CAS-004 Practice Exam 53 — 20 Questions

Question 1

An organization is deploying a containerized application on Kubernetes and must enforce that only approved container images are allowed to run, and that containers cannot escalate privileges. Which combination of controls should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admission controllers with image signing and PodSecurityPolicy. Admission controllers are the Kubernetes mechanism that intercepts API server requests before objects are persisted, so they can reject pods that violate policy. Combined with image signing (e.g., via cosign/Notary or an admission webhook that verifies signatures), they enforce that only approved images run. PodSecurityPolicy (or its successor, Pod Security Admission with restricted/baseline profiles) blocks privilege escalation by restricting privileged containers, hostPath mounts, and capabilities.

Answer

Seccomp and AppArmor profiles with RBAC

Answer

Kubernetes network policies and RBAC

Answer

Container image scanning and network policies

Question 2

A security architect is evaluating an API security strategy for a SaaS application that supports OAuth 2.0. Which TWO controls should the architect recommend to protect against token interception and replay attacks?

Accepted Answer

Enforcing short-lived access tokens with refresh token rotation. Option B is correct because enforcing short-lived access tokens limits the window in which a stolen token can be replayed, and refresh token rotation invalidates the old refresh token each time a new one is issued, so a captured refresh token cannot be reused indefinitely. Option D is correct because token binding cryptographically ties an access or refresh token to a specific client session or TLS channel, so a token intercepted and replayed from a different session or connection will be rejected. Option A is wrong because long-lived access tokens increase the replay window and worsen the impact of interception. Option C is wrong because encrypting JWT payloads provides confidentiality of claims but does not prevent an attacker who captures the token from replaying it. Option E is wrong because rate limiting on the token endpoint only mitigates brute-force or flooding attempts; it does not stop interception or replay of a valid token.

Answer

Using long-lived access tokens to reduce authentication frequency

Answer

Encrypting JWT payloads with a symmetric key

Answer

Implementing rate limiting on the token endpoint

Question 3

An organization is architecting a hybrid cloud environment with AWS and on-premises resources. Which THREE considerations are essential for meeting data residency requirements? (Choose three.)

Accepted Answer

Selecting the correct AWS region for data storage. Option A is correct because data residency is fundamentally about geography: choosing the correct AWS Region (e.g., eu-west-1 for EU data) ensures data at rest and in transit stays within the legally required jurisdiction, since AWS Regions are isolated geographic areas. Option C is correct because encryption keys are themselves regulated data; keeping KMS keys in the same Region as the encrypted data (or using a customer-managed KMS key in that Region) prevents cross-border key movement and satisfies residency controls such as those in GDPR or data-sovereignty mandates. Option D is correct because you cannot enforce residency without first knowing what data you hold; data classification policies identify regulated/sensitive data so it can be tagged, mapped, and placed only in approved Regions and on-premises locations. Option B is not required because hybrid architectures can store data in compliant AWS Regions, so mandating all-on-premises storage is overly restrictive and defeats the hybrid design. Option E is wrong because a global AWS account without Region constraints allows resources and data to be created in any Region, directly violating data residency requirements.

Answer

Using only on-premises storage for all data

Answer

Using a global AWS account without region constraints

Question 4

A compliance officer is preparing for an audit and needs to collect evidence. Which TWO of the following are considered acceptable forms of audit evidence? (Select TWO.)

Accepted Answer

Written security policies. Written security policies (C) are acceptable audit evidence because they are documented, approved artifacts that demonstrate the organization's formal security requirements and controls, providing verifiable proof of governance intent. System access logs (E) are acceptable because they are system-generated, tamper-evident records that objectively show actual activity such as authentication events, timestamps, and user actions, which auditors can trace and corroborate. In contrast, screenshots of unofficial reports (A) lack authenticity and provenance since they can be altered and are not from controlled sources, verbal statements from employees (B) are testimonial and unverifiable without documentation, and assumptions about system configurations (D) are unsubstantiated beliefs rather than evidence, so none of these qualify as acceptable audit evidence.

Answer

Screenshots of unofficial reports

Answer

Verbal statements from employees

Answer

Assumptions about system configurations

Question 5

A security manager is selecting key risk indicators (KRIs) for the organization's risk management program. Which THREE of the following are examples of KRIs that can provide early warning of increasing risk?

Accepted Answer

Number of failed login attempts per hour. Option A (number of failed login attempts per hour) is a valid KRI because a rising rate of authentication failures is a leading indicator of brute-force, password-spraying, or credential-stuffing attacks, giving early warning before a breach occurs. Option C (percentage of users with privileged access) is a KRI because excessive or growing privileged accounts expand the attack surface and the potential blast radius of a compromise, signaling creeping access-control risk. Option D (number of unpatched critical vulnerabilities) is a KRI because a growing count of unpatched critical CVEs directly raises the likelihood of exploitation and is a measurable, forward-looking exposure metric. Option B (MTTD) is a key performance indicator of detection efficiency, not an early-warning risk indicator, and Option E (percentage of systems with current backups) is a control-effectiveness or compliance metric rather than a leading indicator of increasing risk.

Answer

Mean time to detect (MTTD) for incidents

Answer

Percentage of systems with current backups

Question 6

A security manager is implementing a policy exception management process. Which TWO of the following are essential components of an effective exception management process?

Accepted Answer

A defined expiration date for each exception. An effective exception management process requires a formal request and approval workflow (C) so that each exception is documented, justified, risk-assessed, and authorized by the appropriate authority rather than granted informally. It also requires a defined expiration date for each exception (B), ensuring exceptions are temporary, time-bound, and reviewed or renewed before they become permanent policy gaps. Together, these components provide accountability and limit risk exposure. Option A is wrong because blanket denial of all exceptions is impractical and prevents legitimate business needs from being addressed. Option D is wrong because automatic approval of temporary workarounds bypasses risk review and oversight. Option E is wrong because immediately revising policy to eliminate every exception is not always feasible and does not constitute an exception management process.

Answer

A policy that all exceptions are denied

Answer

Automatic approval for temporary workarounds

Answer

Immediate policy revision to eliminate the need for exceptions

Question 7

A security analyst is investigating a potential data exfiltration incident. The analyst needs to preserve evidence for legal proceedings. Which two actions must the analyst take to maintain the chain of custody? (Select TWO).

Accepted Answer

Document every person who accesses the evidence and the time of access. Option C is correct because chain of custody requires an unbroken, auditable record documenting every individual who handles or accesses the evidence, along with the date and time of each access, which is essential for the evidence to be admissible in legal proceedings. Option E is correct because creating a forensic image of the hard drive using a write-blocker preserves the original evidence in an unaltered state while allowing analysis to be performed on the copy; the write-blocker prevents any modification to the source drive, maintaining its integrity. Option A is incorrect because encrypting evidence with a personal key could render it inaccessible to investigators or the court and does not support an auditable custody record. Option B is incorrect because indiscriminately sharing evidence with all team members breaks the controlled, documented access that chain of custody demands. Option D is incorrect because running antivirus scans can modify files or metadata on the evidence, potentially altering or destroying forensic artifacts.

Answer

Encrypt the evidence with a personal key

Answer

Share the evidence with all team members for analysis

Answer

Run antivirus scans on the evidence to ensure it is safe

Question 8

An organization is developing a policy exception management process. Which three of the following are essential components of an effective exception process? (Choose three.)

Accepted Answer

Documented business justification for the exception. Option A is correct because every exception must be supported by a documented business justification that explains why the policy cannot be met and what compensating value the exception provides, giving approvers the rationale needed to make an informed decision. Option B is correct because exceptions must have an expiration date (or defined review period) so they are temporary and time-bound, preventing them from becoming permanent de facto policy and forcing periodic re-evaluation. Option D is correct because a risk assessment quantifies the residual risk introduced by the exception, allowing management to accept that risk knowingly and to define compensating controls. Option C is not essential to the exception process itself; automatic enforcement is a policy implementation mechanism, and an exception by definition suspends or modifies enforcement rather than applying it. Option E is not essential because attaching the entire policy hierarchy is unnecessary documentation; the exception only needs to reference the specific policy clause being excepted, not reproduce the whole hierarchy.

Answer

Automatic enforcement of policy via technical controls

Answer

A copy of the entire policy hierarchy

Question 9

During a compliance audit for PCI DSS, the auditor identifies that cardholder data is stored beyond the required retention period. The organization wants to implement proper data lifecycle management. Which THREE of the following should the organization include in its data retention policy? (Select THREE.)

Accepted Answer

Retention schedules for each data classification level. Option B is correct because a data retention policy must define explicit retention schedules for each data classification level, ensuring cardholder data is not stored beyond the PCI DSS-required period and is deleted when no longer needed. Option C is correct because a legal hold process is essential to suspend scheduled deletion when data is subject to litigation, regulatory investigation, or e-discovery obligations, preventing spoliation while still enforcing lifecycle management. Option E is correct because secure disposal methods (such as NIST SP 800-88 media sanitization, cryptographic erasure, or physical destruction) must be specified for data at end of life to ensure cardholder data cannot be recovered after retention expires. Option A does not belong because encryption for data in transit is a transmission-security control, not a retention lifecycle element. Option D does not belong because the data classification scheme itself is a prerequisite input to the policy, not a retention-specific requirement being asked for here.

Answer

Encryption requirements for data in transit

Answer

Data classification scheme definitions

Question 10

A security architect is designing a data lifecycle management program. Which TWO of the following are phases of the data lifecycle? (Select TWO.)

Accepted Answer

Data creation. Option C (Data creation) is correct because the data lifecycle begins when data is generated or acquired, making creation the first recognized phase in lifecycle models such as the one described in ISO/IEC 27001 and NIST guidance. Option D (Data destruction) is correct because the lifecycle concludes with secure disposal or destruction of data once it is no longer needed, ensuring it cannot be recovered and reducing residual risk. Data replication (A) is a storage or availability technique, not a lifecycle phase. Data anonymization (B) is a privacy-enhancing technique applied during processing, not a distinct lifecycle phase. Data monetization (E) is a business objective or use case, not a formal phase of the data lifecycle.

Answer

Data replication

Answer

Data anonymization

Answer

Data monetization

Question 11

A small business is implementing a privacy impact assessment (PIA) for a new application that processes personal data of EU citizens. Which TWO of the following are required under GDPR?

Accepted Answer

Describe the processing operations and purposes. Under GDPR Article 35, a Data Protection Impact Assessment (DPIA) must contain a systematic description of the envisaged processing operations and the purposes of the processing, which is exactly what option D requires, so D is correct. Article 35(7)(b) also mandates an assessment of the necessity and proportionality of the processing operations in relation to their purposes, making option E correct. Option A is wrong because GDPR does not generally require prior DPA approval before processing; prior consultation under Article 36 is only needed when a DPIA indicates high residual risk that cannot be mitigated. Option B is wrong because a DPO is mandatory only under Article 37 conditions (large-scale regular monitoring, large-scale special-category data, or public authority), not for every PIA. Option C is wrong because GDPR does not require publishing the DPIA on a website; the DPIA is documented and made available to the supervisory authority on request.

Answer

Obtain approval from a data protection authority before processing

Answer

Appoint a data protection officer (DPO)

Answer

Publish the PIA on the company website

Question 12

A global company must comply with data residency regulations that require customer data to stay within specific geographic boundaries. The company uses a multi-cloud architecture. Which THREE strategies should the architect implement to ensure compliance?

Accepted Answer

Using cloud provider's region-specific services and data centers. Option A is correct because using region-specific services and data centers ensures that data is physically stored and processed within the required geographic boundaries, directly satisfying data residency mandates. Option D is correct because data classification tags identify which data is subject to residency regulations, enabling architects to apply location-based controls and policies only to regulated data. Option E is correct because DLP policies can detect and block cross-border transfers of regulated data, preventing accidental or unauthorized movement outside approved regions. Option B is not correct because encryption at rest and in transit protects confidentiality but does not restrict where data is stored or transferred, so it does not ensure residency. Option C is not correct because IAM policies control who can access data, not where data resides or whether it crosses borders.

Answer

Encrypting all data at rest and in transit

Answer

Implementing strict identity and access management (IAM) policies

Question 13

A security architect is designing a defense-in-depth strategy for a cloud-native application. Which TWO controls are most effective for protecting east-west traffic between microservices?

Accepted Answer

Service mesh with mutual TLS. Option A (Service mesh with mutual TLS) is correct because a service mesh provides identity-based, encrypted, and authenticated communication between microservices, and mutual TLS ensures both sides of an east-west connection verify each other's certificates, preventing spoofing and eavesdropping inside the cluster. Option C (Micro-segmentation of virtual networks) is correct because it enforces least-privilege reachability between workloads by applying granular policies at the virtual network or workload level, which directly limits lateral movement if a microservice is compromised. Option B is not the best fit because an IDS on the gateway monitors north-south traffic entering the environment rather than internal service-to-service flows, and it is detective rather than preventive. Option D is not appropriate because a WAF protects HTTP/HTTPS applications from external web attacks at the edge, not east-west microservice traffic. Option E is not appropriate because perimeter ACLs filter traffic at the network boundary and do not provide the identity-aware, workload-level controls needed for internal microservice communication.

Answer

Intrusion detection system (IDS) on the gateway

Answer

Web application firewall (WAF)

Answer

Network access control lists (ACLs) at the perimeter

Question 14

An organization is planning to modernize its cryptographic infrastructure to protect sensitive data for the next 10 years. The security architect must consider future threats from quantum computing. Which TWO quantum-resistant algorithms should the architect prioritize for key encapsulation and digital signatures? (Choose TWO.)

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium (A) is correct because it is a NIST-selected post-quantum digital signature algorithm based on lattice cryptography, designed to resist attacks from both classical and quantum computers, making it suitable for long-term signing needs. CRYSTALS-Kyber (E) is correct because it is the NIST-selected post-quantum key encapsulation mechanism (KEM), also lattice-based, intended for establishing shared secrets resistant to quantum cryptanalysis. Together they cover the two required functions: Kyber for key encapsulation and Dilithium for digital signatures. AES-256 with GCM (B) is a symmetric cipher and does not provide quantum-resistant key encapsulation or signatures, though symmetric keys are less affected by quantum attacks. ECDSA with P-521 (C) and RSA-4096 (D) are classical asymmetric algorithms whose security would be broken by Shor's algorithm on a sufficiently large quantum computer, so they are not quantum-resistant.

Answer

AES-256 with GCM

Answer

ECDSA with P-521

Answer

RSA-4096

Question 15

A security architect is implementing network segmentation in a hybrid cloud environment. Which TWO controls are most effective for reducing east-west traffic risks?

Accepted Answer

Micro-segmentation. Micro-segmentation (A) is correct because it applies granular, workload-level security policies—typically via host-based agents or SDN constructs—that restrict lateral (east-west) movement between workloads even inside the same subnet or VPC, directly reducing east-west risk. East-west traffic inspection (D) is correct because it examines internal traffic flows (e.g., via next-generation firewalls, IDS/IPS, or virtual taps) to detect and block lateral movement, malicious scanning, and exfiltration that perimeter controls would miss. VPN concentrator (B) is not correct because it secures remote-access or site-to-site north-south connectivity, not internal lateral traffic. NAT gateway (C) is not correct because it provides outbound internet address translation and does not inspect or segment internal east-west flows. Perimeter firewall (E) is not correct because it primarily enforces north-south boundary controls and does not address lateral movement within the segmented environment.

Answer

VPN concentrator

Answer

NAT gateway

Answer

Perimeter firewall

Question 16

A financial institution is implementing a secure software development lifecycle (SSDLC) for a new web application that will handle sensitive transactions. The security architect must ensure that application security testing is integrated into the development process. Which THREE testing techniques should be used to identify vulnerabilities early and throughout the lifecycle? (Choose THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST (A) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find flaws such as injection patterns, insecure coding, and hardcoded secrets early in the SSDLC, even in CI pipelines. IAST (C) is correct because it instruments the running application and combines static and dynamic analysis to detect vulnerabilities during functional testing with high accuracy and code-level context, fitting continuous integration. DAST (D) is correct because it tests the deployed application from the outside by sending crafted requests to find runtime and configuration issues such as SQL injection, XSS, and authentication flaws in the running web app. RASP (B) is not a testing technique but a runtime protection mechanism that detects and blocks attacks in production, so it does not identify vulnerabilities early in development. Threat modeling (E) is a design-phase risk analysis activity, not an application security testing technique, so it does not satisfy the requirement for testing throughout the lifecycle.

Answer

Runtime Application Self-Protection (RASP)

Answer

Threat modeling

Question 17

Which of the following is the BEST practice for securely storing secrets (e.g., database passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service with encryption and access policies. Cloud-native applications should rely on a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) that encrypts secrets at rest and in transit, enforces fine-grained access policies via IAM, and supports automatic rotation. This approach decouples secrets from code and infrastructure, eliminating the risks of exposure through version control, logs, or misconfigured permissions.

Answer

Embed the secrets in the application's source code

Answer

Store them in environment variables

Answer

Store them in a configuration file with restricted file permissions

Question 18

A security analyst observes that SSH connections to the server are failing, but HTTP and HTTPS traffic works. Based on the exhibit, what is the most likely cause?

Accepted Answer

The SSH service is being blocked by a firewall rule that drops TCP port 22 traffic.. The exhibit shows a firewall rule that explicitly drops TCP port 22 traffic, which is the default port for SSH. Since HTTP (port 80) and HTTPS (port 443) are unaffected, the issue is isolated to SSH. This rule is the most direct cause of the connection failures, as it blocks all SSH traffic regardless of source or destination.

Answer

The HTTPS rule is overriding the SSH rule.

Answer

The SSH service is only allowed from the 10.0.0.0/8 subnet.

Answer

The SSH service is misconfigured and not listening on the correct interface.

Question 19

A security engineer is writing a Python script to automate the revocation of compromised certificates using the ACME protocol. The script uses the `acme` library and requires secure credential storage. Which method is MOST appropriate for storing the ACME account private key used for authentication?

Accepted Answer

Store the key in the operating system's keychain (e.g., macOS Keychain, Windows Credential Manager) or a HSM. The ACME account private key is a highly sensitive cryptographic credential used to authenticate against the ACME server (RFC 8555). Storing it in the OS keychain or a Hardware Security Module (HSM) provides encryption at rest, access control via OS-level permissions, and protection against accidental exposure. This aligns with the principle of least privilege and secure key management required for automation scripts handling certificate revocation.

Answer

Store the key in a configuration file with 600 permissions

Answer

Embed the key directly in the script as a string variable

Answer

Store the key in an environment variable

Question 20

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Accepted Answer

Permitted and required uses of PHI. A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

Answer

Indemnification clause for breaches

Answer

Requirement to store data in the United States