CAS-004 Practice Exam 58 — 20 Questions

Question 1

An organization has recently migrated its on-premises data center to a public cloud. The security team notices that several virtual machines (VMs) in the same subnet are communicating with each other without any restrictions. The company policy requires that only specific application traffic (e.g., database queries from web servers) be allowed between VMs, and all other inter-VM traffic must be blocked to comply with a zero-trust model. The cloud provider offers native security group and network ACL features. The architect must design a solution that enforces the policy with minimal administrative overhead and supports future expansion.

Which of the following is the BEST course of action?

Accepted Answer

Place all VMs in the same subnet and configure security groups that only allow necessary inter-VM traffic (e.g., web-to-db), with a default deny rule. Security groups are stateful firewalls that operate at the instance level and are deny-by-default. By placing all VMs in the same subnet and applying security groups with allow rules only for required application traffic (e.g., web-to-db), we enforce zero-trust principles: all traffic is denied unless explicitly allowed. This minimizes administrative overhead because security groups are easy to manage and do not require separate subnetting or additional appliances. Option A is incorrect because moving to separate VPCs introduces unnecessary complexity and VPC peering overhead. Option C is incorrect because network ACLs are stateless and require explicit inbound and outbound rules for each flow, increasing administrative effort. Option D is incorrect because a third-party firewall adds cost and complexity without providing additional security benefit beyond what native security groups already offer.

Answer

Move each application tier to a separate VPC and use VPC peering with strict routing policies

Answer

Place all VMs in the same subnet and configure network ACLs with explicit allow rules for required traffic and a deny-all rule for other traffic

Answer

Keep all VMs in the same subnet but deploy a third-party next-generation firewall as a virtual appliance to inspect and filter inter-VM traffic

Question 2

A company is implementing a microservices architecture and needs to ensure secure service-to-service communication. Which of the following BEST describes the recommended approach?

Accepted Answer

Mutual TLS (mTLS) with certificate authentication. Mutual TLS (mTLS) with certificate authentication is the recommended approach for secure service-to-service communication in a microservices architecture because it provides both encryption and bidirectional authentication. Each service presents a unique X.509 certificate to verify its identity, preventing unauthorized access and man-in-the-middle attacks. This aligns with the principle of zero-trust networking, where no implicit trust is granted based on network location.

Answer

Basic HTTP authentication

Answer

IP whitelisting

Answer

Shared API keys

Question 3

A security architect finds this IAM policy attached to an S3 bucket. Which of the following best describes a critical security flaw in this policy?

Accepted Answer

The condition on the second statement uses StringEquals instead of IpAddress. The second statement uses StringEquals for the aws:SourceIp condition. StringEquals performs a literal string comparison, so the condition checks if the source IP exactly equals the string '10.0.0.0/8', which never happens. As a result, the condition always evaluates to false, and the Allow statement never grants any access. The critical security flaw is the misuse of the condition operator: StringEquals should be IpAddress to match IP ranges. This misconfiguration renders the intended IP restriction ineffective, and the bucket remains private (no public access is granted from the 10.0.0.0/8 range or anywhere else).

Answer

The second statement allows public access from the 10.0.0.0/8 IP range

Answer

The first statement allows EC2 to assume any role in the account

Answer

The policy should use a NotPrincipal element to restrict access

Question 4

Which TWO of the following are valid techniques to mitigate the risk of side-channel attacks on cryptographic implementations? (Select exactly 2.)

Accepted Answer

Implementing constant-time algorithms to avoid timing variations.. Constant-time cryptographic implementations ensure that the execution time does not depend on secret data, such as keys or plaintext. This directly mitigates timing side-channel attacks, where an attacker measures variations in execution time to infer secret values. By making all code paths take the same amount of time regardless of input, the attacker cannot exploit timing differences.

Answer

Obfuscating the source code of the cryptographic library.

Answer

Using a cryptographically secure random number generator for key generation.

Answer

Increasing the key length to 4096 bits.

Question 5

A security engineer must select a cryptographic algorithm to ensure non-repudiation for digitally signed documents. Which algorithm is most appropriate?

Accepted Answer

RSA with SHA-256. RSA with SHA-256 (Option A) is the most appropriate choice because digital signatures rely on asymmetric cryptography. RSA provides the private key for signing and the public key for verification, ensuring that only the signer could have created the signature. SHA-256 provides a secure hash. Together, they provide non-repudiation. In contrast, HMAC-SHA256 (Option B) uses a symmetric key, which does not provide non-repudiation because both parties share the key. AES-256 in GCM mode (Option C) is a symmetric encryption algorithm, not a signature algorithm. Elliptic Curve Diffie-Hellman (ECDH) (Option D) is a key exchange protocol, not suitable for digital signatures.

Answer

HMAC-SHA256

Answer

AES-256 in GCM mode

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Question 6

A security engineer is tasked with designing a cryptographic solution to protect data at rest in a multi-tenant cloud storage system. Each tenant's data must be encrypted with a unique key, and the system must support key rotation with minimal performance impact. Which of the following is the BEST approach?

Accepted Answer

Implement envelope encryption: generate a unique data encryption key (DEK) per tenant, encrypt each DEK with a key encryption key (KEK) stored in an HSM, and store the wrapped DEK alongside the data.. Envelope encryption with a unique data encryption key (DEK) per tenant allows independent key rotation and minimizes performance impact by only requiring re-wrapping of the DEK with a new key encryption key (KEK) stored in an HSM. Option A is wrong because storing both the tenant key and the master key in the same database column exposes the master key if the database is compromised. Option C is wrong because a single master key for all tenants violates isolation; if compromised, all tenant data is at risk. Option D is wrong because manual monthly rotation of all keys is not scalable and does not provide per-tenant isolation.

Answer

Generate a unique key per tenant and encrypt each key with a master key, then store both in the same database column.

Answer

Use a single master key for all tenants and store the key in a hardware security module (HSM) with access controls.

Answer

Implement a periodic key rotation schedule that rotates all tenant keys every month manually.

Question 7

A security engineer is evaluating options for securing firmware updates on IoT devices. Which TWO methods provide integrity verification of the update?

Accepted Answer

Hash-based message authentication code (HMAC). HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. The firmware update's integrity is verified by recomputing the HMAC on the received data and comparing it to the transmitted tag; any tampering will cause a mismatch. This ensures that the firmware has not been altered in transit, providing integrity verification.

Answer

Obfuscation of the firmware code

Answer

AES encryption of the firmware

Answer

Secure Boot

Question 8

An organization is implementing a public key infrastructure (PKI). Which THREE of the following are essential components?

Accepted Answer

Certificate authority (CA). The Certificate Authority (CA) is the core trust anchor in a PKI, responsible for issuing, signing, and revoking digital certificates. Without a CA, there is no mechanism to bind public keys to identities, making secure communications impossible. The CA's private key is used to sign certificates, and its public key is distributed as a trusted root.

Answer

Key escrow agent

Answer

Time-stamping authority (TSA)

Question 9

A security engineer is deploying a wireless network for a high-security facility. Which protocol should be used to provide the strongest authentication and encryption for client devices?

Accepted Answer

WPA3-Enterprise with 802.1X. WPA3-Enterprise with 802.1X is the correct choice because it provides the strongest authentication and encryption for a high-security facility. It uses Simultaneous Authentication of Equals (SAE) for secure key exchange, mandates GCMP-256 encryption, and integrates with 802.1X/EAP for per-user, certificate-based authentication, eliminating shared passphrase vulnerabilities.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with AES

Answer

WPA3-Personal with SAE

Question 10

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Options A, C, and E are correct. Threat modeling, static analysis, and penetration testing are core SSDLC activities. Option B is wrong because user acceptance testing (UAT) validates business requirements, not security. Option D is wrong because daily stand-up meetings are a project management practice, not security-specific.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 11

A cloud security architect is designing a multi-region active-active application. The application must maintain high availability even if an entire AWS region fails. Which architecture BEST meets this requirement?

Accepted Answer

Deploy identical stacks in two regions with Route 53 weighted routing and DynamoDB global tables. Deploying identical application stacks in two AWS regions with Route 53 weighted routing distributes traffic evenly across both regions, and DynamoDB global tables provide multi-region, multi-master replication with eventual consistency, ensuring the application remains fully active and available even if an entire AWS region fails. This architecture meets the active-active and region-failure requirement without relying on failover or single-region dependencies.

Answer

Active-active in one region with auto scaling

Answer

Single region with multiple AZs and RDS Multi-AZ

Answer

Two regions with active-passive failover using Route 53 health checks

Question 12

The security engineer notices that SSH login attempts to 192.168.1.1 from the untrust zone are being blocked. Which policy misconfiguration is MOST likely causing this?

Accepted Answer

The source zone is not permitted. The security engineer observes SSH login attempts from the untrust zone to 192.168.1.1 being blocked. In a typical firewall policy, the source zone must be explicitly permitted for traffic to be allowed. If the source zone 'untrust' is not included in the policy's source zone list, the firewall will drop the traffic regardless of other correct parameters. This is the most likely misconfiguration because SSH traffic from the untrust zone is reaching the destination but being denied at the policy level.

Answer

The application is incorrect

Answer

The log setting prevents connections

Answer

The destination address is incorrect

Question 13

A security team is implementing controls to meet PCI DSS requirements for cardholder data. Which THREE controls are required?

Accepted Answer

Encrypt cardholder data at rest. PCI DSS requires several controls, but the question asks for THREE. Options A, B, and D are mandatory controls per PCI DSS: encryption of cardholder data at rest (Requirement 3.4), multi-factor authentication for remote access (Requirement 8.3), and unique IDs for each person with access (Requirement 7.1). While antivirus (Requirement 5) and quarterly vulnerability scans (Requirement 11.2) are also required, they are part of broader operational requirements and not the focus of this specific selection.

Answer

Regularly update antivirus software

Answer

Perform quarterly vulnerability scans

Question 14

A small business runs its critical line-of-business application on a single Windows server located in a local data center. The server is accessed by employees remotely via RDP over a VPN. Recently, the server has been experiencing slow performance, and the administrator notices high CPU usage from a process named 'svchost.exe'. The administrator suspects malware but is not sure. The business has no security tools beyond Windows Defender. Management wants to minimize downtime and ensure the server is back to full operation as soon as possible. Which of the following is the BEST course of action for the administrator to take first?

Accepted Answer

Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.. A full offline scan using Microsoft Defender Offline boots the server from a clean environment, bypassing the running operating system where malware can hide or resist detection. This approach directly addresses the suspected malware without relying on the compromised OS, minimizes downtime by avoiding unnecessary restoration or network changes, and uses the only security tool available (Windows Defender) effectively.

Answer

Restore the server from the most recent backup taken before the performance issues started.

Answer

Install a third-party antivirus solution and perform a full system scan.

Answer

Disconnect the server from the network immediately to contain any potential threat.

Question 15

An organization wants to reduce the attack surface of its web servers by ensuring only necessary modules are enabled. Which practice directly supports this goal?

Accepted Answer

Application whitelisting and module disablement. Application whitelisting and module disablement. This practice directly reduces the attack surface by ensuring only authorized applications and necessary modules are enabled, eliminating unnecessary services that could be exploited. Option A (Patch management) addresses vulnerabilities in existing software but does not remove unused modules. Option C (Regular backups) focuses on data recovery, not attack surface reduction. Option D (Multi-factor authentication) strengthens access control but does not limit enabled modules or applications.

Answer

Patch management

Answer

Regular backups

Answer

Multi-factor authentication

Question 16

Based on the exhibit, which vulnerability is being exploited?

Accepted Answer

Directory traversal. The GET request in the exhibit uses '../' sequences to traverse directories and access the /etc/passwd file, which is characteristic of a directory traversal attack. Option A (CSRF) is wrong because CSRF attacks rely on exploiting a user's authenticated session to perform unintended actions, not directory path manipulation. Option B (SQL injection) is wrong because there is no SQL syntax or database query involved. Option D (XSS) is wrong because no scripts or client-side code execution is present.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 17

Based on the exhibit, what is the primary purpose of the condition in this IAM policy?

Accepted Answer

Restrict access to requests originating from the specified IP ranges. The condition in the IAM policy uses the `aws:SourceIp` key to restrict access to requests originating from the specified IP ranges. Option A is incorrect because the condition does not address encryption in transit. Option B is incorrect because the policy does not allow all traffic; it allows only requests from the specified IPs. Option C is incorrect because the policy is an allow with a condition, not a deny statement. The condition effectively limits which IPs can perform the allowed actions, making D the primary purpose.

Answer

Enable encryption in transit for the S3 bucket

Answer

Allow all incoming traffic to the S3 bucket

Answer

Deny access from the specified IP ranges

Question 18

A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Authentication logs, such as Windows Event ID 4624, are the most critical for detecting lateral movement via pass-the-hash or pass-the-ticket attacks because they record logon events across systems, revealing when an attacker uses stolen credentials to access other machines. Option B (antivirus logs) is less relevant as they focus on malware, not authentication patterns. Option C (DNS logs) shows name resolution but not authentication. Option D (firewall logs) indicate network flows but lack authentication context.

Answer

Antivirus logs

Answer

DNS logs

Answer

Firewall logs

Question 19

An organization needs to demonstrate compliance with the General Data Protection Regulation (GDPR) for processing personal data of EU citizens. Which of the following is a mandatory requirement under GDPR?

Accepted Answer

Implement data protection by design and default. Article 25 of the GDPR mandates data protection by design and default, requiring organizations to integrate data protection measures into processing activities and business practices from the outset. This includes pseudonymization, data minimization, and ensuring that only necessary personal data is processed by default. It is a mandatory, proactive requirement that applies to all controllers, regardless of the legal basis for processing.

Answer

Obtain explicit consent for all data processing

Answer

Notify supervisory authority of a breach within 24 hours

Answer

Store all personal data within the EU

Question 20

A company is evaluating a vendor that will process sensitive customer data. The vendor's SOC 2 Type II report shows that controls were in place but had several exceptions noted. Which of the following is the BEST course of action?

Accepted Answer

Perform a risk assessment on the exceptions. A SOC 2 Type II report with exceptions indicates that controls were tested over a period and found to have gaps. The best course is to perform a risk assessment on the exceptions to evaluate their severity, impact on confidentiality, integrity, or availability of sensitive data, and determine if compensating controls or remediation plans are acceptable. This aligns with the risk management framework required for vendor due diligence under compliance standards like GDPR or PCI DSS.

Answer

Request a SOC 2 Type I report instead

Answer

Accept the vendor because it has a Type II report

Answer

Reject the vendor immediately due to exceptions