CAS-004 Practice Exam 55 — 20 Questions

Question 1

A virtualization administrator needs to ensure that virtual machines (VMs) from different customers cannot communicate with each other unless explicitly allowed. Which network security control should be implemented on the hypervisor?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a virtual firewall to create per-VM security groups. Micro-segmentation (e.g., NSX) allows fine-grained control over VM-to-VM traffic at the virtual switch level.

Answer

Patch the hypervisor regularly

Answer

Assign each VM to a different physical server

Answer

Enable hypervisor memory overcommitment

Question 2

An organization is concerned about side-channel attacks on its embedded devices. Which of the following is the MOST effective countermeasure against power analysis attacks?

Accepted Answer

Using a constant-time algorithm for cryptographic operations. Power analysis attacks exploit variations in power consumption during cryptographic operations. Constant-time algorithms ensure that execution time and power consumption are independent of secret data, making them the most effective software countermeasure against such attacks. While hardware countermeasures like power randomizers exist, among the given options, constant-time algorithms directly address the root cause of power analysis leakage.

Answer

Encrypting all data in memory

Answer

Disabling debug interfaces

Answer

Increasing the clock speed of the processor

Question 3

Which TWO of the following are essential elements of an effective data governance framework?

Accepted Answer

Data classification policies and procedures. Data classification policies and procedures (Option A) are essential for determining how data should be handled based on sensitivity, while assignment of data stewardship roles (Option C) ensures accountability and ownership. These are core governance elements. Mandatory data localization (Option B) is a regulatory requirement, not a governance framework element. Automated breach notification (Option D) is an operational response process. Full-disk encryption (Option E) is a technical control, not governance. Therefore, the correct answers are A and C.

Answer

Mandatory data localization requirements

Answer

Automated breach notification system

Answer

Implementation of full-disk encryption on all endpoints

Question 4

An organization is migrating to a hybrid cloud model. The security policy mandates that all keys used for data encryption must be managed on-premises. Which key management solution should be used?

Accepted Answer

HSM on-premises with key escrow. An on-premises Hardware Security Module (HSM) with key escrow satisfies the mandate that all encryption keys must be managed on-premises. HSMs provide tamper-resistant, FIPS 140-2 Level 3/4 validated hardware for key generation, storage, and cryptographic operations, while key escrow ensures keys can be recovered by authorized personnel. This combination meets the hybrid cloud requirement of keeping key management entirely within the organization's physical control.

Answer

Cloud KMS with BYOK

Answer

Software-based key store on-premises

Answer

Cloud HSM

Question 5

A developer is implementing input validation for a web application that accepts file uploads. Which of the following is the most secure method to prevent path traversal attacks?

Accepted Answer

Storing files outside the web root directory. Storing uploaded files outside the web root directory (e.g., in a non-public directory like /var/uploads) prevents the attacker from directly accessing or executing files via URL manipulation, even if the filename contains path traversal sequences. This architectural control decouples file storage from the web server's document root, making path traversal attacks ineffective since the web server cannot serve files from outside its configured root.

Answer

Using a whitelist of allowed file extensions

Answer

Sanitizing the filename by removing '../' sequences

Answer

Validating the file size before storage

Question 6

Which TWO of the following are effective defenses against Server-Side Request Forgery (SSRF) attacks? (Select TWO.)

Accepted Answer

Whitelist allowed outbound IP addresses and domains. Whitelisting allowed outbound IP addresses and domains is effective because it restricts the server from making requests to any destination not explicitly permitted, directly preventing SSRF attacks that rely on reaching internal or malicious external hosts. This defense operates at the network or application layer, ensuring that even if an attacker injects a URL, the request is blocked unless it matches the whitelist.

Answer

Use a web application firewall (WAF) to block SSRF signatures

Answer

Enforce strict referrer headers on requests

Answer

Implement input validation on all user-supplied URLs

Question 7

A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)

Accepted Answer

Conducting static application security testing (SAST) during coding. Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.

Answer

Performing penetration testing only after production deployment

Answer

Implementing runtime application self-protection (RASP) in development

Answer

Deploying a web application firewall (WAF) in staging

Question 8

A company wants to protect its intellectual property stored on a file server. The security architect proposes implementing rights management services (RMS) integrated with Active Directory. Which attack is this architecture primarily designed to mitigate?

Accepted Answer

Unauthorized distribution of sensitive documents outside the organization. Rights Management Services (RMS) integrated with Active Directory enables persistent protection of documents by encrypting them and enforcing usage policies (e.g., who can open, print, or forward) regardless of where the file resides. This architecture is specifically designed to prevent unauthorized distribution of sensitive documents outside the organization because the protection travels with the file and requires authentication to an RMS server for decryption, even if the file is copied or emailed externally.

Answer

Phishing attacks targeting user credentials

Answer

Malware infection on the file server

Answer

Buffer overflow attack on the file server

Question 9

An organization is deploying a new cloud-based application that processes personally identifiable information (PII). The security team must ensure data at rest is encrypted. Which THREE of the following controls should be implemented to protect the data? (Select THREE.)

Accepted Answer

Implement a key management system (KMS) with automatic key rotation.. A key management system (KMS) with automatic key rotation ensures that encryption keys are securely stored, rotated, and managed, which is essential for protecting data at rest. Without proper key management, encryption can be rendered ineffective if keys are compromised or stale. This control directly supports the confidentiality of PII stored in the cloud.

Answer

Use tokenization for all PII fields in the database.

Answer

Configure TLS 1.3 for all data connections.

Question 10

A security engineer is hardening a Linux server. Which TWO of the following are best practices for preventing privilege escalation attacks?

Accepted Answer

Apply kernel hardening with sysctl. Options B and C are correct. Kernel hardening with sysctl (B) reduces the attack surface by disabling unnecessary kernel features and enforcing security settings (e.g., restricting dmesg, kernel pointer access). SELinux in enforcing mode (C) provides mandatory access control, limiting process capabilities and confining exploits even if a service is compromised. Option A is incorrect because disabling all non-root user accounts is impractical, violates the principle of least privilege, and does not directly prevent privilege escalation. Option D is incorrect because removing the SUID bit from all binaries is too broad; some SUID binaries are essential (e.g., sudo, passwd) and removing them breaks functionality without necessarily preventing escalation. Option E is incorrect; while restricting cron jobs to root may limit cron-based attacks, it is not a primary best practice for preventing privilege escalation and can break legitimate scheduled tasks.

Answer

Disable all user accounts except root

Answer

Remove the SUID bit from all binaries

Answer

Restrict cron jobs to root only

Question 11

Which THREE components are essential for a fully functional Security Operations Center (SOC)? (Select exactly 3.)

Accepted Answer

Incident response team. Options A, C, and E are correct because SIEM for correlation, incident response team, and playbooks are core. Option B is a security control but not a SOC component. Option D is network infrastructure.

Answer

VPN concentrator

Answer

Firewall

Question 12

Refer to the exhibit. A security analyst notices that the pod is running with a service account token mounted. Which security best practice should be implemented to reduce the risk of token theft in container environments?

Accepted Answer

Set automountServiceAccountToken to false in the pod spec.. Setting automountServiceAccountToken to false in the pod spec prevents the automatic mounting of the service account token, reducing the risk of theft. Option A is incorrect because storing the token in a Kubernetes secret and mounting it still exposes the token, increasing rather than reducing risk. Option B is incorrect because changing the container runtime does not address the token mounting issue. Option C is incorrect because disabling the entire service account may break functionality if the pod needs API access; the goal is to prevent token exposure while still allowing explicit token mounting if necessary.

Answer

Store the token in a Kubernetes secret and mount it.

Answer

Use a different container runtime.

Answer

Disable the service account for the pod.

Question 13

A financial institution is adopting a new vendor-managed SaaS platform for customer data processing. The CISO wants to ensure the vendor's security controls meet regulatory requirements before data is transferred. Which of the following should be completed FIRST?

Accepted Answer

Perform a third-party risk assessment.. Before transferring sensitive customer data to a new vendor-managed SaaS platform, the CISO must first perform a third-party risk assessment to evaluate the vendor's security posture against regulatory requirements (e.g., GDPR, PCI DSS). This assessment reviews the vendor's SOC 2 reports, ISO 27001 certification, and contractual security controls, ensuring compliance before any technical testing or data transfer occurs. Without this initial risk evaluation, subsequent technical controls like penetration tests or DLP may be premature or misaligned with regulatory obligations.

Answer

Execute a penetration test on the SaaS platform.

Answer

Implement data loss prevention controls.

Answer

Conduct a vulnerability assessment of the vendor's network.

Question 14

A company is implementing a SIEM solution and needs to ensure that logs from network devices, servers, and endpoints are collected in a consistent format. Which protocol should be used to transport logs securely?

Accepted Answer

Syslog over TLS. Syslog over TLS provides encryption and reliable delivery for log transport. Option A (Syslog over UDP) is unencrypted and unreliable. Option C (SFTP) is a file transfer protocol, not suitable for real-time log streaming. Option D (SNMP traps) is used for network management alerts, not comprehensive log collection.

Answer

Syslog over UDP

Answer

SFTP

Answer

SNMP traps

Question 15

A SOC analyst receives an alert indicating that a workstation has been making outbound connections to a known command-and-control (C2) IP address. The analyst initiates the incident response process. Which of the following should be the FIRST action taken?

Accepted Answer

Isolate the workstation from the network.. The first priority in incident response is to contain the threat to prevent further damage. Option D, isolating the workstation, stops the C2 communication and limits lateral movement. Option A (running a full antivirus scan) is reactive and may alert the attacker. Option B (notifying management and legal) is important but not first. Option C (deleting suspicious files) is premature without analysis.

Answer

Run a full antivirus scan on the affected workstation.

Answer

Notify the organization's management and legal team.

Answer

Delete the suspicious files identified by the antivirus.

Question 16

A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)

Accepted Answer

Exploit public-facing application. Options A, B, and C are correct. Exploiting a public-facing application (A), spear-phishing attachment (B), and valid accounts (C) are all common techniques for initial access according to the MITRE ATT&CK framework. Option D (remote services) is typically associated with lateral movement, not initial access. Option E (boot or logon autostart execution) is a persistence technique.

Answer

Remote services

Answer

Boot or logon autostart execution

Question 17

During a penetration test, the tester has gained initial access to a network and now aims to move laterally to a sensitive database server. Which phase of the penetration testing lifecycle does this activity represent?

Accepted Answer

Post-exploitation. Lateral movement occurs after initial access is gained, which is the defining characteristic of the post-exploitation phase. In the penetration testing lifecycle, post-exploitation encompasses activities such as lateral movement, privilege escalation, and data exfiltration, whereas exploitation focuses on gaining the initial foothold through vulnerabilities.

Answer

Exploitation

Answer

Reporting

Answer

Reconnaissance

Question 18

A SOC wants to improve detection of advanced persistent threats (APTs) that evade traditional signature-based tools. Which TWO approaches are most effective? (Select exactly 2.)

Accepted Answer

Deploy honeypots and deception technology. Options D and E are correct. Deploying honeypots and deception technology (D) helps detect APTs by luring attackers into revealing themselves, while integrating external threat intelligence feeds (E) enables the SIEM to detect known indicators of compromise that may evade traditional signatures. Option A reduces false positives but does not directly improve APT detection. Option B increases log retention but does not enhance detection capability. Option C adds analysts, which is not a technology-based approach and less effective for detecting APTs that bypass signatures.

Answer

Reduce the false positive rate of the SIEM

Answer

Increase log retention period to 12 months

Answer

Hire additional security analysts

Question 19

A security operations team wants to improve their threat intelligence program. Which THREE of the following are most important for ensuring that threat intelligence is actionable and effectively integrated into security operations?

Accepted Answer

Ensure threat intelligence feeds provide timely indicators of compromise (IOCs) that are less than 24 hours old.. For threat intelligence to be actionable and effectively integrated into security operations, timeliness (A) ensures that IOCs are relevant for current threats. Integration with SIEM and SOAR platforms (C) automates correlation and response, reducing manual effort. Context such as targeted sectors, attacker motivations, and TTPs (E) allows prioritization and informed decision-making. Option B (anonymity) is not a key quality; intelligence sources should be credible, not necessarily anonymous. Option D (subscribing to many feeds) can lead to noise and alert fatigue, diluting the value of intelligence.

Answer

Require that all threat intelligence sources are completely anonymous to ensure unbiased reporting.

Answer

Subscribe to as many threat intelligence feeds as possible to maximize coverage.

Question 20

A security operations center (SOC) analyst is investigating an alert from an EDR tool indicating that a workstation executed a suspicious PowerShell command that decoded a base64 string. The decoded string contained a command to download a file from an external IP address. Which stage of the cyber kill chain does this activity most likely represent?

Accepted Answer

Actions on Objectives. The described activity—executing a PowerShell command that decodes a base64 string and downloads a file from an external IP—occurs after the attacker has already gained initial access. This is characteristic of the Actions on Objectives stage, where the attacker performs actions to achieve their goals, such as downloading additional tools for lateral movement, data exfiltration, or persistence. It is not Exploitation, which involves triggering the initial vulnerability to gain access; here, that access has already been established and the attacker is now taking further action.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation