CAS-004 Practice Exam 62 — 20 Questions

Question 1

A security operations center (SOC) analyst is investigating a potential phishing incident. The analyst has a suspicious email and wants to safely analyze any URLs without directly visiting them from a corporate workstation. Which of the following techniques should the analyst use to examine the URL's reputation and content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a URL sandboxing service that detonates the URL in an isolated environment and provides a screenshot and network traffic analysis.. URL sandboxing services are designed to safely analyze URLs by rendering them in an isolated environment. They provide valuable information such as screenshots, final URL, and network requests, which help determine if the URL is malicious. This approach protects the analyst's workstation and the corporate network while gathering actionable intelligence.

Answer

Copy the URL into a text editor and inspect the domain for typosquatting, then use a WHOIS lookup to determine the registrar.

Answer

Forward the email to a personal email account and open the URL on a personal device to see if it is malicious.

Answer

Use a command-line tool like curl to fetch the URL headers and HTML content, then analyze the response for malicious scripts.

Question 2

A security administrator is configuring a Linux server that will host a public-facing web application. The administrator wants to ensure that the server's SSH service is protected against brute-force attacks by limiting the number of failed authentication attempts and blocking offending IP addresses. Which of the following should the administrator implement?

Accepted Answer

Install and configure Fail2ban to monitor SSH logs and update firewall rules.. Fail2ban actively monitors SSH authentication logs and, upon detecting repeated failures, inserts firewall rules to block the offending IP addresses. This provides dynamic brute-force protection. The other options either offer static access control, process confinement, or obscurity, none of which dynamically respond to failed authentication attempts.

Answer

Enable SELinux in enforcing mode.

Answer

Configure TCP wrappers to allow only specific IP addresses.

Answer

Change the SSH port from 22 to a non-standard port.

Question 3

A multinational financial services firm is expanding operations into a new jurisdiction. The legal team has identified that the new country requires all personal data of its citizens to be stored on servers physically located within its borders. The security architect must recommend an approach that satisfies this requirement while maintaining the firm's global security standards. Which of the following should the architect recommend?

Accepted Answer

Implement data localization by deploying dedicated infrastructure in the new jurisdiction and applying the firm's global security baselines to those systems.. Data localization laws require that personal data of a jurisdiction's citizens be stored on physical servers within that jurisdiction. Deploying dedicated in-country infrastructure and applying the organization's global security baselines directly satisfies this legal requirement while ensuring consistent security controls. Other options either store data outside the jurisdiction or fail to guarantee in-country residency.

Answer

Implement tokenization so that only non-sensitive tokens are stored in the new jurisdiction while actual data remains in the central repository.

Answer

Use a content delivery network (CDN) to cache personal data at edge locations closest to the new jurisdiction's users.

Answer

Encrypt all personal data with customer-managed keys and store it in the firm's existing central data center.

Question 4

A healthcare provider is designing a new system to process protected health information (PHI) in a public cloud. The security architect must ensure that data is encrypted at rest and that the organization retains full control over the encryption keys, including the ability to revoke access immediately if a cloud administrator account is compromised. The cloud provider must not be able to decrypt the data. Which of the following key management approaches BEST meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK) with keys stored in an external hardware security module (HSM) under the organization's control. HYOK with an external HSM ensures the organization retains sole control of root keys, preventing the cloud provider from decrypting data. Because the external HSM is outside the provider's environment, access can be revoked immediately by disabling the key, which meets the strict confidentiality and revocation requirements for PHI.

Answer

Customer-managed keys (CMK) stored in the cloud provider's KMS with key rotation enabled

Answer

Provider-managed keys stored in the cloud provider's key management service (KMS)

Answer

Bring Your Own Key (BYOK) where the customer imports keys into the provider's KMS

Question 5

A security analyst is investigating a potential compromise of a Windows server. The analyst suspects that an attacker used a technique to dump credentials from memory. Which TWO of the following artifacts or events would MOST likely indicate that a credential dumping tool such as Mimikatz was executed? (Choose two.)

Accepted Answer

Event ID 10 from Sysmon showing lsass.exe accessed by an unsigned process. The correct indicators are a handle request to lsass.exe with PROCESS_VM_READ (Event ID 4656) and Sysmon Event ID 10 showing lsass.exe accessed by an unsigned process. Both directly relate to unauthorized memory reading of the Local Security Authority Subsystem Service, which stores credentials. The other events are either normal system activities or too generic to specifically indicate credential dumping.

Answer

Event ID 4624 with logon type 3 (network) for a service account

Answer

Event ID 4688 with process creation for lsass.exe

Answer

Event ID 7045 with a new service named 'MimikatzSvc'

Question 6

A security analyst is reviewing a potentially malicious PowerShell script that was executed on a workstation. The script contains obfuscated code and makes network connections. The analyst wants to perform dynamic analysis to understand its behavior. Which TWO of the following methods would BEST allow the analyst to observe the script's runtime actions in a controlled environment? (Choose two.)

Accepted Answer

Set up a debugger and step through the script line by line. Dynamic analysis involves executing the script in a controlled environment to observe its behavior. An isolated sandbox with network simulation allows safe execution and monitoring of API calls, network traffic, and system changes. Stepping through the script with a debugger provides line-by-line visibility into its execution, revealing obfuscated logic and runtime actions. Both methods are essential for understanding malicious scripts without risking production systems.

Answer

Use PowerShell's Constrained Language Mode to restrict script execution

Answer

Perform static analysis by extracting strings and examining the abstract syntax tree

Answer

Run the script on a production workstation with logging enabled

Question 7

A security architect is designing a network for a small business that wants to allow employees to use their personal smartphones and tablets to access corporate email and files. The company wants to enforce screen lock, encryption, and remote wipe on these devices without managing the entire device. Which of the following should the architect implement?

Accepted Answer

Mobile application management (MAM) with containerization of corporate applications.. Mobile application management (MAM) with containerization enforces policies on corporate applications and data without managing the entire personal device. It supports screen lock, encryption, and remote wipe for corporate data, preserving employee privacy. Full MDM enrollment controls the whole device, VDI does not enforce device-level policies, and NAC only checks compliance at network access time, so MAM is the correct choice.

Answer

Mobile device management (MDM) with full device enrollment for all personal devices.

Answer

Network access control (NAC) that checks personal devices for compliance before granting access to the corporate network.

Answer

Virtual desktop infrastructure (VDI) accessed from personal devices through a web browser.

Question 8

A security operations center (SOC) analyst is investigating a potential phishing incident. The analyst has a suspicious email and wants to safely analyze any URLs without directly visiting them from a corporate workstation. Which of the following techniques should the analyst use to examine the URL's reputation and content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web server access logs showing HTTP 200 responses for requests containing encoded traversal sequences.. To confirm a path traversal attack's success, the analyst needs evidence that the server actually processed the malicious requests and potentially returned sensitive files. Web server access logs with HTTP 200 responses to traversal attempts provide that evidence. Other log sources may indicate attempts or unrelated activity but do not directly confirm file access.

Answer

Firewall logs showing allowed outbound connections from the web server to a database server.

Answer

Intrusion detection system (IDS) alerts indicating a path traversal signature match.

Answer

Authentication logs showing multiple failed login attempts from the same IP address.

Question 9

A security engineer is implementing a zero trust architecture for a corporate network. The engineer must ensure that all access requests are continuously verified and that least privilege is enforced. Which TWO components are essential to achieve these goals? (Choose two.)

Accepted Answer

A policy administrator that establishes and maintains the trust relationship between the subject and the resource.. Zero trust architecture relies on a policy engine to make dynamic access decisions based on context, and a policy administrator to enforce those decisions by configuring the data plane. These two components form the control plane and are essential for continuous verification and least privilege. Other options like VPN, NGFW, and SIEM are supporting technologies but not core to the zero trust access decision process.

Answer

A VPN concentrator that provides encrypted tunnels for all remote access.

Answer

A next-generation firewall (NGFW) that inspects all traffic at the network perimeter.

Answer

A security information and event management (SIEM) system that aggregates logs for analysis.

Question 10

A security architect is reviewing the company's incident response plan and wants to ensure that the team can detect and respond to threats in real time across endpoints, networks, and cloud workloads. The architect needs a solution that correlates events from multiple sources and provides automated response actions. Which technology should the architect recommend?

Accepted Answer

Security information and event management (SIEM) with security orchestration, automation, and response (SOAR) capabilities.. A SIEM with SOAR capabilities is the correct choice because it centralizes log collection and correlation from diverse sources and enables automated response workflows. This combination provides the real-time detection and orchestrated response across endpoints, networks, and cloud workloads that the incident response plan requires.

Answer

Endpoint detection and response (EDR) deployed only on servers.

Answer

Network detection and response (NDR) with full packet capture at the perimeter.

Answer

A vulnerability scanner with scheduled scans of all assets.

Question 11

A security analyst is investigating a potential insider threat. The analyst needs to correlate user activity across multiple systems, including file access, email, and web browsing, to build a timeline of events. Which data source is MOST critical for this correlation?

Accepted Answer

Endpoint detection and response (EDR) telemetry. EDR telemetry is the most critical data source because it provides detailed, user-attributed activity across endpoints, including file, process, and network events. This allows the analyst to correlate actions across multiple systems and construct a timeline, whereas other sources offer only partial or network-level visibility.

Answer

Active Directory authentication logs

Answer

NetFlow records

Answer

Firewall logs

Question 12

A security operations center (SOC) analyst is investigating a potential phishing incident. The analyst has a suspicious email and wants to safely analyze any URLs without directly visiting them from a corporate workstation. Which of the following techniques should the analyst use to examine the URL's reputation and content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LSASS memory dumping. The scenario describes an unsigned binary accessing lsass.exe, which is a strong indicator of credential dumping. LSASS stores credentials in memory, and attackers use tools like Mimikatz to extract them. This allows the attacker to obtain password hashes or plaintext passwords for lateral movement. The other techniques do not involve direct access to lsass.exe.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

DCSync

Question 13

A defense contractor must comply with DFARS clause 252.204-7012 and achieve a passing score in its NIST SP 800-171 self-assessment before a contract award. The security lead discovers that several controls in the CUI environment are only partially implemented. Which action should the security lead take to meet the assessment requirement?

Accepted Answer

Document a plan of action with milestones to remediate the partially implemented controls and complete a System Security Plan describing the current state.. When controls are not fully implemented, the accepted method is to document the current state in a System Security Plan and describe remediation in a Plan of Action with milestones. This preserves an honest score while showing the contracting officer a credible path to full implementation.

Answer

Request a variance from the contracting officer to exclude the unimplemented controls from the assessment scope.

Answer

Submit the self-assessment with a perfect score and remediate the gaps after contract award within the first performance period.

Answer

Implement a compensating control for each partial control and claim full credit in the score to reach the required total.

Question 14

A defense contractor is required to comply with NIST SP 800-171 for protecting controlled unclassified information (CUI). The security team is implementing the required security requirements. Which of the following best describes the purpose of the System Security Plan (SSP) in this context?

Accepted Answer

It documents how the organization implements each security requirement and describes any planned remediation.. The System Security Plan (SSP) documents how the organization implements each of the NIST SP 800-171 security requirements and identifies any gaps with remediation plans. It is the primary artifact used to demonstrate compliance with DFARS 252.204-7012. It is not a data inventory, contract, or test report, although it may reference those. The SSP provides a structured narrative of the security posture for the CUI environment.

Answer

It provides a detailed inventory of all CUI data elements and their locations.

Answer

It contains the results of penetration testing and vulnerability scans for the CUI environment.

Answer

It serves as a legal contract between the contractor and the Department of Defense.

Question 15

A healthcare organization is designing a new system to store patient records. The security architect must ensure that data at rest is encrypted and that cryptographic keys are rotated regularly without re-encrypting the entire database. Which of the following techniques should be used?

Accepted Answer

Envelope encryption using a data encryption key (DEK) per record and a key encryption key (KEK) managed by a key management service (KMS).. Envelope encryption separates data encryption keys from key encryption keys. Each record is encrypted with a unique DEK, and the DEK is encrypted with a KEK. Rotating the KEK only requires re-encrypting the DEKs, not the data, enabling regular key rotation without massive re-encryption. This is efficient, scalable, and limits the blast radius of a compromised key, making it ideal for healthcare data with strict compliance.

Answer

Transparent data encryption (TDE) with a single certificate used to encrypt the database.

Answer

Full database encryption with a single master key stored in a hardware security module (HSM).

Answer

Column-level encryption using a static symmetric key stored in a configuration file.

Question 16

A security architect is reviewing the authentication design for a new customer portal that will be accessed by partners from multiple external organizations. The business wants partners to use their existing corporate identities, avoid creating new passwords for the portal, and allow the home organization to remain the authoritative source for disabling accounts. Which of the following should the architect recommend?

Accepted Answer

Federated identity using SAML or OpenID Connect with the partner identity providers. Federated identity lets the portal rely on each partner organization's identity provider for authentication and account lifecycle. Partners use existing credentials, and disabling an account at the home organization immediately prevents new sessions because the portal consumes assertions rather than storing passwords. This is the standard pattern for business-to-business access with external identity sources.

Answer

A shared partner account with per-user activity logging

Answer

Local account provisioning with mandatory password complexity and rotation

Answer

Certificate-based authentication with manually distributed client certificates

Question 17

A financial services firm is designing a new online banking platform. The security architect must ensure that if the session token issued to a customer is stolen via a cross-site scripting attack, the attacker cannot use it from a different device or network. Which of the following should be implemented to meet this requirement?

Accepted Answer

Token binding that cryptographically ties the session token to the client's TLS connection.. Token binding is the only mechanism that cryptographically links the session token to the client's TLS connection, so a token stolen via XSS cannot be replayed from a different device or network. Lifetime reduction, cookie flags, and local storage encryption mitigate other risks but do not satisfy the explicit cross-device reuse requirement.

Answer

Shortening the session token lifetime to five minutes and requiring re-authentication.

Answer

Encrypting the session token with AES-256 before writing it to the client's local storage.

Answer

Storing the session token in an HttpOnly cookie with the Secure and SameSite attributes.

Question 18

A healthcare organization is architecting a secure data exchange with a partner hospital. The partners need to share patient records in near real time, but they do not want to expose their internal databases directly. The security architect must ensure that only specific, authorized fields are exchanged, that the data is validated against a predefined schema, and that the exchange is auditable and resistant to tampering. Which approach best satisfies these requirements?

Accepted Answer

A mutually authenticated API gateway with schema validation and signed messages. A mutually authenticated API gateway with schema validation and signed messages enables selective field exchange, real-time communication, strict schema enforcement, and tamper-resistant auditing. It avoids exposing internal databases and provides the necessary security controls for partner data sharing.

Answer

A shared message queue using AMQP with no message signing

Answer

SFTP file drops of full database exports on a scheduled basis

Answer

Direct database replication between the two organizations over a VPN

Question 19

A security administrator is configuring a network intrusion detection system (NIDS) to monitor traffic for known attack patterns. The administrator wants to ensure that the NIDS can detect a specific SQL injection attempt that uses a particular string. Which Snort rule action and option combination will BEST accomplish this?

Accepted Answer

alert tcp any any -> any 80 (msg:"SQL Injection"; content:"1=1"; sid:100001;). The goal is to detect a SQL injection attempt containing a specific string. Snort rules with the alert action and a content match on TCP port 80 are appropriate for unencrypted HTTP traffic. Using drop would block traffic, which is not required. UDP or port 443 would not match typical SQL injection traffic. Thus, the rule with alert, TCP, port 80, and content match is correct.

Answer

alert udp any any -> any 80 (msg:"SQL Injection"; content:"1=1"; sid:100001;)

Answer

drop tcp any any -> any 80 (msg:"SQL Injection"; content:"1=1"; sid:100001;)

Answer

alert tcp any any -> any 443 (msg:"SQL Injection"; content:"1=1"; sid:100001;)

Question 20

A security operations center (SOC) analyst is investigating a potential phishing incident. The analyst has a suspicious email and wants to safely analyze any URLs without directly visiting them from a corporate workstation. Which of the following techniques should the analyst use to examine the URL's reputation and content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A combination of all three artifacts correlated together.. The most reliable timeline is obtained by correlating the Windows Event Log, file system metadata, and memory dump. Each source has unique data and limitations; combining them allows the analyst to cross-validate timestamps and activities. For example, a process execution in the event log can be linked to a file creation in metadata and a network connection in memory. This multi-source correlation is essential for accurate incident reconstruction.

Answer

The memory dump, because it contains running processes and network connections at the time of capture.

Answer

The Windows Event Log, because it records all system and application events with timestamps.

Answer

The file system metadata, because it includes timestamps for file creation, modification, and access.