CAS-004 Practice Test 6 — 10 Questions

Question 1

An organization is implementing a hardware security module (HSM) to protect cryptographic keys used for code signing. The HSM is required to meet a government standard for physical security and tamper resistance. Which FIPS 140 security level must the HSM achieve to provide tamper-evident coatings and tamper response mechanisms?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIPS 140-2 Level 3. FIPS 140-2 Level 3 requires tamper-evident coatings and tamper response mechanisms that zeroize keys upon tampering. Level 2 requires tamper-evident coatings but no response, Level 4 is for extreme environments.

Answer

FIPS 140-2 Level 4

Answer

FIPS 140-2 Level 2

Answer

FIPS 140-2 Level 1

Question 2

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Accepted Answer

Disable TLS 1.0 and enable TLS 1.2 only. The vulnerability being remediated is likely the use of outdated TLS 1.0, which is deprecated by PCI DSS and has known weaknesses (e.g., POODLE, BEAST). Disabling TLS 1.0 and enabling only TLS 1.2 directly addresses the cryptographic protocol weakness, ensuring compliance with PCI DSS requirement 4.1 (use of strong cryptography). This is the most appropriate action because it removes the insecure protocol entirely rather than isolating or compensating for it.

Answer

Move the host to a separate VLAN

Answer

Apply a compensating control such as an API gateway

Answer

Accept the risk because the CVSS score is below 8.0

Question 3

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). SBOMs list all components and their versions; dependency analysis identifies vulnerabilities in those components.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration

Question 4

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Accepted Answer

Reset the service account password and revoke any active tokens.. Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Answer

Check the workstation logs for signs of malware.

Answer

Notify law enforcement and the organization's legal department.

Answer

Restore the affected files from a known good backup.

Question 5

A security administrator is configuring SSH for a jump host used to access critical servers. Which of the following is the most secure configuration option to restrict authentication and reduce the attack surface?

Accepted Answer

Allow only key-based authentication. Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

Answer

Enable root login with a strong password

Answer

Allow only SSH protocol version 2

Answer

Change the default port to 2222

Question 6

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 7

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

Accepted Answer

In the DMZ. A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

Answer

In the management network

Answer

In the database tier

Answer

Inside the internal network

Question 8

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 9

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

Accepted Answer

Implement short-lived access tokens with refresh tokens that are automatically rotated. Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Answer

Extend the session token expiration time to reduce the frequency of re-authentication

Answer

Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture

Answer

Reduce the number of authentication factors required for re-authentication

Question 10

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. The best course of action because it directly addresses both security issues: cross-region replication of KMS master keys eliminates the single point of failure, and restricting health check ports to internal IP ranges reduces exposure. Option A is incorrect because it replaces TLS with IPsec (unnecessary) and adds complexity. Option C consolidates to one region, which defeats the purpose of multi-region deployment for availability and disaster recovery. Option D embeds keys in code, violating key management best practices. Option B minimizes latency and cost while ensuring security.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely