CAS-004 Practice Test 8 — 10 Questions

Question 1

A vulnerability management team is prioritizing patches for a set of critical vulnerabilities. Vulnerability A has a CVSS base score of 9.8, vulnerability B has a CVSS base score of 7.5, and vulnerability C has a CVSS base score of 8.2. However, vulnerability B is actively being exploited in the wild, while the others are not. Which vulnerability should be patched first according to best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability B because it is actively exploited. Vulnerability B should be patched first because it is actively being exploited in the wild. While CVSS base scores indicate severity, active exploitation means the vulnerability poses an immediate and real threat. Best practices prioritize vulnerabilities with known exploits, especially those used in active attacks, over higher-scored but unexploited ones.

Answer

All three should be patched simultaneously

Answer

Vulnerability C because it has a higher base score than B

Answer

Vulnerability A because it has the highest base score

Question 2

Based on the exhibit, which security issue does this IAM policy represent?

Accepted Answer

Overly permissive resource access. The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.

Answer

No versioning configured

Answer

Missing server-side encryption

Answer

Insufficient logging and monitoring

Question 3

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

Accepted Answer

seccomp. seccomp (secure computing mode) is a Linux kernel feature that filters system calls made by a process. In container security, seccomp profiles define which syscalls a containerized process can invoke, directly restricting its ability to interact with the kernel. This is the primary mechanism used by container runtimes like Docker and containerd to enforce syscall-level restrictions.

Answer

AppArmor

Answer

chroot

Answer

SELinux

Question 4

A security architect is evaluating a hardware security module (HSM) for key management. Which of the following is a PRIMARY benefit of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant physical protection of keys. An HSM provides tamper-resistant physical protection for cryptographic keys, ensuring that even if an attacker gains physical access to the device, the keys cannot be extracted or modified. This is a primary benefit over software-based key storage, which stores keys in memory or disk and is vulnerable to OS-level attacks, memory dumps, or file system breaches. The HSM's hardware root of trust and physical security mechanisms (e.g., tamper switches, zeroization) make it the gold standard for key protection in compliance-heavy environments like FIPS 140-2 Level 3 or PCI DSS.

Answer

Easier key rotation

Answer

Integration with cloud APIs

Answer

Lower cost

Question 5

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

Accepted Answer

Validating and sanitizing all input from logs. Log files can contain maliciously crafted entries designed to exploit parsing logic. Without input validation and sanitization, an attacker could inject commands or manipulate the script into blocking legitimate IPs or executing unintended actions, leading to a denial-of-service or compromise of the automation system itself.

Answer

Using the most efficient parsing algorithm

Answer

Ensuring the script runs with root privileges

Answer

Writing detailed audit logs of script actions

Question 6

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Option A is correct because dynamic application security testing (DAST) and penetration testing exercise the running application before release, detecting runtime vulnerabilities such as injection, authentication flaws, and misconfigurations that static analysis cannot see. Option C is correct because static application security testing (SAST) analyzes source code or binaries during development, catching insecure coding patterns like buffer overflows and hardcoded secrets early when remediation is cheapest. Option E is correct because threat modeling during the design phase systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE), allowing architectural security controls to be built in before code exists. Option B does not belong because user acceptance testing validates functional business requirements, not security engineering controls. Option D does not belong because daily stand-ups are an Agile project-management ceremony with no direct security engineering function.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 7

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Accepted Answer

Use ECDSA P-384 for authentication. Option A (ECDSA P-384) is correct because elliptic-curve signatures at the 384-bit level provide roughly 192-bit security strength, far exceeding RSA-2048, and are well supported in IKEv2 for strong peer authentication. Option C (AES-256-GCM) is correct because AES-256 gives a 256-bit key and GCM is an AEAD mode that provides both confidentiality and integrity in a single efficient primitive, making it the strongest symmetric choice here. Option E (perfect forward secrecy via DHE) is correct because Diffie-Hellman ephemeral key exchange ensures that compromise of the long-term key cannot decrypt previously captured sessions, which is essential for 'strongest possible security' in an IKEv2 deployment. Option B (SHA-1) is not appropriate because SHA-1 is cryptographically broken for integrity and should be replaced by SHA-256 or stronger. Option D (IKEv1) is not appropriate because IKEv2 is more secure, more robust, and supports modern features like MOBIKE and stronger authentication methods.

Answer

Use SHA-1 for integrity

Answer

Use IKEv1 instead of IKEv2

Question 8

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. The development team is slow to fix the SQL injection vulnerability in code, so an immediate control is needed. Adding a WAF rule (option C) can block common SQL injection payloads at the perimeter without code changes, minimizing performance impact and maintaining defense in depth. Option A (disable search) is too disruptive. Option B (isolate database server) is a good defense-in-depth measure but does not address the vulnerability at the application layer. Option D (increase IDS sensitivity) only detects, not prevents. Therefore, C is the most effective immediate control.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 9

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Accepted Answer

Eliminates configuration drift and unauthorized changes. Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Answer

Reduces operational costs by reusing existing servers

Answer

Increases system performance through hardware acceleration

Answer

Simplifies monitoring by reducing the number of servers

Question 10

A financial institution is required to comply with SOX. Which of the following is a primary focus of this regulation?

Accepted Answer

Accuracy of financial reporting and internal controls. SOX (Sarbanes-Oxley Act) primarily focuses on the accuracy of financial reporting and the effectiveness of internal controls for publicly traded companies. It mandates that management assess and report on internal controls over financial reporting, and requires external auditors to attest to those assessments. This ensures transparency and accountability in financial disclosures.

Answer

Privacy of personal data for EU citizens

Answer

Security of health information

Answer

Protection of cardholder data