CAS-004 Practice Exam 54 — 20 Questions

Question 1

A Windows administrator needs to automate the retrieval of failed login events from the Security log. Which scripting language is most native and efficient for this task?

Accepted Answer

PowerShell. PowerShell is the most native and efficient scripting language for automating the retrieval of failed login events from the Windows Security log because it provides direct access to the Windows Event Log via the Get-WinEvent cmdlet, which can filter for Event ID 4625 (failed logon) using XPath queries or FilterHashtable for optimal performance. It runs natively on Windows without additional dependencies and integrates seamlessly with the .NET framework and Windows Management Instrumentation (WMI), making it the default automation tool for Windows administrators.

Answer

Bash

Answer

Ruby

Answer

Python

Question 2

A SOC team is implementing a SOAR playbook to automate response to phishing emails reported by users. Which step should be included in the playbook to prevent other users from accessing the malicious link?

Accepted Answer

Block the malicious URL in the web proxy. URL blocking in a web proxy prevents other users from accessing the malicious link, which is a common automated response in phishing playbooks.

Answer

Isolate the reporter's workstation

Answer

Reset the reporter's password

Answer

Delete the email from all mailboxes

Question 3

An organization is hardening its Kubernetes cluster. Which THREE of the following are effective controls to limit the blast radius of a compromised container?

Accepted Answer

Implementing Kubernetes network policies to restrict pod-to-pod communication. Network policies restrict communication between pods, limiting lateral movement. Seccomp profiles restrict system calls, reducing attack surface. Pod Security Standards (PSS) enforce security contexts like not running as root. RBAC controls user access, not container-to-container. Image scanning identifies vulnerabilities but does not limit blast radius.

Answer

Using RBAC to restrict service account permissions

Answer

Performing regular container image scanning for vulnerabilities

Question 4

An organization is automating cloud security group management across AWS, Azure, and GCP. Which TWO approaches provide centralized, auditable control? (Select TWO.)

Accepted Answer

Leverage infrastructure as code tools (e.g., Terraform) to define and enforce security group rules.. Infrastructure as Code (IaC) tools like Terraform provide a declarative, version-controlled, and repeatable method to define and enforce security group rules across AWS, Azure, and GCP. This approach ensures that all changes are auditable through code repositories (e.g., Git), and can be automatically validated and applied via CI/CD pipelines, eliminating manual drift and providing centralized control.

Answer

Require manual approval for every security group change through a ticketing system.

Answer

Disable logging on security group changes to reduce performance impact.

Answer

Store service account credentials directly in automation scripts for simplicity.

Question 5

Which TWO of the following are best practices for securing a database that stores personally identifiable information (PII)? (Select TWO.)

Accepted Answer

Encrypt data at rest using AES-256. Encrypting data at rest using AES-256 ensures that even if the underlying storage media is compromised, the PII remains unreadable without the decryption key. AES-256 is a symmetric encryption standard approved by NIST for protecting sensitive data, providing a strong cryptographic barrier against unauthorized access.

Answer

Use default admin credentials for easy access

Answer

Enable audit logging for all queries

Answer

Store all data in plaintext for performance

Question 6

A developer needs to securely store user passwords in a database. Which hashing technique is recommended for password storage?

Accepted Answer

bcrypt with a per-user salt. Bcrypt is recommended for password storage because it incorporates a per-user salt to prevent rainbow table attacks and uses a configurable cost factor to slow down brute-force attempts, making it resistant to GPU-based cracking. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password hashing with built-in salting and adaptive work factor.

Answer

SHA-256 with a random salt

Answer

MD5 with a static salt

Answer

Base64 encoding

Question 7

An organization is evaluating risk treatment options for a critical vulnerability with a CVSS score of 9.8. The cost to remediate is $500,000, and the potential loss if exploited is estimated at $2,000,000. Which risk response is most appropriate?

Accepted Answer

Remediate the vulnerability. With a CVSS score of 9.8 (critical) and a potential loss of $2,000,000, the cost to remediate ($500,000) is significantly lower than the expected loss. Remediation reduces the risk to an acceptable residual level, making it the most cost-effective response. This aligns with the principle that when the cost of remediation is less than the potential loss, the organization should directly fix the vulnerability.

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Answer

Avoid the risk by decommissioning the affected system

Question 8

Which TWO of the following are advantages of using a hardware security module (HSM) over a software-based cryptographic module? (Select exactly 2.)

Accepted Answer

Physical tamper resistance and protection against key extraction.. Options C and E are correct. A hardware security module (HSM) provides physical tamper resistance and dedicated hardware accelerators, making cryptographic operations faster and more secure than software-based modules. Option A is incorrect because HSMs are generally harder to deploy in cloud environments due to physical hardware requirements. Option B is incorrect because HSMs do not automatically receive security patches; they require manual updates and careful management. Option D is incorrect because HSMs are typically more expensive than software-based cryptographic modules.

Answer

Easier to deploy in cloud environments than software.

Answer

Automatically receive security patches without manual intervention.

Answer

Lower cost than software modules.

Question 9

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

Accepted Answer

The policy violates the principle of least privilege. The IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Answer

The policy restricts access to specific resources

Answer

The policy does not enable logging

Answer

The policy does not allow any actions

Question 10

A company is developing a new mobile app that will process users' biometric data for authentication. The legal team is concerned about compliance with the GDPR's data protection by design. Which of the following is the MOST appropriate control to implement?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) before development.. Conducting a Data Protection Impact Assessment (DPIA) before development is the most appropriate control because GDPR Article 35 mandates a DPIA when processing biometric data is likely to result in high risk to individuals' rights and freedoms. This aligns with the principle of data protection by design (Article 25), requiring privacy considerations to be embedded into the development process from the outset, not added later.

Answer

Obtain explicit consent from users before data collection.

Answer

Store biometric data in hashed form on the device.

Answer

Implement strong encryption for data in transit and at rest.

Question 11

A security team discovers a misconfiguration that exposes sensitive data. The operations team wants to wait until the next maintenance window. What is the BEST course of action?

Accepted Answer

Immediately fix the misconfiguration. When a misconfiguration exposes sensitive data, the security team must prioritize immediate remediation to prevent data exfiltration or regulatory penalties. Waiting for a maintenance window violates the principle of timely risk mitigation, especially when the exposure is active and exploitable. The best course of action is to fix the misconfiguration immediately, even if it requires a temporary service disruption, as the risk of data breach outweighs operational convenience.

Answer

Document the risk and accept it

Answer

Notify the data protection authority

Answer

Implement a temporary workaround

Question 12

An organization is migrating sensitive customer data to a public cloud. Which of the following actions best demonstrates due diligence for compliance with GDPR?

Accepted Answer

Conducting a data protection impact assessment (DPIA).. A Data Protection Impact Assessment (DPIA) is a mandatory requirement under GDPR Article 35 for processing activities that are likely to result in high risk to individuals' rights and freedoms, such as migrating sensitive customer data to a public cloud. Conducting a DPIA demonstrates due diligence by systematically identifying, assessing, and mitigating privacy risks before the migration begins, ensuring compliance with GDPR's accountability principle.

Answer

Enabling server-side encryption on the cloud storage.

Answer

Obtaining explicit consent from all data subjects.

Answer

Signing a data processing agreement (DPA) with the cloud provider.

Question 13

When evaluating the security architecture of a containerized application, which THREE of the following practices should be implemented to minimize the attack surface? (Select THREE.)

Accepted Answer

Use minimal base images (e.g., Alpine Linux) instead of full OS images. Using minimal base images like Alpine Linux reduces the number of installed packages, libraries, and utilities, which directly shrinks the attack surface by eliminating unnecessary components that could contain vulnerabilities. This practice aligns with the principle of least functionality, ensuring only essential binaries are present in the container image.

Answer

Encrypt sensitive data at rest within the container

Answer

Implement multi-factor authentication for container registries

Question 14

An organization is using the FAIR framework to quantify risk. The analyst estimates the probable loss event frequency (LEF) as 4 per year and the probable loss magnitude (LM) as $25,000 per event. What is the annualized loss expectancy (ALE) under FAIR?

Accepted Answer

$100,000. In FAIR, ALE = LEF × LM. Here, LEF=4 and LM=$25,000, so ALE = 4 × $25,000 = $100,000.

Answer

$6,250

Answer

$125,000

Answer

$25,000

Question 15

A multinational organization is subject to GDPR and local data protection laws. A data subject from country X requests deletion of personal data, but the data is also required for a legal hold under country Y's law. What is the BEST course of action?

Accepted Answer

Retain the data and inform the data subject of the conflicting legal obligation. When a legal hold under country Y's law conflicts with a GDPR deletion request, the organization must retain the data to comply with the legal obligation and inform the data subject of the conflicting legal requirement. GDPR Article 17(3)(e) explicitly allows retention when necessary for compliance with a legal obligation under Union or Member State law. This balances the data subject's right to erasure with overriding legal holds, which are common in e-discovery and litigation scenarios.

Answer

Anonymize the data to satisfy both requirements

Answer

Escalate to the data protection authority

Answer

Delete the data to comply with GDPR

Question 16

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 17

A company is implementing continuous compliance monitoring for PCI DSS. Which TWO activities are most appropriate for this approach? (Select TWO.)

Accepted Answer

Automated daily file integrity monitoring on critical systems. Continuous compliance monitoring involves automated, ongoing checks that run frequently or in real-time. Automated daily file integrity monitoring (B) detects unauthorized changes to critical systems on a continuous basis, while real-time monitoring of firewall and intrusion detection system logs (E) provides immediate alerting of security events. In contrast, quarterly vulnerability scanning (D) is periodic, not continuous, and annual audits or manual monthly reviews (A, C) are point-in-time assessments that do not meet the continuous monitoring requirement.

Answer

Manual review of access logs every month

Answer

Annual on-site audit by a Qualified Security Assessor (QSA)

Answer

Automated quarterly vulnerability scanning of the cardholder data environment

Question 18

A security analyst is reviewing an AppArmor profile for an application. Based on the exhibit, which action would the application be denied?

Accepted Answer

Write to a file in /etc/config/. AppArmor profiles restrict applications by path and capability. The profile shown does not include any rule allowing write access to /etc/config/, so any write attempt to that directory or its files would be denied. This is because AppArmor enforces mandatory access control based on the profile's explicit allow rules.

Answer

Send a UDP packet to a remote server

Answer

Override discretionary access controls

Answer

Write to /var/log/app.log

Question 19

An organization is adopting a SASE architecture to provide secure access to cloud applications. Which component is essential for enforcing security policies based on user identity and device posture?

Accepted Answer

Zero Trust Network Access (ZTNA). SASE converges networking and security functions, with the Security Service Edge (SSE) component including SWG, CASB, ZTNA, and FWaaS. While CASB focuses on data security and compliance for cloud applications, ZTNA is the component specifically designed to enforce security policies based on user identity and device posture, providing granular access control regardless of location.

Answer

Firewall as a Service (FWaaS)

Answer

Secure Web Gateway (SWG)

Answer

Cloud Access Security Broker (CASB)

Question 20

Refer to the exhibit. A security analyst is reviewing the firewall rule set for a corporate network. Which misconfiguration is present?

Accepted Answer

No default deny rule present. The rule set lacks an explicit deny rule at the end. Without a default deny, traffic that does not match any rule may be implicitly permitted depending on the firewall platform. Most security best practices require a deny-all trailing rule to ensure only explicitly allowed traffic passes.

Answer

Overly permissive source IP addresses

Answer

Unnecessary allowed ports

Answer

Missing logging on permit rules