CAS-004 Practice Exam 63 — 20 Questions

Question 1

A developer is writing a mobile app that stores sensitive user data locally on the device. Which is the best practice for protecting the data at rest?

Accepted Answer

Use the device's keychain/keystore with encryption. The best practice for protecting sensitive user data at rest on a mobile device is to use the device's keychain/keystore with encryption. The keychain (iOS) or keystore (Android) provides hardware-backed secure storage that encrypts data using platform-specific cryptographic APIs, ensuring that even if the device is compromised, the data remains confidential. This aligns with the principle of defense-in-depth for mobile application security.

Answer

Use SQLite without encryption

Answer

Store data in a remote database only

Answer

Store data in plain XML files

Question 2

Drag and drop the steps to configure a site-to-site IPsec VPN on a firewall into the correct order.

Accepted Answer

Configure IKE policy, then configure IPsec policy, then create VPN tunnel, then define interesting traffic, then apply crypto map to the outgoing interface.. IPsec VPN configuration follows a logical order: first define IKE policy, then IPsec policy, create tunnel, permit traffic, and finally apply crypto map.

Answer

Configure IPsec policy, then configure IKE policy, then create VPN tunnel, then define interesting traffic, then apply crypto map.

Answer

Create VPN tunnel, then define interesting traffic, then configure IKE policy, then configure IPsec policy, then apply crypto map.

Answer

Define interesting traffic, then configure IKE policy, then configure IPsec policy, then create VPN tunnel, then apply crypto map.

Question 3

A security architect is designing a secure remote access solution for employees using personal devices (BYOD). The company requires that corporate data is separated from personal data and can be wiped remotely without affecting personal data. Which solution best meets these requirements?

Accepted Answer

Implement mobile device management (MDM) with containerization. Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the BYOD device that isolates corporate data from personal data. The MDM policy can remotely wipe only the corporate container (selective wipe) without affecting the user's personal apps, photos, or settings, meeting both separation and remote wipe requirements.

Answer

Deploy a virtual desktop infrastructure (VDI) solution

Answer

Provide a full VPN client and remote wipe capability

Answer

Require employees to use company-owned devices only

Question 4

A financial institution manages customer data through a web application built on a LAMP stack. The application uses a third-party library for PDF generation that was patched last year. Recently, the security team discovered that an attacker exploited an unpatched vulnerability in the library to execute arbitrary code on the server. The library vendor has released an update, but the development team is concerned that updating the library will break several custom features that rely on its internal API. The CIO wants to minimize risk while maintaining business continuity. The application is critical to daily operations, and any downtime would result in significant revenue loss. Which course of action should the security analyst recommend?

Accepted Answer

Implement a web application firewall (WAF) with a custom rule to block known attack patterns against the library, and then schedule the patch for the next maintenance window. Deploying a WAF with custom rules provides virtual patching, reducing risk immediately while allowing time for thorough testing of the library update. Option A (immediate patch) could break features without adequate testing. Option B (VPN) does not address the vulnerability. Option D (disable PDF generation) removes functionality, impacting business operations.

Answer

Disable the PDF generation feature entirely until the library can be updated in the next quarterly release

Answer

Deploy a virtual private network (VPN) for all access to the server and restrict input to only trusted IPs

Answer

Immediately apply the vendor's patch and then test all features in a staging environment for a month before production rollout

Question 5

Match each authentication protocol or method to its characteristic.

Accepted Answer

Kerberos: Uses tickets and symmetric key cryptography.. Correct matches: Kerberos uses tickets and symmetric keys for authentication; SAML uses XML assertions for single sign-on; OAuth provides delegated authorization via tokens. Common confusions include mixing cryptographic methods and confusing authorization with authentication.

Answer

Kerberos: Uses certificates and asymmetric keys.

Answer

SAML: Used for OAuth 2.0 token exchange.

Answer

OAuth: Authenticates users with passwords.

Question 6

Which THREE of the following are required components of a Business Continuity Plan (BCP) per ISO 22301?

Accepted Answer

Scope and policy for business continuity. ISO 22301 mandates that a Business Continuity Plan (BCP) must include the scope and policy for business continuity (Option B) to define the boundaries and objectives of the BCP. This ensures alignment with organizational strategy and compliance requirements, as specified in Clause 4.3 (Scope) and Clause 5.2 (Policy) of the standard.

Answer

Detailed technical recovery procedures for IT systems

Answer

Vulnerability scanner configuration

Question 7

Match each security feature to its description.

Accepted Answer

Multi-Factor Authentication (MFA): Requires two or more verification factors to grant access.. These features are covered in identity and access management and data protection domains.

Answer

Multi-Factor Authentication (MFA): Assigns permissions based on a user's role within the organization.

Answer

Role-Based Access Control (RBAC): Requires two or more verification factors to grant access.

Question 8

Match each error code or HTTP status code to its meaning.

Accepted Answer

200: OK - Standard success response. Common HTTP status codes: 200 OK, 403 Forbidden, 404 Not Found, and 500 Internal Server Error. Distractors swap codes with similar meanings or misinterpretations.

Answer

200: Forbidden - Server understands but refuses access

Answer

404: Internal Server Error - Generic server error

Question 9

Refer to the exhibit. A cloud security engineer is reviewing an AWS S3 bucket policy. What security issue does the policy contain?

Accepted Answer

Public read access is allowed. The policy allows any principal ('*') to perform s3:GetObject on the bucket, making the bucket publicly readable. This exposes objects to anyone on the internet. No encryption, logging, or versioning issues are indicated by this JSON snippet.

Answer

No server-side encryption is specified

Answer

No version ID is specified in the resource

Answer

No logging is enabled for the bucket

Question 10

A threat hunter hypothesizes that a sophisticated attacker is using DNS tunneling for command and control. Which data source would most likely confirm this activity?

Accepted Answer

DNS query logs from authoritative/internal DNS servers. DNS logs contain queries and responses; anomalous patterns like large TXT records or high frequency indicate tunneling. Option A is wrong because firewall logs may show traffic but not DNS content. Option C is wrong because antivirus may not detect tunneling. Option D is wrong because web proxy logs show HTTP traffic.

Answer

Network flow data (NetFlow)

Answer

Endpoint antivirus alerts

Answer

Web proxy logs

Question 11

During a penetration test, an engineer discovers that the application uses client-side JavaScript to validate input before submission. What is the MOST significant vulnerability?

Accepted Answer

Server-side validation is missing. Client-side validation can be easily bypassed by disabling JavaScript or sending crafted HTTP requests. Without server-side validation, attackers can submit malicious payloads, leading to injection attacks. XSS and IDOR are separate issues; weak session management is unrelated to input validation.

Answer

Cross-site scripting

Answer

Insecure direct object reference

Answer

Weak session management

Question 12

A security architect is evaluating web application firewall (WAF) features to protect against common attacks. Which TWO of the following attacks can a WAF most effectively prevent?

Accepted Answer

Cross-site scripting (XSS). SQL injection and XSS are application-layer attacks that a WAF can detect and block based on signatures or heuristics. CSRF requires tokens, and session hijacking is often at the network layer.

Answer

Session hijacking

Answer

Distributed denial-of-service (DDoS)

Answer

Cross-site request forgery (CSRF)

Question 13

A security analyst observes anomalous outbound network traffic from a server that normally only performs internal functions. According to the incident response plan, what should the analyst do first?

Accepted Answer

Follow the incident response plan. The first step in incident response is to follow the established plan to ensure proper handling and minimize damage. Option B is wrong because containment should follow identification and reporting. Option C is wrong because shutting down may destroy evidence. Option D is wrong because ignoring is risky.

Answer

Contain the server by disconnecting it from the network

Answer

Immediately shut down the server

Answer

Ignore the traffic as it might be a false positive

Question 14

During a security review, it is discovered that a critical application uses hardcoded cryptographic keys. The development team refactors the code to retrieve keys from a centralized key management system (KMS) using role-based access control. Which additional practice should be implemented to minimize the risk of key compromise?

Accepted Answer

Implement key expiration and automated rotation. Rotation reduces the window of exposure if a key is compromised, and automating it ensures consistency.

Answer

Log every key access without rotation

Answer

Use a single, long key to reduce management overhead

Answer

Store keys in a hardware security module only

Question 15

A security team needs to implement a CI/CD pipeline that automatically scans container images for vulnerabilities before deployment. Which tool can be integrated into the pipeline for this purpose?

Accepted Answer

Trivy. Trivy is a comprehensive open-source vulnerability scanner specifically designed for container images, filesystems, and Git repositories. It can be integrated directly into a CI/CD pipeline to automatically scan container images for known CVEs before deployment, making it the correct choice for this use case.

Answer

SonarQube

Answer

Prometheus

Answer

Grafana

Question 16

An organization wants to implement a zero-trust architecture for remote access. Which component is most critical for enforcing least-privilege access to internal applications?

Accepted Answer

Software-defined perimeter (SDP). A software-defined perimeter (SDP) uses a controller to authenticate users and devices before granting access to specific applications, hiding the network from unauthorized users. VPNs extend network access, IDS only detects, and firewalls enforce network-level rules but not user/device granularity.

Answer

Virtual private network (VPN) concentrator

Answer

Next-generation firewall (NGFW)

Answer

Intrusion detection system (IDS)

Question 17

During a forensic investigation, the examiner discovers that the chain of custody documentation was not properly maintained for a critical hard drive. What is the most likely consequence?

Accepted Answer

The evidence may be ruled inadmissible in legal proceedings. Without chain of custody, evidence could be tampered, making it inadmissible in court. Option B is wrong that investigators are still admissible if procedure is followed, but chain of custody is vital. Option C is wrong that analysis is still valid but legally challenged. Option D is wrong because return to operations is not primary concern.

Answer

The investigation can continue without any impact

Answer

The data on the drive is automatically deleted

Answer

The drive must be returned to the owner immediately

Question 18

The engineer needs to prevent brute-force attacks while allowing legitimate access. Which security control is MOST effective?

Accepted Answer

Implement fail2ban with a threshold of 5 attempts per minute. Fail2ban dynamically blocks IP addresses after a configurable number of failed attempts, stopping brute-force while allowing legitimate users (e.g., 10.0.0.50) to connect. Disabling root login only prevents root access but not attacks on other users. Changing the SSH port is security by obscurity. IP whitelisting for 10.0.0.0/8 would block all other legitimate users and is not flexible.

Answer

Disable root login

Answer

Change SSH port to 2222

Answer

Implement IP whitelist for 10.0.0.0/8

Question 19

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a public-facing e-commerce site. The site has been experiencing intermittent false positives that block legitimate customers during checkout. The WAF is deployed in blocking mode with a rule set that includes SQL injection and cross-site scripting (XSS) signatures. The engineer notices that legitimate credit card numbers containing the string 'OR' are being blocked. The site uses HTTPS and input validation on the server side. Which of the following actions would BEST resolve the false positives while maintaining security?

Accepted Answer

Disable the specific signature that matches the string 'OR' in the SQL injection rule set.. The false positive is caused by a specific SQL injection signature that matches the string 'OR' within legitimate credit card numbers. Disabling only that signature preserves the WAF's protection against actual SQL injection and XSS attacks while eliminating the false positive. The server-side input validation and HTTPS provide additional layers of defense, so removing the entire rule or switching to detection mode would unnecessarily weaken security.

Answer

Remove the WAF and rely on server-side input validation alone.

Answer

Change the WAF from blocking mode to detection mode.

Answer

Add a custom rule to allow all traffic to the checkout page.

Question 20

A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?

Accepted Answer

The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.. A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.

Answer

The container image is from a public registry and should use a private one.

Answer

The container runs as non-root, but root access is required for certain operations.

Answer

The container allows privilege escalation, which should be disabled.