CAS-004 Practice Exam 56 — 20 Questions

Question 1

A security engineer is implementing a secure boot process for an embedded device. The engineer needs to ensure that only trusted firmware is executed and that the integrity of the boot chain is maintained. Which TWO of the following are essential components of a secure boot implementation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Digital signature verification of each boot stage. Secure boot requires an immutable root of trust to anchor trust and digital signature verification at each stage to ensure only trusted code executes. Encryption, secure enclaves, and TPMs can complement security but are not essential for the fundamental secure boot process.

Answer

Full disk encryption of the boot partition

Answer

Trusted Platform Module (TPM) for measured boot

Answer

Secure enclave for key storage

Question 2

A security architect is designing a system that requires cryptographic separation of duties for key management. The organization wants to ensure that no single administrator can both generate and use a key without oversight. Which of the following key management practices BEST achieves this requirement?

Accepted Answer

Implementing dual control with split knowledge for key generation and usage. Dual control and split knowledge are specifically designed to enforce separation of duties. Dual control requires multiple authorizations, while split knowledge ensures that components of a key are divided among individuals. This combination prevents any single administrator from unilaterally generating and using a key, which is essential for high-assurance key management and compliance with standards like FIPS 140-2.

Answer

Using a hardware security module (HSM) to store all keys

Answer

Rotating keys automatically every 24 hours

Answer

Encrypting all keys with a master key stored in a software vault

Question 3

A security engineer is configuring a Linux web server that hosts a public-facing application. The server's SSH daemon must be hardened to prevent brute-force attacks and unauthorized access. The engineer has already disabled root login and password authentication. Which additional control should the engineer implement to restrict access to only authorized administrative users?

Accepted Answer

Configure AllowUsers in /etc/ssh/sshd_config to list authorized usernames.. The AllowUsers directive in sshd_config explicitly whitelists user accounts permitted to authenticate over SSH. When combined with disabled password authentication and no root login, it ensures only named administrative users can connect, directly satisfying the hardening goal. Other options either add authentication methods or obscure the service without limiting user access.

Answer

Enable ChallengeResponseAuthentication and configure PAM modules.

Answer

Set PermitRootLogin to no in /etc/ssh/sshd_config.

Answer

Change the SSH port from 22 to a non-standard port.

Question 4

A security manager at a defense contractor is reviewing the organization's risk register. A critical vulnerability in a widely used open-source library has been identified. The vendor has not released a patch, and the library is embedded in a custom application that cannot be easily replaced. The manager decides to implement a virtual patching solution at the network perimeter. Which risk treatment strategy does this represent?

Accepted Answer

Risk mitigation. Virtual patching is a compensating control that reduces the likelihood of exploitation by filtering malicious traffic. Since the underlying vulnerability remains but its risk is lowered, this is risk mitigation. Transfer, acceptance, and avoidance do not involve actively reducing the risk through controls, making mitigation the correct classification.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Question 5

A security engineer is implementing a secure boot process for an embedded device. The engineer needs to ensure that only trusted firmware is executed and that the integrity of the boot chain is maintained. Which TWO of the following are essential components of a secure boot implementation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static application security testing (SAST) in the CI/CD pipeline.. Threat modeling during design and SAST in the CI/CD pipeline are both early-stage activities that help identify and mitigate vulnerabilities before deployment. Threat modeling addresses design flaws, while SAST catches coding errors. Together, they shift security left and reduce remediation costs.

Answer

Security awareness training for developers.

Answer

Penetration testing after production deployment.

Answer

Dynamic application security testing (DAST) during the design phase.

Question 6

A company is implementing a secure software development lifecycle (SDLC). The security architect wants to ensure that vulnerabilities are identified early in the development process and that developers receive immediate feedback. Which of the following should be integrated into the CI/CD pipeline?

Accepted Answer

Static application security testing (SAST) integrated into the build process.. Integrating SAST into the build process enables automated security testing on every code commit, providing immediate feedback to developers. This shifts security left, allowing vulnerabilities to be found and fixed early when they are cheaper and easier to remediate. SAST is well-suited for CI/CD pipelines because it does not require a running application and can be triggered automatically.

Answer

Interactive application security testing (IAST) run manually by the security team quarterly.

Answer

Software composition analysis (SCA) performed only before major releases.

Answer

Dynamic application security testing (DAST) run after deployment to production.

Question 7

A security analyst is configuring an EDR solution to detect a specific fileless attack technique where malicious code is injected into the memory of a legitimate process. The analyst wants to trigger an alert when a process attempts to write to the memory of another process. Which Windows API function should the EDR monitor to detect this activity?

Accepted Answer

WriteProcessMemory. The correct API to monitor for detecting memory writes to another process is WriteProcessMemory. This function is commonly used in process injection and fileless malware to place malicious code into a legitimate process's memory space. Monitoring it provides direct visibility into the injection attempt. Other APIs like CreateRemoteThread or VirtualAllocEx are related but do not directly capture the write operation.

Answer

NtCreateThreadEx

Answer

CreateRemoteThread

Answer

VirtualAllocEx

Question 8

A multinational financial services firm is preparing to adopt a new enterprise risk management approach. The CISO wants a quantitative method that expresses risk in monetary terms to prioritize investments. Which of the following should the CISO implement?

Accepted Answer

Factor Analysis of Information Risk (FAIR). The CISO needs a quantitative risk analysis method that expresses risk in monetary terms. FAIR is specifically designed to quantify risk in financial terms, enabling prioritization of investments based on potential monetary loss. Other options are either qualitative or framework-oriented without inherent financial quantification.

Answer

NIST Risk Management Framework (RMF)

Answer

OCTAVE Allegro

Answer

ISO/IEC 27005

Question 9

A security analyst is investigating a suspected data exfiltration incident. The analyst has captured network traffic and wants to identify evidence of data being transferred over a covert channel. Which TWO of the following techniques would BEST help detect covert channels in the network traffic? (Choose two.)

Accepted Answer

Analyze DNS query patterns for unusually long or high-entropy subdomains.. Covert channels often hide data within protocols that are typically allowed through firewalls, such as DNS and ICMP. Analyzing DNS for long, high-entropy subdomains can reveal DNS tunneling, while inspecting ICMP payloads for anomalies can detect ICMP tunneling. Both techniques focus on the content and patterns within these protocols, which is essential for identifying stealthy exfiltration.

Answer

Scan internal hosts for open ports that could be used for data transfer.

Answer

Examine NetFlow records for spikes in outbound traffic volume during off-hours.

Answer

Monitor for large file transfers over HTTP/HTTPS to known cloud storage services.

Question 10

A security architect is designing a network for a financial services firm. The firm requires that all data in transit between its internal microservices be encrypted and mutually authenticated, but the services run in a containerized environment where static IP addresses are not available. Which of the following is the MOST appropriate solution to meet these requirements?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) between sidecar proxies.. A service mesh with mutual TLS (mTLS) provides encryption and mutual authentication for service-to-service communication. It uses sidecar proxies to manage certificates and identity without relying on static IPs, which suits containerized environments. This directly meets the requirements for encrypted, mutually authenticated traffic in a dynamic infrastructure.

Answer

Implement IPsec tunnels between each container host.

Answer

Configure a VPN concentrator that all microservices connect to for encrypted communication.

Answer

Use TLS with server-side certificates only for each microservice.

Question 11

A security operations center (SOC) analyst receives an alert from the endpoint detection and response (EDR) platform indicating that a process on a finance workstation has made an outbound connection to a known command-and-control (C2) domain. The analyst wants to quickly determine the full scope of the incident, including other hosts that may have communicated with the same domain. Which of the following actions should the analyst take FIRST?

Accepted Answer

Query the SIEM for all events matching the C2 domain and create a timeline of affected hosts.. In incident response, scoping the incident is critical before containment or remediation. Querying the SIEM for the C2 domain rapidly identifies all hosts that communicated with the malicious infrastructure, revealing the full extent of the compromise. This allows the analyst to prioritize containment efforts and avoid missing additional compromised systems. Other actions like isolation or blocking are containment steps that should follow scoping.

Answer

Run a full antivirus scan on the finance workstation to remove any malware.

Answer

Immediately isolate the finance workstation from the network using the EDR console.

Answer

Block the C2 domain at the perimeter firewall to prevent further communication.

Question 12

A security analyst is investigating a potential data exfiltration incident. The analyst observes a large outbound transfer of encrypted traffic to an unfamiliar IP address over port 443. The organization uses a next-generation firewall (NGFW) with TLS inspection enabled. Which of the following actions would BEST determine if the traffic is malicious?

Accepted Answer

Decrypt the TLS traffic using the NGFW and inspect the payload for sensitive data patterns.. The most definitive way to determine if the encrypted traffic is malicious is to inspect its decrypted payload for sensitive data. The NGFW with TLS inspection can perform this decryption and content analysis. Other methods provide context or metadata but cannot confirm the actual data being exfiltrated.

Answer

Check the endpoint detection and response (EDR) logs for process execution on the source host.

Answer

Analyze NetFlow records to identify the volume and frequency of the transfer.

Answer

Perform a WHOIS lookup on the destination IP address to determine its reputation.

Question 13

A security analyst is reviewing the organization's incident response plan. The plan includes a section on communication with external parties. Which of the following best describes the primary purpose of a communication plan during a security incident?

Accepted Answer

To ensure timely and accurate information sharing with stakeholders, regulators, and the public.. The communication plan is a component of incident response that focuses on information sharing with stakeholders, including executives, legal, regulators, and customers. Its primary goal is to ensure timely, accurate, and compliant messaging. Technical containment and evidence handling are separate processes, making the stakeholder communication purpose the correct choice.

Answer

To outline the technical steps for containing the incident.

Answer

To document the chain of custody for forensic evidence.

Answer

To provide technical details of the incident to the security operations team.

Question 14

A security analyst is reviewing the configuration of a web application firewall (WAF) protecting an e-commerce site. The analyst notices that the WAF is in detection-only mode. The site has been experiencing SQL injection attacks that are not being blocked. Which of the following actions should the analyst take to BEST protect the site while minimizing false positives?

Accepted Answer

Review the WAF logs, create custom rules to address the SQL injection patterns, and then switch to blocking mode.. Reviewing logs allows the analyst to understand the attack patterns and identify false positives. Creating custom rules tailors the WAF to the specific application, reducing false positives. Switching to blocking mode after tuning ensures that legitimate traffic is not disrupted while attacks are blocked.

Answer

Switch the WAF to blocking mode immediately.

Answer

Disable the WAF and rely on input validation in the application code.

Answer

Configure the WAF to block only requests from known malicious IP addresses.

Question 15

A hospital's security manager is aligning internal documents after a policy refresh. The board approved a statement that defines the organization's overall security intent and assigns responsibility to executive leadership, but it deliberately avoids naming specific products or technical settings. Which document type has the board approved?

Accepted Answer

A security policy. A policy is the management-approved, high-level statement that expresses security intent and assigns accountability without dictating products or settings. Standards enforce specific mandatory requirements, procedures describe operational steps, and guidelines offer optional advice. Because the board's document sets direction and delegates responsibility at an enterprise level while avoiding technical specificity, it is a policy sitting at the top of the governance hierarchy.

Answer

A security standard

Answer

A security procedure

Answer

A security guideline

Question 16

A security analyst is reviewing a vulnerability scan report for a web application. The report shows a high-severity finding for a SQL injection vulnerability on a login page. The analyst needs to validate the finding before escalating to the development team. Which of the following actions should the analyst take to safely validate the vulnerability?

Accepted Answer

Manually inject a benign SQL payload that returns a database error, such as a single quote.. Manual injection of a benign payload like a single quote is a safe and effective way to validate SQL injection. It tests the application's input handling without extracting data or causing damage. If a database error is returned, the vulnerability is confirmed. This approach is minimally invasive and suitable for production systems, allowing the analyst to escalate with confidence.

Answer

Run a full vulnerability scan with credentials to confirm the finding.

Answer

Use an automated SQL injection tool to dump the database schema.

Answer

Review the application source code for parameterized queries.

Question 17

A security analyst is investigating a suspected DNS tunneling attack. The analyst observes a high volume of DNS queries to a single domain, with query names that appear to be Base64-encoded strings. Which of the following is the MOST effective way to confirm and analyze this activity?

Accepted Answer

Capture full packet data and decode the query names to look for hidden data. DNS tunneling hides data within DNS queries and responses. To confirm and analyze it, the analyst must capture the actual DNS packets and decode the query names, which often contain Base64 or hex-encoded payloads. This reveals the exfiltrated data or C2 commands. The other options may provide circumstantial evidence but do not directly analyze the tunneled content.

Answer

Check the reputation of the destination DNS server IP address

Answer

Monitor for an increase in DNS response time

Answer

Review firewall logs for allowed outbound DNS traffic

Question 18

A security architect for a financial services firm is designing a new data protection scheme for account numbers stored in a PostgreSQL database. The business requires that the same account number always transforms to the same ciphertext so that existing equality-based lookups and unique constraints continue to work, while the raw values must remain unreadable to database administrators. Which cryptographic approach should the architect select?

Accepted Answer

Deterministic encryption using AES-SIV. The requirement for repeatable ciphertext that still supports equality lookups points to a deterministic authenticated encryption mode. AES-SIV derives its nonce from the plaintext and associated data, so the same input always yields the same output while still providing integrity. Randomized modes and salted hashing break the equality-search property the database design depends on.

Answer

SHA-256 hashing of the account number with a per-row salt

Answer

RSA-4096 OAEP encryption of each account number

Answer

AES-256-GCM with a random 96-bit nonce per record

Question 19

A security operations center (SOC) is deploying a new endpoint detection and response (EDR) solution across 10,000 endpoints. The team wants to ensure that if the EDR agent is disabled or tampered with, the SOC is immediately alerted and the endpoint can be isolated. Which EDR capability should the team prioritize?

Accepted Answer

Tamper protection with automated response actions. The requirement is to detect tampering and respond by isolating the endpoint. Tamper protection ensures the EDR agent cannot be easily disabled, and automated response actions can isolate the host. Other options focus on detection updates, logging, or encryption, which do not provide the needed tamper detection and immediate isolation.

Answer

Full disk encryption with key escrow

Answer

Continuous signature updates from the vendor

Answer

Integration with a SIEM for log forwarding

Question 20

A security engineer is configuring a hardware security module (HSM) to protect a root certificate authority's private key. The requirement is that the key must never exist in plaintext outside the HSM and must be usable by multiple authorized administrators under dual control. Which configuration BEST satisfies these requirements?

Accepted Answer

Generate the CA key inside the HSM as a non-extractable key and configure M of N quorum authentication for administrative operations.. The strongest protection is to have the HSM itself generate the key as non-extractable, so the private material is created and used only within the tamper-resistant boundary. Layering M of N quorum authentication ensures that no single administrator can perform sensitive CA operations, providing the dual control the scenario requires.

Answer

Generate the CA key on a hardened offline workstation, wrap it with a passphrase-derived AES key, and import the wrapped blob into the HSM.

Answer

Generate the CA key inside the HSM as an extractable key so that a secure backup can be made, and rely on HSM role-based access control for administrator separation.

Answer

Generate the CA key inside the HSM and store a passphrase-protected copy in an encrypted configuration management database for disaster recovery.