, vulnerability B is actively being exploited in the wild, while the others are not. Which vulnerability should be patched first according to best practices?

Accepted Answer

Vulnerability B because it is actively exploited. While CVSS base score is important, temporal factors like active exploitation increase risk. Vulnerability B, despite a lower base score, is being exploited and thus poses a more immediate threat. Patching should prioritize actively exploited vulnerabilities.

Answer

All three should be patched simultaneously

Answer

Vulnerability C because it has a higher base score than B

Answer

Vulnerability A because it has the highest base score

Question 9

A security manager is reviewing business continuity plans. Which element is MOST critical to test regularly?

Accepted Answer

Failover capability of critical systems. The most critical element to test regularly is the failover capability of critical systems, as it directly validates that business-critical operations can continue during a disruption. This testing ensures that the entire failover process works, including system redundancy, network paths, and data synchronization. While updated contact lists (A) are important for communication, they do not test operational continuity. Alternate site readiness (C) is a component of failover testing, but testing the full failover capability is more comprehensive. Backup media integrity (D) is essential for data recovery but does not validate the entire system recovery process.

Answer

Updated contact lists

Answer

Alternate site readiness

Answer

Backup media integrity

Question 10

A regional healthcare provider with 2,000 employees recently acquired a smaller clinic that uses a legacy electronic health record (EHR) system. The provider's security team performed a risk assessment and identified that the legacy system does not support encryption at rest, lacks role-based access controls (RBAC), and stores administrative credentials in plaintext. The system is scheduled to be decommissioned in 18 months, but it must remain operational to support patient care during the transition. The provider is subject to HIPAA and state breach notification laws. The CEO wants to avoid any disruption to patient services but also minimize regulatory risk. Which of the following is the BEST course of action?

Accepted Answer

Implement compensating controls such as network segmentation, storage-level encryption, and strict access monitoring.. The best course of action because it allows the legacy EHR system to remain operational for patient care while reducing regulatory risk. Compensating controls like network segmentation isolate the vulnerable system, storage-level encryption (e.g., BitLocker or LUKS) protects data at rest, and strict access monitoring (e.g., SIEM with real-time alerts) mitigates the lack of RBAC and plaintext credentials. This approach balances the CEO's requirement for no disruption with HIPAA's security rule requirements for reasonable safeguards.

Answer

Accelerate the migration timeline to replace the legacy system within 6 months.

Answer

Immediately disconnect the legacy system from the network and use manual processes.

Answer

Accept the residual risk and document it in the risk register.

Question 11

During an incident response exercise, a company discovers that sensitive data was exfiltrated. The CIRT needs to determine the root cause and prevent recurrence. Which THREE of the following steps are part of the lessons learned process? (Choose THREE.)

Accepted Answer

Identify gaps in security controls and recommend improvements.. Identifying gaps in security controls and recommending improvements is a core component of the lessons learned phase. This step ensures that the root cause of the exfiltration is addressed by analyzing which controls failed (e.g., missing DLP rules, inadequate network segmentation) and proposing concrete enhancements to prevent recurrence.

Answer

Conduct a full forensic analysis of affected systems.

Answer

Disable the compromised accounts immediately.

Question 12

Which of the following is the MOST effective way to detect unauthorized changes to critical files?

Accepted Answer

File integrity monitoring. File integrity monitoring (FIM) is the most effective method for detecting unauthorized changes to critical files because it uses cryptographic hashing (e.g., SHA-256) to create a baseline of file states and then periodically re-computes hashes to identify any alterations. Unlike other security controls, FIM specifically focuses on the integrity of file content, metadata, and permissions, providing immediate alerts when a deviation from the baseline occurs.

Answer

Antivirus software

Answer

Intrusion detection system

Answer

Regular backups

Question 13

A DevOps team is implementing a CI/CD pipeline for a Java application. They want to ensure that all dependencies are scanned for known vulnerabilities before deployment. Which type of tool should they integrate into the pipeline?

Accepted Answer

Software Composition Analysis (SCA). Software Composition Analysis (SCA) is the correct tool because it specifically analyzes open-source and third-party libraries (dependencies) for known vulnerabilities by cross-referencing them against databases like the National Vulnerability Database (NVD). In a CI/CD pipeline for a Java application, SCA tools (e.g., OWASP Dependency-Check, Snyk) scan build artifacts such as pom.xml or build.gradle to identify vulnerable components before deployment.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 14

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit

Question 15

An administrator runs the above iptables command on a Linux server. The server is directly connected to the internet. Which of the following is the MOST significant security issue with this configuration?

Accepted Answer

The OUTPUT chain default policy is ACCEPT, allowing any outbound traffic. The most significant security issue is that the OUTPUT chain default policy is ACCEPT, allowing any outbound traffic from the server. Since the server is directly connected to the internet, this means that if the server is compromised, an attacker can freely exfiltrate data, initiate outbound connections to command-and-control servers, or perform other malicious activities without any firewall restriction. A default DROP policy on the OUTPUT chain would require explicit rules for allowed outbound traffic, providing defense in depth.

Answer

The INPUT chain default policy is DROP, which will block legitimate traffic

Answer

SSH (port 22) is allowed from any source, which is overly permissive

Answer

ICMP echo requests are allowed, which could be used for network reconnaissance

Question 16

A security engineer is hardening a container image. Which practice is MOST effective in reducing the attack surface?

Accepted Answer

Using a minimal base image. Using a minimal base image (e.g., Alpine, Distroless) removes unnecessary packages and binaries, significantly reducing the attack surface. Running as root increases risk. Antivirus is not typical in containers. Latest packages are good but do not reduce surface.

Answer

Running containers as root

Answer

Adding antivirus software

Answer

Using the latest version of all packages

Question 17

A security analyst is reviewing cryptographic implementations for a new application. The application needs to support digital signatures that are quantum-resistant and provide high performance. Which TWO algorithms should the analyst consider? (Select TWO.)

Accepted Answer

XMSS (eXtended Merkle Signature Scheme). Ed25519 is a high-performance signature algorithm based on Curve25519, but it is not quantum-resistant. BLAKE3 is a hash function, not a signature. ECDSA P-384 is also not quantum-resistant. Currently, NIST is standardizing post-quantum algorithms like CRYSTALS-Dilithium and XMSS (hash-based). CRYSTALS-Dilithium is a lattice-based signature scheme, and XMSS is a hash-based signature scheme that is quantum-resistant. Both are suitable for high performance in software.

Answer

Ed25519

Answer

ECDSA P-384

Answer

BLAKE3

Question 18

A security engineer needs to design a solution to detect and respond to insider threats involving unauthorized data exfiltration via USB devices. Which of the following is the MOST effective approach?

Accepted Answer

Implement a data loss prevention (DLP) solution with device control and content inspection.. The most effective because a DLP solution with device control and content inspection can monitor, block, or alert on unauthorized data transfers to USB devices by inspecting the content being written (e.g., file types, keywords, patterns) and enforcing policies at the endpoint or network level. This directly addresses the specific threat of data exfiltration via USB, unlike other options that either lack detection or are too restrictive.

Answer

Conduct regular security awareness training on data handling policies.

Answer

Deploy endpoint detection and response (EDR) agents on all workstations.

Answer

Disable all USB ports via group policy.

Question 19

Which of the following is a key benefit of using an Extended Detection and Response (XDR) solution over traditional Endpoint Detection and Response (EDR)?

Accepted Answer

XDR provides centralized visibility across multiple security layers including endpoints, network, and cloud. XDR extends detection beyond endpoints to include network, email, cloud, and other data sources, providing broader visibility and correlation across the entire environment.

Answer

XDR only works with a single vendor's products

Answer

XDR eliminates the need for SIEM and SOAR systems

Answer

XDR only focuses on network traffic analysis

Question 20

Drag and drop the steps to configure a RADIUS server for 802.1X authentication into the correct order.

Accepted Answer

1. Install NPS, 2. Register NPS in Active Directory, 3. Add RADIUS client, 4. Configure connection request policy, 5. Configure network policy. RADIUS setup: install NPS, register in AD, add RADIUS client, configure connection policy, then network policy.

Answer

1. Install NPS, 2. Register NPS in Active Directory, 3. Configure connection request policy, 4. Add RADIUS client, 5. Configure network policy

Answer

1. Register NPS in Active Directory, 2. Install NPS, 3. Add RADIUS client, 4. Configure connection request policy, 5. Configure network policy

Answer

1. Install NPS, 2. Add RADIUS client, 3. Register NPS in Active Directory, 4. Configure connection request policy, 5. Configure network policy