CAS-004 Practice Exam 62 — 20 Questions

Question 1

A vulnerability has a CVSS base score of 9.8. The vulnerability is present on a server that is not exposed to the internet but is accessible to internal users with valid credentials. Which CVSS metric should be adjusted to reflect the reduced risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Environmental score. The Environmental Score allows customization based on specific organizational context, such as modified access requirements.

Answer

None, the base score should be used as-is

Answer

Temporal score

Answer

Base score

Question 2

An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?

Accepted Answer

Deploy a forward proxy with SSL/TLS inspection. A forward proxy with SSL/TLS inspection decrypts outbound HTTPS traffic, allowing the security team to inspect the payload of connections over TCP 443. This reveals encrypted C2 traffic that would otherwise be hidden within legitimate HTTPS flows, while still permitting authorized business traffic to pass through after inspection.

Answer

Block outbound TCP 443 and require users to use a VPN

Answer

Enable logging on the firewall for all outbound 443 traffic

Answer

Install a network-based IDS on the internal side of the firewall

Question 3

A company wants to ensure that only authorized code runs on its point-of-sale (POS) terminals. Which technology should be implemented?

Accepted Answer

Code signing. Code signing ensures that only code digitally signed by a trusted publisher can execute on the POS terminals. By verifying the digital signature before execution, the terminal can cryptographically confirm the code's integrity and origin, preventing unauthorized or tampered code from running. This directly addresses the requirement to restrict execution to authorized code only.

Answer

Application whitelisting

Answer

Trusted Platform Module (TPM)

Answer

Secure Boot

Question 4

A large enterprise is designing a disaster recovery site that must support rapid failover with minimal data loss. The primary data center is 50 miles away. The RPO is 1 minute, and RTO is 15 minutes. Which replication strategy best meets these requirements?

Accepted Answer

Synchronous replication over dedicated low-latency fiber links.. Synchronous replication writes data to both the primary and secondary sites simultaneously before acknowledging the write to the application, ensuring zero data loss at the storage layer. With dedicated low-latency fiber links over 50 miles, the round-trip time can be kept under 1 ms, meeting the 1-minute RPO and enabling rapid failover within the 15-minute RTO. This strategy guarantees transactional consistency and immediate availability at the DR site.

Answer

Log shipping with a 5-minute delay.

Answer

Scheduled snapshot-based replication every 30 minutes.

Answer

Asynchronous replication with continuous data protection.

Question 5

A company is adopting a serverless architecture using AWS Lambda. Which of the following are security concerns specific to serverless functions? (Select TWO.)

Accepted Answer

Event injection via malformed input. Event injection via malformed input (B) is a specific serverless security concern because AWS Lambda functions are triggered by events from sources like API Gateway, S3, or DynamoDB Streams. An attacker can craft malicious input that exploits the function's event-handling logic, leading to unintended execution paths or data corruption. This differs from traditional injection attacks because the event structure itself can be manipulated to bypass validation.

Answer

Insecure deserialization of function input

Answer

Container escape vulnerabilities

Answer

SQL injection in the database

Question 6

The Docker container `myservice` has the mount configuration shown. What is the most significant security implication of this configuration?

Accepted Answer

The container can read host files at /data/config, but not write.. The mount configuration shown (a bind mount with read-only flag) restricts the container to read-only access to the host's /data/config directory. The container cannot write to or modify files on the host at that path, which is the most significant security implication: it prevents the container from altering host configuration or data, reducing the risk of privilege escalation or data corruption.

Answer

The container can modify files on the host at /data/config.

Answer

The container has full access to the host's filesystem.

Answer

The container can mount additional filesystems using the bind mount.

Question 7

A security analyst is reviewing the results of a vulnerability scan and identifies a critical vulnerability in a legacy application that cannot be patched because it is no longer supported by the vendor. The application is critical for business operations. Which of the following risk treatment strategies should the organization implement?

Accepted Answer

Risk acceptance with compensating controls such as network segmentation and strict access controls.. When a legacy application cannot be patched due to vendor end-of-life, the organization must accept the residual risk while implementing compensating controls. Network segmentation (e.g., VLANs, ACLs) and strict access controls (e.g., least privilege, MFA) reduce the attack surface and contain potential exploitation, aligning with the risk acceptance strategy under the NIST SP 800-37 risk management framework.

Answer

Risk transfer by purchasing cyber insurance to cover potential losses.

Answer

Risk mitigation by applying a vendor-supplied patch.

Answer

Risk avoidance by decommissioning the application and migrating to a new system.

Question 8

A small business wants to protect endpoints from malware without incurring per-device licensing costs. Which approach is MOST cost-effective?

Accepted Answer

Use built-in Windows Defender and periodically scan with free tools. The most cost-effective because Windows Defender (now Microsoft Defender Antivirus) is built into modern Windows operating systems at no additional cost, providing real-time protection against malware. Supplementing it with free on-demand scanners like Microsoft Safety Scanner or Malwarebytes Free provides periodic secondary checks without per-device licensing fees, meeting the small business's requirement for endpoint protection without recurring costs.

Answer

Implement network-based IPS

Answer

Use open-source host firewall

Answer

Purchase enterprise EDR suite

Question 9

In a CI/CD pipeline, a security gate fails because a high-severity vulnerability is found in the base image of a container. The pipeline is configured to block deployment on such findings. What is the appropriate remediation step?

Accepted Answer

Update the base image to a patched version. Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Answer

Override the security gate and proceed with deployment

Answer

Rebuild the image using the same base image

Answer

Add the vulnerability to an exception list

Question 10

During a penetration test, the tester has gained initial access to a web server and wants to perform lateral movement to reach a database server. The tester enumerates the network and finds that the web server has two network interfaces: one connected to a DMZ and one to an internal network. The database server is on the internal network. Which TWO techniques could the tester use to pivot from the web server to the database server? (Choose TWO.)

Accepted Answer

Use SSH tunneling to create a local forward to the database server's port. Pivoting techniques include using the compromised host as a proxy to route traffic and port forwarding to tunnel to internal systems. SSH tunneling and Metasploit's pivot module are common. A reverse shell is for initial access, not pivoting. SQL injection is for initial compromise, not lateral movement.

Answer

Perform a SQL injection attack against the database server

Answer

Deploy a reverse shell from the web server to the tester's machine

Answer

Install a keylogger on the web server to capture database credentials

Question 11

A company's security team is reviewing the integration of a legacy application that only supports NTLM authentication. The infrastructure must be updated to meet modern security standards. Which of the following is the BEST approach to mitigate the risk of using NTLM?

Accepted Answer

Deploy an authentication federation service that translates modern Kerberos/SAML to NTLM for the legacy application.. Deploying an authentication federation service (such as ADFS or a SAML proxy) allows the legacy application to continue using NTLM internally while presenting a modern authentication interface (e.g., Kerberos or SAML) to clients. This mitigates the risk of exposing NTLM to the network and allows integration with modern identity providers without modifying the legacy application. Option A is incorrect because network isolation and IP whitelisting do not address the inherent vulnerabilities of the NTLM protocol itself. Option C is incorrect because upgrading to NTLMv2 still leaves the protocol susceptible to relay attacks and other weaknesses, and vendor patches may not be available or feasible. Option D is incorrect because disabling NTLM would break the application if it does not support Kerberos directly.

Answer

Place the application on an isolated network segment and restrict access with IP whitelisting.

Answer

Apply vendor patches to upgrade NTLM to NTLMv2 and enable extended protection for authentication.

Answer

Disable NTLM and force the application to use Kerberos directly.

Question 12

An OpenVPN configuration file is shown. A security auditor recommends replacing the cipher and auth directives. Which of the following is the BEST replacement pair from a security engineering perspective?

Accepted Answer

cipher AES-256-GCM and auth SHA256. Cipher AES-256-GCM and auth SHA256, is the best replacement pair. AES-256-GCM is an AEAD cipher that provides both confidentiality and integrity, making the auth directive redundant but still compatible with SHA256. AES-256-GCM is considered strong and current. Option B uses AES-128-GCM with SHA384; while still secure, AES-256 is generally preferred for higher security margins. Option C uses 3DES-168 and MD5, both of which are weak and deprecated. Option D uses Blowfish-128 and SHA1, where Blowfish is outdated and SHA1 is considered weak.

Answer

cipher AES-128-GCM and auth SHA384

Answer

cipher 3DES-168 and auth MD5

Answer

cipher Blowfish-128 and auth SHA1

Question 13

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Accepted Answer

Use try-except blocks to handle exceptions gracefully. Using try-except blocks in Python allows the script to catch and handle exceptions (e.g., missing environment variables, API call failures) gracefully without crashing. This is a fundamental secure coding practice that prevents unhandled errors from exposing sensitive information or causing unpredictable behavior in automated compliance checks.

Answer

Use os.system() to run shell commands for resource management

Answer

Hardcode API tokens as fallback if environment variables are missing

Answer

Log the API tokens for troubleshooting purposes

Question 14

Which TWO of the following are examples of compensating controls for a security control deficiency?

Accepted Answer

Increasing logging and monitoring.. Increasing logging and monitoring (A) is a compensating control because it does not prevent the security deficiency itself but instead provides enhanced visibility and detection capabilities to identify and respond to incidents that exploit the deficiency. For example, if a legacy system cannot support multifactor authentication, enabling verbose logging of authentication attempts and real-time alerting via a SIEM (e.g., Splunk or ELK) allows the security team to detect brute-force attacks or unauthorized access attempts, thereby compensating for the missing control. This aligns with the NIST SP 800-53 definition of compensating controls as alternative measures that reduce risk to an acceptable level without directly fixing the underlying flaw.

Answer

Accepting the risk.

Answer

Purchasing cyber insurance.

Answer

Re-architecting the network.

Question 15

A security team is developing a data classification policy. Which TWO of the following elements should be included in the policy to ensure effective data governance?

Accepted Answer

Handling requirements for each classification level, including storage and transmission. A data classification policy must define handling requirements for each classification level, specifying how data should be stored, transmitted, and accessed. This ensures consistent protection controls are applied based on sensitivity, which is a core governance principle. Without these requirements, data may be mishandled, leading to compliance violations or data breaches.

Answer

Data retention and disposal schedules

Answer

Encryption algorithms to be used for data at rest

Answer

Data loss prevention (DLP) rules

Question 16

A security analyst is investigating a potential advanced persistent threat (APT) that has been evading traditional detection. The analyst decides to use User and Entity Behavior Analytics (UEBA) to identify anomalous activity. Which TWO of the following activities would be most indicative of a potential compromise when analyzed through UEBA? (Choose TWO.)

Accepted Answer

A user logging in from a remote location at 3:00 AM, which is outside their normal working hours. UEBA detects deviations from normal behavior. A user logging in at unusual hours and accessing large volumes of data are common anomalies. Running scheduled antivirus scans and normal VPN access are expected behaviors.

Answer

A service account authenticating to a database server every 5 minutes

Answer

A user connecting to the corporate VPN from a hotel during a business trip

Answer

An administrator running a scheduled antivirus scan on a server

Question 17

A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?

Accepted Answer

Authenticate and authorize every device and user for every resource access, and encrypt all communication.. Zero trust is built on the principle of 'never trust, always verify.' This means every device and user must be authenticated and authorized for each resource access, regardless of network location, and all communication should be encrypted to protect data in transit. This eliminates implicit trust based on network perimeter and enforces least-privilege access.

Answer

Place all resources on the internal network and rely on perimeter firewalls.

Answer

Implement VLANs to separate traffic based on user roles.

Answer

Use a VPN to secure all remote access to the corporate network.

Question 18

A security architect is designing a cloud-native application that must comply with GDPR data residency requirements. Which TWO of the following measures should the architect implement? (Choose two.)

Accepted Answer

Store data only in approved geographical locations. GDPR requires that personal data of EU residents be stored within the EEA or in jurisdictions with an adequacy decision, making geographical storage restrictions a direct residency measure. Option C is also correct because data loss prevention (DLP) policies can monitor and block unauthorized data transfers out of approved regions, enforcing compliance with data residency requirements. Option D is incorrect; while encryption is a security measure required under GDPR Article 32, it does not ensure that data stays within approved geographical boundaries.

Answer

Deploy the application in a single region to simplify compliance

Answer

Encrypt data at rest and in transit

Answer

Implement data classification and labeling

Question 19

A security architect is designing a secure wireless network for a government facility. Which TWO of the following measures should be implemented to ensure the highest level of security? (Select TWO.)

Accepted Answer

Disable SSID broadcast on the access points. Disabling SSID broadcast (option C) is correct because it prevents the access point from advertising the network name in beacon frames, making the network less visible to casual scanning tools. While not a strong security control on its own (since the SSID is still discoverable via passive monitoring of probe responses and association frames), it adds a layer of obscurity that can deter low-skill attackers and is often required in government environments as part of a defense-in-depth strategy.

Answer

Use WPA2-PSK with a strong pre-shared key

Answer

Implement a captive portal with social login

Answer

Enable MAC address filtering on the access points

Question 20

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The exhibit shows a high number of failed authentication attempts (e.g., Event ID 4625) from a single source IP against multiple user accounts over a short period. This pattern is characteristic of a brute force password guessing attack, where an attacker systematically tries common passwords against many accounts to gain unauthorized access. The absence of successful logins or account lockouts further supports this conclusion.

Answer

Pass-the-hash attack

Answer

Account lockout attack

Answer

Replay attack