CAS-004 Practice Test 8 — 10 Questions

Question 1

A security analyst reviews this output from an SSH session. What security control is in place on the remote server?

Accepted Answer

MaxAuthTries limit in SSH configuration. The output shows repeated 'Permission denied' messages followed by 'Connection closed by remote host' after a specific number of attempts. This behavior is characteristic of the MaxAuthTries directive in the SSH server configuration (sshd_config), which limits the number of authentication attempts per connection. When the limit is reached, the SSH server immediately closes the connection, as seen in the output.

Answer

Account lockout policy

Answer

Fail2ban or similar IP blocking

Answer

SSH banner

Question 2

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?

Accepted Answer

Implement data mapping to track personal data across systems and jurisdictions.. Options A and D are correct. GDPR and CCPA both require data mapping (A) to understand data flows, and data classification (D) to apply appropriate controls. Option B (retention schedule) is important but not the most critical for both regulations; retention is more GDPR-specific. Option C (DLP) is a technical control that supports compliance but is not a governance control. Option E (SIEM) is a security monitoring tool, not a governance control.

Answer

Deploy data loss prevention (DLP) technology to monitor data exfiltration.

Answer

Define a data retention schedule that automatically deletes data after a set period.

Answer

Integrate a security information and event management (SIEM) system for log analysis.

Question 3

During a third-party risk assessment, an organization discovers that a cloud service provider (CSP) stores data in a jurisdiction with conflicting privacy laws. The organization's legal team advises that this could expose the organization to regulatory penalties. Which of the following contractual clauses would best address this compliance risk?

Accepted Answer

Include a Data Processing Agreement (DPA) that requires data to be stored only in approved jurisdictions.. A Data Processing Agreement (DPA) is the correct contractual mechanism to enforce data residency restrictions. By requiring the CSP to store data only in approved jurisdictions, the DPA directly addresses the compliance risk of conflicting privacy laws and potential regulatory penalties, as it legally binds the provider to specific geographic data handling requirements.

Answer

Insert a right-to-audit clause allowing the organization to inspect the CSP's facilities.

Answer

Negotiate a service-level agreement (SLA) guaranteeing 99.99% uptime.

Answer

Require the CSP to sign a business associate agreement (BAA) under HIPAA.

Question 4

A large enterprise is designing a disaster recovery site that must support rapid failover with minimal data loss. The primary data center is 50 miles away. The RPO is 1 minute, and RTO is 15 minutes. Which replication strategy best meets these requirements?

Accepted Answer

Synchronous replication over dedicated low-latency fiber links.. Synchronous replication writes data to both the primary and secondary sites simultaneously before acknowledging the write to the application, ensuring zero data loss at the storage layer. With dedicated low-latency fiber links over 50 miles, the round-trip time can be kept under 1 ms, meeting the 1-minute RPO and enabling rapid failover within the 15-minute RTO. This strategy guarantees transactional consistency and immediate availability at the DR site.

Answer

Log shipping with a 5-minute delay.

Answer

Scheduled snapshot-based replication every 30 minutes.

Answer

Asynchronous replication with continuous data protection.

Question 5

Which TWO of the following are essential characteristics of a hardware security module (HSM)? (Select TWO.)

Accepted Answer

Hardware acceleration of cryptographic operations.. Option A is correct because HSMs are dedicated hardware appliances that offload cryptographic operations from the main CPU, providing hardware acceleration for algorithms such as AES, RSA, and ECC. This acceleration is critical for high-throughput environments like TLS termination or code signing, where software-based cryptography would create a performance bottleneck.

Answer

Virtualization of the hardware root of trust.

Answer

Integration with public key infrastructure (PKI) to replace certificate authorities.

Answer

User authentication and authorization.

Question 6

A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.. A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.

Answer

Deploy IPsec tunnels between each pair of services using pre-shared keys.

Answer

Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.

Answer

Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.

Question 7

A network administrator is troubleshooting connectivity to a server at 192.168.1.100. The ACL shown is applied inbound on GigabitEthernet0/0. Which THREE statements are true regarding this ACL configuration? (Choose three.)

Accepted Answer

Traffic sourced from 192.168.1.100 going to the 10.0.0.0/24 network will be permitted. Option B is correct because the ACL, when applied inbound on GigabitEthernet0/0, evaluates traffic entering the interface. The permit statement allows traffic sourced from host 192.168.1.100 destined to the 10.0.0.0/24 network, so that specific traffic is explicitly permitted.

Answer

The ACL will block all traffic from the 192.168.1.0/24 network to 10.0.0.0/24

Answer

The implicit deny at the end of the ACL will block all other traffic not explicitly permitted

Question 8

A security architect is designing a segmentation strategy for a multi-tier web application. The public-facing web servers must communicate only with application servers, and application servers must communicate only with database servers. The architect wants to use a firewall that can inspect application-layer traffic to prevent SQL injection attacks. Which firewall type should be deployed between the application tier and the database tier?

Accepted Answer

Next-generation firewall (NGFW) with intrusion prevention. A next-generation firewall (NGFW) with intrusion prevention is the correct choice because it can perform deep packet inspection (DPI) at the application layer, allowing it to detect and block SQL injection payloads within database queries. Unlike simpler firewalls, an NGFW integrates signature-based and behavioral IPS engines that can identify malicious SQL patterns (e.g., 'OR 1=1') in traffic between the application and database tiers, providing the required application-layer inspection.

Answer

Packet filtering firewall

Answer

Stateful firewall

Answer

Web application firewall (WAF)

Question 9

A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?

Accepted Answer

Use parameterized queries or prepared statements for all database interactions.. Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.

Answer

Use stored procedures exclusively for database access.

Answer

Deploy a web application firewall (WAF) with SQL injection rules.

Answer

Implement client-side input validation and sanitize all user input.

Question 10

An administrator runs the above iptables command on a Linux server. The server is directly connected to the internet. Which of the following is the MOST significant security issue with this configuration?

Accepted Answer

The OUTPUT chain default policy is ACCEPT, allowing any outbound traffic. The most significant security issue is that the OUTPUT chain default policy is ACCEPT, allowing any outbound traffic from the server. Since the server is directly connected to the internet, this means that if the server is compromised, an attacker can freely exfiltrate data, initiate outbound connections to command-and-control servers, or perform other malicious activities without any firewall restriction. A default DROP policy on the OUTPUT chain would require explicit rules for allowed outbound traffic, providing defense in depth.

Answer

The INPUT chain default policy is DROP, which will block legitimate traffic

Answer

SSH (port 22) is allowed from any source, which is overly permissive

Answer

ICMP echo requests are allowed, which could be used for network reconnaissance

CAS-004 Practice Test 8 — 10 Questions

Exhibit

CAS-004 Practice Test 8 — 10 Questions

Exhibit