CAS-004 Practice Exam 56 — 20 Questions

Question 1

A financial organization's SOC analysts have observed repeated failed authentication attempts from a single external IP address against multiple user accounts, followed by a successful authentication from the same IP using one of those accounts. Which type of security monitoring rule would be most effective at detecting this attack pattern in real time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Alert when multiple failed logins from a single source IP are followed by a successful login from that IP within 10 minutes.. The observed attack pattern is a credential stuffing attempt: multiple failed logins from a single external IP followed by a successful login from that same IP. Option A directly detects this by correlating multiple failures and a subsequent success from the same source IP within a short time window. This is the most effective real-time detection rule for such behavior. Option B targets a single user account, not the source IP, so it would miss the pattern if the attacker uses different users. Option C is unrelated (password reset success). Option D would generate excessive false positives by alerting on any single failure.

Answer

Alert when a user account has three failed logins within 5 minutes followed by a successful login.

Answer

Alert when a successful authentication occurs immediately after a password reset.

Answer

Alert on any single failed login attempt from an external IP.

Question 2

A security analyst is reviewing web server logs and notices repeated requests to URLs containing sequences like '/../../../etc/shadow' and '/../../../etc/passwd'. Which TWO actions should the analyst take as part of the immediate incident response process?

Accepted Answer

Check for successful exploitation by reviewing file access logs. The correct immediate actions are A and B. Checking for successful exploitation (A) is crucial to determine if the attacker accessed sensitive files like /etc/shadow or /etc/passwd, which would indicate a breach requiring further response. Blocking the source IP at the firewall (B) stops further exploitation attempts from that address. Running a full antivirus scan (C) is not directly relevant to a directory traversal attack, which exploits application logic rather than malware. Rebuilding the web server from backup (D) is premature before confirming compromise, and disabling the server (E) is too disruptive when containment via IP blocking suffices.

Answer

Run a full antivirus scan on the web server

Answer

Rebuild the web server from a known good backup

Answer

Disable the web server until a patch is applied

Question 3

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

Accepted Answer

Avoid the risk by not collecting unnecessary personal data. With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

Answer

Transfer the risk through cyber insurance

Answer

Mitigate the risk by encrypting personal data

Answer

Accept the risk and self-insure

Question 4

A cloud security team uses AWS and has configured a virtual private cloud (VPC) with a public subnet for a web application. The web servers in the public subnet have security groups that allow inbound HTTP/HTTPS from 0.0.0.0/0. The security team receives an alert that an EC2 instance in the public subnet is making outbound connections to an IP address that is listed on a threat intelligence feed as a known mining pool. The instance's security group allows all outbound traffic. The team suspects the instance is compromised and running cryptocurrency mining malware. Which of the following should be the FIRST action to take?

Accepted Answer

Isolate the instance by revoking its security group egress rules temporarily to prevent further communication.. The first action should be to isolate the instance to immediately stop communication with the mining pool. This is achieved by revoking the security group egress rules (Option A), which contains the threat. Option B (running a scan) allows the attack to continue. Option C (terminating after snapshot) loses volatile evidence. Option D (inbound rule) does not block outbound connections.

Answer

Start a full antivirus scan on the instance and monitor the network logs.

Answer

Take a forensic snapshot of the instance and then terminate it.

Answer

Modify the security group inbound rules to block traffic from the miner IP only.

Question 5

A security analyst at a large enterprise notices that several servers have missing security patches that are critical. The patch management process requires approval from the change advisory board (CAB) which meets weekly. The next meeting is in three days, but the vulnerability is being actively exploited. What should the analyst do?

Accepted Answer

Implement temporary compensating controls until the CAB approves.. When a critical vulnerability is being actively exploited, the security analyst must prioritize risk mitigation over standard change management processes. Implementing temporary compensating controls (e.g., network segmentation, host-based firewall rules, or disabling the vulnerable service) reduces the attack surface immediately while still seeking formal CAB approval for the permanent patch. This balances the need for rapid response with the enterprise's governance requirements.

Answer

Apply the patches immediately without waiting for CAB approval.

Answer

Notify the system owners and leave the decision to them.

Answer

Document the issue and wait for the CAB meeting.

Question 6

A security analyst discovers that a web application is vulnerable to directory traversal. Which of the following is the MOST effective mitigation?

Accepted Answer

Whitelist of allowed file paths. A whitelist of allowed file paths is the most effective mitigation because it defines an explicit set of permissible paths, preventing any unauthorized file access regardless of traversal attempts. Unlike input validation, which can be bypassed with encoding or alternative traversal sequences, a whitelist enforces a positive security model that blocks all unspecified paths, including those using '..' or symbolic links. This approach directly addresses the root cause of directory traversal by restricting the application to only known-safe resources.

Answer

Encrypting all files on the server

Answer

Chroot jail

Answer

Input validation that rejects paths containing '..'

Question 7

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Under HIPAA, a healthcare organization must have a Business Associate Agreement (BAA) in place with any cloud provider that handles protected health information (ePHI). The BAA contractually obligates the provider to safeguard ePHI and comply with HIPAA Privacy and Security Rules. The fact that the provider's SOC 2 report does not cover HIPAA controls indicates that the provider has not been audited specifically for HIPAA compliance, but a BAA establishes the required legal protections. Option A is incorrect because a SOC 3 report, like the SOC 2, does not guarantee HIPAA controls. Option B is incorrect because simply accepting the risk without a BAA would violate HIPAA requirements. Option D is incorrect because encryption, while important, does not substitute for the contractual safeguards required by a BAA.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 8

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Accepted Answer

Permitted and required uses of PHI. A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

Answer

Indemnification clause for breaches

Answer

Requirement to store data in the United States

Question 9

An enterprise is implementing a cloud security posture management (CSPM) solution. What is the primary function of CSPM?

Accepted Answer

Monitoring and remediating misconfigurations. CSPM continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks, providing automated remediation and reporting.

Answer

Brokering access to cloud apps

Answer

Protecting workloads from malware

Answer

Encrypting data at rest

Question 10

A security architect is evaluating an API security strategy for a SaaS application that supports OAuth 2.0. Which TWO controls should the architect recommend to protect against token interception and replay attacks?

Accepted Answer

Enforcing short-lived access tokens with refresh token rotation. Using short-lived access tokens reduces the window of opportunity for replay attacks. Token binding (proof-of-possession) ties the token to the client, making interception less useful. Rate limiting mitigates brute force but not token interception. Long-lived tokens increase risk. JWT encryption protects content but not replay.

Answer

Using long-lived access tokens to reduce authentication frequency

Answer

Encrypting JWT payloads with a symmetric key

Answer

Implementing rate limiting on the token endpoint

Question 11

A vulnerability management team is prioritizing patches for a large enterprise. They have identified a critical vulnerability in a widely used software with a CVSS base score of 9.8. However, the exploit requires local access and authentication. Which CVSS metric should the team use to adjust the score to reflect the actual risk in their environment?

Accepted Answer

Environmental score. The question asks for a metric to adjust the CVSS base score to reflect actual risk in the organization's specific environment. The Environmental score is designed for this purpose, allowing customization based on factors such as security controls, asset criticality, and compensating measures. In contrast, the Temporal score adjusts for factors that change over time (e.g., exploit maturity), but it does not account for organization-specific context. Therefore, the Environmental score is the correct metric to use.

Answer

Privileges required metric

Answer

Temporal score

Answer

Attack vector metric

Question 12

A security engineer is configuring a new web server to support TLS 1.3. The server must provide forward secrecy and support clients that may not have updated certificates frequently. Which of the following is a feature of TLS 1.3 that addresses these requirements?

Accepted Answer

Mandatory use of ephemeral Diffie-Hellman key exchange. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (ECDHE) key exchange for all sessions. This ensures that if the server's long-term private key is compromised, past session keys remain secure. While TLS 1.3 does remove cipher suites that use RSA key exchange (which lack forward secrecy), this removal does not directly address the requirement to support clients with infrequently updated certificates. The question asks for a feature that satisfies both forward secrecy and support for clients with infrequently updated certificates; only mandatory use of ephemeral Diffie-Hellman key exchange directly provides forward secrecy, which is the key requirement.

Answer

Support for certificate pinning

Answer

Support for 0-RTT handshake

Answer

Removal of cipher suites that use RSA key exchange

Question 13

A security analyst reviews logs from a web application firewall (WAF) and notices that an attacker is bypassing the WAF by encoding malicious payloads using base64 and then sending them in HTTP headers. Which WAF configuration change would BEST detect and block such attacks?

Accepted Answer

Add custom signatures to detect base64-encoded patterns in headers. Base64-encoded payloads in HTTP headers are a known evasion technique that bypasses signature-based WAF rules designed for plaintext attacks. By adding custom signatures that specifically match base64-encoded patterns (e.g., detecting long strings of base64 characters or known malicious base64 strings), the WAF can decode and inspect the payload before applying detection logic. This directly addresses the attacker's encoding method without relying on generic protocol or rate controls.

Answer

Enable geoblocking to restrict traffic from the attacker's country

Answer

Implement strict HTTP protocol validation to reject malformed requests

Answer

Increase the rate limiting threshold to allow more requests per second

Question 14

A security manager is reviewing the company's vendor risk management program. Which of the following should be included as a mandatory step BEFORE entering into a contract with a new cloud service provider?

Accepted Answer

Conducting a third-party security assessment. A third-party security assessment is a mandatory due diligence step before entering into a contract with a new cloud service provider. This assessment evaluates the vendor's security controls, compliance posture, and risk profile against the organization's requirements, ensuring that the vendor meets minimum security standards before any data or systems are entrusted to them. Without this pre-contract assessment, the organization would be accepting unknown risks that could lead to data breaches or compliance violations.

Answer

Establishing an incident response plan

Answer

Performing a penetration test of the vendor's infrastructure

Answer

Requesting monthly vulnerability reports

Question 15

A company is deploying containers in a Kubernetes cluster and needs to enforce that containers run with reduced capabilities. Which Linux security feature should be configured to drop unnecessary capabilities?

Accepted Answer

AppArmor. To drop unnecessary capabilities in a Linux container, the correct Linux security feature is AppArmor. AppArmor is a Mandatory Access Control (MAC) system that can be configured with profiles to restrict capabilities granted to processes. By defining an AppArmor profile that drops specific capabilities (e.g., using the 'capability' rule set to deny), administrators can enforce that containers run with reduced privileges. While Seccomp filters system calls, it does not directly manage capabilities. PodSecurityPolicy is a Kubernetes resource, not a Linux feature. SELinux can also control capabilities but is more complex and less commonly used for this specific purpose in container environments.

Answer

PodSecurityPolicy

Answer

Seccomp

Answer

SELinux

Question 16

A company is designing a secure communication channel between two branch offices over the internet using IPsec. Which TWO statements are true regarding IPsec modes and protocols? (Select TWO.)

Accepted Answer

Tunnel mode encrypts the entire original IP packet. IKEv2 is a key exchange protocol used to establish IPsec security associations, but it is not a mode or protocol for encapsulating data packets; the question asks about IPsec modes and protocols (tunnel/transport, AH/ESP). Thus, A does not qualify as a true statement about IPsec modes and protocols. Option B is correct: Tunnel mode encapsulates and encrypts the entire original IP packet, adding a new IP header for routing. Option C is false: AH (Authentication Header) provides integrity and authentication but not confidentiality (no encryption). Option D is false: Transport mode encrypts only the payload of the IP packet, not the entire packet (the original IP header remains unencrypted). Option E is correct: ESP (Encapsulating Security Payload) provides confidentiality via encryption and optionally provides authentication and integrity.

Answer

IKEv2 is used to negotiate IPsec security associations

Answer

AH provides confidentiality for the packet

Answer

Transport mode encrypts the entire IP packet including the header

Question 17

A multinational corporation must comply with multiple data protection laws. What is the BEST strategy?

Accepted Answer

Implement the most stringent requirements across all regions. Implementing the most stringent requirements across all regions ensures compliance with the strictest data protection law (e.g., GDPR's Article 3 territorial scope, LGPD, or CCPA) without needing to track per-region variations. This approach reduces legal risk and operational complexity by applying a single, high-standard baseline that satisfies all applicable regulations, such as requiring explicit consent for data processing and 72-hour breach notification timelines.

Answer

Use a minimal baseline that meets all laws

Answer

Follow only the laws of the home country

Answer

Follow local laws per region

Question 18

Refer to the exhibit. This clause is a requirement of which of the following?

Accepted Answer

GDPR Article 32.. The clause in the exhibit mandates a data processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization and encryption of personal data. This is a direct requirement of GDPR Article 32, which specifically addresses the security of processing personal data and is distinct from sector-specific or framework-based standards.

Answer

PCI DSS.

Answer

ISO 27001.

Answer

HIPAA Security Rule.

Question 19

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

Accepted Answer

Implement a rate-limiting rule on the network firewall for the source IP.. Rate-limiting the source IP at the network firewall immediately throttles the number of authentication attempts from that address, mitigating the brute-force attack without disrupting legitimate user access. This is the best immediate action as it directly blocks the attack vector at the network layer, preventing further failed logins while preserving user productivity.

Answer

Disable the affected user accounts until the source IP is blocked.

Answer

Reset the passwords for all affected accounts.

Answer

Enable multi-factor authentication for all accounts.

Question 20

A security engineer needs to implement a solution that provides both confidentiality and integrity for data at rest. Which cryptographic method BEST meets these requirements?

Accepted Answer

AES-256-GCM. AES-256-GCM is correct because it provides both confidentiality (via AES encryption) and integrity (via Galois/Counter Mode authentication tag). GCM is an authenticated encryption mode that ensures data at rest remains both secret and tamper-proof, meeting the dual requirement directly.

Answer

SHA-256

Answer

Diffie-Hellman

Answer

RSA-2048