CAS-004 Practice Test 8 — 10 Questions

Question 1

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lack of peer review and cryptanalysis. The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 2

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Accepted Answer

Run the container with a non-root user and drop all capabilities. Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 3

A security team is implementing deception technology to detect attackers inside the network. They plan to deploy fake systems that appear vulnerable and attract attackers. Which of the following is an example of a honeytoken?

Accepted Answer

A fake database credential file that triggers an alert when opened. A honeytoken is a decoy object such as a fake credential, file, or database record that is used to detect unauthorized access. A fake database credential file that triggers an alert when accessed is a typical honeytoken.

Answer

A network segment with multiple decoy systems

Answer

A fake DNS entry for a non-existent domain

Answer

A virtual machine running a vulnerable web server

Question 4

A security engineer is designing a secure hybrid cloud connection between an on-premises data center and AWS. Which service provides a dedicated, private network connection that bypasses the public internet?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private connection from on-premises to AWS.

Answer

Site-to-Site VPN

Answer

Transit Gateway

Answer

VPC Peering

Question 5

A security architect is designing a cryptographic system for a government agency that must protect classified data for the next 30 years. The agency is concerned about the threat from quantum computers. Which NIST post-quantum cryptography algorithm is recommended for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for general encryption. CRYSTALS-Dilithium is a digital signature algorithm. RSA and ECDH are vulnerable to quantum attacks.

Answer

ECDH with NIST P-384

Answer

CRYSTALS-Dilithium

Answer

RSA-4096

Question 6

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 7

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. An SBOM lists open-source components and their versions, enabling vulnerability tracking. Dependency analysis helps identify known vulnerabilities in those components.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 8

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

Accepted Answer

AWS Config. AWS Config continuously monitors and evaluates AWS resource configurations against desired policies, helping meet compliance requirements like SOC 2.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Shield

Question 9

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Accepted Answer

Runtime protection. CWPP should provide vulnerability management across different environments and runtime protection (e.g., intrusion detection) for workloads regardless of location.

Answer

Security information and event management

Answer

Identity and access management

Answer

Data loss prevention

Question 10

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. Software Bill of Materials (SBOM) is a list of all components in the application, including open-source libraries. Dependency analysis tools use SBOMs to identify known vulnerabilities. SAST analyzes source code, not libraries. DAST tests running applications. RASP provides runtime protection.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)