CAS-004 Practice Exam 59 — 20 Questions

Question 1

A mid-sized healthcare organization processes protected health information (PHI) and must comply with HIPAA and the GDPR for its EU patients. The organization uses a hybrid cloud environment with on-premises servers and AWS. Recently, an employee's laptop was stolen containing unencrypted PHI. The incident response team was activated. The security architect must determine the best course of action to address compliance obligations. The organization has a data classification policy, but it is not consistently enforced. A business continuity plan exists but has not been tested in two years. The CEO is concerned about reputational damage and legal liability. Which of the following should the security architect recommend FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Notify affected patients and relevant regulatory authorities per breach notification rules. Under both HIPAA and GDPR, the primary immediate obligation after a data breach involving PHI is to notify affected individuals and relevant authorities within prescribed timeframes (72 hours for GDPR, and within 60 days for HIPAA). This demonstrates compliance and mitigates legal and reputational risk. Option A is wrong because purchasing cyber liability insurance is a financial risk transfer mechanism that does not satisfy the legal requirement to notify; it addresses potential costs but not the immediate compliance obligation. Option C is wrong while full-disk encryption is a preventive control that should be implemented, it does not address the current breach; notification must come first. Option D is wrong because updating the data classification policy is a long-term improvement, but the immediate priority is fulfilling breach notification requirements.

Answer

Purchase cyber liability insurance to cover potential fines and legal costs

Answer

Implement full-disk encryption on all laptops and mobile devices immediately

Answer

Update the data classification policy to require encryption of all PHI on endpoints

Question 2

A company's internal audit found that employees often share passwords. Which policy change would BEST address this?

Accepted Answer

Implement multi-factor authentication. Multi-factor authentication (MFA) directly mitigates the risk of password sharing by requiring a second authentication factor (e.g., a one-time passcode from a hardware token or authenticator app, or a biometric) in addition to the password. Even if employees share passwords, an attacker cannot authenticate without the second factor, which is typically not shared. This policy change addresses the root cause—unauthorized access via shared credentials—rather than trying to prevent the sharing behavior itself.

Answer

Increase password complexity requirements

Answer

Require password changes every 30 days

Answer

Provide security awareness training on password sharing

Question 3

During a third-party risk assessment, a security architect discovers that a vendor's data retention policy does not align with the organization's legal requirements. Which of the following is the BEST course of action?

Accepted Answer

Request the vendor to update its retention policy to align with legal requirements.. The vendor's data retention policy must comply with the organization's legal requirements, such as GDPR or HIPAA, which mandate specific data lifecycle controls. Requesting the vendor to update its policy is the most direct and effective way to achieve compliance, as it addresses the root cause without prematurely terminating a business relationship or relying on compensating controls that may not fully satisfy regulatory obligations.

Answer

Accept the risk and document it in the risk register.

Answer

Immediately terminate the vendor contract.

Answer

Implement compensating controls to enforce data deletion after the required period.

Question 4

During a compliance audit, an organization's security team discovers that sensitive data in a legacy database is stored in plaintext. The database is critical for operations and cannot be taken offline for patching until the next maintenance window in three months. Which of the following is the BEST compensating control to reduce risk immediately?

Accepted Answer

Restrict network access to the database to only authorized applications. Restricting network access to the database to only authorized applications is the best compensating control because it immediately reduces the attack surface without requiring any changes to the database itself. By implementing a host-based firewall or network ACLs that limit inbound connections to only specific application servers (e.g., via IP whitelisting and port restrictions), the organization can prevent unauthorized users or malware from directly querying the plaintext data. This control is operational immediately, does not require downtime, and aligns with the principle of least privilege, making it the most practical short-term risk mitigation while awaiting the maintenance window.

Answer

Use file-level encryption on the database storage volume

Answer

Implement transparent database encryption (TDE)

Answer

Apply a digital signature to the database files

Question 5

An organization wants to adopt a cybersecurity framework that provides a structured approach to managing cyber risks. Which framework is BEST suited?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is specifically designed to provide a structured, risk-based approach to managing cybersecurity risks, offering core functions (Identify, Protect, Detect, Respond, Recover) and implementation tiers that align with an organization's risk appetite. It is the best fit because it directly addresses cyber risk management through a flexible, outcome-driven framework, unlike other frameworks that focus on IT governance, information security management systems, or service management.

Answer

COBIT

Answer

ISO 27001

Answer

ITIL

Question 6

Which TWO of the following are key components of a risk assessment methodology?

Accepted Answer

Threat identification.. Threat identification (B) is a core component of a risk assessment methodology because it systematically catalogs potential sources of harm that could exploit vulnerabilities in the environment. Without identifying threats—such as malware, insider threats, or natural disasters—the subsequent risk analysis cannot calculate likelihood or impact. Asset inventory (E) is equally fundamental because risk is always assessed in the context of what is valuable or critical to the organization; you cannot evaluate risk to assets you do not know exist.

Answer

Disaster recovery.

Answer

Risk appetite.

Answer

Incident response.

Question 7

Which THREE of the following are required by the NIST Cybersecurity Framework (CSF) for the 'Protect' function?

Accepted Answer

Performing regular maintenance of systems. Performing regular maintenance of systems is required under the Protect function of the NIST Cybersecurity Framework (CSF) because it directly supports the 'Protective Technology' and 'Maintenance' subcategories (PR.MA). Regular patching, updates, and hardware upkeep ensure that security controls remain effective against known vulnerabilities, reducing the attack surface. This is a proactive measure to sustain the integrity and availability of systems, aligning with the CSF's focus on safeguarding critical infrastructure.

Answer

Conducting a risk assessment for critical assets

Answer

Developing an incident response plan

Question 8

Refer to the exhibit. Which of the following best describes the effect of this ACL?

Accepted Answer

Blocks all traffic to the 10.0.0.0/24 network.. The ACL 'deny ip any 10.0.0.0 0.0.0.255' is an extended IP access-list that filters based on both source and destination. The source is 'any', meaning all sources, and the destination is the 10.0.0.0/24 network. Therefore, this ACL blocks all IP traffic destined to the 10.0.0.0/24 network, regardless of the source. The correct answer is that it blocks traffic to that network.

Answer

Blocks all traffic from the 10.0.0.0/24 network.

Answer

Permits all traffic to the 10.0.0.0/24 network.

Answer

Permits all traffic from the 10.0.0.0/24 network.

Question 9

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

Accepted Answer

The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.. Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Answer

The image tag "latest" might pull an outdated image.

Answer

The readOnlyRootFilesystem prevents logging.

Answer

The pod runs as root by default.

Question 10

An organization uses AWS, Azure, and GCP for different workloads. They want a single tool to manage infrastructure consistently across all providers. Which approach is most appropriate?

Accepted Answer

Use Terraform with provider plugins. Terraform is an infrastructure-as-code tool that uses provider plugins to interact with the APIs of AWS, Azure, GCP, and hundreds of other services. This allows a single declarative configuration language (HCL) to manage resources consistently across all three cloud providers, making it the most appropriate choice for multi-cloud infrastructure management.

Answer

Use Azure Resource Manager templates

Answer

Write provider-specific scripts in PowerShell

Answer

Use AWS CloudFormation

Question 11

A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?

Accepted Answer

Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.. Integrating container image scanning into the CI/CD pipeline ensures vulnerabilities are detected before deployment, reducing delays and improving security. Option A is correct because adding a stage in Jenkins to run Trivy scans before pushing images to the registry catches issues early. Option B is incorrect because weekly scans after deployment do not prevent vulnerable images from being deployed. Option C is incorrect because Terraform can enforce registry trust but does not scan for vulnerabilities within the image. Option D is incorrect because relying on developers for local scans is inconsistent and not automated.

Answer

Schedule a weekly cron job to scan the container registry and generate reports.

Answer

Use Terraform to enforce that only images from a trusted registry are deployed.

Answer

Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.

Question 12

A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?

Accepted Answer

Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.. Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.

Answer

Use a runtime security tool that scans containers only when they are running.

Answer

Scan the container image only after deployment to production.

Answer

Rely on the developers to manually check for vulnerabilities.

Question 13

A security analyst is reviewing the following JSON Web Token (JWT) header: {"alg":"none","typ":"JWT"}. Which of the following vulnerabilities does this indicate?

Accepted Answer

Algorithm confusion attack surface. The JWT header specifies `"alg":"none"`, which instructs the server to accept a token without any cryptographic signature. This is a critical vulnerability because an attacker can forge arbitrary tokens by setting the algorithm to `none`, bypassing signature verification entirely. The correct answer is B because this directly creates an algorithm confusion attack surface, where the server may be tricked into accepting unsigned tokens.

Answer

Weak signing key

Answer

Token expiration not set

Answer

Unencrypted payload

Question 14

A security analyst discovers that a containerized application is running with root privileges. Which of the following is the best practice to reduce the attack surface?

Accepted Answer

Run the container as a non-root user. Running a container as a non-root user directly reduces the attack surface by limiting the privileges available to an attacker if the container is compromised. Option A (minimal base image) reduces potential vulnerabilities but does not address the root privilege issue. Option B (disable network access) could break application functionality and does not affect privilege level. Option D (read-only root filesystem) prevents writing to the filesystem but still allows root-level access.

Answer

Use a minimal base image

Answer

Disable network access for the container

Answer

Use a read-only root filesystem

Question 15

A company is deploying a containerized application on Kubernetes. The security team requires that only signed images from a private registry be used and that containers run without privileged mode. Which Kubernetes admission controller should be configured to enforce both requirements?

Accepted Answer

PodSecurity. PodSecurity is the correct admission controller because it enforces Pod Security Standards (PSS) that can restrict containers from running in privileged mode (via the `privileged` policy) and can be combined with other mechanisms (e.g., image verification) to ensure only signed images are used. While PodSecurity itself does not directly verify image signatures, it can be paired with a separate admission controller like ImagePolicyWebhook or a mutating webhook to enforce signed images, and the question's phrasing implies a single controller that addresses both requirements—PodSecurity is the only option that natively handles the privileged mode restriction and can integrate with signature enforcement. The other options either lack the ability to enforce both conditions or address only one aspect.

Answer

NodeRestriction

Answer

ImagePolicyWebhook

Answer

AlwaysPullImages

Question 16

A company is deploying a RESTful API that handles sensitive financial data. Which of the following should be implemented to ensure data integrity during transmission?

Accepted Answer

TLS 1.3. TLS 1.3 ensures data integrity during transmission by providing transport-layer encryption with authenticated encryption (AEAD), which guarantees that any tampering with the ciphertext will be detected upon decryption. For a RESTful API handling sensitive financial data, TLS 1.3 is the correct choice because it protects the entire HTTP payload in transit, preventing man-in-the-middle attacks from modifying or replaying data.

Answer

Input validation

Answer

JSON Web Token (JWT) authentication

Answer

API rate limiting

Question 17

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC)?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.

Answer

Continuous deployment

Answer

Code signing

Question 18

A company is adopting a secure software development lifecycle (SDLC). Which two practices are most effective for identifying vulnerabilities early in the development process? (Select TWO.)

Accepted Answer

Regular code reviews with security focus. Options C and D are correct because both are early-phase security practices in the SDLC. Regular code reviews with a security focus (C) involve manual inspection of source code for logic flaws, injection vulnerabilities, and insecure design patterns, enabling detection before compilation or deployment. Static application security testing (SAST) integrated into the IDE (D) automatically scans source code for known vulnerability patterns, providing immediate feedback during development. Both practices target the coding phase, allowing early detection and remediation. In contrast, DAST, RASP, and penetration testing require a running application or occur post-deployment, making them late-phase practices.

Answer

Runtime application self-protection (RASP)

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing after deployment

Question 19

An organization is migrating a legacy application to a containerized environment. The application requires root privileges to bind to a low port (80). What is the most secure approach to handle this requirement?

Accepted Answer

Map port 80 to a non-privileged port and grant CAP_NET_BIND_SERVICE capability. It allows the container to bind to port 80 without running as root by mapping the container's port 80 to a non-privileged host port (e.g., 8080) and granting the CAP_NET_BIND_SERVICE capability. This capability enables the container process to bind to privileged ports (<1024) while running with a non-root user, adhering to the principle of least privilege. It avoids the security risks of full root access while satisfying the application's requirement.

Answer

Change the application to use a high port (e.g., 8080)

Answer

Run the container as root and bind to port 80

Answer

Use host networking mode

Question 20

A security analyst is performing incident response and needs to collect evidence from a live system. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory (RAM). The order of volatility dictates that memory (RAM) is the most volatile and must be captured before any other evidence.

Answer

Network connections

Answer

Hard drive contents

Answer

System logs