CAS-004 Practice Exam 54 — 20 Questions

Question 1

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Accepted Answer

Include a manual approval step for high-impact actions.. High-impact automated actions, such as blocking a critical server or deleting user accounts, can cause significant collateral damage if triggered by a false positive. Including a manual approval step ensures a human verifies the alert before irreversible or disruptive actions are taken, aligning with the principle of least privilege and incident response best practices.

Answer

Execute all actions immediately to minimize damage.

Answer

Use the same playbook for all incident types.

Question 2

A financial services company is implementing a risk management framework. The security team has identified that the current encryption algorithm for customer data in transit is deprecated. According to NIST SP 800-53, which of the following is the MOST appropriate step to address this finding?

Accepted Answer

Update the encryption algorithm to a FIPS 140-2 validated one. NIST SP 800-53 requires that cryptographic algorithms used to protect data in transit must be FIPS 140-2 validated. A deprecated algorithm (e.g., DES, RC4, or 3DES) is no longer considered secure and must be replaced with a current, approved algorithm such as AES-256 or ChaCha20. Updating the encryption algorithm directly remediates the security finding and aligns with the risk management framework's requirement to maintain adequate security controls.

Answer

Implement compensating controls such as network segmentation

Answer

Accept the risk because the algorithm is still functional

Answer

Transfer the risk by purchasing cyber insurance

Question 3

Refer to the exhibit. A security review is being conducted on the Python application configuration. Which of the following security issues is present?

Accepted Answer

The code does not handle the case where API_KEY is not set, potentially causing an error. The code attempts to retrieve the API_KEY environment variable using `os.environ['API_KEY']`, which raises a `KeyError` if the variable is not set. This lack of a fallback or error handling can cause the application to crash at startup, making it a security issue as it could lead to denial of service or expose stack traces in production logs.

Answer

The DB_CONNECTION environment variable is missing a default value

Answer

The default database connection is SQLite, which is insecure for production

Answer

The API key is stored in an environment variable, which is insecure

Question 4

During a penetration test, a tester finds that an application uses server-side sessions with predictable session IDs. Which attack is this vulnerability most likely to facilitate?

Accepted Answer

Session hijacking. Predictable session IDs allow an attacker to guess or calculate a valid session identifier for an authenticated user. By obtaining or predicting the session ID, the attacker can impersonate that user and gain unauthorized access to the application, which is the essence of session hijacking. This attack directly exploits weak session ID generation or insufficient entropy in the server-side session management.

Answer

Session fixation

Answer

Clickjacking

Answer

CSRF

Question 5

A security analyst is investigating a potential advanced persistent threat (APT) that has been evading traditional detection. The analyst decides to use User and Entity Behavior Analytics (UEBA) to identify anomalous activity. Which TWO of the following activities would be most indicative of a potential compromise when analyzed through UEBA? (Choose TWO.)

Accepted Answer

A user logging in from a remote location at 3:00 AM, which is outside their normal working hours. Option B is correct because UEBA baselines each user's normal login behavior, so a login from a remote location at 3:00 AM deviates from that user's established time-of-day and geographic pattern, which is a classic anomaly indicating possible credential compromise or unauthorized access. Option C is correct because UEBA tracks entity-to-resource relationships, and a user suddenly accessing a large volume of files they do not normally touch signals abnormal data access consistent with reconnaissance or exfiltration by an APT. Option A is not indicative because a service account authenticating to a database every 5 minutes is a predictable, recurring pattern that UEBA would learn as normal baseline behavior. Option D is not indicative because connecting to the corporate VPN from a hotel during a business trip is consistent with legitimate, expected remote-work behavior. Option E is not indicative because a scheduled antivirus scan run by an administrator is a routine, authorized administrative task that matches normal baseline activity.

Answer

A service account authenticating to a database server every 5 minutes

Answer

A user connecting to the corporate VPN from a hotel during a business trip

Answer

An administrator running a scheduled antivirus scan on a server

Question 6

A security architect is designing a cloud-native application that must comply with GDPR data residency requirements. Which TWO of the following measures should the architect implement? (Choose two.)

Accepted Answer

Store data only in approved geographical locations. Option B is correct because GDPR data residency requires that personal data be stored and processed only within approved jurisdictions, so restricting storage to approved geographical locations directly satisfies the residency obligation. Option C is correct because DLP policies monitor and can block transfers of regulated data across borders or to unauthorized destinations, providing the enforcement and audit trail needed to keep data within approved regions. Option A is not inherently sufficient: deploying in a single region does not guarantee that region is an approved GDPR location, nor does it prevent cross-border replication or access. Option D, while a strong security control, addresses confidentiality rather than residency and does not by itself constrain where data is stored or transferred. Option E supports governance and handling rules but does not enforce or guarantee geographical data residency.

Answer

Deploy the application in a single region to simplify compliance

Answer

Encrypt data at rest and in transit

Answer

Implement data classification and labeling

Question 7

A company is designing a hybrid cloud architecture with AWS and an on-premises data center. They need to ensure that all data transmitted between environments is encrypted and that the connection is resilient. Which design should the architect choose?

Accepted Answer

Establish multiple redundant IPsec VPN tunnels to the VPC. Multiple redundant IPsec VPN tunnels provide both encryption and resilience. IPsec encrypts all traffic between the on-premises data center and AWS VPC, and having multiple tunnels (e.g., over the internet or different Direct Connect virtual interfaces) ensures high availability if one tunnel fails. This meets the requirements for encrypted data transmission and resilient connectivity.

Answer

Deploy a single MPLS connection with network-based encryption

Answer

Set up a single AWS Direct Connect connection and rely on the provider's encryption

Answer

Use an SSL VPN tunnel from the on-premises firewall to the VPC

Question 8

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.

Question 9

An organization is adopting the NIST Risk Management Framework (RMF). During which step would the security team select and implement security controls, and how does this map to the organization's governance structure?

Accepted Answer

Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.. In the NIST RMF, Step 2 (Select) is where controls are chosen based on the risk assessment and organizational risk tolerance, and Step 3 (Implement) is where those controls are deployed and integrated into the system and its environment of operation. Together they represent the control selection and implementation phase, which maps to governance through the policies, roles, and risk decisions established in Step 1 (Prepare).

Answer

Step 4: Assess — controls are evaluated for effectiveness.

Answer

Step 1: Prepare — the organization establishes risk management roles and responsibilities.

Answer

Step 5: Authorize — a senior official accepts the risk.

Question 10

A security engineer is configuring a TLS 1.3 connection between a web server and client. Which feature is unique to TLS 1.3 and provides reduced latency for returning clients?

Accepted Answer

0-RTT. 0-RTT (zero round-trip time) resumption is a TLS 1.3 feature that lets a returning client send application data in the first flight using a previously established session ticket, eliminating the round trip needed for a full handshake. This reduces latency for repeat connections. It is unique to TLS 1.3 and not available in TLS 1.2.

Answer

Cipher suite negotiation

Answer

Forward secrecy

Answer

Mutual authentication

Question 11

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

Question 12

A security architect is selecting a cipher suite for TLS 1.3 to ensure forward secrecy and high performance. Which cipher suite should be recommended?

Accepted Answer

TLS_AES_256_GCM_SHA384. TLS_AES_256_GCM_SHA384 is the only option that is a valid TLS 1.3 cipher suite. TLS 1.3 removed RSA key transport and all CBC-mode ciphers, mandating AEAD (Authenticated Encryption with Associated Data) ciphers and ephemeral key exchange for forward secrecy. This suite uses AES-256 in GCM mode for authenticated encryption and SHA-384 for the HKDF-based key schedule, delivering both high performance (AES-NI accelerated) and strong security.

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Answer

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Question 13

A security assessor is evaluating an application that uses ChaCha20-Poly1305 for encryption. Which TWO of the following are true about this cryptographic algorithm?

Accepted Answer

It is a stream cipher. Option C is correct because ChaCha20 is a stream cipher: it generates a keystream from a 256-bit key and a 96-bit nonce (with a 32-bit counter) and XORs it with the plaintext, so no block structure is involved. Option D is correct because the Poly1305 one-time authenticator is combined with ChaCha20 to form an AEAD construction, producing a 128-bit authentication tag that protects both the ciphertext and any additional authenticated data (AAD) such as headers. Option A is wrong because ChaCha20 is unrelated to AES; it was designed by Daniel J. Bernstein as a variant of Salsa20 and does not use the Rijndael/AES structure or S-boxes. Option B is wrong because stream ciphers encrypt data byte-by-byte and require no padding to reach a block size. Option E is wrong because ChaCha20 is not a block cipher; it processes data as a continuous keystream rather than fixed-size blocks.

Answer

It is based on the AES algorithm

Answer

It requires padding to achieve correct block sizes

Answer

It is a block cipher

Question 14

A security analyst discovers that container images in the company's private registry lack signatures. The development team uses a script to build and push images. The analyst wants to ensure image integrity and prevent tampering. Which solution should the analyst recommend?

Accepted Answer

Implement Docker Content Trust with a Notary server to require signatures on all images.. Docker Content Trust (DCT) integrates with a Notary server to enforce cryptographic signing of container images. When enabled, the Docker client will only pull, push, or run images that have been signed by trusted keys, ensuring image integrity and preventing tampering. This directly addresses the requirement to require signatures on all images in the private registry.

Answer

Restrict registry access to only the build servers.

Answer

Use SSH keys to sign the image tarball before pushing.

Answer

Encrypt the image filesystem layer using AES-256.

Question 15

An organization wants to implement a hardware security module (HSM) to protect cryptographic keys. Which of the following is a primary benefit of using an HSM?

Accepted Answer

Tamper-resistant key storage. An HSM provides tamper-resistant key storage by using physical and logical safeguards, such as tamper switches, epoxy potting, and zeroization circuits, that destroy cryptographic keys if an attacker attempts to access the hardware. This ensures that private keys remain secure even if the device is compromised, which is a primary requirement for compliance with standards like FIPS 140-2 Level 3 or 4. Software-based storage cannot offer the same level of physical protection against extraction attacks.

Answer

Faster key generation than software

Answer

Reduced network latency for encryption

Answer

Automatic cloud backup of keys

Question 16

Based on the exhibit, which vulnerability is being exploited?

Accepted Answer

Directory traversal. The GET request in the exhibit uses '../' sequences to traverse directories and access the /etc/passwd file, which is characteristic of a directory traversal attack. Option A (CSRF) is wrong because CSRF attacks rely on exploiting a user's authenticated session to perform unintended actions, not directory path manipulation. Option B (SQL injection) is wrong because there is no SQL syntax or database query involved. Option D (XSS) is wrong because no scripts or client-side code execution is present.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 17

A company is implementing MFA for remote access. Which TWO factors are considered possession factors?

Accepted Answer

A hardware OTP token. Option B (a hardware OTP token) is a possession factor because authentication depends on something the user physically has — the token device that generates or stores the one-time passcode. Option D (a push notification to a registered smartphone) is also a possession factor because the approval prompt is delivered to a specific device the user possesses, and possession of that enrolled phone is what enables the authentication. Option A (a fingerprint scan) is an inherence factor, since it relies on a biometric characteristic of the user. Option C (a PIN) and Option E (a password) are both knowledge factors, because they rely on something the user knows rather than something the user has.

Answer

A fingerprint scan

Answer

A PIN

Answer

A password

Question 18

A security analyst is investigating a potential side-channel attack on an IoT device. The device's cryptographic operations show variable execution times based on the key and plaintext. Which mitigation is most effective against timing attacks?

Accepted Answer

Use constant-time cryptographic implementations.. Timing attacks exploit variations in execution time. Using constant-time algorithms ensures that operations take the same amount of time regardless of input, preventing information leakage.

Answer

Use a faster processor to reduce execution time.

Answer

Implement random delays in cryptographic operations.

Answer

Disable caching in the CPU during cryptographic operations.

Question 19

A company is implementing a Privileged Access Management (PAM) solution to manage admin credentials. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access is a core PAM capability that grants elevated privileges only when needed, for a limited time, and often with approval workflows. It directly addresses the requirement for temporary elevated access for a specific task, reducing standing privileges and the attack surface. JIT typically integrates with identity governance to enforce least privilege and just-enough administration.

Answer

Session recording

Answer

Password vaulting

Answer

Break-glass accounts

Question 20

Which of the following best describes the purpose of the STIX and TAXII standards in threat intelligence sharing?

Accepted Answer

They standardize the format and exchange of cyber threat intelligence. STIX (Structured Threat Information Expression) is a language for describing threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol for exchanging that intelligence. Together they enable automated sharing of threat data.

Answer

They are tools for analyzing malware behavior in a sandbox environment

Answer

They are used to automatically patch vulnerabilities based on threat feeds

Answer

They provide a framework for conducting incident response exercises