CAS-004 Practice Exam 53 — 20 Questions

Question 1

Which of the following is the BEST practice for securely storing secrets (e.g., database passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service with encryption and access policies. Cloud-native applications should rely on a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) that encrypts secrets at rest and in transit, enforces fine-grained access policies via IAM, and supports automatic rotation. This approach decouples secrets from code and infrastructure, eliminating the risks of exposure through version control, logs, or misconfigured permissions.

Answer

Embed the secrets in the application's source code

Answer

Store them in environment variables

Answer

Store them in a configuration file with restricted file permissions

Question 2

A security architect is designing a cloud security strategy for a healthcare organization that uses a hybrid cloud environment with AWS and Azure. The organization must comply with HIPAA and needs to protect sensitive patient data. Which THREE cloud security controls should be prioritized? (Choose THREE.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Cloud Access Security Broker (CASB) provides visibility and data protection across cloud services, CSPM identifies misconfigurations that could lead to breaches, and Cloud Workload Protection Platform (CWPP) secures workloads in public clouds. IAM and VPC are important but are more basic controls; they are not the primary focus for this scenario.

Answer

Virtual Private Cloud (VPC)

Answer

Identity and Access Management (IAM)

Question 3

Match each automation security concept (left) with its corresponding best practice (right).

Answer

Scan container images for vulnerabilities before deployment

Answer

Never modify a running instance; redeploy instead

Answer

Store all configuration files in version control

Answer

Use a dedicated vault service to store credentials

Question 4

A company is implementing a defense-in-depth strategy for its web application. Which THREE security controls should be included in the architecture? (Choose three.)

Accepted Answer

Web application firewall (WAF). Defense-in-depth uses multiple layers. WAF filters malicious traffic, network segmentation limits lateral movement, and RASP protects the application at runtime.

Answer

Load balancer with SSL termination

Answer

Single sign-on (SSO)

Question 5

A company is preparing for post-quantum cryptography migration. According to NIST PQC standards, which algorithm is a candidate for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a NIST-selected algorithm for key encapsulation, designed to resist quantum attacks. It is used for establishing symmetric keys.

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Answer

Falcon

Question 6

Which of the following is the primary purpose of a honeypot in a security operations environment?

Accepted Answer

To provide early detection of unauthorized activity. Honeypots are decoy systems designed to attract attackers, allowing security teams to observe their tactics, techniques, and procedures without risking real assets.

Answer

To encrypt sensitive data at rest

Answer

To replace the need for traditional firewalls

Answer

To block malicious traffic at the network perimeter

Question 7

Refer to the exhibit. Which security issue does this cloud storage bucket policy present?

Accepted Answer

The bucket allows anonymous PUT operations from any source. The cloud storage bucket policy shown includes a `Principal: "*"` with `Action: "PutObject"` and no `Condition` block restricting the source IP or requiring authentication. This means any unauthenticated user on the internet can upload objects to the bucket, which is a classic data ingestion vulnerability. Option C correctly identifies this as allowing anonymous PUT operations from any source.

Answer

The bucket allows anonymous GET operations from any IP

Answer

The bucket policy is too restrictive

Answer

The bucket is not encrypted

Question 8

A security analyst receives an alert from the SIEM indicating multiple failed logon attempts from an external IP address followed by a successful logon for a domain admin account. Which phase of the incident response lifecycle is the analyst currently in?

Accepted Answer

Detection. The detection phase involves identifying potential incidents through alerts and analysis. The analyst has received an alert and is likely investigating, which is part of detection.

Answer

Lessons learned

Answer

Containment

Answer

Preparation

Question 9

A security analyst is reviewing a Kubernetes cluster's security configuration. Which component should be used to ensure that only authorized pods can communicate with each other?

Accepted Answer

Network Policies. Kubernetes Network Policies allow you to define ingress and egress rules for pods, controlling traffic at the IP address or port level, which is essential for micro-segmentation.

Answer

Pod Security Policies (PSP)

Answer

Seccomp profiles

Answer

RBAC roles

Question 10

Refer to the exhibit. A security analyst notices that traffic from external clients to the web server at 10.0.0.10 port 80 is being blocked. Which of the following is the MOST likely cause?

Accepted Answer

The ACL is misordered (deny before permit). The ACL is misordered because Cisco ACLs process rules sequentially from top to bottom, and a 'deny any' statement placed before a 'permit' statement will block all traffic, including the desired web traffic to 10.0.0.10 port 80. Since the exhibit shows a deny statement preceding the permit, the permit is never evaluated, causing the block.

Answer

The ACL lacks a log statement

Answer

The web server is using port 443

Answer

The destination IP is incorrect

Question 11

During a security incident, a forensic investigator needs to capture the contents of volatile memory on a compromised server. Which of the following tools should the investigator use?

Accepted Answer

FTK Imager (with memory capture). FTK Imager with memory capture is the correct tool because it is specifically designed to acquire a bit-for-bit copy of volatile memory (RAM) from a live system while preserving forensic integrity. Unlike disk imaging tools, FTK Imager can capture the contents of physical memory, including running processes, network connections, and encryption keys, which are critical for incident response. This tool also generates a hash of the captured memory to ensure data integrity during analysis.

Answer

dd

Answer

Wireshark

Answer

Nmap

Question 12

A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?

Accepted Answer

Encrypt the data at rest and in transit, and implement IAM policies. Encrypting data at rest (using AES-256 or similar) and in transit (using TLS 1.2/1.3 or IPsec) ensures confidentiality during migration and after the ERP is hosted in the cloud. Implementing IAM policies with least-privilege access controls prevents unauthorized access to the sensitive financial data, addressing both data protection and access management requirements for a public cloud IaaS environment.

Answer

Leverage the cloud provider's default security groups and disable encryption

Answer

Migrate the ERP without changes and apply encryption after migration

Answer

Use a VPN to connect on-premises and cloud while keeping data unencrypted

Question 13

A global company must comply with data residency regulations that require customer data to stay within specific geographic boundaries. The company uses a multi-cloud architecture. Which THREE strategies should the architect implement to ensure compliance?

Accepted Answer

Using cloud provider's region-specific services and data centers. To meet data residency requirements, data must be stored and processed locally. Encryption alone does not prevent data from leaving the region. Private links keep traffic within the cloud provider's network but do not guarantee data stays in region. Access controls do not prevent data movement. Data classification helps identify regulated data. Cloud provider's region-specific services ensure data remains in that region.

Answer

Encrypting all data at rest and in transit

Answer

Implementing strict identity and access management (IAM) policies

Question 14

A security engineer is reviewing a TLS 1.3 configuration. Which of the following is a key feature of TLS 1.3 that improves security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 removes support for insecure cipher suites like CBC mode and RC4, and only supports AEAD ciphers. It also provides forward secrecy by default.

Answer

Support for RC4 cipher suite

Answer

Support for static RSA key exchange

Answer

Ability to downgrade to TLS 1.2

Question 15

A company is implementing API security for its web services. Which THREE of the following are considered best practices for securing APIs? (Select THREE).

Accepted Answer

Validate all input. API security best practices include using OAuth 2.0 for authentication/authorization, implementing rate limiting to prevent abuse, and validating input to prevent injection attacks. WPA3 is for Wi-Fi; symmetric encryption alone is not a complete API security practice.

Answer

Rely solely on symmetric encryption for data at rest

Answer

Use WPA3 for transport encryption

Question 16

During a digital forensics investigation, an analyst needs to acquire the contents of RAM from a compromised server. Which order of volatility should the analyst follow?

Accepted Answer

Capture RAM first, then the hard drive. The order of volatility dictates collecting the most volatile data first. RAM is highly volatile and should be captured before less volatile data like disks.

Answer

Capture the swap file first, then RAM

Answer

Capture network connections first, then RAM

Answer

Capture the hard drive image first, then RAM

Question 17

A company uses Terraform to deploy infrastructure on AWS. They have a compliance requirement that all containers running on Amazon ECS must have a read-only root filesystem and must not run as root. The security team needs an automated way to enforce this policy and provide an audit trail for any violations. Which solution best meets these requirements?

Accepted Answer

Use Open Policy Agent (OPA) with Gatekeeper as an admission controller on Amazon EKS, and deploy EKS instead of ECS.. Open Policy Agent (OPA) with Gatekeeper is a Kubernetes admission controller that can enforce policies on pods at creation time, such as requiring read-only root filesystems and not running as root. However, the question specifies Amazon ECS, not EKS. Option D suggests migrating from ECS to EKS to leverage OPA/Gatekeeper, which meets the compliance requirement with automated enforcement and audit trail. Option A (manual review) is not automated. Option B (Terraform policy) validates at deployment time but does not enforce runtime behavior or provide audit trail for violations. Option C (custom Python script) is reactive and does not prevent violations. Therefore, D is the best solution despite the platform change.

Answer

Review all container definitions manually during the change management process.

Answer

Add a Terraform policy that validates container definitions at deployment time.

Answer

Write a custom Python script that periodically scans running ECS tasks and reports violations.

Question 18

A PKI administrator is deploying certificates for code signing. Which certificate type should be used to ensure that the signed code can be verified by clients without requiring a full chain validation?

Accepted Answer

Code signing certificate. Code signing certificates are specifically designed for signing software; they are typically issued by a publicly trusted CA.

Answer

EV certificate

Answer

S/MIME certificate

Answer

DV certificate

Question 19

A forensic analyst needs to collect volatile data from a live Windows system. In which order should the analyst collect the following data? (Order of volatility)

Accepted Answer

Memory dump, network connections, running processes, disk image. Memory is the most volatile and should be collected first, followed by network connections, then processes, and finally disk data. Option A is wrong because disk is less volatile. Option C is wrong because processes should be after memory. Option D is wrong because network state is more volatile than disk.

Answer

Disk image, memory dump, network connections, running processes

Answer

Network connections, running processes, memory dump, disk image

Answer

Running processes, memory dump, network connections, disk image

Question 20

A global e-commerce company processes payment card data and is required to comply with PCI DSS. During a quarterly vulnerability scan, the security team discovers that a web application firewall (WAF) rule is blocking legitimate traffic, causing transaction failures. The WAF is a critical compensating control for a known vulnerability in the application that cannot be patched for 90 days. The compliance officer is concerned about maintaining PCI DSS compliance while ensuring business continuity. The security team proposes temporarily disabling the WAF to restore service while they fine-tune the rules. Which of the following is the BEST action?

Accepted Answer

Temporarily modify the WAF rule set to allow legitimate traffic while maintaining security, and schedule a permanent fix within 24 hours.. The best action because temporarily modifying the WAF rule set to allow legitimate traffic while maintaining security addresses both business continuity and PCI DSS compliance. The WAF serves as a critical compensating control for a known vulnerability that cannot be patched for 90 days; disabling it (as in Option B) would remove this control, likely violating PCI DSS Requirement 6.6 and increasing risk. Option A (segmentation) may not provide equivalent protection and could be impractical in the short term. Option C (accepting transaction failures) harms business operations without a long-term benefit. Fine-tuning rules and scheduling a permanent fix within 24 hours balances security and availability, keeping the compensating control active.

Answer

Segment the affected application from the rest of the network and remove the WAF from the data path.

Answer

Disable the WAF immediately to restore service and document the decision as a risk acceptance.

Answer

Accept the risk of transaction failures and keep the WAF in place until the rules are fully tested.