CAS-004 Practice Exam 59 — 20 Questions

Question 1

A security architect is designing a microsegmentation strategy for a data center hosting both legacy monolithic applications and new containerized workloads. The architect must reduce lateral movement while minimizing disruption to existing traffic flows. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Map application dependencies and traffic flows before defining segmentation policy so that legitimate communication paths are preserved.. Effective microsegmentation starts with understanding real traffic dependencies, then enforces least-privilege rules anchored to workload identity so policy survives address churn in mixed legacy and container environments. Blanket deny-with-manual-opening, perimeter-only appliances, and uniform static lists either disrupt operations or fail to constrain east-west movement.

Answer

Apply identical static access control lists to every subnet regardless of the workloads hosted there.

Answer

Replace all existing firewalls with a single perimeter appliance that inspects north-south traffic at the data center edge.

Answer

Disable all inter-tier communication by default and require application teams to open ports manually after each deployment.

Question 2

A security analyst is investigating a malware sample that uses the Windows API function NtQueryInformationProcess to detect if it is being debugged. The analyst wants to understand how this anti-debugging technique works and how to bypass it. Which of the following statements accurately describes the technique and a potential bypass?

Accepted Answer

The malware checks the ProcessDebugPort field, which is non-zero when a debugger is attached. A bypass is to patch the return value of the API call.. The correct answer describes the ProcessDebugPort technique. When a debugger is attached, the system creates a debug port, and NtQueryInformationProcess with ProcessDebugPort returns a non-zero value. Malware can check this to detect debugging. A common bypass is to patch the API function to always return zero for that information class, effectively hiding the debug port. This is a standard anti-anti-debugging approach used in malware analysis.

Answer

The malware checks the ProcessDebugFlags field, which is zero when a debugger is attached. A bypass is to use a kernel-mode debugger to avoid detection.

Answer

The malware checks the ProcessBasicInformation field, which contains a pointer to the PEB. A bypass is to modify the PEB directly.

Answer

The malware checks the ProcessDebugObjectHandle field, which is zero when a debugger is attached. A bypass is to set a breakpoint on the API and modify the handle.

Question 3

A security engineer is implementing a solution to protect sensitive data stored in a database. The requirement is to ensure that even if the database files are stolen, the data cannot be read without access to a hardware security module (HSM). Which of the following should the engineer implement?

Accepted Answer

Transparent Data Encryption (TDE) with keys stored in an HSM. Transparent Data Encryption with keys stored in an HSM ensures that the encryption keys are protected by hardware and never exposed in software or configuration files. This means that even if the database files are stolen, decryption is impossible without the HSM. The other options either store keys insecurely or do not provide hardware-based key protection.

Answer

Application-level encryption with keys derived from a user password

Answer

Column-level encryption with keys stored in a configuration file

Answer

Disk encryption on the database server with keys stored in the operating system keyring

Question 4

A security engineer is configuring a Linux web server that must accept TLS connections only from clients presenting a valid client certificate issued by the corporate internal CA. The engineer adds `SSLVerifyClient require` to the Apache configuration, restarts the service, and finds that all connections now fail with a handshake error. Which of the following is the MOST likely cause?

Accepted Answer

The `SSLCACertificateFile` directive pointing to the internal CA trust anchor is missing or incorrect.. Requiring client certificates forces the server to build and validate a chain from each client certificate to a trusted anchor. If the CA file that contains the internal root is absent or wrong, every validation fails and the handshake is torn down. Configuring the correct SSLCACertificateFile restores trust and allows valid clients to complete the handshake.

Answer

The server is missing an OCSP responder URL, so revocation checking fails and the handshake is rejected.

Answer

The client certificates were generated with ECDSA keys while the server is configured to accept only RSA client keys.

Answer

The `SSLProtocol` directive allows only TLSv1.3, which does not support client certificate authentication.

Question 5

An organization's security team has drafted a new acceptable use policy that defines how employees may handle company devices, email, and internet access. Before the policy is published and enforced, which action is most important to complete?

Accepted Answer

Obtain review and formal approval from executive management and the appropriate governance body. Approval by executive management and the relevant governance body is what gives a policy its authority. Without that endorsement, the acceptable use policy is an unreviewed draft that cannot be enforced consistently, may conflict with legal or contractual obligations, and offers no defensible basis for disciplinary action. Distribution, translation, and version archiving are supporting activities that follow approval.

Answer

Translate the policy into every language spoken by employees before any review occurs

Answer

Archive the draft in the document management system with a version number

Answer

Publish the policy on the intranet and begin disciplinary enforcement immediately

Question 6

A security governance committee is reviewing the organization's risk register after a merger. The committee wants to apply risk treatment strategies that transfer or share risk with another party rather than reducing it internally. Which two actions represent risk transference? (Choose two.)

Accepted Answer

Outsourcing the payment card processing function to a PCI DSS validated third-party service provider under contract.. Risk transference shifts the financial or operational consequence to another party. Cyber insurance and outsourcing card processing to a validated provider both move risk to external entities through contracts or policies, whereas detection controls, acceptance, and diversification change or retain the risk internally.

Answer

Deploying endpoint detection and response agents across all workstations to catch malicious activity earlier.

Answer

Diversifying the cloud provider portfolio so no single vendor outage halts all critical services.

Answer

Accepting the risk of a legacy application because remediation cost exceeds the potential loss.

Question 7

A financial services firm must protect cardholder data in a database and wants a control that renders the data unreadable to database administrators and to anyone who steals a backup, while still allowing the application to run equality lookups on the protected column. Which approach BEST meets these requirements?

Accepted Answer

Store a keyed hash of the column using HMAC-SHA-256 with a key held outside the database, and query by recomputing the hash of the search value.. A keyed hash computed with a secret key held outside the database is deterministic, so equality predicates can be evaluated directly against the stored digest while the original values stay hidden from administrators and backup thieves. This preserves index-based lookups and satisfies the confidentiality goal, whereas randomized encryption breaks equality queries and static-IV encryption introduces serious cryptographic weaknesses.

Answer

Store the column encrypted with AES-256-GCM using a key held in an HSM, and let the application decrypt rows after retrieving them by primary key.

Answer

Store the column in plaintext but restrict table access with database roles and enable transparent data encryption on the tablespace.

Answer

Store the column encrypted with AES-256-CBC using a static initialization vector so identical plaintexts produce identical ciphertext for lookups.

Question 8

A security manager is updating the organization's risk register. A new risk has been identified: a critical vendor may fail to provide timely security patches, potentially leading to a breach. The manager decides to purchase cyber insurance to cover potential financial losses from such a breach. Which risk treatment strategy does this represent?

Accepted Answer

Risk transference. Purchasing cyber insurance transfers the financial impact of a potential breach to the insurer. Risk transference is the correct treatment because the organization is not reducing the likelihood or impact through controls, nor is it avoiding the risk or accepting it without action. Insurance is a common method of transferring financial risk associated with vendor failures.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 9

A security architect is reviewing the identity architecture for a company that uses a hybrid cloud. Employees authenticate to an on-premises Active Directory Domain Services (AD DS) domain and also need to access SaaS applications. The company wants to avoid storing separate passwords for each SaaS application and wants to enforce on-premises account status and group membership in real time. Which of the following should the architect implement?

Accepted Answer

Federate the on-premises AD DS with each SaaS application using SAML 2.0, and configure the SaaS applications to trust the on-premises identity provider.. Federating on-premises AD DS with SAML 2.0 makes the domain the identity provider for SaaS applications. Users authenticate once with their AD credentials, and the SaaS application receives assertions about group membership and account status at each login. This satisfies the requirements for no separate passwords and real-time enforcement of on-premises account state, unlike cloud LDAP, local accounts, or RADIUS.

Answer

Deploy a standalone LDAP directory in the cloud and synchronize user passwords from AD DS using a one-way hash, then point each SaaS application to the cloud LDAP service.

Answer

Configure each SaaS application with a separate local account for every employee, and use a password manager to generate and store unique passwords.

Answer

Implement RADIUS authentication between the SaaS applications and the on-premises AD DS, and rely on RADIUS attributes to convey group membership.

Question 10

A security architect must protect data at rest on a database server while allowing a backup application to read the raw encrypted files without ever holding the plaintext data key. The architect wants a design where a hardware security module (HSM) enforces key usage policy and keys never leave the module in plaintext. Which approach BEST satisfies these requirements?

Accepted Answer

Use envelope encryption where the data key is wrapped by a master key resident in the HSM, and decrypt the data key only inside the HSM for authorized operations.. Envelope encryption separates the bulk data key from a master key held inside the HSM. Backup processes can handle ciphertext without ever seeing the plaintext data key, because unwrapping occurs only within the HSM under its enforced policy. This design satisfies both the confidentiality requirement and the constraint that key material never leaves the hardware module.

Answer

Apply full-disk encryption with a passphrase-protected key and share the passphrase with the backup operators.

Answer

Encrypt the database with a key stored in a software keystore and grant the backup service read access to that keystore.

Answer

Store the data key in a TPM sealed to the database server's boot measurements and let the backup service request unsealing remotely.

Question 11

A security architect is designing a data-at-rest protection scheme for a database that stores regulated records on a shared storage array. The requirement is to ensure that even if an administrator copies the raw storage volume, the data cannot be read, and that the keys are never accessible to the storage administrator. Which of the following BEST meets these requirements?

Accepted Answer

Application-level encryption of sensitive columns using keys held in a hardware security module (HSM) with strict role separation. The strongest control is application-level encryption whose keys live in an HSM with strict role separation, because the ciphertext on shared storage is meaningless without the HSM and the storage administrator cannot reach the keys. Controller, database, and filesystem encryption all leave key material accessible to privileged administrators in the same trust domain.

Answer

Transparent data encryption (TDE) enabled on the database instance with the master key stored in the database's internal keystore

Answer

Filesystem-level encryption on the database server with keys protected only by the operating system's file permissions

Answer

Full-disk encryption using the storage array's built-in controller-based encryption with keys managed by the array firmware

Question 12

A financial services firm is designing a new internal API platform. The security architect must ensure that every service-to-service call is authenticated, that a compromised service cannot impersonate another service, and that credentials are short-lived and automatically rotated. The platform runs on Kubernetes and uses an external secrets manager. Which of the following designs best meets these requirements?

Accepted Answer

Use mutual TLS with certificates issued by a service mesh certificate authority that binds each certificate to the service's Kubernetes service account and rotates it automatically.. Binding a cryptographic identity to each service's Kubernetes service account through a service mesh certificate authority ensures that a compromised service cannot present another service's identity. Mutual TLS authenticates both ends of every call, and the mesh can issue short-lived certificates and rotate them automatically without manual intervention. The other options either share secrets across services, rely only on network reachability, or use long-lived credentials that are not bound to a specific service identity.

Answer

Rely on network policies that restrict pod-to-pod traffic to approved namespaces and assume that only authorized services can reach each other.

Answer

Issue a long-lived shared API key to each service and store it in a Kubernetes Secret mounted as an environment variable.

Answer

Require services to present a JSON Web Token signed with a symmetric key that is distributed to all services in the cluster.

Question 13

A security architect is designing a system that must ensure the confidentiality and integrity of data at rest on a database server. The architect plans to use full-disk encryption (FDE) with a TPM 2.0 module. Which of the following BEST describes a limitation of this approach that the architect must address?

Accepted Answer

FDE with TPM does not protect data if the operating system is running and an attacker gains remote access.. Full-disk encryption with TPM protects data at rest when the system is off or locked. Once the OS is running, the volume is decrypted and accessible to any process with sufficient privileges, including remote attackers. This runtime exposure is the key limitation. Other options misstate TPM capabilities or conflate optional features with fundamental constraints.

Answer

TPM 2.0 modules are vulnerable to cold boot attacks that can extract the encryption key from RAM.

Answer

TPM 2.0 requires a PIN to be entered at every boot, which is impractical for servers.

Answer

FDE with TPM cannot be used with self-encrypting drives (SEDs) or hardware encryption.

Question 14

A security analyst is reviewing a suspicious PowerShell script that was found on a compromised host. The analyst wants to understand the script's functionality without executing it. Which of the following techniques should the analyst use?

Accepted Answer

Static code analysis. The analyst needs to understand the script's functionality without executing it. Static code analysis involves examining the script's code, deobfuscating if necessary, and identifying malicious commands. This avoids the risks of execution. Dynamic analysis, debugging, and network traffic analysis all require or assume execution, which is not desired here. Therefore, static code analysis is the correct approach.

Answer

Network traffic analysis

Answer

Debugging with PowerShell ISE

Answer

Dynamic analysis in a sandbox

Question 15

A security engineer is reviewing how a Transport Layer Security session derives its keys and protects data. The engineer wants to identify the mechanisms that provide confidentiality and integrity for application data in TLS 1.3. (Choose two.)

Accepted Answer

HKDF-based key schedule using the transcript hash. In TLS 1.3, confidentiality and integrity for application data come from AEAD ciphers such as AES-GCM and ChaCha20-Poly1305, whose keys are produced by the HKDF-based key schedule bound to the handshake transcript. The certificate signature authenticates the peer, while randoms, session IDs, and compression do not protect record data.

Answer

The server certificate's RSA signature over the handshake

Answer

The ClientHello random value and session ID

Answer

Compression of the record payload before encryption

Question 16

A multinational corporation is designing a hybrid cloud architecture that spans an on-premises data center and two public cloud regions. The security architect needs to ensure that all administrative access to cloud resources is brokered through a central identity provider, that access decisions consider device posture, and that no long-lived credentials are stored in the cloud. Which combination of technologies should the architect implement?

Accepted Answer

A cloud identity provider with SAML/OIDC federation, conditional access policies, and short-lived credentials issued via just-in-time elevation. Centralizing administrative access through federation, evaluating device posture with conditional access, and issuing short-lived credentials via just-in-time elevation collectively meet the requirements. This design removes long-lived credentials from the cloud and ensures that access decisions are context-aware, which is essential for a hybrid, multi-region architecture.

Answer

SAML federation with the on-premises identity provider and role-based access control (RBAC) in each cloud

Answer

OIDC federation combined with a cloud access security broker (CASB) and just-in-time access

Answer

A hardware security module (HSM) for key storage and a VPN for administrative access

Question 17

A security team is implementing a new detection for a fileless malware attack that uses PowerShell to execute a malicious script directly in memory. The team wants to detect this activity using Windows Event Logs. Which of the following event IDs should they monitor to capture the script block content?

Accepted Answer

Event ID 4104. Event ID 4104 is the correct choice because it logs PowerShell script block content, which is essential for detecting fileless malware that executes in memory. Event ID 4688 only shows process creation and command-line arguments, not the script itself. Event IDs 4624 and 5156 are unrelated to script execution and do not provide the needed visibility.

Answer

Event ID 4688

Answer

Event ID 5156

Answer

Event ID 4624

Question 18

A security architect is designing a microsegmentation strategy for a data center hosting both legacy monolithic applications and new containerized workloads. The architect must reduce lateral movement while minimizing disruption to existing traffic flows. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Software-defined networking with distributed firewalls that apply policy based on workload identity tags. Microsegmentation requires granular, identity-based policy enforcement for east-west traffic that remains consistent as workloads move. Distributed firewalls integrated with SDN use workload tags to apply rules regardless of IP changes, providing least-privilege segmentation. Perimeter firewalls, VLAN ACLs, and host IPS lack the combination of identity awareness and mobility support needed here.

Answer

A next-generation firewall deployed at the perimeter with application-aware rules

Answer

VLAN segmentation with access control lists applied on the core switch

Answer

Host-based intrusion prevention systems installed on each virtual machine

Question 19

A security architect is designing a Zero Trust architecture for a multinational corporation. The organization wants to enforce least-privilege access to applications based on device health, user identity, and contextual factors, and it requires continuous verification of trust. Which TWO of the following are core enforcement mechanisms that should be implemented to achieve these goals? (Choose two.)

Accepted Answer

Microsegmentation with identity-based policies. The PDP/PEP separation and microsegmentation with identity-based policies are core Zero Trust enforcement mechanisms. The PDP/PEP model enables dynamic, context-aware access decisions, while identity-based microsegmentation enforces least privilege and limits lateral movement, together supporting continuous verification and device health evaluation.

Answer

Static VPN access with split tunneling for all employees

Answer

A single-factor password authentication for all internal applications

Answer

Implicit trust for devices on the corporate LAN

Question 20

A security administrator is hardening a Linux server that hosts a public web application. The administrator wants to reduce the attack surface by restricting which services are accessible from the internet. Which of the following actions BEST achieves this?

Accepted Answer

Configure the host-based firewall to allow only TCP ports 80 and 443 from any source, and drop all other inbound traffic.. The most direct way to reduce the attack surface is to configure the host-based firewall to allow only the necessary ports (80 and 443) and drop all other inbound traffic. This ensures that only the web application is reachable from the internet. SELinux, HIDS, and SSH hardening are valuable but do not restrict network accessibility of services.

Answer

Enable SELinux in enforcing mode and set the web server's context to httpd_sys_content_t for all files.

Answer

Disable password authentication for SSH and require key-based authentication for all users.

Answer

Install and configure a host-based intrusion detection system (HIDS) to monitor for suspicious activity on all ports.