CAS-004 Practice Exam 61 — 20 Questions

Question 1

A DevOps engineer is automating the deployment of a web application using containers. Which of the following security practices should be implemented to reduce the attack surface of the containers? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run containers as a non-root user. Running containers as a non-root user (option A) is a fundamental security best practice because it limits the privileges available to processes inside the container. If an attacker compromises the application, they will not have root access to the host or the container runtime, reducing the potential for privilege escalation or host-level damage. This aligns with the principle of least privilege, which is critical for container security.

Answer

Build images with embedded database credentials

Answer

Expose port 22 for SSH debugging

Answer

Grant all Linux capabilities to the container

Question 2

An IAM policy is applied to an AWS user. Which of the following actions is permitted?

Accepted Answer

List objects in example-bucket. The IAM policy explicitly allows 's3:ListBucket' on 'example-bucket', so listing objects in that bucket is permitted. The policy does not grant any actions on 'secret-bucket' or any write/delete permissions, so only Option D is allowed.

Answer

Delete objects in example-bucket

Answer

Put objects in secret-bucket

Answer

List objects in secret-bucket

Question 3

A security architect is evaluating cloud security architectures. The company requires that all data at rest in a public cloud object storage bucket be encrypted with a key that is managed by the company's own hardware security module (HSM) on-premises. Which encryption approach should the architect recommend?

Accepted Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.. Client-side encryption ensures the data is encrypted by the application before it is sent to the cloud, using a key managed by the company's own on-premises HSM. This approach guarantees that the cloud provider never has access to the encryption key or the plaintext data, meeting the requirement that all data at rest in the public cloud object storage bucket be encrypted with a key managed by the company's own HSM.

Answer

Use envelope encryption where a cloud KMS wraps a data key, and the data key is used to encrypt the data.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Question 4

During an audit, a compliance officer finds that the organization has not conducted a risk assessment in over two years. Which of the following is the MOST significant risk?

Accepted Answer

Non-compliance with regulatory fines.. Regulatory fines can be substantial and are directly tied to compliance requirements, making it the most significant risk.

Answer

Inability to prioritize security investments.

Answer

Loss of customer trust.

Answer

Increased likelihood of successful attacks.

Question 5

Which two of the following are effective mitigations against XML External Entity (XXE) injection attacks? (Select the two best options.)

Accepted Answer

Disable Document Type Definition (DTD) processing in the XML parser. XXE attacks exploit the XML parser's ability to process external entities defined in a DTD. By disabling DTD processing entirely, the parser cannot resolve or fetch external resources, which neutralizes the primary vector for XXE injection. This is a standard security hardening step for XML parsers like libxml2, Xerces, or .NET's XmlReader, often achieved by setting properties such as `LIBXML_NOENT` to false or `XmlReaderSettings.DtdProcessing` to `Prohibit`.

Answer

Use a blacklist to filter out dangerous XML tags

Answer

Validate all XML input against a schema

Question 6

A security architect at a financial institution is designing a cloud-native application using AWS. The application processes sensitive customer data and must comply with PCI DSS. Which of the following security architecture decisions best supports both compliance and operational efficiency?

Accepted Answer

Implement a cloud access security broker (CASB) and use customer-managed encryption keys (CMKs) for data at rest. A CASB provides visibility and control over data in cloud environments, which is critical for PCI DSS compliance, while customer-managed encryption keys (CMKs) give the institution direct control over encryption of data at rest, meeting both compliance requirements and operational flexibility. This combination allows the financial institution to enforce data protection policies and audit access without sacrificing the agility of cloud-native deployment.

Answer

Place all application resources in a VPC with no internet gateway and use VPC endpoints for AWS services

Answer

Use a cloud-based web application firewall (WAF) and enable logging for all API calls

Answer

Deploy the application on a single tenant dedicated instance and rely on the cloud provider's compliance certifications

Question 7

A company deploys a microservices architecture using container orchestration. The security team wants to enforce mutual TLS between services. Which technology should be used?

Accepted Answer

Service mesh. A service mesh (e.g., Istio, Linkerd) is the correct technology because it provides a dedicated infrastructure layer for handling service-to-service communication, including automatic mutual TLS (mTLS) enforcement between microservices. It injects sidecar proxies that intercept all traffic and negotiate mTLS using X.509 certificates, ensuring both encryption and authentication without modifying application code.

Answer

SSH tunneling

Answer

API gateway

Answer

VPN

Question 8

A cloud security engineer reviews the above S3 bucket policy. Which of the following is the most significant security concern?

Accepted Answer

The bucket policy allows any user to upload objects to the bucket.. The bucket policy statement includes a Principal of '*' and an Action of 's3:PutObject' without any condition restricting who can upload, meaning any unauthenticated user on the internet can write objects to the bucket. This creates a severe data integrity and malware-upload risk, as attackers can place arbitrary content into the bucket, potentially leading to data corruption, storage cost abuse, or serving malicious files.

Answer

The bucket policy grants unnecessary permissions for s3:GetObject.

Answer

The IP address restriction uses an incorrect format for the condition key.

Answer

The bucket policy allows public read access to all objects.

Question 9

A security engineer is configuring a SIEM correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address that has never been communicated with before, within a 5-minute window. Additionally, the external IP should not be on any whitelist. Which correlation logic best implements this detection?

Accepted Answer

Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.. Ly implements the detection rule. It aggregates data transfer per host over 5 minutes, checks that the volume exceeds 10 MB, verifies the external IP is not on any whitelist, and ensures the IP has not been seen in the last 24 hours (i.e., it is a new destination). This matches all the requirements: a single internal host, >10 MB, to an external IP never communicated with before, within 5 minutes, and not whitelisted. Option B adds an unnecessary port 443 condition. Option C omits the requirement that the external IP must be new (unseen before). Option D aggregates over all external IPs without checking newness, which could alert on previously contacted IPs.

Answer

Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.

Answer

Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.

Answer

Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.

Question 10

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

Accepted Answer

Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.. A Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Answer

Store the private keys in an encrypted database on a separate database server.

Answer

Use a software-based key vault that runs on the same operating system as the web server.

Answer

Store the private keys in a local file with restricted permissions on the application server.

Question 11

After a security incident, the IR team identifies that the attacker used a spear-phishing email with an attached malicious macro. Which log source would be MOST crucial to determine the scope of the compromise?

Accepted Answer

Proxy server logs. Proxy logs capture all outbound HTTP/HTTPS traffic, which is critical for identifying command-and-control (C2) communications and data exfiltration by the malware. Option A (EDR telemetry) provides endpoint-level details like process execution and network connections, but not all outbound traffic if endpoints are not forwarding logs. Option B (Windows Event Logs 4688) shows process creation events, which can help identify malicious process execution but may not reveal network connections. Option D (email server logs) is useful for tracing the initial phishing email but does not show subsequent system activity or network traffic.

Answer

Endpoint detection and response (EDR) telemetry

Answer

Windows Event Logs (Event ID 4688)

Answer

Email server logs

Question 12

A system administrator is configuring a Linux server to host a web application. Which file permission should be set for the private SSL key?

Accepted Answer

600. The private SSL key must be protected from unauthorized access because it is used to decrypt traffic and establish trust. Setting permissions to 600 (owner read/write only) ensures that only the root or the application user who owns the key can read it, preventing other users or processes from extracting the key material.

Answer

644

Answer

444

Answer

755

Question 13

A DevOps team is automating server configuration using configuration management tools. Which THREE principles should be followed to ensure secure automation? (Choose three.)

Accepted Answer

Store secrets in encrypted variables or vaults. Storing secrets in encrypted variables or vaults (e.g., HashiCorp Vault, Ansible Vault, or AWS Secrets Manager) ensures that sensitive data like API keys and passwords are never exposed in plaintext within scripts or version control. This prevents credential leakage during automation execution and adheres to security best practices for configuration management.

Answer

Hardcode credentials in automation scripts

Answer

Perform unit testing on scripts

Question 14

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

Accepted Answer

Block top secret content and allow confidential content with an override requiring a business justification. It aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Answer

Encrypt all emails containing any sensitive data and allow delivery

Answer

Block both top secret and confidential content with no override

Answer

Block top secret content and allow confidential content with an audit log

Question 15

A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?

Accepted Answer

Use parameterized queries or prepared statements for all database interactions.. Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.

Answer

Use stored procedures exclusively for database access.

Answer

Deploy a web application firewall (WAF) with SQL injection rules.

Answer

Implement client-side input validation and sanitize all user input.

Question 16

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

Accepted Answer

Enable SQL injection signature rules.. Enabling SQL injection signature rules allows the WAF to inspect HTTP requests for known SQL injection patterns, such as UNION, OR 1=1, or comment sequences like '--', using a predefined rule set. Option B is correct because input validation for all query parameters ensures that user-supplied data is sanitized or rejected before reaching the application, preventing malicious SQL syntax from being interpreted by the database. Together, these controls provide both signature-based detection and behavioral prevention against SQL injection attacks.

Answer

Enable rate limiting on login endpoints.

Answer

Enable IP reputation blocking.

Answer

Enable SSL/TLS inspection for all traffic.

Question 17

What is the primary benefit of using infrastructure as code (IaC) tools like Terraform for cloud resource provisioning?

Accepted Answer

It provides a declarative language to define resources, enabling version control and repeatability.. Infrastructure as Code (IaC) tools like Terraform use a declarative language (HCL) to define cloud resources in configuration files. This approach enables version control (e.g., Git), repeatable deployments, and consistent environments, which are the primary benefits of IaC over manual provisioning.

Answer

It reduces cloud costs by optimizing resource usage.

Answer

It eliminates the need for manual configuration management.

Answer

It automatically applies security patches to resources.

Question 18

Refer to the exhibit. A security review is being conducted on the Python application configuration. Which of the following security issues is present?

Accepted Answer

The code does not handle the case where API_KEY is not set, potentially causing an error. The code attempts to retrieve the API_KEY environment variable using `os.environ['API_KEY']`, which raises a `KeyError` if the variable is not set. This lack of a fallback or error handling can cause the application to crash at startup, making it a security issue as it could lead to denial of service or expose stack traces in production logs.

Answer

The DB_CONNECTION environment variable is missing a default value

Answer

The default database connection is SQLite, which is insecure for production

Answer

The API key is stored in an environment variable, which is insecure

Question 19

Refer to the exhibit. Based on the data classification policy JSON, what action is MOST consistent with the policy?

Accepted Answer

Block the email and notify the security team. The data classification policy JSON explicitly marks documents with a classification of 'Confidential' and a data type of 'PII' as 'block' action. The email contains a document classified as 'Confidential' with PII data, so the policy dictates that the email must be blocked and the security team notified. This aligns with the policy's enforcement rule for high-risk data, preventing unauthorized disclosure.

Answer

Allow the email but reclassify the document as 'Internal'

Answer

Allow the email with an exception request

Answer

Encrypt the email automatically with S/MIME

Question 20

A security team needs to automate the enforcement of cloud security policies across multiple accounts in AWS. They want a solution that uses code to define policies and automatically remediate violations. Which approach best meets these requirements?

Accepted Answer

Use AWS Config with managed rules and custom Lambda functions for auto-remediation.. AWS Config with managed rules and custom Lambda functions enables automated enforcement of security policies across multiple AWS accounts. This approach uses code to define policies and automatically remediate violations via Lambda, meeting the requirement for automation and code-defined policies. Option A (boto3 scripts) is manual and not fully automated; Option C (GuardDuty) is reactive and focuses on threats, not policy enforcement; Option D (CSPM) is a third-party tool, not a code-defined approach within AWS.

Answer

Write Python boto3 scripts that run on a schedule to check and update security groups.

Answer

Enable AWS GuardDuty and rely on its threat detection alerts.

Answer

Deploy a third-party cloud security posture management (CSPM) tool like Prisma Cloud.