CAS-004 Practice Exam 58 — 20 Questions

Question 1

A security engineer is configuring a Linux server to enforce encrypted remote administration. The requirement is that after the initial key exchange, session keys must be rotated periodically to limit the impact of a compromised session key. Which OpenSSH configuration directive should the engineer use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set RekeyLimit to 1G 1h in the sshd_config file.. The RekeyLimit directive in OpenSSH allows administrators to enforce periodic rekeying based on data volume, time, or both. By setting it to 1G 1h, the session key is refreshed after 1 gigabyte of data or one hour, whichever occurs first. This limits the amount of data encrypted under a single key, reducing the impact of a key compromise. Other directives control cipher selection, key exchange algorithms, or integrity algorithms but do not manage key rotation.

Answer

Set Ciphers to aes256-ctr in the sshd_config file.

Answer

Set MACs to hmac-sha2-512 in the sshd_config file.

Answer

Set KexAlgorithms to diffie-hellman-group-exchange-sha256 in the sshd_config file.

Question 2

A security governance team is drafting a new data handling standard for a research subsidiary that processes both regulated personal data and proprietary intellectual property. The team must select controls that directly support data classification and labeling objectives. Which two of the following controls best fulfill this requirement? (Choose two.)

Accepted Answer

Automated sensitive-data discovery that tags files with the appropriate classification label at creation. Controls that directly support classification and labeling must either identify and mark data according to its sensitivity or enforce handling based on those markings. Automated discovery that tags data at creation and template-embedded labels enforced through data loss prevention both do this. Firewall reviews, awareness training, and role-based access control address network hygiene, human behavior, and authorization respectively, but none of them classify or label information assets.

Answer

Role-based access control applied to the subsidiary's file shares

Answer

A quarterly review of firewall rule sets against the approved network baseline

Answer

Annual security awareness training that mentions the existence of the data classification policy

Question 3

A healthcare provider must allow clinicians to access patient records from personal mobile devices while ensuring that data cannot be copied to unauthorized apps or stored locally. The organization wants to enforce this without managing the entire device. Which of the following should the security architect implement?

Accepted Answer

Mobile application management (MAM) with app-level encryption and containerization. MAM with app-level encryption and containerization enforces data protection at the application layer, allowing personal device use while preventing patient data from being copied to unauthorized apps or stored locally. It avoids the privacy concerns of full device management and directly addresses the data leakage requirement.

Answer

Virtual desktop infrastructure (VDI) with clipboard redirection disabled

Answer

Mobile threat defense (MTD) with behavioral anomaly detection

Answer

Mobile device management (MDM) with full device wipe capability

Question 4

A security administrator is configuring a new VPN concentrator to support remote workers. The organization requires that all remote access use strong authentication and that the VPN concentrator validate the health of connecting devices before granting access. Which technology should the administrator implement?

Accepted Answer

Network Access Control (NAC) with posture assessment. The requirement is for strong authentication and device health validation for remote VPN access. NAC with posture assessment provides exactly that by evaluating endpoint compliance before granting access. While IKEv2 with certificates offers strong authentication, it lacks health checks. RADIUS with PAP is weak, and 802.1X is not typically used for VPN health validation.

Answer

VPN with IKEv2 and certificate-based authentication

Answer

802.1X with EAP-TLS

Answer

RADIUS with PAP

Question 5

A security engineer must ensure that log data collected from production servers cannot be altered or deleted by an attacker who gains administrative access to those servers. The logs must remain verifiable for audit purposes. Which of the following designs BEST achieves this?

Accepted Answer

Forward logs in real time to a centralized server that uses append-only storage and cryptographic hash chaining.. Sending logs off-host in real time and storing them on a separate system with append-only writes and hash chaining ensures that a compromised server cannot retroactively change the audit record. The chained hashes let auditors detect any insertion, deletion, or modification, so the logs remain trustworthy even if the source host is fully compromised.

Answer

Configure log rotation with a short retention window and compress older files to save space.

Answer

Encrypt log files at rest on each server using a key stored in the server's local keystore.

Answer

Store logs locally on each server with strict file permissions and enable file integrity monitoring.

Question 6

A security engineer is configuring a wireless network for a hospital. The network must support legacy medical devices that only support WPA2-Personal with pre-shared keys (PSK) and cannot be upgraded. The hospital also wants to prevent unauthorized devices from connecting and to detect rogue access points. Which of the following should the engineer implement to BEST meet these requirements?

Accepted Answer

WPA2-Personal with a strong, unique PSK and a wireless intrusion prevention system (WIPS).. WPA2-Personal with a strong PSK accommodates legacy devices that cannot use 802.1X. A WIPS monitors the airwaves for rogue access points and can detect and mitigate unauthorized devices. This combination meets the requirements without requiring device upgrades, balancing compatibility and security.

Answer

WPA2-Enterprise with 802.1X authentication and a RADIUS server.

Answer

Open network with a captive portal and MAC address filtering.

Answer

WPA3-Enterprise with 192-bit mode and a RADIUS server.

Question 7

A cloud security engineer is designing an architecture where workloads in a virtual private cloud must reach an on-premises database over a site-to-site VPN. The requirement is that only the database subnet can be reached, no other on-premises networks, and traffic must be encrypted in transit. Which design BEST satisfies this?

Accepted Answer

Configure a customer gateway and virtual private gateway with a static route limited to the database subnet CIDR. A site-to-site IPsec VPN between a customer gateway and a virtual private gateway encrypts traffic, and constraining the static route to the database subnet CIDR enforces least-privilege reachability. Transit gateway full propagation, VPC peering, and public-IP exposure either broaden access or fail to provide an encrypted private path to the on-premises database.

Answer

Deploy a transit gateway and attach every on-premises VPC to it with full route propagation

Answer

Use VPC peering between the workload VPC and the on-premises database VPC

Answer

Create an internet gateway and allow the workload subnet to reach the database's public IP over TLS

Question 8

A security operations team has deployed a deception platform consisting of several Windows and Linux honeypots on a dedicated VLAN. After two weeks, the team notices the honeypots generate a high volume of connection attempts originating from internal vulnerability scanners, asset discovery tools, and backup agents, drowning out any genuine adversary activity. Which of the following is the BEST course of action to preserve the fidelity of the deception environment?

Accepted Answer

Tune the deception platform to suppress alerts for known scanner, discovery, and backup agent signatures and source addresses, while forwarding all other honeypot interactions to the SIEM.. Deception environments lose value when benign, authorized traffic overwhelms the alerts they produce. The practical fix is to baseline and suppress the deterministic signatures and source addresses of sanctioned tools such as vulnerability scanners, asset discovery engines, and backup agents, while continuing to forward every other honeypot interaction to the SIEM. This preserves the honeypot's high-fidelity detection role without discarding it or exposing production networks.

Answer

Place the honeypots behind a firewall rule that permits only traffic from external IP address ranges.

Answer

Decommission the honeypots and replace them with host-based intrusion detection agents installed on production servers.

Answer

Move the honeypots to the same VLAN as production servers so that legitimate administrative traffic blends in with adversary activity.

Question 9

A security architect is designing a network segmentation strategy for a critical industrial control system (ICS) environment. The architect must ensure that unauthorized devices cannot communicate with the ICS network even if they gain physical access to a network port. The architect decides to implement IEEE 802.1X with MAC Authentication Bypass (MAB) as a fallback. Which of the following is the MOST significant security weakness introduced by enabling MAB?

Accepted Answer

MAB allows any device to authenticate by spoofing a known MAC address, bypassing 802.1X authentication controls.. MAB authenticates devices by their MAC address, which is not a secret and can be easily spoofed. In an ICS environment where physical port access might be possible, an attacker could clone a permitted MAC address and bypass 802.1X controls. This defeats the goal of preventing unauthorized devices from communicating. Certificate-based methods or strict port security would be more robust, but MAB as a fallback introduces this spoofing vulnerability.

Answer

MAB transmits credentials in clear text, allowing an attacker to capture them and authenticate to the network.

Answer

MAB disables the use of RADIUS, forcing authentication to occur locally on the switch and reducing centralized control.

Answer

MAB requires the use of digital certificates on all endpoints, increasing administrative overhead and complexity.

Question 10

A financial services firm is designing a hybrid identity architecture. Employees authenticate on-premises to Active Directory Domain Services, while applications are hosted in multiple SaaS and IaaS providers. The security architect must ensure that a compromised on-premises domain controller cannot be used to forge tokens that grant access to cloud applications, and that cloud access decisions reflect real-time on-premises risk signals. Which of the following BEST achieves these goals?

Accepted Answer

Implement a cloud-based identity provider with conditional access that ingests on-premises risk telemetry through a secure API and uses short-lived tokens.. A cloud identity provider that uses conditional access and consumes on-premises risk telemetry issues short-lived tokens based on real-time evaluation, so cloud trust does not depend on on-premises token-signing keys. This prevents a compromised domain controller from forging cloud tokens while allowing risk signals to influence access decisions across SaaS and IaaS applications.

Answer

Use password hash synchronization with seamless single sign-on and enforce smart card authentication for all on-premises users.

Answer

Extend Active Directory Domain Services to the cloud using domain controllers deployed in IaaS virtual networks and replicate credentials.

Answer

Federate on-premises Active Directory Federation Services with each cloud provider using SAML or OIDC, and require MFA at the federation layer.

Question 11

A multinational financial services firm must comply with the General Data Protection Regulation (GDPR). The Chief Information Security Officer (CISO) asks the security team to implement a mechanism that allows data subjects to request and receive a copy of their personal data in a structured, commonly used, and machine-readable format. Which of the following technical controls BEST addresses this requirement?

Accepted Answer

Implement an API endpoint that allows authenticated data subjects to download their personal data in JSON or CSV format.. The GDPR grants data subjects the right to data portability, which requires organizations to provide personal data in a structured, commonly used, and machine-readable format. An API endpoint that allows authenticated users to download their data in JSON or CSV directly satisfies this requirement. Other controls like DLP, encryption, or retention policies address different GDPR obligations and do not enable data subject access requests.

Answer

Establish a records retention policy that automatically deletes personal data after a defined period.

Answer

Deploy a data loss prevention (DLP) solution to monitor and block unauthorized exfiltration of personal data.

Answer

Configure database encryption at rest using Transparent Data Encryption (TDE) to protect personal data.

Question 12

A software company wants to strengthen the integrity of its build pipeline. Developers currently commit code directly to the main branch, and build servers pull dependencies from public repositories without verification. The security architect must ensure that only reviewed code is built and that dependencies have not been tampered with. Which combination of controls best addresses these requirements?

Accepted Answer

Enforce signed commits with mandatory peer review and verify dependency signatures against a trusted allowlist.. Signed commits with mandatory peer review and branch protection ensure only reviewed, attributable code is built, while verifying dependency signatures against a trusted allowlist confirms that third-party components match their publishers' originals. These preventive controls address both halves of the requirement. Authentication, static analysis, and artifact storage protections each cover different concerns and leave the provenance and dependency integrity gaps open.

Answer

Store build artifacts in an encrypted repository and enable versioning on the storage bucket.

Answer

Run static application security testing on every build and block releases with high-severity findings.

Answer

Require developers to use multi-factor authentication when pushing to the repository.

Question 13

A financial services company is deploying a new internal web application that must meet PCI DSS requirements for encrypting cardholder data in transit. The security engineer must configure TLS to ensure that only ephemeral key exchanges are used and that compromised long-term keys cannot decrypt past sessions. Which of the following should the engineer implement?

Accepted Answer

Enable TLS 1.3 with cipher suites that use ephemeral Diffie-Hellman (DHE or ECDHE) key exchange.. TLS 1.3 enforces forward secrecy by requiring ephemeral key exchange, so even if the server's long-term private key is compromised, past session keys remain secure. The other options either use static key exchanges that lack forward secrecy or include deprecated algorithms like SHA-1. For PCI DSS compliance, ephemeral Diffie-Hellman with TLS 1.3 is the most robust choice.

Answer

Deploy TLS 1.2 with AES-256-GCM and ensure the server certificate uses SHA-1 for signing.

Answer

Implement TLS 1.2 with static Diffie-Hellman parameters and a 4096-bit RSA certificate.

Answer

Configure the server to use TLS 1.2 with RSA key exchange and 2048-bit RSA certificates.

Question 14

A security engineer is deploying a new wireless network for a corporate campus and must ensure that all client traffic is protected with strong encryption and that the network does not rely on a pre-shared key. Which configuration should the engineer implement?

Accepted Answer

WPA3-Enterprise with 802.1X authentication against a RADIUS server. WPA3-Enterprise with 802.1X and RADIUS authentication meets both requirements: it provides strong, current cryptographic protections and authenticates each client individually, so no pre-shared key is used. WPA2-Personal retains a shared key, open authentication provides no encryption, and WEP is broken. The enterprise mode with 802.1X is the standard choice for corporate wireless deployments.

Answer

WPA2-Personal with a rotated pre-shared key every 30 days

Answer

WEP with 128-bit keys and MAC address filtering

Answer

Open authentication with a captive portal for guest access

Question 15

A security team is deploying a hardware security module (HSM) to protect the root of trust for a code-signing pipeline. The team must ensure that signing keys cannot be extracted and that all signing operations are attributable to an authorized operator. Which TWO controls BEST meet these requirements? (Choose two.)

Accepted Answer

Configure the HSM to mark signing keys as non-extractable and perform all cryptographic operations inside the module. Marking keys non-extractable and performing operations inside the module protects the signing key from extraction, while per-operator authentication with operation logging provides attribution. Backup exports and shared service accounts undermine both goals, and FIPS validation is a module-level compliance attribute rather than an operational control.

Answer

Store an encrypted backup of the HSM's key material on a network share protected by share-level permissions

Answer

Enable FIPS 140-3 validated mode on the HSM and publish the validation certificate internally

Answer

Configure the HSM to allow a shared service account to perform signing so that automation is not interrupted

Question 16

A security architect is designing a system that must provide confidentiality and integrity for data at rest and in transit. The organization wants to minimize the risk of key compromise and ensure that a single compromised key does not expose all data. Which key management strategy best meets these requirements?

Accepted Answer

Implement a hierarchical key management system with data encryption keys wrapped by key encryption keys. A hierarchical key management system with unique data encryption keys wrapped by key encryption keys ensures that compromise of one data key only affects the data it protects. This limits the blast radius and meets the requirement that a single compromised key does not expose all data. Other strategies create single points of failure.

Answer

Derive all encryption keys from a single password using PBKDF2

Answer

Use a single master key to encrypt all data, stored in a hardware security module (HSM)

Answer

Store all encryption keys in a centralized key vault without additional wrapping

Question 17

A security engineer is deploying a wireless network for a corporate campus that must authenticate users with 802.1X and protect credentials from eavesdropping. The engineer configures a RADIUS server and WPA3-Enterprise. Which TWO additional configuration elements are required to establish a mutually authenticated, encrypted EAP tunnel before the supplicant's identity is exposed? (Choose two.)

Accepted Answer

An EAP method that establishes a TLS tunnel before transmitting the inner identity, such as EAP-TTLS or PEAP.. A protected EAP deployment needs the supplicant to validate the authentication server via a trusted certificate, then negotiate a TLS tunnel in which the real identity and credentials travel. PEAP and EAP-TTLS both do this, whereas methods that expose identity before tunneling do not. Together the trusted server certificate and the tunneling EAP method deliver mutual authentication and credential protection.

Answer

A preshared key distributed to all campus clients through group policy.

Answer

WPA3-SAE on the access point to derive the pairwise master key from the passphrase.

Answer

A captive portal that redirects unauthenticated clients to a credential entry page.

Question 18

A security governance team is defining the scope of its enterprise risk management (ERM) program. Which TWO of the following activities are core components of ERM as described in frameworks such as ISO 31000 and COSO ERM? (Choose two.)

Accepted Answer

Integrating risk considerations into strategic planning and objective setting. ERM frameworks such as ISO 31000 and COSO ERM center on governance, strategy integration, and risk appetite. Defining risk appetite and tolerance gives leadership a benchmark for decisions, while integrating risk into strategic planning ensures objectives are set with awareness of uncertainty. Technical controls and asset inventories support risk management but are not core ERM components themselves.

Answer

Performing technical vulnerability scans on all production servers weekly

Answer

Maintaining an inventory of all hardware assets with purchase dates

Answer

Encrypting all databases containing personally identifiable information

Question 19

A company's security team is reviewing its risk register. A risk related to an outdated internal application has been assigned an owner, but the owner has taken no action for two quarters. The Chief Information Security Officer wants to ensure the risk is tracked and escalated appropriately. Which action should the security team take first?

Accepted Answer

Escalate the overdue risk to the risk owner's management and the risk committee with the current status. The security team should escalate the overdue risk to the owner's management and the risk committee with current status. Escalation preserves accountability, keeps the risk visible, and forces a timely treatment decision by those with authority. Accepting, deleting, or unilaterally transferring the risk would bypass governance and hide the exposure rather than manage it, which is why escalation is the correct first action.

Answer

Immediately accept the risk on behalf of the business owner to close the item

Answer

Remove the risk from the register because the owner has implicitly accepted it by doing nothing

Answer

Transfer the risk to an insurance carrier and mark the register item as resolved

Question 20

A security architect at a financial services firm is designing a microsegmentation strategy for a data center running both virtual machines and containerized workloads. The architect must reduce east-west lateral movement and enforce least-privilege communication between tiers. Which TWO design elements are most appropriate? (Choose two.)

Accepted Answer

Use a service mesh with mutual TLS and authorization policies for service-to-service communication.. Identity-based host firewall policies and a service mesh with mutual TLS and authorization policies both enforce least-privilege communication at the workload level. Identity-based rules survive IP changes across VMs and containers, while the mesh cryptographically authenticates and authorizes service-to-service calls. Together they reduce east-west lateral movement, whereas perimeter, VLAN, and monitoring-only controls cannot enforce per-workload segmentation.

Answer

Enable promiscuous-mode intrusion detection on a SPAN port for all internal traffic.

Answer

Deploy a single perimeter firewall with rules based on source and destination IP ranges.

Answer

Rely on VLAN segmentation between application tiers to control east-west traffic.