CAS-004 Practice Test 9 — 10 Questions

Question 1

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

Accepted Answer

The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.. Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Answer

The image tag "latest" might pull an outdated image.

Answer

The readOnlyRootFilesystem prevents logging.

Answer

The pod runs as root by default.

Question 2

A defense contractor must demonstrate compliance with NIST SP 800-171 for controlled unclassified information stored in a contractor-owned system. The compliance lead is preparing evidence for an upcoming assessment and wants to avoid the most common cause of failed assessments. Which activity best prevents assessment failure?

Accepted Answer

Maintaining artifacts that show each security requirement is implemented and periodically reviewed, tied to the specific system boundary being assessed.. Assessments of controlled unclassified information environments fail most often because organizations cannot produce current, boundary-specific evidence for implemented requirements. Sustaining reviewed artifacts tied to the assessed system lets assessors verify each objective directly. Plans of action, provider inheritance, and penetration tests each address only part of the picture and cannot substitute for complete implementation evidence.

Answer

Producing a plan of action and milestones that lists every unimplemented requirement with target dates, even if no compensating controls exist.

Answer

Relying on the cloud service provider's FedRAMP authorization to inherit all 110 security requirements for the contractor system.

Answer

Scheduling the assessment immediately after a penetration test so the most recent findings can serve as proof of implementation.

Question 3

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

Accepted Answer

It ensures consistent and repeatable security configurations. Infrastructure as code (IaC) enables security configurations to be defined in declarative or procedural scripts (e.g., Terraform, AWS CloudFormation, Ansible). This ensures that every deployment applies the exact same security settings (e.g., firewall rules, IAM policies, encryption at rest) without drift, making configurations consistent and repeatable across environments. The primary benefit is eliminating manual, error-prone processes that lead to configuration inconsistencies.

Answer

It eliminates the need for security testing

Answer

It allows unapproved changes to be deployed faster

Answer

It increases manual oversight of security settings

Question 4

During a digital forensics investigation of a compromised Linux server, the investigator needs to preserve the evidence in a forensically sound manner. The server is still running. Which of the following should the investigator do first?

Accepted Answer

Capture the contents of RAM using a tool like LiME or fmem. On a live system, volatile data — RAM contents, running processes, network connections, and encryption keys — is lost the moment power is cut or the system is rebooted. Order of volatility (RFC 3227) dictates capturing RAM first using tools like LiME or fmem before touching the disk. This preserves evidence that may never exist on disk, such as in-memory malware or active sessions.

Answer

Pull the power cord to preserve the disk state

Answer

Create a forensic image of the hard drive using dd over a network connection

Answer

Run the 'history' command to see recent user commands

Question 5

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. Option A is correct because an IPsec VPN tunnel between the AWS VPC and the on-premises network creates an encrypted, private path over the internet, satisfying both the requirement to minimize public exposure and to ensure encryption in transit. Option B is correct because AWS Direct Connect provides a dedicated private network connection from on-premises to AWS that bypasses the public internet entirely, and it can be combined with encryption (e.g., MACsec or VPN over Direct Connect) to meet the in-transit encryption requirement. Option C is not correct here because Secrets Manager handles credential storage and rotation, not the secure network path or encryption in transit between the web app and the database. Option D is not correct because VPC peering only connects VPCs within AWS (or between AWS VPCs), not an AWS VPC to an on-premises network. Option E is not correct because TLS encrypts the application-to-database session but does not by itself minimize internet exposure, since the traffic could still traverse the public internet.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.

Question 6

An organization is implementing a privacy by design approach for a new customer-facing application. Which of the following actions best exemplifies this principle?

Accepted Answer

Minimizing data collection to only what is necessary for the application's function. Privacy by design, codified in GDPR Article 25 as 'data protection by design and by default,' requires privacy to be embedded into systems from the outset. Data minimization — collecting only what is strictly necessary for the stated purpose — is a foundational PbD principle because it reduces the attack surface, limits breach impact, and satisfies the 'by default' requirement. It is a design-time decision, not a post-hoc control.

Answer

Adding a privacy notice to the application post-launch

Answer

Conducting a privacy impact assessment after the application is deployed

Answer

Encrypting data at rest and in transit

Question 7

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 8

An organization is implementing a risk management framework and wants to align with a standard that emphasizes a continuous, iterative process for identifying, assessing, and responding to risk. Which framework is most appropriate?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) is explicitly designed as a continuous, iterative process for identifying, assessing, and responding to risk. It consists of six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor, which are repeated throughout the system lifecycle. This aligns perfectly with the requirement for a continuous, iterative approach. ISO 27005 provides guidelines for risk management but is not as prescriptive about the continuous process as NIST RMF. FAIR is a quantitative risk analysis methodology, and COBIT is a governance framework for IT management, not specifically a risk management framework with a continuous iterative process.

Answer

FAIR

Answer

ISO 27005

Answer

COBIT

Question 9

A security architect is designing a public key infrastructure (PKI). Which component is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority. The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Answer

Validation Authority

Answer

Certificate Repository

Answer

Registration Authority

Question 10

A company must protect cryptographic keys used to sign financial transactions. The solution must be FIPS 140-2 Level 3 compliant and provide tamper-resistant hardware. Which technology should be deployed?

Accepted Answer

Hardware security module. A Hardware Security Module (HSM) is a dedicated physical appliance that generates, stores, and protects cryptographic keys inside a tamper-resistant boundary. FIPS 140-2 Level 3 requires physical tamper-resistance, identity-based authentication, and key zeroization on intrusion — capabilities that only validated hardware appliances like HSMs deliver. HSMs are the standard for signing high-value financial transactions because private keys never leave the cryptographic boundary in plaintext.

Answer

Software-based key management system

Answer

Cloud KMS

Answer

TPM