CAS-004 Practice Exam 61 — 20 Questions

Question 1

A security engineer is reviewing the configuration of a web server that uses TLS 1.3. The engineer wants to ensure that the server supports perfect forward secrecy (PFS) and uses strong cipher suites. Which of the following cipher suites should be selected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TLS_AES_256_GCM_SHA384. In TLS 1.3, all cipher suites provide forward secrecy because key exchange is always ephemeral. The only valid TLS 1.3 cipher suite among the options is TLS_AES_256_GCM_SHA384, which uses strong AES-256-GCM encryption. The others are TLS 1.2 suites or use weak algorithms.

Answer

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

Question 2

A security compliance officer is mapping the organization's controls to the NIST Cybersecurity Framework (CSF) 2.0. The officer needs to ensure that the organization's governance and risk management processes are adequately covered. Which CSF 2.0 function primarily addresses the development and implementation of cybersecurity policies, procedures, and risk management strategies?

Accepted Answer

Govern (GV). CSF 2.0 introduced the Govern function to emphasize cybersecurity governance and risk management. It encompasses organizational context, risk management strategy, roles and responsibilities, and policy. This function ensures that cybersecurity is integrated into enterprise risk management, making it the correct choice for policy and procedure development.

Answer

Detect (DE)

Answer

Identify (ID)

Answer

Protect (PR)

Question 3

A security engineer is configuring a Linux server that hosts a web application. The server must accept connections only from the internal network 10.0.0.0/24 and must reject all other incoming traffic. The engineer decides to use iptables. Which command sequence correctly implements this requirement?

Accepted Answer

iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT; iptables -A INPUT -j DROP. The requirement is to allow traffic only from 10.0.0.0/24 and drop everything else. In iptables, rules are evaluated in order, so the ACCEPT rule for the internal subnet must come before the DROP rule. Appending ACCEPT then DROP achieves this. Other orderings either block legitimate traffic or permit unauthorized traffic, violating the stated policy.

Answer

iptables -A INPUT -j DROP; iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/24 -j DROP; iptables -A INPUT -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/24 -j REJECT; iptables -A INPUT -j ACCEPT

Question 4

A security architect is evaluating a cloud service provider's ability to support a customer's compliance with PCI DSS. The customer will store cardholder data in the cloud. The architect needs to determine which party is responsible for configuring encryption of the data at rest and managing the encryption keys. According to the shared responsibility model, which of the following is the MOST accurate statement?

Accepted Answer

The customer is responsible for enabling encryption at rest and managing keys, but the provider may offer key management services.. In the shared responsibility model, the customer is responsible for securing data in the cloud, including enabling encryption at rest and managing keys. The cloud provider may offer key management services, but the customer must configure them to meet PCI DSS requirements. The other options either reverse responsibilities or incorrectly assign full responsibility to one party.

Answer

The customer is responsible for physical security of the data center, and the provider handles encryption.

Answer

PCI DSS compliance is solely the cloud provider's responsibility because they own the infrastructure.

Answer

The cloud provider is always responsible for encrypting cardholder data at rest and managing keys.

Question 5

A security architect is designing a new cloud-native application for a healthcare provider. The application will process protected health information (PHI) and must comply with HIPAA. The architect must ensure that all data at rest and in transit is encrypted, and that access is logged and auditable. Which of the following controls BEST meets the requirement for auditing access to PHI?

Accepted Answer

Implement application-level logging that records user identity, timestamp, and the specific PHI records accessed, and store logs securely.. HIPAA's Security Rule requires audit controls that record and examine activity in systems containing ePHI. Application-level logging that captures user identity, timestamp, and the specific PHI accessed provides the necessary audit trail. Other controls like CloudTrail, AWS Config, or WAFs address different aspects of security but do not provide the granular access auditing required for PHI.

Answer

Use AWS Config to monitor resource configurations and alert on changes to security groups.

Answer

Deploy a web application firewall (WAF) to log all incoming HTTP requests and block malicious traffic.

Answer

Enable AWS CloudTrail to log all API activity and store logs in an immutable S3 bucket.

Question 6

A startup is building a new application on a public cloud and wants to minimize the attack surface of its virtual machines. The security architect recommends replacing SSH key-based administration with a model where no inbound management ports are exposed and access is granted per session with short-lived credentials. Which of the following should be implemented?

Accepted Answer

A just-in-time access broker that issues short-lived certificates and proxies sessions.. A just-in-time access broker removes standing inbound management access by issuing short-lived credentials and proxying sessions only when needed. This eliminates persistent SSH keys and exposed ports, directly minimizing the attack surface on the virtual machines while still allowing controlled administrative access.

Answer

Security groups that allow SSH only from the administrator's home IP address.

Answer

A bastion host in a public subnet with SSH restricted to the corporate CIDR range.

Answer

VPN concentrators that place administrators on the same private network as the VMs.

Question 7

A security architect is designing a zero trust architecture for a hybrid environment where users access internal applications from managed and unmanaged devices. The requirement is that access decisions consider device health and user identity on every request rather than relying on network location. Which of the following BEST implements this requirement?

Accepted Answer

Implement a policy engine that evaluates user identity and device posture from a device attestation service for each access request, brokered through a policy enforcement point. Zero trust requires a policy decision point that consumes identity and device-posture telemetry and a policy enforcement point that applies the decision to each request. Perimeter, bastion, and segmentation approaches all evaluate trust at connection or network admission time and do not continuously factor device health into every access decision.

Answer

Segment the internal network into microsegments with host-based firewalls and require 802.1X for all wired and wireless access

Answer

Require all users to connect through a bastion host that performs multi-factor authentication before reaching internal applications

Answer

Deploy a next-generation firewall with IP-based allow lists for the corporate VPN address pool and enable TLS inspection

Question 8

A software company wants to demonstrate to prospective enterprise customers that its cloud-hosted product meets recognized security and availability controls without exposing its internal procedures. The security manager must select an attestation that an independent auditor issues after testing the design and operating effectiveness of controls over a period. Which report type should the manager obtain?

Accepted Answer

A SOC 2 Type II report covering the relevant trust services criteria.. A SOC 2 Type II report provides independent auditor testing of both control design and operating effectiveness across a review period, which is the standard evidence enterprise buyers request from cloud providers. Type I lacks the period of operation, SOC 3 omits the detail customers need, and SOC 1 targets financial reporting rather than trust services criteria.

Answer

A SOC 1 Type II report covering the relevant trust services criteria.

Answer

A SOC 2 Type I report covering the relevant trust services criteria.

Answer

A SOC 3 general use report covering the relevant trust services criteria.

Question 9

A multinational retailer must comply with PCI DSS v4.0 for its cardholder data environment. The security manager is asked to define the scope of the CDE. Which of the following best describes the first step in scoping the CDE according to PCI DSS?

Accepted Answer

Identify all system components that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD).. The correct answer is to identify all system components that store, process, or transmit CHD or SAD. PCI DSS scoping requires a thorough inventory of people, processes, and technologies that handle cardholder data or could impact its security. This inventory forms the basis for defining the CDE and determining which requirements apply. Without it, segmentation and validation efforts are misdirected.

Answer

Conduct a penetration test on all internet-facing systems to determine which ones are in scope.

Answer

Review the PCI DSS Self-Assessment Questionnaire (SAQ) to determine which requirements apply.

Answer

Segment the network by placing all cardholder data systems behind a firewall and then document the segmentation.

Question 10

A security manager is developing a third-party risk management program. The organization wants to ensure that vendors handling sensitive data are subject to appropriate oversight. Which two of the following are the most effective methods for ongoing monitoring of a vendor's security posture? (Choose two.)

Accepted Answer

Conducting periodic on-site security assessments of the vendor. Effective ongoing vendor monitoring requires objective, independent evidence of security controls. SOC 2 Type II reports provide third-party attestation over time, and periodic on-site assessments allow direct verification. Other options like marketing materials, self-attestation, and stock price monitoring lack the rigor and specificity needed for security oversight.

Answer

Asking the vendor to self-attest to security compliance annually

Answer

Reviewing the vendor's marketing materials for security claims

Answer

Monitoring the vendor's stock price for fluctuations

Question 11

A security analyst is reviewing the organization's risk register and notices a risk that has been assigned a risk score of 15 on a scale of 1 to 25. The risk owner has decided to purchase cyber insurance to transfer the financial impact of the risk. Which risk treatment strategy is being applied?

Accepted Answer

Risk transfer. Purchasing cyber insurance shifts the financial consequences of a risk to an insurer, which is the definition of risk transfer. Risk avoidance would eliminate the activity, mitigation would reduce likelihood or impact, and acceptance would involve bearing the risk without transfer. The scenario clearly describes transfer.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 12

A security team is hardening a Kubernetes cluster that runs multi-tenant workloads. The team wants to prevent a compromised pod from reaching the cloud metadata service at 169.254.169.254 to steal node credentials, while still allowing pods to reach required external APIs. Which of the following should the team implement?

Accepted Answer

Apply a network policy that denies egress to the link-local metadata address while permitting approved external destinations.. Blocking pod egress to the link-local metadata address removes the direct path a compromised workload would use to obtain node credentials, and pairing it with an allow rule for required external APIs preserves functionality. Network policy operates below the application, so it constrains all processes in the selected pods without relying on application cooperation.

Answer

Set the pod security context to run containers as a non-root user with a read-only root filesystem.

Answer

Configure role-based access control so that pods run under a service account with no RBAC permissions.

Answer

Enable mutual TLS between all pods and require SPIFFE identities for service-to-service calls.

Question 13

A security analyst is reviewing the following command executed on a Linux server: 'nmap -sS -Pn -p 80,443 192.168.1.0/24'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a TCP SYN scan on ports 80 and 443 across the subnet, skipping host discovery. The command uses -sS for a TCP SYN scan, -Pn to skip host discovery, and -p 80,443 to target specific ports. This is a common reconnaissance technique to quickly identify web servers on a subnet without the noise of a full port scan or host discovery. The other options misinterpret the flags or the scan type.

Answer

Perform a ping sweep to identify live hosts on the subnet, then scan ports 80 and 443

Answer

Perform a TCP connect scan on all ports across the subnet, including host discovery

Answer

Perform a UDP scan on ports 80 and 443 across the subnet, skipping host discovery

Question 14

A security analyst is reviewing a packet capture (PCAP) from a suspected command-and-control (C2) channel. The analyst observes periodic outbound connections to an external IP address over TCP port 443. The traffic is encrypted with TLS, but the analyst suspects it may be malicious. Which TWO of the following techniques would be MOST effective to identify the malicious nature of the traffic without decrypting the payload? (Choose two.)

Accepted Answer

Examine the packet sizes and timing intervals for patterns.. Analyzing the TLS certificate can reveal anomalies like self-signed or expired certificates, which are common in malicious C2 infrastructure. Examining packet sizes and timing intervals can expose beaconing patterns typical of automated C2 communication. Both techniques work without decrypting the payload. Deep packet inspection requires decryption, using the public key for decryption is impossible, and vulnerability scanning does not analyze the traffic itself.

Answer

Run a vulnerability scanner against the external IP address.

Answer

Perform deep packet inspection (DPI) to examine the payload contents.

Answer

Decrypt the TLS traffic using the server's public key.

Question 15

A security administrator is configuring a Linux server to enforce mandatory access control (MAC) for a web application. The administrator wants to confine the web server process to only access its own files and network ports, even if the process is compromised. Which of the following should the administrator implement?

Accepted Answer

SELinux in enforcing mode with a targeted policy.. SELinux in enforcing mode applies mandatory access control, restricting processes to only the resources defined in the policy. A targeted policy confines specific services like the web server, limiting the impact of a compromise. This meets the requirement to confine the web server process even if exploited.

Answer

A chroot jail for the web server process.

Answer

AppArmor in complain mode.

Answer

Standard Linux discretionary access control (DAC) with file permissions.

Question 16

A security engineer is hardening a Kubernetes cluster that runs multi-tenant workloads. The requirement is to prevent a compromised pod from reading another tenant's secrets and from making unauthorized network connections to other namespaces. Which of the following combinations BEST addresses both concerns?

Accepted Answer

Apply network policies that deny ingress and egress by default and mount secrets only into pods that explicitly require them with least-privilege service accounts. Default-deny network policies enforce network segmentation between namespaces, and least-privilege service accounts with scoped secret mounts enforce secret isolation at the API level. The other options harden adjacent layers such as control-plane access, admission, or transport encryption without preventing the two specific cross-tenant actions described.

Answer

Enable role-based access control (RBAC) for the API server and require TLS client certificates for all kubelet connections

Answer

Deploy a service mesh with mutual TLS between all pods and rotate the cluster's certificate authority on a fixed schedule

Answer

Use pod security admission to enforce the restricted profile and enable audit logging on the API server for all secret access

Question 17

A security analyst is reviewing the organization's third-party risk management program. The organization recently onboarded a new SaaS provider that will process sensitive customer data. The provider has provided a SOC 2 Type II report, but the analyst notices that the report is over 18 months old and covers a different service than the one being used. Which of the following should the analyst recommend?

Accepted Answer

Request a current SOC 2 Type II report that specifically covers the service being used, or conduct an on-site assessment if one is not available.. Third-party risk management requires current and relevant assurance. A SOC 2 Type II report must be recent and cover the specific service in use. Requesting an updated report or conducting an on-site assessment ensures the organization has accurate information to assess the provider's controls. Other options rely on outdated, unverified, or inappropriate methods.

Answer

Accept the existing SOC 2 Type II report since it demonstrates the provider's overall security posture.

Answer

Perform a penetration test against the provider's service to validate its security controls.

Answer

Rely on the provider's self-attestation of compliance with industry best practices.

Question 18

A security architect at a financial services firm is designing the network segmentation for a new containerized trading platform running on Kubernetes. The platform must isolate workloads so that a compromise of the public-facing web tier cannot directly reach the database tier. The architect wants to enforce this isolation natively within the cluster and have policies applied automatically as new pods are scheduled. Which of the following should the architect implement?

Accepted Answer

NetworkPolicies applied to namespaces and selected pods. Kubernetes NetworkPolicies provide label-based, pod-level segmentation enforced by the CNI plugin, so isolation follows workloads wherever they are scheduled. The architect can default-deny traffic in a namespace and then allow only the specific web-to-API and API-to-database flows, which prevents a compromised front end from reaching the database tier. Encryption and edge controls address different concerns and do not restrict lateral movement inside the cluster.

Answer

A service mesh with mutual TLS between all sidecars

Answer

VLAN segmentation on the underlying hypervisor

Answer

An ingress controller with TLS termination and WAF rules

Question 19

A security administrator is configuring a new endpoint detection and response (EDR) solution. The administrator wants to ensure that the EDR agent can detect and block malicious activities in real-time. Which of the following capabilities is MOST essential for the EDR agent to achieve this goal?

Accepted Answer

Continuous monitoring of process and file system activity.. EDR agents must continuously monitor endpoint activities such as process execution, file system changes, and network connections to detect and block malicious behavior in real-time. This telemetry enables behavioral analysis and immediate response. SIEM integration, scheduled scans, and UBA are valuable but do not provide the real-time detection and blocking capability that continuous monitoring offers.

Answer

Periodic full disk scans scheduled during off-hours.

Answer

Integration with a security information and event management (SIEM) system.

Answer

User behavior analytics (UBA) to detect insider threats.

Question 20

A security engineer is implementing network segmentation to isolate a PCI DSS environment from the corporate network. The engineer plans to use VLANs and a firewall. Which TWO of the following are essential to ensure that the segmentation is effective and compliant? (Choose two.)

Accepted Answer

Implement 802.1Q VLAN tagging on all switch ports that connect to the PCI environment and ensure that native VLANs are not used on trunk ports.. Effective network segmentation for PCI DSS requires both Layer 3 access control and Layer 2 isolation. A default-deny firewall rule between the PCI VLAN and other networks ensures that only necessary traffic is allowed. Proper VLAN tagging and avoiding native VLANs on trunk ports prevent VLAN hopping attacks that could bypass segmentation. Together, these controls establish a strong boundary. Other measures like DAI, IPS, and PVLANs enhance security but are not essential for the segmentation itself.

Answer

Use private VLANs (PVLANs) to isolate hosts within the PCI VLAN from each other.

Answer

Deploy a dedicated intrusion prevention system (IPS) on the PCI VLAN to monitor all traffic.

Answer

Enable dynamic ARP inspection (DAI) and DHCP snooping on all VLANs to prevent IP spoofing.