CAS-004 Practice Exam 60 — 20 Questions

Question 1

A security analyst is reviewing a Windows event log from a domain controller and notices Event ID 4769 with the ticket encryption type 0x17. The analyst suspects a Kerberoasting attack. Which of the following best explains why this event is suspicious?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The encryption type 0x17 indicates RC4-HMAC, which is weak and often requested by attackers to crack service account passwords offline.. Kerberoasting involves requesting service tickets for accounts with SPNs and then cracking them offline. Attackers often request RC4 (0x17) encryption because it is weaker and faster to crack. Event ID 4769 with encryption type 0x17 on a domain controller is a key detection point. The correct answer identifies RC4-HMAC as the suspicious element, which aligns with known attacker tactics.

Answer

The encryption type 0x17 indicates that the ticket is encrypted with the KRBTGT account hash, which is only used for TGTs and not service tickets.

Answer

The encryption type 0x17 indicates AES256-CTS-HMAC-SHA1-96, which is the default for modern Windows systems and should not trigger alerts.

Answer

Event ID 4769 with encryption type 0x17 indicates a TGT request using DES, which is deprecated and signals an attempt to downgrade encryption.

Question 2

A security architect must protect a REST API that issues short-lived, signed access tokens. The design goal is to prevent a compromised authorization server from minting tokens that other resource servers will accept after the compromise is detected, without requiring resource servers to poll a central service on every request. Which design BEST meets this goal?

Accepted Answer

Publish a signed token status list that resource servers fetch and cache, allowing revoked or suspect token identifiers to be rejected until the list's next refresh.. The goal is to bound how long a fraudulent token remains acceptable without adding a synchronous dependency on the issuer. A signed, cacheable token status list gives resource servers an offline-checkable revocation signal that they can refresh periodically, so tokens minted after detection can be rejected within the refresh interval while normal request processing stays fast and resilient.

Answer

Shorten the token lifetime to five minutes and require resource servers to validate the signature with the authorization server's public key.

Answer

Issue tokens bound to the client's TLS session so that a token is only usable from the connection on which it was issued.

Answer

Require mutual TLS between the authorization server and each resource server and pin the authorization server's certificate.

Question 3

A security operations center (SOC) analyst is reviewing a Windows event log after a suspected credential dumping incident. The analyst observes Event ID 4688 (process creation) for a process named 'rundll32.exe' with command-line arguments containing 'comsvcs.dll MiniDump'. Which of the following best describes the attacker's technique?

Accepted Answer

Credential dumping via LSASS memory using a signed Windows binary. The attacker used rundll32.exe to call the MiniDump export of comsvcs.dll, a built-in Windows DLL, to dump LSASS process memory. This is a living-off-the-land technique for credential dumping (T1003.001) that evades detection by using a signed binary. The other options describe different credential access methods that do not match the observed command line.

Answer

Pass-the-hash using NTLM authentication against remote systems

Answer

Kerberoasting by requesting service tickets for SPNs

Answer

DCSync attack to replicate directory services data

Question 4

A security engineer is configuring a Linux bastion host that must expose SFTP to external partners while preventing interactive shell access for those same partner accounts. Partner keys are already deployed in each account's authorized_keys file. Which sshd_config directive combination BEST satisfies this requirement?

Accepted Answer

Set ForceCommand internal-sftp and ChrootDirectory /sftp/%u for the partner group in sshd_config.. Forcing the internal SFTP subsystem for matched sessions guarantees the connection can only perform file transfer, because the daemon never invokes the user's login shell. Combining that with a chroot directory confines each partner to a dedicated subtree and satisfies both the access and isolation goals with a single Match block. Authentication hardening alone does not change what a successfully authenticated session is allowed to do.

Answer

Set Subsystem sftp /usr/lib/openssh/sftp-server and PermitTunnel no in the global sshd_config.

Answer

Set PasswordAuthentication no and PubkeyAuthentication yes for the partner group in sshd_config.

Answer

Set PermitRootLogin no and AllowUsers partner1 partner2 in the global sshd_config.

Question 5

A hospital is preparing for a compliance audit and must demonstrate that it has implemented administrative safeguards required by the HIPAA Security Rule. Which activity best provides this evidence?

Accepted Answer

Maintaining a current inventory of all electronic protected health information systems and the results of periodic risk analyses. Administrative safeguards under the HIPAA Security Rule include risk analysis, risk management, workforce security, and access management. A documented inventory of ePHI systems and periodic risk analysis results directly demonstrate that the hospital has assessed risks and identified where ePHI is stored and processed. The other choices are physical, technical, or Privacy Rule activities that do not provide the specific administrative evidence the auditor seeks.

Answer

Publishing a notice of privacy practices on the hospital website

Answer

Installing biometric access readers at the data center entrance

Answer

Enabling full-disk encryption on all clinical workstations

Question 6

A multinational financial services firm is aligning its enterprise risk management program with the NIST Risk Management Framework (RMF). The Chief Risk Officer wants to ensure that risk response decisions are formally authorized before changes are made to production systems. Which RMF step is responsible for providing that authorization?

Accepted Answer

Authorize the system. Authorization is the RMF step where an authorizing official formally accepts residual risk and permits the system to operate. It follows categorization, control selection, implementation, and assessment, and it is the point at which risk decisions become official. Continuous monitoring then sustains that authorization over time. Because the CRO requires formal risk acceptance before production changes, the Authorize step is the correct fit.

Answer

Assess security controls

Answer

Categorize the system

Answer

Monitor security controls

Question 7

A multinational retailer operates an on-premises data center and two public cloud regions. Regulations require that customer payment data never leave the home country, but the company wants centralized security analytics. The architect needs a design that keeps raw payment records local while enabling global threat detection. Which design best meets these constraints?

Accepted Answer

Keep raw payment records in the home country and forward only normalized security telemetry to a central SIEM.. Local retention of raw payment records meets the residency regulation, while exporting only normalized security telemetry to a central SIEM preserves the global correlation needed for threat detection. This separates regulated data from operational telemetry. Full replication, per-region silos, and encrypted offsite storage each either move regulated records across borders or prevent the centralized analytics the company requires.

Answer

Replicate the full payment database to a central cloud data lake for analytics.

Answer

Deploy independent SIEM instances per region with no cross-region data sharing.

Answer

Encrypt payment records with a customer-managed key and store them in the nearest cloud region.

Question 8

A security administrator is configuring a new web server and wants to ensure that it is protected against cross-site scripting (XSS) attacks. Which of the following controls should the administrator implement to BEST mitigate XSS?

Accepted Answer

Input validation and output encoding. Cross-site scripting occurs when untrusted data is included in web output without proper handling. Input validation ensures data is safe, and output encoding ensures it is rendered as text, not code. These controls directly address the vulnerability. A WAF, HTTPS, and CSP are supplementary but do not fix the underlying issue. Thus, input validation and output encoding are the best mitigations.

Answer

Content Security Policy (CSP)

Answer

Web application firewall (WAF) in blocking mode

Answer

HTTPS with HSTS

Question 9

A security engineer is configuring a Linux bastion host that must use only the strongest key-exchange method available in OpenSSH, avoiding any Diffie-Hellman group that relies on finite-field modular exponentiation. Which sshd_config directive setting should the engineer apply?

Accepted Answer

KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org. Restricting KexAlgorithms to the X25519-based curve25519-sha256 variants forces the server and client to use elliptic-curve Diffie-Hellman, eliminating all finite-field modular-exponentiation groups. The other directives govern ciphers or host-key signatures and leave the default key-exchange list, which still permits classic DH groups, intact. Only the KexAlgorithms restriction directly enforces the stated cryptographic constraint.

Answer

KexAlgorithms diffie-hellman-group14-sha256

Answer

HostKeyAlgorithms ssh-ed25519

Answer

Ciphers chacha20-poly1305@openssh.com

Question 10

A security analyst is performing dynamic malware analysis in a sandbox. The analyst observes that the malware sample attempts to connect to a command-and-control (C2) server but fails. The analyst wants to modify the sandbox environment to allow the malware to communicate with the C2 server to observe its behavior. Which TWO of the following changes should the analyst make? (Choose two.)

Accepted Answer

Configure the sandbox to use a simulated internet service (INetSim) to respond to network requests.. To allow the malware to communicate with its C2 server in a safe manner, the analyst should simulate network services. INetSim provides fake responses to common protocols, and a fake DNS server redirects C2 domains to a local listener. Both techniques enable observation of the malware's network behavior without risking actual external communication. Disabling the firewall or using a VPN could expose the real C2 and is unsafe. Resource adjustments do not solve the network issue.

Answer

Use a VPN to route all sandbox traffic through a different country.

Answer

Increase the sandbox's CPU and memory resources to prevent timeouts.

Answer

Disable the sandbox's firewall to allow all outbound traffic to the internet.

Question 11

A security architect is designing a microservices platform that runs on a shared Kubernetes cluster. Each service must be able to prove its identity to other services, and the design must avoid long-lived shared secrets and support automatic credential rotation when a pod is rescheduled. Which approach BEST meets these requirements?

Accepted Answer

Issue each service a signed SPIFFE SVID through a SPIRE agent running as a DaemonSet, and use mTLS between services.. Workload identity frameworks such as SPIFFE/SPIRE bind a cryptographic identity to the actual workload through node and pod attestation, then issue short-lived certificates that rotate automatically. Using mTLS with those identities gives mutual authentication and encryption without shared static secrets, which is exactly what the microservices platform needs.

Answer

Enable Kubernetes service account token projection with a 24-hour expiration and use the token as a bearer credential for inter-service calls.

Answer

Store a unique API key for each service in a Kubernetes Secret and require services to present the key in an HTTP header.

Answer

Configure Kubernetes NetworkPolicies to allow traffic only between approved service namespaces.

Question 12

A security analyst is investigating a potential breach and needs to determine the timeline of events on a compromised Windows workstation. The analyst has access to the disk image and memory dump. Which artifact should the analyst examine FIRST to establish a timeline of file system activity?

Accepted Answer

$MFT (Master File Table). The $MFT is the central repository for file metadata on NTFS, including timestamps for file creation, modification, and access. It provides a comprehensive record of file system activity, making it the primary artifact for timeline analysis. Other artifacts like Prefetch or Event Logs are useful for specific activities but do not cover the full scope of file system changes.

Answer

Registry hives

Answer

Prefetch files

Answer

Windows Event Logs

Question 13

A security administrator is configuring a new wireless network for a small office. The administrator wants to ensure that only authorized devices can connect and that traffic is encrypted. Which of the following should the administrator implement?

Accepted Answer

WPA3-Personal with SAE. WPA3-Personal with SAE offers robust encryption and authentication without the need for additional infrastructure like a RADIUS server. It is designed for small to medium-sized networks where individual user credentials are not required. SAE prevents offline dictionary attacks, ensuring that only devices with the correct password can connect, and all traffic is encrypted.

Answer

Open network with a captive portal

Answer

WPA2-Enterprise with RADIUS

Answer

WEP with MAC address filtering

Question 14

A security engineer is implementing a hardware security module (HSM) to protect cryptographic keys used by a certificate authority (CA). The engineer must ensure that the HSM provides strong protections against key extraction and unauthorized use. Which of the following are security properties that the HSM should provide? (Choose two.)

Accepted Answer

Tamper-responsive mechanisms that zeroize keys upon physical intrusion.. Tamper-responsive mechanisms and role-based access control with separation of duties are essential security properties for an HSM protecting CA keys. Tamper responsiveness prevents physical key extraction, while RBAC with separation of duties prevents unauthorized logical access. The other options either provide insufficient protection or weaken security.

Answer

FIPS 140-2 Level 1 validation for the cryptographic module.

Answer

Support for exporting private keys in plaintext for backup purposes.

Answer

The ability to run arbitrary code within the HSM to extend functionality.

Question 15

A security analyst is investigating a potential security incident and needs to determine the order of events. The analyst has collected logs from various sources, including Windows Event Logs, firewall logs, and IDS alerts. Which of the following should the analyst do FIRST to establish a timeline?

Accepted Answer

Normalize the timestamps from all log sources to a common time zone and format. To establish an accurate timeline, the analyst must first normalize timestamps from all log sources to a common time zone and format. This ensures that events can be correctly ordered and correlated. Without this step, any subsequent analysis or correlation could be flawed due to time discrepancies. The other actions are important but should be performed after timestamp normalization.

Answer

Create a visual representation of the incident using a timeline tool

Answer

Correlate the IDS alerts with firewall logs to identify the attacker's IP address

Answer

Review Windows Event Logs for failed login attempts

Question 16

A security architect is designing key management for a backup platform that stores encrypted archives in cloud object storage. The requirement is that destroying a single small piece of key material must render all archived data permanently unrecoverable, even if an attacker later obtains a full copy of the storage bucket and the wrapped data keys. Which design BEST meets this requirement?

Accepted Answer

Encrypt each archive with a unique data encryption key, wrap those keys with a customer-managed root key held in a hardware security module, and destroy the root key to crypto-shred the archives.. Envelope encryption with a hardware-protected root key separates the wrapped data keys from the material needed to use them, so deleting the root key makes every wrapped key permanently unusable and crypto-shreds the entire archive set in one action. Keeping the root key in an HSM prevents export or copying, so an attacker who later captures the bucket gains only undecryptable ciphertext.

Answer

Encrypt all archives with a single long-lived storage key protected by a passphrase that is rotated quarterly and distributed to backup administrators.

Answer

Encrypt each archive with a unique data encryption key and store those keys in the same object storage bucket alongside the ciphertext for operational simplicity.

Answer

Apply server-side encryption with provider-managed keys and rely on the cloud provider's internal key rotation schedule to invalidate old key versions over time.

Question 17

A financial services firm's third-party risk team is onboarding a new SaaS payroll provider. The provider refuses to share its internal audit reports but will allow the firm to send its own assessor on-site to inspect the provider's controls. Which risk assessment method should the firm use to obtain assurance in this situation?

Accepted Answer

On-site assessment performed by the firm's own assessors. Because the provider withholds internal audit reports yet allows assessors on-site, the only method that yields independently verified, first-hand evidence of control effectiveness is a direct on-site assessment. Self-assessments and certifications provide weaker, provider-controlled evidence, and the SOC 2 report is unavailable by the provider's own refusal, leaving the on-site inspection as the reliable path.

Answer

Review of the provider's SOC 2 Type I report

Answer

Acceptance of the provider's ISO/IEC 27001 certificate as sufficient evidence

Answer

Self-assessment questionnaire completed by the provider's security team

Question 18

A security engineer is implementing a secure enclave using Intel SGX for a sensitive application. The engineer must ensure that the enclave's memory is protected from a compromised operating system. Which of the following BEST describes how SGX achieves this protection?

Accepted Answer

The enclave's memory is encrypted by the CPU's memory encryption engine (MEE) and integrity-protected, so the OS cannot read or tamper with it.. Intel SGX protects enclave memory using the CPU's memory encryption engine, which encrypts data leaving the CPU and verifies integrity on return. This prevents a compromised OS from reading or altering enclave memory. Other options incorrectly describe SGX as using VMs, ACLs, or separate secure elements, which are not how SGX provides isolation.

Answer

The enclave runs in a separate virtual machine that is isolated by the hypervisor, preventing the OS from accessing its memory.

Answer

The enclave's memory is protected by a hardware-based access control list (ACL) that the OS cannot modify.

Answer

The enclave's code and data are stored in a dedicated secure element (SE) that is physically separate from the main CPU.

Question 19

A security operations team is deploying a new endpoint agent. They want to enforce a policy that only executables signed by trusted publishers and with a valid certificate chain are allowed to run, even if the user has local administrator rights. Which Windows feature should they configure to meet this requirement?

Accepted Answer

Windows Defender Application Control (WDAC). Windows Defender Application Control (WDAC) is the correct choice because it enforces code integrity at the kernel level, requiring all executables to have a valid certificate chain from a trusted publisher. It cannot be bypassed by local administrators, unlike AppLocker or SRP. UAC only manages elevation prompts and does not validate signatures, so it fails to meet the strict policy requirement.

Answer

User Account Control (UAC)

Answer

Software Restriction Policies (SRP)

Answer

AppLocker

Question 20

A security engineer must select a cryptographic hash function for a new code-signing service that will protect firmware for at least 15 years. The service must resist length-extension attacks and provide collision resistance against well-funded adversaries. The organization's policy requires FIPS 140-3 validated modules only. Which hash function BEST meets these requirements?

Accepted Answer

SHA3-256. SHA3-256 is the only listed option that combines FIPS approval, strong collision resistance, and intrinsic resistance to length-extension attacks. The sponge construction avoids the Merkle-Damgard weakness that affects SHA-256, SHA-1, and MD5. Given the 15-year firmware-signing horizon and the explicit anti-length-extension requirement, SHA3-256 is the appropriate engineering choice.

Answer

SHA-256

Answer

MD5

Answer

SHA-1