CAS-004 Practice Exam 57 — 20 Questions

Question 1

A security analyst is reviewing a packet capture and observes that a client and server negotiate a session key using ephemeral Diffie-Hellman, after which all application data is encrypted with a symmetric cipher. The analyst wants to document which security property the ephemeral key exchange provides that a static RSA key transport would not. Which property is that?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Forward secrecy, because compromise of the long-term private key does not reveal past session keys.. Ephemeral Diffie-Hellman creates a unique shared secret per session and erases the private ephemeral values, so a later compromise of the server's long-term key cannot decrypt previously captured traffic. Static RSA key transport ties the premaster secret to the long-term key, so that compromise exposes all recorded sessions. The distinguishing property is forward secrecy.

Answer

Perfect confidentiality of the server certificate, because the certificate is encrypted during the handshake.

Answer

Non-repudiation, because the ephemeral key pair proves the server's identity to the client.

Answer

Data integrity, because Diffie-Hellman produces a message authentication code over each record.

Question 2

A security analyst is reviewing the organization's business continuity plan (BCP). The plan specifies a recovery time objective (RTO) of 4 hours for a critical e-commerce application. Which of the following BEST describes the meaning of this RTO?

Accepted Answer

The maximum time the application can be down before it significantly impacts the business.. The recovery time objective (RTO) defines the maximum acceptable downtime for a system after a disruption. In this case, a 4-hour RTO means the e-commerce application must be restored within 4 hours. RTO is distinct from RPO, which deals with data loss. The other options describe RPO, actual recovery time, or backup frequency, none of which define RTO.

Answer

The time required to fully restore the application from backups.

Answer

The frequency at which backups of the application are performed.

Answer

The maximum acceptable amount of data loss measured in time.

Question 3

A security engineer is configuring a secure boot process for a Linux server using UEFI. The engineer wants to ensure that only signed bootloaders and kernels are executed. Which of the following components is responsible for verifying the signature of the bootloader?

Accepted Answer

The UEFI signature database (db). In UEFI Secure Boot, the firmware uses the signature database (db) to validate the bootloader's signature. The db contains trusted certificates and hashes. When the bootloader is loaded, the firmware checks its signature against the db. If it matches, the bootloader runs; otherwise, boot is halted or an error is shown. This ensures only trusted code executes.

Answer

The bootloader's own signature check

Answer

The Key Exchange Key (KEK)

Answer

The UEFI firmware's Platform Key (PK)

Question 4

A security analyst is investigating a potential data exfiltration incident. The analyst has a packet capture (PCAP) file from the network segment where the suspected exfiltration occurred. The analyst wants to extract files that were transferred over HTTP and analyze their contents. Which of the following tools should the analyst use to achieve this?

Accepted Answer

Wireshark. The analyst needs to extract files from a PCAP, specifically from HTTP transfers. Wireshark's 'Export Objects' feature can reassemble and save files from HTTP, SMB, and other protocols. tcpdump is limited to packet capture and display without file extraction. Nmap and Metasploit are not designed for PCAP analysis. Thus, Wireshark is the correct tool.

Answer

tcpdump

Answer

Nmap

Answer

Metasploit

Question 5

A security engineer is configuring a web application firewall (WAF) to protect against injection attacks. The application uses a relational database and reflects user input in HTML pages. The engineer must choose a WAF rule set that provides the BEST protection with minimal false positives. Which approach should the engineer take?

Accepted Answer

Deploy the WAF in learning mode to baseline normal traffic, then enable targeted rules for SQL injection and XSS with virtual patching for known vulnerabilities.. The best approach is to use learning mode to understand normal traffic, then enable targeted SQL injection and XSS rules along with virtual patching for known vulnerabilities. This minimizes false positives while providing strong protection. Generic blocking rules, overly broad regex, or disabling WAF rules entirely either cause operational issues or reduce defense-in-depth.

Answer

Create custom regular expression rules that block any request containing single quotes, double quotes, or angle brackets.

Answer

Enable the WAF's generic SQL injection and cross-site scripting (XSS) rules in blocking mode with a default action of deny.

Answer

Rely solely on the database's parameterized queries and disable all WAF injection rules to avoid false positives.

Question 6

A security architect is designing a system that must detect tampering with archived audit logs even if an attacker later gains administrative access to the log storage. The logs must remain verifiable for seven years without exposing their contents to the storage provider. Which design BEST meets these requirements?

Accepted Answer

Compute a hash chain over log entries, sign each checkpoint with a private key held in an offline hardware security module, and encrypt logs with keys the provider cannot access.. Tamper-evident archival requires cryptographic binding of entries plus signatures produced with a key the attacker cannot reach, combined with encryption whose keys the storage provider does not hold. Hash chains detect alteration, offline hardware security module signing prevents forgery of new checkpoints, and provider-inaccessible keys preserve confidentiality across the retention period.

Answer

Encrypt each log file with a symmetric key stored alongside the files and rely on file permissions to prevent modification.

Answer

Upload plaintext logs to object storage with versioning enabled and enable a write-once retention lock on the bucket.

Answer

Replicate logs to a second region and compare file checksums between regions during quarterly audits.

Question 7

A security administrator must ensure that log data collected from servers across multiple sites cannot be altered or deleted by an attacker who compromises a single server. Which of the following BEST achieves this?

Accepted Answer

Forward logs in real time to a centralized logging platform with append-only storage and restricted administrative access. Centralizing logs with real-time forwarding removes the single point of failure and append-only storage with restricted access prevents tampering or deletion even if one server is fully compromised. Local encryption, retention changes, and database encryption all leave authoritative copies within reach of the compromised host.

Answer

Configure each server to write logs to a local encrypted volume and enable file integrity monitoring on the log directory

Answer

Increase local log retention to one year and rotate log files daily with compression enabled

Answer

Enable verbose logging on all servers and store the logs in a database that uses transparent data encryption

Question 8

A financial services company is designing a secure multi-tenant SaaS application hosted on AWS. The security architect must ensure that each tenant's data is isolated and that encryption keys are unique per tenant, while allowing the company to manage keys centrally. Which AWS service should the architect use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys (CMKs) and encryption context per tenant.. AWS KMS with customer managed keys allows the architect to create a unique key for each tenant and use encryption context to enforce that only the intended tenant can decrypt its data. This centralizes key management while providing cryptographic isolation, satisfying both the per-tenant key requirement and the need for central administration.

Answer

AWS Certificate Manager (ACM) with a wildcard certificate per tenant.

Answer

AWS CloudHSM with a single cluster shared across all tenants.

Answer

AWS Secrets Manager with automatic rotation for each tenant's database credentials.

Question 9

A security analyst receives an alert from the SIEM indicating a possible DNS tunneling attempt. The analyst needs to investigate the incident. Which of the following actions should the analyst take FIRST to validate the alert?

Accepted Answer

Review DNS logs for unusually long or high-entropy subdomain queries from the same host.. The first step should be to review DNS logs for anomalies such as long or high-entropy subdomain queries from the same host. This leverages existing data to validate the alert without disrupting services. Blocking DNS traffic is a containment action, packet capture is more resource-intensive, and vulnerability scanning does not address active tunneling behavior.

Answer

Run a vulnerability scan on the suspected host to check for DNS-related exploits.

Answer

Capture full packet data for all DNS queries and analyze the payloads for executable content.

Answer

Immediately block all outbound DNS traffic from the suspected host.

Question 10

A multinational retailer needs to protect cardholder data across its e-commerce platform, which spans on-premises and multiple cloud providers. The security architect must implement a solution that discovers sensitive data, classifies it consistently, and enforces encryption and access policies wherever the data resides, without relying on a single cloud provider's native tools. Which of the following should the architect implement?

Accepted Answer

A data security posture management (DSPM) solution with centralized policy and encryption key management.. The requirement is data-centric protection across on-premises and multiple clouds with consistent discovery, classification, encryption, and access policy. DSPM with centralized key management delivers cross-provider visibility and enforcement. CSPM addresses configuration, WAF addresses application attacks, and HSM addresses key operations, none of which provide the complete data discovery and policy enforcement needed.

Answer

A hardware security module (HSM) cluster in the primary data center.

Answer

A web application firewall (WAF) deployed in front of each e-commerce site.

Answer

A cloud security posture management (CSPM) tool integrated with each cloud provider.

Question 11

A security architect is designing a microservices-based application deployed on a Kubernetes cluster. The architect needs to ensure that inter-service communication is secure, that services can authenticate each other, and that access to services is controlled based on identity. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Mutual TLS (mTLS) between services using short-lived certificates. Mutual TLS with short-lived certificates ensures encrypted and authenticated communication between services, while a service mesh with identity-based authorization policies provides centralized, fine-grained access control based on service identity. Together, they secure inter-service communication and enforce access control. The other options either lack encryption, use static secrets, or are overly permissive.

Answer

A shared secret used by all services for authentication

Answer

API keys stored in environment variables for each service

Answer

Network policies that allow all traffic within the cluster namespace

Question 12

A financial services firm is designing a microsegmentation strategy for its VMware-based private cloud. The security team wants to enforce east-west policy based on workload identity rather than IP address, and it must survive IP address changes during automated redeployments. Which approach best satisfies these requirements?

Accepted Answer

Install host-based firewall agents on each virtual machine and manage rules through a central console keyed to workload labels.. Microsegmentation requires policy that follows the workload rather than the network. Host-based enforcement managed by workload labels keeps rules valid across IP changes caused by automated redeployments and allows east-west policy expressed in terms of identity. VLAN, private VLAN, and perimeter firewall approaches all bind policy to topology, which the scenario explicitly rules out.

Answer

Create VLANs per application tier and enforce inter-VLAN access control lists on the core switches.

Answer

Deploy a next-generation firewall between the data center core and aggregation layers and define zones by subnet.

Answer

Use 802.1Q trunking to isolate each application into a dedicated broadcast domain and apply private VLANs.

Question 13

A software company suffers a breach exposing customer records. Legal counsel determines the incident meets the regulatory threshold for notification. The incident response lead must decide which external parties receive notice and within what timeframe, balancing regulatory duties against contractual obligations. Which action best satisfies the organization's notification obligations?

Accepted Answer

Notify regulators and affected data subjects within the applicable legal timeframes, and notify contractual partners per their agreements. Breach notification obligations run in parallel and on different clocks. Regulators and affected individuals must be notified within statutory windows measured from awareness, while contractual partners may have their own deadlines triggered by the same event. Notifying all required parties within their respective timeframes is the only approach that satisfies both legal and contractual duties, whereas waiting for investigation closure or substituting public notices fails those deadlines.

Answer

Notify law enforcement and defer all other notifications until the criminal case concludes

Answer

Notify only the affected customers once the forensic investigation is fully complete

Answer

Publish a general notice on the corporate website in place of direct notification

Question 14

A security engineer is implementing a new endpoint detection and response (EDR) solution. The engineer wants to detect process injection techniques where malware writes to the memory of a remote process and then creates a remote thread to execute its payload. Which of the following Windows API call sequences should the EDR monitor to detect this behavior?

Accepted Answer

OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread. Remote process injection via CreateRemoteThread requires allocating memory in the target process (VirtualAllocEx), writing the payload (WriteProcessMemory), and then creating a thread to execute it (CreateRemoteThread). The OpenProcess call obtains the necessary handle. Monitoring this API sequence helps EDR solutions detect a common malware technique. The other options describe file, registry, or network operations that are not related to process injection.

Answer

RegOpenKeyEx, RegSetValueEx, RegCloseKey

Answer

WSAStartup, socket, connect, send

Answer

CreateFile, ReadFile, WriteFile, CloseHandle

Question 15

A security analyst is reviewing firewall logs and notices a large number of outbound connections from an internal server to various external IP addresses on port 443. The connections are occurring at regular intervals and transferring small amounts of data. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

The server is beaconing to a command-and-control (C2) server as part of a malware infection.. The pattern of regular outbound connections to multiple external IPs on port 443 with small data transfers is a classic indicator of C2 beaconing. Malware often uses HTTPS to evade detection and communicates periodically to receive commands or exfiltrate small amounts of data. This behavior warrants further investigation, such as checking the server for malware and analyzing the destinations.

Answer

The server is performing legitimate software updates from various vendors.

Answer

The server is using a peer-to-peer file-sharing application for legitimate business purposes.

Answer

The server is experiencing a distributed denial-of-service (DDoS) attack from external sources.

Question 16

A financial services firm must allow third-party partners to call internal REST APIs. Partners authenticate with their own OAuth 2.0 authorization servers, and the firm must validate tokens without sharing secrets and enforce per-partner rate limits and scopes. Which approach BEST meets these requirements?

Accepted Answer

Configure the API gateway to trust partner-issued JWTs by validating signatures against published JSON Web Key Sets and mapping claims to scopes and rate limits.. Trusting externally issued tokens through published JSON Web Key Sets allows signature verification with public keys, eliminating secret sharing. Claim mapping at the gateway then enforces scopes and per-partner throttling, which is exactly the combination the scenario demands. Symmetric keys, VPN client certificates, and session reissuance each fail at least one stated requirement.

Answer

Terminate partner tokens at the gateway and reissue firm-issued session cookies for subsequent API calls.

Answer

Require partners to connect through a dedicated VPN and authenticate with client certificates issued by the firm's internal certificate authority.

Answer

Issue each partner a shared symmetric key and validate HMAC-signed requests at the API gateway.

Question 17

A global pharmaceutical company must comply with the EU GDPR for clinical trial data. The Data Protection Officer is reviewing the data protection impact assessment (DPIA) process. Which of the following situations requires a DPIA under GDPR?

Accepted Answer

Conducting a clinical trial that involves large-scale processing of genetic data and health data.. A DPIA is mandatory under GDPR when processing is likely to result in a high risk to data subjects, particularly when it involves large-scale processing of special categories of data such as genetic and health data. Clinical trials often involve such data and are conducted on a large scale, making a DPIA a legal requirement. Other scenarios described are routine and low risk, so they do not trigger the mandatory DPIA.

Answer

Collecting employee emergency contact information for HR records.

Answer

Processing personal data for routine patient billing using a standard software platform.

Answer

Using CCTV cameras in a single office lobby for physical security.

Question 18

A security architect is evaluating a hardware security module (HSM) deployment for a certificate authority. The requirement is that private keys must never leave the HSM in plaintext, and that key operations must be auditable. During a review, the architect learns that the HSM supports key wrapping for backup. Which of the following is the MOST important control to verify?

Accepted Answer

That the key wrapping key is stored in a separate, tamper-resistant HSM under a different administrator's control, and that wrapping operations are logged.. The strongest control is to separate the key wrapping key into an independent, tamper-resistant HSM under different administrative control and to log all wrapping operations. This enforces separation of duties and ensures that compromise of one HSM does not expose all backed-up private keys. Exportable wrapping keys, weak ciphers like ECB, or insecure transport channels all undermine the security of the backup process.

Answer

That the private keys are backed up to an encrypted network share using the HSM's built-in FTP client for offsite storage.

Answer

That the key wrapping key is stored in the same HSM and is itself exportable for disaster recovery.

Answer

That the HSM uses AES-128 in ECB mode for key wrapping to maximize performance during backup operations.

Question 19

A security administrator is reviewing the configuration of a wireless network. The network uses WPA3-Enterprise with 802.1X authentication. The administrator wants to ensure that the authentication server validates the identity of the supplicant before granting network access. Which protocol should be used to encapsulate the authentication credentials?

Accepted Answer

EAP-TLS. EAP-TLS requires certificates on both the supplicant and the authentication server, enabling mutual authentication. This ensures the server validates the supplicant's identity before granting access. PEAP and EAP-TTLS typically authenticate only the server with a certificate, while EAP-MD5 lacks mutual authentication entirely. Thus, EAP-TLS is the correct choice for strong mutual identity validation.

Answer

EAP-MD5

Answer

EAP-TTLS

Answer

PEAP

Question 20

A security operations center (SOC) is implementing a new SIEM and wants to improve detection of credential-based attacks. The team plans to ingest Windows Security event logs and create correlation rules. Which TWO event IDs should the SOC prioritize to detect a brute-force attack against local accounts? (Choose two.)

Accepted Answer

4625 (An account failed to log on). Brute-force attacks against local accounts are characterized by repeated failed logon attempts, which generate Event ID 4625. When the number of failures exceeds the account lockout threshold, Event ID 4740 is logged. Correlating these two events allows the SOC to detect both the ongoing attack and its impact. Other events like successful logons or privilege assignments are not direct indicators of the attack itself, and log clearing is a post-compromise action.

Answer

4624 (An account was successfully logged on)

Answer

4672 (Special privileges assigned to new logon)

Answer

1102 (The audit log was cleared)