CAS-004 Practice Exam 63 — 20 Questions

Question 1

A multinational financial services firm is subject to GDPR and must transfer personal data from its EU offices to a data analytics vendor in the United States. The vendor is not certified under the EU-U.S. Data Privacy Framework. Which mechanism should the firm use to lawfully transfer the data while meeting GDPR Chapter V requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standard Contractual Clauses (SCCs) with a transfer impact assessment. Because the U.S. vendor lacks Data Privacy Framework certification, the firm must rely on an Article 46 safeguard. Standard Contractual Clauses are the European Commission's pre-approved contractual terms for such transfers, and after Schrems II they must be supplemented by a transfer impact assessment evaluating the destination's surveillance laws. This combination lawfully supports routine transfers to the analytics provider.

Answer

Obtaining explicit consent from every data subject for each transfer

Answer

Relying on the vendor's ISO/IEC 27001 certification as an adequacy mechanism

Answer

Binding Corporate Rules (BCRs) approved by the lead supervisory authority

Question 2

A security engineer is configuring a Linux server that hosts a web application. The engineer needs to ensure that the application runs with the least privilege necessary and that any compromise of the application is confined to a limited set of system resources. Which of the following should the engineer implement?

Accepted Answer

SELinux in enforcing mode with a targeted policy for the web server. SELinux in enforcing mode enforces a mandatory access control policy that restricts the web server to only the resources it needs, such as specific files and network ports. This provides strong confinement and least privilege. The other options either do not enforce restrictions, provide only partial isolation, or rely on traditional permissions that are insufficient for limiting a compromised process.

Answer

Running the web server as a non-root user without additional controls

Answer

chroot jail for the web server process

Answer

AppArmor with a complain-mode profile for the web server

Question 3

A security administrator is configuring a RADIUS server for a wireless network. The administrator wants to ensure that the shared secret between the access point and the RADIUS server is protected against eavesdropping. Which protocol should be used to encapsulate RADIUS traffic?

Accepted Answer

RADIUS over TLS (RadSec). RadSec (RADIUS over TLS) is the standard protocol for securely encapsulating RADIUS traffic. It uses TLS to encrypt the entire RADIUS conversation, including the shared secret, protecting against eavesdropping. Other options either do not encrypt the RADIUS packet fully or are authentication methods that do not address the shared secret protection.

Answer

RADIUS with MS-CHAPv2

Answer

RADIUS over UDP with IPsec transport mode

Answer

RADIUS with EAP-TTLS

Question 4

A security architect is designing a data loss prevention (DLP) program for a company that uses Microsoft 365 and a SaaS CRM. The architect must reduce false positives while still detecting sensitive data leaving the environment. Which TWO capabilities should be prioritized? (Choose two.)

Accepted Answer

Trainable classifiers that learn from labeled examples of the organization's confidential documents. High-fidelity DLP combines exact data matching, which fingerprints the organization's own sensitive records, with trainable classifiers that recognize document categories from labeled examples. Together they detect both known data and semantically sensitive content while avoiding the noise of generic regex or keyword rules. Size limits and broad patterns do not target sensitive content and increase false positives.

Answer

Blocking all outbound email attachments larger than 10 MB

Answer

Keyword lists built from common industry terms such as 'confidential' and 'internal use'

Answer

Regular expressions that match any nine-digit number as a potential account identifier

Question 5

A security architect is designing a system that requires secure key exchange over an untrusted network. The system must provide perfect forward secrecy (PFS) and must be resistant to quantum computer attacks. Which key exchange algorithm BEST meets these requirements?

Accepted Answer

Post-quantum key exchange using lattice-based cryptography (e.g., Kyber). The requirements are perfect forward secrecy and resistance to quantum attacks. Traditional key exchanges like RSA, DHE, and ECDHE provide PFS but are vulnerable to quantum computers. Lattice-based post-quantum algorithms such as Kyber are designed to withstand quantum attacks and can be used in ephemeral modes to achieve PFS, making them the only suitable option.

Answer

RSA key exchange with 4096-bit keys

Answer

Diffie-Hellman Ephemeral (DHE) with 2048-bit parameters

Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) with Curve25519

Question 6

A multinational financial services firm is subject to GDPR and must transfer personal data from its EU offices to a data analytics vendor in the United States. The vendor is not certified under the EU-U.S. Data Privacy Framework. Which mechanism should the firm use to lawfully transfer the data while meeting GDPR Chapter V requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) for the portal's processing activities.. GDPR emphasizes a risk-based approach, requiring organizations to assess privacy risks before processing personal data. A Data Protection Impact Assessment (DPIA) is specifically mandated for high-risk processing and helps identify and mitigate risks, ensuring compliance by design. Other controls like encryption or WAFs are supportive but not the initial compliance step.

Answer

Implement encryption for all data at rest and in transit.

Answer

Deploy a web application firewall (WAF) to block SQL injection attacks.

Answer

Appoint a Data Protection Officer (DPO) to oversee the portal.

Question 7

A security architect at a healthcare provider must design a solution that lets clinicians access patient records from managed laptops and personal tablets without exposing the internal electronic health record (EHR) network. The requirement is that no inbound firewall ports be opened and that access decisions evaluate device posture and user identity on every session. Which solution best meets these requirements?

Accepted Answer

Implement a Zero Trust Network Access (ZTNA) service that brokers outbound-only connections after continuous identity and device-posture checks.. Zero Trust Network Access matches the stated constraints because it inverts the traditional model: users connect outbound to a broker, the internal EHR network is never published, and authorization is continuously re-evaluated based on identity and device posture. VPN concentrators, reverse proxies, and network access control all require either inbound exposure or do not deliver per-session verification.

Answer

Publish the EHR through a reverse proxy in the DMZ and require digital certificates on all client devices.

Answer

Segment the clinical VLAN and apply 802.1X port-based authentication to all wired and wireless access switches.

Answer

Deploy a hardware VPN concentrator in the DMZ and issue IPsec client profiles to all clinical endpoints.

Question 8

A security analyst is investigating a suspected data exfiltration incident. The analyst has captured full packet data from the network tap and wants to identify the exfiltration channel. Which TWO of the following techniques would be most effective for analyzing the captured traffic to detect covert exfiltration? (Choose two.)

Accepted Answer

Analyze DNS query lengths and entropy for signs of DNS tunneling. Analyzing DNS query lengths and entropy can reveal DNS tunneling, a common exfiltration method. Reassembling TCP sessions to examine payload sizes and timing helps detect beaconing and automated data transfers. Both techniques directly analyze the captured traffic for anomalies indicative of covert exfiltration, making them the most effective choices.

Answer

Inspect HTTP User-Agent strings for outdated browser versions

Answer

Review SMTP traffic for email attachments with double extensions

Answer

Check for ARP spoofing by comparing MAC addresses to a baseline

Question 9

A security architect is designing a zero trust architecture for a hybrid workforce that accesses internal applications from managed and unmanaged devices. The architect wants to enforce continuous verification of device and user trust for every session. Which TWO controls are essential to meet this goal? (Choose two.)

Accepted Answer

Enforce identity-aware access proxies that mediate every session and apply the policy decision to each request.. Continuous verification in zero trust depends on two functions working together: a policy decision point that evaluates identity, device posture, and context on every request, and identity-aware enforcement points that mediate sessions and apply those decisions inline. Together they replace implicit network trust with per-request authorization; perimeter rules, long-lived VPN sessions, and VLAN segmentation do not evaluate trust dynamically.

Answer

Require all traffic to traverse a traditional perimeter firewall with static rules based on internal IP subnets.

Answer

Issue long-lived VPN credentials so users authenticate once and retain access for the duration of the workday.

Answer

Segment the internal network into VLANs and rely on switch ACLs to isolate application tiers.

Question 10

A security engineer is implementing a secure boot process for a Linux server. The requirement is to ensure that only signed and trusted kernel modules can be loaded, preventing rootkits from persisting. Which mechanism should the engineer enable?

Accepted Answer

Kernel module signing enforcement (module.sig_enforce=1).. Kernel module signing enforcement is the specific mechanism that requires all kernel modules to be signed with a trusted key before they can be loaded. When enabled via the module.sig_enforce=1 kernel parameter, the kernel rejects any module without a valid signature. This prevents rootkits that use kernel modules from persisting, as they cannot be loaded. UEFI Secure Boot, SELinux, and IMA provide related but distinct protections that do not directly enforce module signing at load time.

Answer

Integrity Measurement Architecture (IMA) with appraisal.

Answer

UEFI Secure Boot with a custom key enrollment.

Answer

Linux Security Modules (LSM) with SELinux in enforcing mode.

Question 11

A security administrator is configuring a new wireless network for a corporate office. The network must support the latest security standard that provides robust encryption and protection against offline dictionary attacks. Which of the following should the administrator implement?

Accepted Answer

WPA3-Personal with SAE. WPA3-Personal with SAE is the correct choice because it introduces a secure handshake that prevents offline dictionary attacks and provides forward secrecy. WPA2-Personal is vulnerable to offline attacks, WPA2-Enterprise with PEAP-MSCHAPv2 lacks the latest protections, and WEP is obsolete and insecure.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2

Answer

WEP with 128-bit key

Answer

WPA2-Personal with AES-CCMP

Question 12

A security architect is designing a new system that will process personal data of European Union citizens. The architect must ensure that data protection principles are embedded into the design. Which of the following best exemplifies the principle of data minimization under the General Data Protection Regulation (GDPR)?

Accepted Answer

Collecting only the personal data that is necessary for the specified purpose. Data minimization under GDPR means collecting and processing only the personal data that is necessary for the intended purpose. This principle is about limiting the scope of data collection, not about security measures, legal bases, or retention periods. The other options represent different GDPR principles or requirements.

Answer

Encrypting all personal data at rest and in transit

Answer

Obtaining explicit consent before processing personal data

Answer

Implementing a retention schedule to delete data after a set period

Question 13

A security analyst is investigating a security incident and needs to collect volatile evidence from a compromised Windows system. The analyst must preserve the evidence in a forensically sound manner. Which TWO of the following actions should the analyst take to ensure the integrity of the volatile data? (Choose two.)

Accepted Answer

Document the system time and date. To preserve volatile evidence, the analyst must capture memory contents and document the system time. Memory dumps capture running processes and network connections, which are lost on shutdown. Documenting system time ensures accurate timeline correlation. Actions like antivirus scans, shutdown, and defragmentation modify the system and destroy evidence, so they should be avoided. Thus, the correct actions are memory capture and time documentation.

Answer

Defragment the hard drive

Answer

Run a full antivirus scan

Answer

Shut down the system to preserve the state

Question 14

A security administrator is configuring a wireless network for a small office. The requirement is to use the strongest available encryption and authentication method that is supported by modern devices and does not require a separate authentication server. Which of the following should the administrator choose?

Accepted Answer

WPA3-Personal with SAE. WPA3-Personal with SAE is the most secure method for a pre-shared key network. It provides forward secrecy and resists offline dictionary attacks, which are weaknesses in WPA2-Personal. It does not require a RADIUS server, satisfying the constraint. WPA2-Enterprise requires a server, WEP is obsolete, and WPA2-Personal is weaker than WPA3-Personal. Therefore, WPA3-Personal is the correct choice.

Answer

WPA2-Enterprise with PEAP-MSCHAPv2

Answer

WEP with 128-bit key

Answer

WPA2-Personal with AES-CCMP

Question 15

A security analyst is monitoring network traffic and observes a high volume of DNS queries for randomly generated domain names that return NXDOMAIN responses. The queries originate from a single workstation and occur at regular intervals. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

A domain generation algorithm (DGA) used by malware for command and control. The scenario describes a workstation making repeated DNS queries for random domain names that do not resolve. This behavior is a hallmark of a domain generation algorithm (DGA) used by malware to locate its command-and-control server. DGAs generate many domain names, and the malware attempts to resolve them until one succeeds. The regular intervals and NXDOMAIN responses are typical of this technique.

Answer

DNS tunneling for data exfiltration

Answer

A network scan using DNS enumeration techniques

Answer

A misconfigured DNS server causing excessive recursive lookups

Question 16

A CISO is presenting a risk register to the board. The register shows a ransomware risk with a single loss expectancy of $2,000,000 and an annualized rate of occurrence of 0.25. The board asks for the expected annual financial exposure. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$500,000. Quantitative risk analysis uses ALE = SLE × ARO. With a single loss expectancy of $2,000,000 and an annualized rate of occurrence of 0.25, the expected annual loss is $500,000. This metric lets the board compare the cost of controls against the financial exposure and decide whether to mitigate, transfer, or accept the ransomware risk.

Answer

$8,000,000

Answer

$2,000,000

Answer

$250,000

Question 17

A security operations team is implementing a new SIEM and wants to ensure that log sources are properly synchronized. The team notices that some events appear out of order in the SIEM interface. Which of the following is the most likely cause and the best solution?

Accepted Answer

The log sources are not synchronized with a common time source. Implement NTP on all log sources and the SIEM.. The most likely cause of out-of-order events is clock skew due to unsynchronized clocks on log sources. Even small differences in system time can cause events to be sorted incorrectly. Implementing NTP on all log sources and the SIEM ensures a consistent time reference. This is a fundamental requirement for accurate log correlation and timeline analysis. Other factors like time zone or parsing issues can also cause problems, but clock skew is the primary culprit for subtle ordering issues.

Answer

The network latency between log sources and the SIEM is causing delays. Deploy log collectors closer to the sources.

Answer

The SIEM is not parsing timestamps correctly. Update the SIEM's log parsers to recognize the timestamp format.

Answer

The SIEM is using a different time zone than the log sources. Configure all log sources to use UTC.

Question 18

A security architect is designing a system that must ensure the confidentiality and integrity of data at rest on a database server. The organization wants to minimize the impact on application performance and avoid modifying the application code. Which of the following should the architect implement?

Accepted Answer

Transparent data encryption (TDE) at the database level. Transparent data encryption encrypts database files at rest without requiring application changes, providing confidentiality and integrity with minimal performance impact. It is specifically designed for the scenario's constraints, unlike application-level encryption or transit encryption.

Answer

Application-level encryption of each field before storage

Answer

Full disk encryption (FDE) on the database server's storage volumes

Answer

Network encryption using TLS for all database connections

Question 19

A software company is designing an internal developer platform where engineers need short-lived credentials to access production databases. The security architect wants to eliminate long-lived static database passwords, bind access to the identity of the calling workload, and automatically revoke credentials when a deployment is removed. Which of the following should the architect implement?

Accepted Answer

Issue dynamic, lease-based database credentials through a secrets engine tied to workload identity. Dynamic secrets with workload identity binding issue credentials only after the platform verifies the caller, and the credentials expire automatically with their lease. This removes static passwords from the environment and ensures that deleting a deployment terminates its database access without manual intervention. Secrets storage, mutual TLS, and auditing each address part of the problem but do not deliver identity-bound, automatically revoked credentials.

Answer

Configure database native auditing and alert on anomalous query patterns

Answer

Enable TLS client certificate authentication for all database connections

Answer

Store database passwords in a centralized secrets manager and inject them at runtime

Question 20

A security engineer is implementing an integrity-monitoring solution for a fleet of Linux servers that must detect unauthorized changes to critical binaries and configuration files. The solution must provide a cryptographic baseline, resist tampering by an attacker with root privileges, and support automated verification. Which approach BEST meets these requirements?

Accepted Answer

Deploy a file integrity monitoring agent that stores SHA-256 baselines in a remote, append-only repository and alerts on deviations. The strongest approach combines a cryptographic baseline using SHA-256, remote append-only storage of that baseline to resist tampering by a local root attacker, and automated deviation alerting. MD5 is collision-prone, auditd logs lack baseline comparison and automation, and SELinux is preventive rather than detective. Only the agent with remote append-only baseline storage meets all three requirements.

Answer

Schedule a nightly script that computes MD5 hashes of files under /etc and /usr/bin and emails the output to the security team

Answer

Enable the Linux auditd subsystem to log all file writes and review the audit log manually each week

Answer

Configure SELinux in enforcing mode with a strict policy that prevents writes to system directories