CAS-004 Practice Exam 55 — 20 Questions

Question 1

An organization wants to implement a zero-trust architecture for remote access. Which of the following is the MOST important component?

Accepted Answer

Micro-segmentation. Micro-segmentation is the most important component for zero-trust remote access because it enforces granular, identity-based access controls that limit lateral movement within the network. Unlike perimeter-based models, zero-trust assumes no implicit trust, and micro-segmentation ensures that even after authentication, each remote session is isolated to only the specific resources required, reducing the attack surface.

Answer

RAID 5

Answer

Syslog server

Answer

VPN concentrator

Question 2

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

Accepted Answer

Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.. Tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.

Answer

Aggregate all logs from all sources and create a single correlation rule for each attack type.

Answer

Use the default correlation rules provided by the SIEM vendor without modification.

Answer

Block all traffic from external IP addresses that are not on the organization's whitelist.

Question 3

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

Accepted Answer

Isolating workloads at the virtual network interface level with granular security policies. Micro-segmentation in a zero trust architecture isolates individual workloads at the virtual network interface level and enforces granular, per-workload security policies. This limits lateral movement because each workload becomes its own security zone, and traffic between workloads is explicitly allowed or denied based on identity and policy rather than network location. It is a foundational zero trust control that assumes no implicit trust based on being 'inside' the network.

Answer

Creating a single perimeter around the entire network

Answer

Using VLANs to separate departments

Answer

Implementing a VPN for remote access

Question 4

A security administrator needs to automate the process of revoking access for terminated employees across multiple cloud services. Which scripting approach would best minimize the risk of errors and ensure consistent execution?

Accepted Answer

Use a configuration management tool like Ansible with a playbook that calls cloud provider modules using encrypted vault files for credentials.. Ansible playbooks with encrypted vault files provide idempotent, repeatable automation across multiple cloud services without exposing credentials in plaintext. The use of dedicated cloud provider modules (e.g., aws_iam, gcp_iam) abstracts API complexities and ensures consistent revocation logic, minimizing human error compared to ad-hoc scripting.

Answer

Create a shell script that relies on environment variables containing API keys.

Answer

Write a Python script using separate API calls for each service with hardcoded credentials.

Answer

Manually execute commands each time an employee is terminated.

Question 5

A data loss prevention (DLP) solution is being implemented to prevent sensitive data from leaving the corporate network. Which of the following is the most effective approach for detecting structured data like credit card numbers in outbound traffic?

Accepted Answer

Regular expression matching. Regular expression matching is the most effective approach for detecting structured data like credit card numbers because it can match the specific pattern (e.g., 16 digits with optional separators) and validate format, such as the Luhn check in some DLP engines. This provides high precision for well-defined formats like PANs, SSNs, and IBANs.

Answer

Keyword matching

Answer

Machine learning classification

Answer

Exact file hash matching

Question 6

In the shared responsibility model for cloud security, which of the following is generally the responsibility of the cloud customer?

Accepted Answer

Configuration of network access controls. In the cloud shared responsibility model, the customer is always responsible for 'security IN the cloud' — their data, configurations, and access controls. Network access control configuration (security groups, NACLs, firewall rules) is a customer-managed setting in IaaS/PaaS, so option A is correct. The provider handles 'security OF the cloud' — physical, host, and hypervisor layers.

Answer

Hardware maintenance of servers

Answer

Hypervisor vulnerability patching

Answer

Physical security of data centers

Question 7

During a security audit, it is discovered that a critical server uses SSH with password authentication and supports weak key exchange algorithms. Which of the following is the most effective hardening step to prevent brute-force attacks and ensure forward secrecy?

Accepted Answer

Disable password authentication and restrict key exchange algorithms to curve25519-sha256. Disabling password authentication forces the use of key-based authentication, which is resistant to brute-force attacks. Restricting key exchange algorithms to those providing forward secrecy (e.g., Curve25519) ensures that session keys cannot be compromised even if the long-term private key is exposed.

Answer

Implement fail2ban to block IPs after failed attempts

Answer

Change the SSH port to a non-default high port

Answer

Use RSA keys with 4096-bit length

Question 8

An organization wants to collect threat intelligence from multiple Information Sharing and Analysis Centers (ISACs) relevant to their industry. Which of the following is a primary benefit of participating in an ISAC?

Accepted Answer

Timely and relevant threat data from peers. ISACs provide a trusted community for sharing threat intelligence, early warnings, and best practices, helping members defend against sector-specific threats.

Answer

Free penetration testing services

Answer

Access to proprietary threat intelligence feeds

Answer

Ability to share sensitive information anonymously

Question 9

A security operations team is developing a SOAR playbook to automate response to a detected ransomware outbreak. The team wants to ensure the playbook can contain the threat quickly while minimizing business disruption. Which TWO actions should the playbook include as automated responses? (Select TWO.)

Accepted Answer

Block outbound traffic to known malicious IP addresses and domains. Option D is correct because blocking outbound traffic to known malicious IP addresses and domains (e.g., via firewall, proxy, or DNS sinkhole rules) severs command-and-control (C2) and exfiltration channels, which is a fast, low-disruption containment action that prevents the ransomware from receiving instructions or leaking data. Option E is correct because isolating affected endpoints from the network (for example, via EDR network containment or switch port/VLAN quarantine) stops lateral movement and further encryption or spread while leaving the hosts powered on for forensic memory capture and recovery. Option A is not appropriate as an automated containment response because a full antivirus scan is slow, resource-intensive, and does not stop an active outbreak. Option B is not appropriate because automatically restoring all systems from backup can overwrite forensic evidence, reintroduce malware if the backup is compromised, and cause major business disruption before the threat is contained. Option C is not appropriate because powering off affected servers immediately destroys volatile memory evidence, can corrupt encrypted or in-flight data, and may disrupt critical services more than isolation would.

Answer

Run a full antivirus scan on all systems

Answer

Restore all systems from the latest backup automatically

Answer

Power off all affected servers immediately

Question 10

An organization is deploying a new IoT device that must securely update its firmware over the air (OTA). The device has limited processing power and memory. Which cryptographic solution would provide the BEST balance of security and performance for verifying firmware updates?

Accepted Answer

Ed25519 digital signatures. Ed25519 is a fast and secure digital signature algorithm that performs well on constrained devices. RSA 4096 is computationally expensive. HMAC-SHA256 is a symmetric key technique and requires key management overhead. AES-256-GCM is for encryption, not verification.

Answer

RSA-4096 digital signatures

Answer

HMAC-SHA256 with pre-shared key

Answer

AES-256-GCM for authentication

Question 11

Based on the exhibit, what is the primary purpose of the condition in this IAM policy?

Accepted Answer

Restrict access to requests originating from the specified IP ranges. The condition in the IAM policy uses the `aws:SourceIp` key to restrict access to requests originating from the specified IP ranges. Option A is incorrect because the condition does not address encryption in transit. Option B is incorrect because the policy does not allow all traffic; it allows only requests from the specified IPs. Option C is incorrect because the policy is an allow with a condition, not a deny statement. The condition effectively limits which IPs can perform the allowed actions, making D the primary purpose.

Answer

Enable encryption in transit for the S3 bucket

Answer

Allow all incoming traffic to the S3 bucket

Answer

Deny access from the specified IP ranges

Question 12

A security analyst is reviewing web server logs and notices repeated requests to URLs containing sequences like '/../../../etc/shadow' and '/../../../etc/passwd'. Which TWO actions should the analyst take as part of the immediate incident response process?

Accepted Answer

Check for successful exploitation by reviewing file access logs. Option A is correct because the log entries show directory traversal attempts targeting sensitive files like /etc/shadow and /etc/passwd, so the analyst must determine whether any request actually succeeded by correlating web server logs with file access logs (e.g., auditd or file integrity monitoring) to confirm compromise. Option B is correct because blocking the attacking source IP at the firewall is a standard immediate containment step that stops ongoing exploitation attempts while investigation continues. Option C is not appropriate as an immediate response since antivirus scanning targets malware, not directory traversal exploitation of a web application. Option D is premature because rebuilding from backup is a recovery action that should only follow confirmed compromise and root-cause analysis. Option E is overly disruptive; disabling the web server is not warranted unless exploitation is confirmed and no other containment is feasible.

Answer

Run a full antivirus scan on the web server

Answer

Rebuild the web server from a known good backup

Answer

Disable the web server until a patch is applied

Question 13

A security analyst is analyzing a network capture and sees repeated TCP SYN packets to a host but no SYN-ACK responses. Which TWO conclusions are MOST likely? (Choose two.)

Accepted Answer

A firewall is dropping the SYN packets before they reach the host.. Option D is correct because a firewall rule silently dropping inbound SYN packets would prevent the target host from ever receiving them, so no SYN-ACK would be generated and the capture would show repeated SYNs with no replies. Option E is correct because a SYN flood DDoS attack sends many TCP SYN packets, often with spoofed source addresses, and the victim either never responds or exhausts its backlog, producing the same pattern of unanswered SYNs. Option A is not the best conclusion because a full TCP receive window affects established connections and would typically still involve SYN-ACKs or window advertisements, not a total absence of SYN-ACKs. Option B is not supported because a network loop would duplicate frames, including any SYN-ACKs, rather than selectively eliminate all SYN-ACK responses. Option C is incorrect because accepted connections require the three-way handshake, meaning a SYN-ACK would be observed, which contradicts the capture.

Answer

The host is out of TCP receive window space.

Answer

The network has a loop causing packet duplication.

Answer

The host has accepted the connections.

Question 14

An organization has a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. The application is required for business operations and is accessible only from the internal network. Which compensating control would best reduce the risk of exploitation while maintaining availability?

Accepted Answer

Implement network segmentation and strict ACLs to limit access to the application. Network segmentation with strict ACLs limits who can reach the legacy application, reducing the attack surface while keeping it available to authorized internal users. This is a classic compensating control when patching is impossible — it does not fix the vulnerability but constrains exploitability and blast radius.

Answer

Deploy a host-based intrusion prevention system (HIPS) on the server

Answer

Apply a vendor-supplied patch

Answer

Uninstall the application

Question 15

A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?

Accepted Answer

Security information and event management (SIEM) with behavior analytics. A SIEM with User and Entity Behavior Analytics (UEBA) is most effective for reducing MTTD because it baselines normal behavior and detects anomalies in real time, enabling early detection of threats. Full disk encryption (B) protects data at rest but does not aid detection. A DLP system (C) focuses on preventing data exfiltration, not broad detection. A NIDS (D) relies on signature matching, which can miss novel or subtle attacks and typically has a higher detection latency than behavior analytics.

Answer

Full disk encryption software

Answer

Data loss prevention (DLP) system

Answer

Network-based intrusion detection system (NIDS)

Question 16

A security analyst is performing a quantitative risk assessment for a server that processes payment card data. The server has an asset value of $50,000. Based on historical data, the exposure factor (EF) for a ransomware attack is 80%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$20,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE is Asset Value (AV) times Exposure Factor (EF). Here, AV = $50,000, EF = 0.8, so SLE = $40,000. ARO = 0.5, so ALE = $40,000 * 0.5 = $20,000.

Answer

$40,000

Answer

$50,000

Answer

$25,000

Question 17

A security administrator is configuring a firewall to allow only encrypted remote administration traffic to a server. The administrator wants to use a protocol that provides confidentiality and integrity for the management session. Which of the following should be used?

Accepted Answer

SSH. SSH is designed for secure remote administration, providing encryption and integrity. Telnet and HTTP are plaintext, and SNMPv3 without privacy lacks encryption. Only SSH meets the requirement for encrypted management traffic.

Answer

HTTP over port 8080

Answer

Telnet

Answer

SNMPv3 without privacy

Question 18

A healthcare organization is architecting a microsegmentation strategy for its hybrid data center. The security architect must limit lateral movement between workloads, enforce policy based on workload identity rather than IP addresses, and maintain visibility into inter-workload flows. Which TWO of the following controls BEST support these requirements? (Choose two.)

Accepted Answer

Deploy a software-defined perimeter (SDP) controller that authenticates endpoints before granting access to protected workload segments.. A software-defined perimeter and a service mesh with mutual TLS both base access decisions on authenticated workload identity rather than IP addresses, which limits lateral movement and supports visibility into inter-workload flows. The other controls either rely on static IP or zone constructs, or address layer 2 threats without providing identity-based segmentation.

Answer

Enable dynamic ARP inspection and DHCP snooping on all access-layer switches.

Answer

Place all workloads behind a next-generation firewall and create zone-based policies for north-south traffic.

Answer

Implement host-based firewalls with rules based on IP address ranges that mirror the existing VLAN segmentation.

Question 19

A security architect is designing a microsegmentation strategy for a data center that hosts both legacy virtual machines and modern containerized workloads. The architect must ensure that security policies follow the workload regardless of its location and that lateral movement is restricted even if a host is compromised. (Choose two.)

Accepted Answer

Implement a host-based firewall on each virtual machine that enforces allow-list rules based on workload tags. Host-based firewalls with tag-based rules and an SDN overlay using identity-based security groups both enforce policy at the workload level, ensuring that protections follow the workload regardless of location. These controls restrict lateral movement even if a host is compromised, unlike perimeter or physical segmentation approaches.

Answer

Enable port security on all physical switch ports to limit MAC addresses

Answer

Deploy a centralized next-generation firewall (NGFW) at the data center perimeter to inspect all north-south traffic

Answer

Segment the network into VLANs based on physical rack location and apply ACLs between VLANs

Question 20

A security analyst is investigating a compromised Linux web server. The analyst needs to preserve volatile evidence before shutting the system down for forensic imaging. Which action should the analyst perform FIRST?

Accepted Answer

Capture the contents of physical memory and the current network connections.. Forensic handling follows the order of volatility, so the most transient data is collected first. RAM and network connections vanish on power loss or reboot, while disk contents persist. Capturing memory and live connections before imaging or analysis preserves evidence that would otherwise be unrecoverable.

Answer

Create a forensic image of the server's disk drives.

Answer

Review the application and system logs for signs of intrusion.

Answer

Shut down the server gracefully to prevent further attacker activity.