CAS-004 Practice Test 9 — 10 Questions

Question 1

An organization wants to implement a hardware security module (HSM) to protect cryptographic keys. Which of the following is a primary benefit of using an HSM?

Accepted Answer

Tamper-resistant key storage. An HSM provides tamper-resistant key storage by using physical and logical safeguards, such as tamper switches, epoxy potting, and zeroization circuits, that destroy cryptographic keys if an attacker attempts to access the hardware. This ensures that private keys remain secure even if the device is compromised, which is a primary requirement for compliance with standards like FIPS 140-2 Level 3 or 4. Software-based storage cannot offer the same level of physical protection against extraction attacks.

Answer

Faster key generation than software

Answer

Reduced network latency for encryption

Answer

Automatic cloud backup of keys

Question 2

A security engineer is reviewing an S3 bucket policy for a bucket named 'corporate-data'. The policy is shown. Which of the following describes a vulnerability in this configuration?

Accepted Answer

The Allow statement's IP address condition uses a private IP range, which is ineffective for internet-facing buckets. Option C is correct because the Allow statement in the S3 bucket policy restricts access to a private IP address range (e.g., 10.0.0.0/8 or 192.168.0.0/16), which is non-routable on the public internet. Since the bucket is internet-facing, this condition is ineffective—any request from a public IP will fail the condition, effectively denying all external access, but the real vulnerability is that the policy relies on a private IP range that cannot be enforced for internet traffic, leaving the bucket either inaccessible or misconfigured. This misconfiguration can lead to unintended access if the condition is bypassed or if the bucket is intended to be public.

Answer

The Deny statement allows anonymous uploads over HTTP

Answer

The Deny statement allows any anonymous user to upload objects to the bucket

Answer

The Allow statement permits access over insecure HTTP

Question 3

A network administrator is configuring a firewall to block traffic from a specific IP address range. The firewall uses ACLs. Which ACL entry would deny traffic from 192.168.1.0/24?

Accepted Answer

deny ip 192.168.1.0 0.0.0.255 any. Option A is correct because in Cisco ACL syntax, the wildcard mask 0.0.0.255 matches all addresses in the 192.168.1.0/24 network. The 'deny ip 192.168.1.0 0.0.0.255 any' entry blocks any IP traffic from the source subnet 192.168.1.0 through 192.168.1.255 to any destination.

Answer

deny ip 192.168.1.0 0.0.0.0 any

Answer

deny ip 192.168.1.0 0.0.0.127 any

Answer

deny ip 192.168.1.0 255.255.255.0 any

Question 4

A security analyst reviews logs from a web application firewall (WAF) and notices that an attacker is bypassing the WAF by encoding malicious payloads using base64 and then sending them in HTTP headers. Which WAF configuration change would BEST detect and block such attacks?

Accepted Answer

Add custom signatures to detect base64-encoded patterns in headers. Option C is correct because base64-encoded payloads in HTTP headers are a known evasion technique that bypasses signature-based WAF rules designed for plaintext attacks. By adding custom signatures that specifically match base64-encoded patterns (e.g., detecting long strings of base64 characters or known malicious base64 strings), the WAF can decode and inspect the payload before applying detection logic. This directly addresses the attacker's encoding method without relying on generic protocol or rate controls.

Answer

Enable geoblocking to restrict traffic from the attacker's country

Answer

Implement strict HTTP protocol validation to reject malformed requests

Answer

Increase the rate limiting threshold to allow more requests per second

Question 5

An organization wants to implement a solution that automatically detects and blocks malicious traffic based on known signatures and behavioral anomalies. Which of the following should be deployed?

Accepted Answer

Network-based IDS/IPS. A network-based IDS/IPS (Intrusion Detection/Prevention System) is designed to inspect network traffic in real time, using a combination of signature-based detection (matching known attack patterns) and behavioral/anomaly-based detection (identifying deviations from normal traffic baselines). This dual approach allows it to both detect and automatically block malicious traffic, fulfilling the organization's requirement directly.

Answer

Next-generation firewall with application control

Answer

Web application firewall (WAF)

Answer

Security information and event management (SIEM) system

Question 6

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

Accepted Answer

Implement a rate-limiting rule on the network firewall for the source IP.. Option D is correct because rate-limiting the source IP at the network firewall immediately throttles the number of authentication attempts from that address, mitigating the brute-force attack without disrupting legitimate user access. This is the best immediate action as it directly blocks the attack vector at the network layer, preventing further failed logins while preserving user productivity.

Answer

Disable the affected user accounts until the source IP is blocked.

Answer

Reset the passwords for all affected accounts.

Answer

Enable multi-factor authentication for all accounts.

Question 7

Match each error code or HTTP status code to its meaning.

Question 8

Match each cloud service model to its scope.

Question 9

Match each acronym to its definition.

Question 10

Match each security tier or model to its description.