CAS-004 Practice Exam 57 — 20 Questions

Question 1

A security analyst reviews a web application that accepts user-supplied data to generate PDF reports. The application uses a legacy library that directly inserts user input into SQL queries and also includes user input in the PDF generation without sanitization. Which is the most effective countermeasure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use parameterized queries and output encoding. Parameterized queries prevent SQL injection by separating SQL logic from user input, and output encoding prevents injection in PDF generation by ensuring user input is treated as data, not executable code. Option B (HTTPS/HSTS) only encrypts in transit and does not prevent injection attacks. Option C (WAF) can be bypassed and does not address the root cause. Option D (SIEM) only logs events, not prevents them.

Answer

Enable HTTPS and HSTS

Answer

Implement a web application firewall (WAF) to block malicious input

Answer

Deploy a SIEM to log all database queries and PDF generation events

Question 2

A compliance officer is reviewing logs from a web application and finds multiple failed login attempts from a single IP address. Which type of control should be implemented to reduce the risk of brute-force attacks?

Accepted Answer

Account lockout policy. An account lockout policy is the correct control because it directly mitigates brute-force attacks by temporarily disabling the account after a predefined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents an attacker from continuously guessing passwords from a single IP address, as the account becomes unavailable for further attempts until the lockout period expires or an administrator intervenes.

Answer

Network firewall

Answer

Password hashing

Answer

Encryption of traffic

Question 3

A security analyst is reviewing a suspicious file. Which static analysis technique would the analyst use to examine the file without executing it?

Accepted Answer

Use strings to extract readable text. Static analysis examines the file without running it. Running strings extracts readable text, which can reveal clues like IP addresses or commands.

Answer

Submit the file to VirusTotal

Answer

Execute the file in a debugger

Answer

Run the file in a sandbox

Question 4

A security architect is designing a deception-based detection system for a high-security environment. The goal is to detect lateral movement by attackers who have already breached the perimeter. Which of the following deception techniques would be most effective at identifying an attacker without alerting them to the deception?

Accepted Answer

Plant honey credentials (username/password) for non-existent Active Directory accounts in a common password manager.. Planting honey credentials for non-existent Active Directory accounts in a common password manager is the most effective deception technique for detecting lateral movement because attackers often search for stored credentials to move laterally. When they attempt to use these credentials, the authentication failure will trigger an alert without alerting the attacker to the deception. Other techniques like honey files or honeypots may be more obvious or require interaction that could tip off the attacker, making them less suitable for stealthy detection.

Answer

Configure a network share with honey files and monitor for file access.

Answer

Create a honeypot web server with known vulnerabilities and monitor for interactions.

Answer

Deploy fake database tables containing plausible but fictitious data.

Question 5

An organization discovers that a vendor's data breach exposed customer PII. The contract with the vendor does not address breach notification. What is the BEST way to prevent this in the future?

Accepted Answer

Add a breach notification clause in vendor contracts. Adding a breach notification clause directly addresses the contractual gap that left the organization without recourse or timely notification when the vendor suffered a data breach. This contractual remedy ensures that future incidents trigger a predefined notification process, aligning with regulatory requirements such as GDPR or HIPAA that mandate breach notification obligations for data processors. Without such a clause, the organization has no enforceable mechanism to compel the vendor to report breaches, regardless of other risk management activities.

Answer

Purchase cyber insurance covering vendor breaches

Answer

Terminate the vendor relationship immediately

Answer

Conduct more frequent vendor risk assessments

Question 6

After containing a confirmed security incident, the incident response team must plan for eradication. What must be done before eradication begins?

Accepted Answer

Determine the root cause of the incident. Before eradication can begin, the incident response team must determine the root cause of the incident. This ensures that the eradication steps are comprehensive and address the underlying vulnerability, preventing recurrence. Conducting a full forensic analysis (A) may be part of root cause determination but is not a separate prerequisite. Beginning eradication immediately (C) without understanding the root cause risks incomplete removal. Notifying law enforcement (D) is optional and not a required step before eradication.

Answer

Conduct a full forensic analysis of all systems

Answer

Begin eradication immediately to minimize dwell time

Answer

Notify law enforcement agencies

Question 7

A security architect is designing a secure connectivity solution between an on-premises data center and a public cloud provider. The solution must provide low latency, high bandwidth, and avoid traversing the public internet. Which approach BEST meets these requirements?

Accepted Answer

Direct Connect. Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the internet for low latency and high bandwidth.

Answer

SSL VPN

Answer

SD-WAN over internet

Answer

Site-to-site VPN over internet

Question 8

Refer to the exhibit. A security analyst is reviewing the Nginx configuration. Which of the following is the most critical security flaw?

Accepted Answer

The /api location does not have any access restrictions, exposing internal API. The /api location block lacks any authentication or authorization directives, such as `allow/deny` or `auth_basic`, leaving the internal API endpoint exposed to any client that can reach the Nginx server. In a typical deployment, this would allow unauthenticated access to sensitive backend services, which is a critical security flaw. The absence of access controls on /api directly violates the principle of least privilege and can lead to data exfiltration or unauthorized operations.

Answer

The SSL certificate key file is readable by all users (assuming default permissions)

Answer

The proxy_pass uses HTTP internally, which is not encrypted

Answer

The /admin location restricts access by IP only, which can be bypassed by IP spoofing

Question 9

During a security incident, a forensic analyst needs to acquire a memory dump from a Linux server without altering the system state. Which tool is most appropriate for this task?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is the most appropriate tool because it is specifically designed to acquire volatile memory from Linux systems while minimizing the footprint on the target system. It loads as a kernel module and directly accesses physical memory, ensuring that the acquisition process does not alter the system state, which is critical for forensic integrity.

Answer

Volatility framework

Answer

dd if=/dev/mem of=mem.dump

Answer

memdump utility

Question 10

An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?

Accepted Answer

Include a right-to-audit clause that covers subcontractors. To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

Answer

Use only vendors that are SOC 2 certified

Answer

Reduce reliance on vendors by bringing services in-house

Answer

Conduct penetration tests on all fourth parties directly

Question 11

Which THREE of the following are required for PCI DSS compliance regarding cardholder data?

Accepted Answer

Maintain a vulnerability management program.. PCI DSS Requirement 5 mandates that entities must maintain a vulnerability management program that includes deploying anti-malware software on all systems commonly affected by malicious software, as well as performing regular vulnerability scans and applying security patches. This requirement ensures that cardholder data environments are protected against known vulnerabilities that could be exploited by attackers.

Answer

Store cardholder data after authorization.

Answer

Implement multifactor authentication for all physical access to data centers.

Question 12

A cloud security architect is designing a key management system for a multi-tenant SaaS application. Which TWO practices are essential for ensuring cryptographic key security? (Select TWO).

Accepted Answer

Separate key management from data storage. Key rotation limits exposure if a key is compromised, and separating key management from data storage reduces attack surface. Storing keys in plaintext is insecure, using a single master key increases risk, and auditing is a detective control but not as fundamental as the other two.

Answer

Store keys in plaintext configuration files for easy retrieval

Answer

Use a single master key for all customers

Answer

Audit all key access events

Question 13

Match each port number to its associated protocol.

Accepted Answer

Port 80: HTTP. These are standard IANA port assignments for common protocols. Correct matches: Port 80=HTTP, Port 443=HTTPS, Port 22=SSH, Port 21=FTP. Common confusions involve swapping port numbers for similar protocols.

Answer

Port 80: HTTPS

Answer

Port 22: Telnet

Question 14

Refer to the exhibit. A security analyst reviews the following firewall rule on a border firewall. Which vulnerability is present?

Accepted Answer

SSH access is allowed from any source. The firewall rule allows SSH (TCP port 22) from any source, which exposes the border firewall to brute-force attacks, unauthorized access, and potential credential harvesting. SSH should be restricted to specific trusted IP addresses or management networks to reduce the attack surface. An implicit deny rule exists by default at the end of most firewall rule sets, but the explicit permissive SSH rule overrides it, creating a critical security gap.

Answer

HTTPS is only allowed from a single host

Answer

HTTP is allowed from the internal network

Answer

An implicit deny rule is missing

Question 15

A mid-sized e-commerce company has recently experienced a data breach where customer payment card information was exfiltrated. The security team has identified that the breach originated from a compromised web server that was part of a PCI DSS compliant environment. The server was running outdated software and had several known vulnerabilities. Post-incident analysis reveals that the attacker exploited a SQL injection vulnerability in the order-tracking feature. The incident response team followed NIST SP 800-61 guidelines: they contained the threat, eradicated the malicious code, and restored the server from a known clean backup. However, two weeks after the restoration, the same server is again showing signs of similar malicious activity. The server is still in production and handling credit card transactions. Which of the following is the MOST effective course of action to prevent this recurring compromise?

Accepted Answer

Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.. The root cause of the breach is a SQL injection vulnerability in the order-tracking feature. Simply patching the server or redeploying the same code (Option B), implementing network segmentation (Option C), or adding a WAF (Option D) are all band-aid solutions that do not address the underlying flawed code. To prevent recurrence, the application code must be reviewed and the SQL injection flaw remediated by using parameterized queries. After fixing the code, redeploying after passing a static code analysis scan ensures the vulnerability is resolved. Therefore, option A is the most effective course of action.

Answer

Replace the web server with a new server running the latest OS and web server version, then redeploy the same web application code.

Answer

Implement network segmentation to isolate the web server and restrict outbound traffic to only essential services.

Answer

Increase logging and deploy a WAF in front of the server with rules to block common SQLi patterns.

Question 16

A defense contractor is developing a new secure messaging application for classified communications. The application must ensure end-to-end encryption, perfect forward secrecy, and resistance to quantum computing attacks. The development team proposes using ECDH for key exchange and AES-256-GCM for message encryption. The security architect reviews the design and identifies a weakness: the current key exchange does not authenticate the public keys, making it vulnerable to man-in-the-middle attacks. The team suggests adding digital signatures using RSA-2048. However, the architect is concerned about quantum resistance. What should the architect recommend?

Accepted Answer

Use ECDH with RSA-2048 signatures for authentication and plan to migrate to CRYSTALS-KYBER when standardized.. It provides a practical hybrid approach: using ECDH for key exchange (ensuring perfect forward secrecy) with RSA-2048 signatures for authentication (preventing man-in-the-middle attacks), while planning to migrate to the NIST-standardized post-quantum algorithm CRYSTALS-KYBER when available. This balances current security needs with future quantum resistance. Option A is wrong because increasing Diffie-Hellman parameters does not provide quantum resistance, and RSA-4096 is still vulnerable to quantum attacks. Option B is wrong because EdDSA with Curve25519 is not quantum-resistant, and hash-based signatures are unsuitable for real-time key exchange. Option C is wrong because pre-shared keys break perfect forward secrecy and are not scalable.

Answer

Replace ECDH with Diffie-Hellman using 4096-bit prime modulus and use RSA-4096 signatures.

Answer

Implement ECDH with Edwards-curve Digital Signature Algorithm (EdDSA) using Curve25519 and hash-based signatures for long-term keys.

Answer

Use pre-shared keys (PSK) for both key exchange and encryption, eliminating the need for public key authentication.

Question 17

A financial institution needs to ensure that transaction logs are tamper-proof after creation. Which solution should be implemented?

Accepted Answer

Cryptographic hashing with chain hashing. Chain hashing (also known as hash chaining or blockchain-style linking) ensures tamper-proof logs by including the cryptographic hash of the previous log entry in the current entry. This creates an immutable chain: any modification to a prior entry changes its hash, breaking the chain for all subsequent entries, making tampering immediately detectable. Unlike simple hashing of individual entries, chain hashing ties the entire log sequence together, providing integrity and non-repudiation of the log's chronological order.

Answer

Access control lists

Answer

Encryption with AES

Answer

Digital signatures on each log entry

Question 18

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

Accepted Answer

Include security requirements in contracts and conduct periodic audits. Including security requirements in contracts and conducting periodic audits is the most effective method because it creates a legally binding obligation for vendors to adhere to the organization's security policies, and audits provide direct, verifiable evidence of compliance. Unlike self-assessments or certifications, audits allow the organization to actively inspect controls, configurations, and processes, ensuring ongoing adherence rather than relying on a point-in-time assertion. This approach aligns with the NIST SP 800-53 continuous monitoring framework and is a core principle of third-party risk management (TPRM) in the CAS-004 domain.

Answer

Require vendors to obtain ISO 27001 certification

Answer

Send annual self-assessment questionnaires

Answer

Perform quarterly penetration tests on vendor networks

Question 19

A security engineer is writing a Python script to parse system logs and alert on suspicious patterns. What is the best practice to ensure the script remains secure when handling log data?

Accepted Answer

Sanitize log input and use safe parsing functions like `json.loads()` for structured logs.. Sanitizing log input and using safe parsing functions like `json.loads()` prevents injection attacks (e.g., command injection, code injection) that can occur when untrusted log data is processed. `json.loads()` strictly parses JSON according to RFC 7159, rejecting malformed or malicious payloads, whereas unsanitized input could contain escape sequences or embedded scripts that compromise the script's execution context.

Answer

Store all logs in a database and query directly.

Answer

Use `eval()` to dynamically evaluate log content.

Answer

Run the script with root privileges to access all logs.

Question 20

An organization is implementing a third-party risk management program. Which of the following is the FIRST step in the vendor risk assessment process?

Accepted Answer

Identify the vendor and the type of data it will handle. The first step in a vendor risk assessment is to identify the vendor and the type of data it will handle. This foundational step determines the scope and criticality of the assessment, as the data classification (e.g., PII, PHI, PCI-DSS) directly dictates the required security controls and regulatory compliance obligations. Without this identification, subsequent steps like audits or contract reviews lack context and may miss key risk areas.

Answer

Conduct an on-site audit of the vendor's facilities

Answer

Review the vendor's contractual security clauses

Answer

Determine risk treatment options