CAS-004 Practice Exam 60 — 20 Questions

Question 1

In a cloud shared responsibility model, which of the following is typically the customer's responsibility for IaaS?

Accepted Answer

Guest OS patch management. In IaaS, the customer manages the guest OS, applications, and data, while the cloud provider secures the physical hosts and hypervisor.

Answer

Hypervisor security

Answer

Hardware maintenance

Answer

Physical security of data centers

Question 2

A security architect is designing a network segmentation strategy for a data center to reduce the attack surface. Which TWO of the following are best practices for implementing effective network segmentation?

Accepted Answer

Use VLANs to logically isolate traffic between different security zones.. VLANs (IEEE 802.1Q) provide Layer 2 isolation between security zones by segmenting broadcast domains, preventing traffic from crossing zone boundaries without a Layer 3 device (router/firewall). This reduces the attack surface by containing lateral movement within a single VLAN and enforcing access control at the gateway.

Answer

Deploy network access control (NAC) to authenticate devices before granting network access.

Answer

Place all external-facing services in a single shared DMZ segment.

Answer

Allow any-to-any communication within each security zone to avoid performance bottlenecks.

Question 3

You are the security architect for a mid-sized e-commerce company that processes credit card payments. The company must comply with PCI DSS. Currently, the cardholder data environment (CDE) includes a web server, an application server, and a database server, all on the same flat network segment. The QSA has identified that the CDE is not properly segmented, and network access controls are insufficient. The company wants to minimize the scope of PCI compliance by reducing the number of systems that handle cardholder data. You propose implementing network segmentation to isolate the CDE. Which of the following is the most effective approach to reduce PCI scope while maintaining business functionality?

Accepted Answer

Deploy a firewall between the CDE and corporate network, allowing only necessary traffic. Deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.

Answer

Encrypt all cardholder data at rest and in transit

Answer

Replace the database with a tokenization service and remove the database from the CDE

Answer

Move all servers to a DMZ and implement host-based firewalls

Question 4

A company's development team uses a CI/CD pipeline hosted in a public cloud. The pipeline builds container images, pushes them to a private registry, and deploys them to a Kubernetes cluster. A security engineer must ensure that only signed and vulnerability-scanned images are deployed. The engineer has configured the registry to require signatures and the CI/CD pipeline to scan images. However, deployments are still failing because unsigned images are being pulled. The engineer discovers that developers can push images directly to the registry bypassing the CI/CD pipeline and that Kubernetes nodes can pull images without signature verification. Which of the following should the engineer implement to enforce image signing and scanning?

Accepted Answer

Restrict registry write access to the CI/CD service account and enable image signature verification via admission controller in Kubernetes.. It addresses both root causes: restricting registry write access to only the CI/CD service account prevents developers from bypassing the pipeline, and enabling image signature verification via an admission controller (e.g., using Kubernetes ImagePolicyWebhook or a tool like Cosign with OCI signatures) ensures that only signed and scanned images are allowed to run in the cluster. This combination enforces the security policy at both the registry and the cluster level, closing the gaps identified in the scenario.

Answer

Implement a manual approval step in the pipeline for each deployment.

Answer

Use network policies to block all outbound traffic from developer workstations to the container registry.

Answer

Configure the CI/CD pipeline to perform vulnerability scanning after every build.

Question 5

A security architect is evaluating a new cloud SaaS application that will handle sensitive customer data. The SaaS provider offers a shared responsibility model where the customer is responsible for data classification, access management, and encryption of data at rest using customer-managed keys. The architect must ensure that the organization retains the ability to revoke access to the data if the provider is compromised. Which key management strategy best meets this requirement?

Accepted Answer

Implement bring-your-own-key (BYOK) with keys stored in a customer-controlled external KMS. BYOK with keys stored in a customer-controlled external KMS ensures the organization retains full control over encryption keys, enabling immediate revocation of access to data at rest if the SaaS provider is compromised. This aligns with the shared responsibility model where the customer manages keys, and external KMS decouples key management from the provider's infrastructure, preventing the provider from accessing data after key revocation.

Answer

Escrow the encryption key with a third-party and rely on legal agreements for revocation

Answer

Use the provider's default encryption with a customer-managed key stored in the provider's KMS

Answer

Use a cloud hardware security module (HSM) to generate and store keys

Question 6

A security engineer is reviewing firewall logs and finds multiple failed SSH attempts from an internal IP. Which control should be implemented to reduce this risk?

Accepted Answer

Implement account lockout after 5 failed attempts. Implementing an account lockout policy after a defined number of failed attempts (e.g., 5) directly mitigates brute-force or password-guessing attacks against SSH. This control enforces a threshold that stops automated scripts or manual attempts from continuing, reducing the risk of unauthorized access without blocking legitimate administrative traffic.

Answer

Allow SSH only from a specific management subnet

Answer

Install a host-based IDS on the server

Answer

Disable SSH and use Telnet instead

Question 7

During a merger, two companies need to integrate their networks securely. Company A uses RFC 1918 addresses (10.0.0.0/8) and Company B also uses 10.0.0.0/8. Which architectural solution prevents routing conflicts and maintains security?

Accepted Answer

Deploy network address translation (NAT) on the border routers to translate one company's addresses to a unique range. Both companies use the same RFC 1918 address space (10.0.0.0/8), which would cause routing conflicts if directly connected. Deploying NAT on the border routers translates one company's overlapping addresses to a unique range (e.g., 172.16.0.0/12 or a public IP block), eliminating IP collisions while maintaining security through stateful inspection or ACLs. This allows the merged networks to communicate without renumbering either company's internal infrastructure.

Answer

Configure a site-to-site VPN with no address translation

Answer

Enable direct BGP peering between the two networks

Answer

Implement a firewall between the networks and allow all traffic

Question 8

A company is deploying a wireless network for guests. Which security measure is most important to prevent unauthorized users from accessing internal resources?

Accepted Answer

Place the guest network on a separate VLAN with no access to internal subnets. Placing the guest network on a separate VLAN with no access to internal subnets provides network segmentation, which is the most effective security measure to prevent unauthorized users from reaching internal resources. This approach uses VLAN tagging (802.1Q) and access control lists (ACLs) to enforce Layer 2 and Layer 3 isolation, ensuring that guest traffic cannot traverse to internal networks even if other wireless security measures are bypassed.

Answer

Use WPA2-Enterprise with 802.1X

Answer

Disable SSID broadcast

Answer

Implement MAC address filtering

Question 9

An organization uses a CI/CD pipeline that builds Docker images and pushes them to a private registry. A security analyst discovers that some images contain environment variables with database credentials. Which of the following is the most effective way to prevent this in the future?

Accepted Answer

Implement multi-stage builds to separate build and runtime environments.. The best approach is to use multi-stage builds: build the application in one stage, then copy only the artifact to a final, clean image. This avoids including build-time secrets in the final image. Additionally, using Docker BuildKit's --secret flag can inject secrets without persisting them.

Answer

Use a .dockerignore file to exclude credential files.

Answer

Scan images with a vulnerability scanner after build.

Answer

Reduce the base image size to minimize attack surface.

Question 10

Which THREE of the following are common techniques to mitigate side-channel attacks?

Accepted Answer

Implement constant-time algorithms for cryptographic operations. Constant-time algorithms ensure that the execution time of cryptographic operations does not depend on secret data, such as keys. By avoiding conditional branches or variable-time instructions (e.g., multiplication or memory accesses) that vary with input, these algorithms prevent attackers from inferring secrets through timing measurements. This is a fundamental mitigation against timing side-channel attacks, as specified in standards like FIPS 140-3 and NIST SP 800-56B.

Answer

Disable CPU caching to prevent cache timing attacks

Answer

Use random delays in code execution paths

Question 11

A small business has a single physical server running multiple virtual machines (VMs) using Type 2 hypervisor software on a Windows Server host. The host is not joined to a domain. The VMs include an Active Directory domain controller, a file server, and a web server. The company recently suffered a ransomware attack that encrypted all data on the file server VM. The IT administrator restored the file server from a backup, but the ransomware returned within hours. Analysis shows that the ransomware is now spreading to other VMs. The administrator suspects that the hypervisor host itself may be compromised. Which of the following is the MOST effective immediate action to contain the spread and secure the environment?

Accepted Answer

Disconnect the physical host from the network immediately.. Immediately disconnecting the physical host from the network is the most effective immediate action to contain the spread of ransomware. Since the host is compromised and the Type 2 hypervisor runs on top of a Windows Server OS, the attacker can pivot from the host to any VM via the virtual switch. Cutting network connectivity stops all lateral movement and outbound command-and-control traffic, buying time for forensic analysis and remediation.

Answer

Run a full antivirus scan on the host operating system.

Answer

Apply the latest security patches to the hypervisor software.

Answer

Restore all VMs from known clean backups taken before the attack.

Question 12

A security architect is designing a secure enclave for a high-value application. Which of the following is the BEST approach to isolate the application from the rest of the network?

Accepted Answer

Deploy the application in a DMZ behind a stateful firewall with least-privilege rules.. A DMZ behind a stateful firewall with least-privilege rules provides network-level isolation by placing the application in a separate security zone that restricts inbound and outbound traffic to only necessary ports and protocols. The stateful firewall tracks connection states, preventing unauthorized traffic from reaching the enclave while allowing legitimate responses. This approach directly addresses the requirement to isolate the application from the rest of the network, as the DMZ acts as a buffer between the internal network and the application.

Answer

Install an intrusion detection system (IDS) on the application subnet.

Answer

Configure a jump box with two-factor authentication to access the application.

Answer

Place the application on a separate VLAN with an ACL.

Question 13

An organization is migrating to a zero-trust architecture. Which of the following components is CRITICAL for enforcing policy decisions based on user identity, device health, and context?

Accepted Answer

Policy enforcement point (PEP). In a zero-trust architecture, the Policy Enforcement Point (PEP) is the critical component that enforces access decisions by mediating all traffic between users and resources. It evaluates policies based on user identity, device health, and contextual attributes (e.g., location, time) before allowing or denying access, aligning with the NIST SP 800-207 zero-trust framework.

Answer

Intrusion prevention system (IPS)

Answer

Web application firewall (WAF)

Answer

Network access control (NAC)

Question 14

A security architect is reviewing the network architecture of a financial trading system. The system uses a time-sensitive order matching engine that must process trades with minimal latency. The architect is concerned about the risk of a DDoS attack on the matching engine. Which of the following architectural changes would best mitigate DDoS risk while preserving low latency?

Accepted Answer

Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.. A cloud-based DDoS scrubbing service (e.g., AWS Shield Advanced, Cloudflare Magic Transit) filters malicious traffic at the cloud edge before it reaches the on-premises matching engine. This preserves low latency because only clean, low-volume traffic is forwarded, and the scrubbing infrastructure is designed for high-throughput, low-latency processing without introducing inline inspection delays on the critical path.

Answer

Deploy an intrusion prevention system (IPS) in inline mode in front of the matching engine.

Answer

Move the matching engine to a cloud provider with elastic scalability.

Answer

Implement a reverse proxy with rate limiting and IP blacklisting.

Question 15

A company's risk assessment identifies that employees often use weak passwords. Which control directly addresses this risk?

Accepted Answer

Enforce a strong password policy. Enforcing a strong password policy directly addresses the risk of weak passwords by mandating complexity, length, and expiration requirements (e.g., minimum 12 characters, mixed case, numbers, symbols). This control reduces the likelihood of successful brute-force or dictionary attacks by increasing the entropy of user credentials. Unlike other options, it specifically targets the root cause—weak password creation—rather than adding compensating controls.

Answer

Conduct security awareness training

Answer

Deploy single sign-on

Answer

Implement multi-factor authentication

Question 16

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 17

A developer is creating a REST API that handles sensitive data. Which HTTP method should be used for updates that are not idempotent?

Accepted Answer

POST. POST is correct because it is not idempotent, meaning multiple identical requests can result in different outcomes (e.g., creating a new resource each time). For updates that are not idempotent, POST is the appropriate HTTP method as it allows side effects such as appending data or triggering a process, unlike PUT which is idempotent and replaces the entire resource.

Answer

DELETE

Answer

GET

Answer

PUT

Question 18

A technology company suspects an insider threat is exfiltrating intellectual property. The security team has deployed user and entity behavior analytics (UEBA) and set up data loss prevention (DLP) rules. A UEBA alert flags a senior developer who is accessing the source code repository at 2 AM from a VPN connection that routes through a foreign country. The developer also recently downloaded a large quantity of source code—more than 10 times the normal volume. DLP policies are configured to block emails with attachments over 10 MB. Which of the following should the incident response team do FIRST?

Accepted Answer

Isolate the developer's workstation and revoke access to the source code repository immediately.. The correct first step because the UEBA alert combined with anomalous behavior (access at 2 AM via foreign VPN, excessive download volume) strongly suggests malicious activity. Immediate isolation of the developer's workstation and revocation of repository access prevents further exfiltration and preserves evidence. Options A, B, and D are incorrect as they either focus on secondary controls, risk alerting the suspect, or delay containment.

Answer

Implement stricter DLP policies to block large downloads from the repository.

Answer

Conduct an informal interview with the developer to ask about the unusual activity.

Answer

Review DLP logs to confirm that no emails containing source code were sent.

Question 19

An organization is merging with another company and needs to ensure that the combined entity's security policies are aligned. Which document type should the security team prioritize to harmonize security expectations and responsibilities?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) is the correct document to prioritize because it defines the rules and expectations for how users may access and use the organization's IT resources. During a merger, harmonizing the AUP ensures that all employees from both entities operate under a single, consistent set of security requirements, reducing the risk of policy violations and data breaches. This document directly governs user behavior, which is foundational to aligning security expectations and responsibilities across the combined workforce.

Answer

Disaster Recovery Plan (DRP)

Answer

Non-Disclosure Agreement (NDA)

Answer

Business Continuity Plan (BCP)

Question 20

During a security assessment, a tester finds that a web application accepts user input and directly uses it in an LDAP query without sanitization. Which of the following attacks is most likely to be successful?

Accepted Answer

LDAP injection. The scenario explicitly describes unsanitized user input being used directly in an LDAP query. LDAP injection occurs when an attacker manipulates LDAP statements by injecting special characters (e.g., *, (, ), &, |, !) to alter the query logic, potentially bypassing authentication or extracting unauthorized directory information. This is a direct injection attack against the LDAP protocol (RFC 4511), not against a database or web client.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote file inclusion