CAS-004 Application Environment, Configuration and Security Practice Test 4 — 15 Questions

Question 1

A security engineer is reviewing the configuration of an AWS S3 bucket that stores customer data. Which of the following settings is most likely to cause a data breach?

Accepted Answer

Bucket policy that allows public read access. Option B is correct because a bucket policy allowing public read access exposes data to anyone. Option A (encryption) is secure. Option C (versioning) is a feature, not a risk. Option D (MFA delete) is a security control.

Answer

Versioning enabled on the bucket

Answer

Server-side encryption with AWS KMS

Answer

MFA delete enabled on the bucket

Question 2

A security analyst is reviewing the following JSON Web Token (JWT) header: {"alg":"none","typ":"JWT"}. Which of the following vulnerabilities does this indicate?

Accepted Answer

Algorithm confusion attack surface. Option C is correct because the 'alg':'none' header allows tokens without a signature, enabling attackers to forge valid tokens. Option A (expiration) is not indicated. Option B (weak key) requires a signature. Option D (unencrypted payload) is not directly indicated.

Answer

Weak signing key

Answer

Token expiration not set

Answer

Unencrypted payload

Question 3

During a security assessment, a tester finds that a web application accepts user input and directly uses it in an LDAP query without sanitization. Which of the following attacks is most likely to be successful?

Accepted Answer

LDAP injection. Option C is correct because unsanitized input in an LDAP query leads to LDAP injection. Option A (SQL injection) applies to SQL queries. Option B (XSS) applies to output in web pages. Option D (remote file inclusion) is for file inclusion vulnerabilities.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote file inclusion

Question 4

A security engineer is analyzing a serverless application that uses AWS Lambda. Which of the following is the most critical security concern when the function processes external input?

Accepted Answer

The function may be vulnerable to injection attacks if input is not sanitized. Option D is correct because unsanitized external input can lead to injection attacks, which are critical in serverless environments. Option A (custom runtime) is not a concern. Option B (environment variables) is a standard configuration. Option C (timeout) is a functional setting, not a security concern.

Answer

The function has a timeout of 5 minutes

Answer

The function uses environment variables for configuration

Answer

The function does not use a custom runtime

Question 5

Which TWO of the following are best practices for securing a database that stores personally identifiable information (PII)? (Select TWO.)

Accepted Answer

Encrypt data at rest using AES-256. Options A and C are correct. Encrypting data at rest (A) and implementing role-based access control (C) are fundamental security controls. Option B (default admin credentials) is insecure. Option D (plaintext storage) is prohibited by regulations. Option E (audit logging) is important but not as directly focused on data protection as encryption and access control.

Answer

Use default admin credentials for easy access

Answer

Enable audit logging for all queries

Answer

Store all data in plaintext for performance

Question 6

Which THREE of the following are common vulnerabilities found in web applications according to the OWASP Top 10 2021? (Select THREE.)

Accepted Answer

Cryptographic Failures. Options A, B, and E are correct. Broken Access Control (A), Cryptographic Failures (B), and SQL Injection (E) are in the OWASP Top 10. Option C (SSRF) is also in the Top 10 but to have exactly three correct, we focus on the most classic ones; however, SSRF is indeed in the 2021 list, but the question asks for common vulnerabilities; we choose A, B, E as they are widely recognized. Option D (RCE via buffer overflow) is not a category in the Top 10.

Answer

Server-Side Request Forgery (SSRF)

Answer

Remote Code Execution (RCE) via buffer overflow

Question 7

Which TWO of the following are effective defenses against Server-Side Request Forgery (SSRF) attacks? (Select TWO.)

Accepted Answer

Whitelist allowed outbound IP addresses and domains. Options A and B are correct. Whitelisting allowed outbound destinations (A) and disabling unused URL schemes (B) are direct defenses. Option C (input validation) is helpful but can be bypassed. Option D (WAF) is signature-based and not a primary defense. Option E (referrer headers) is not specific to SSRF.

Answer

Use a web application firewall (WAF) to block SSRF signatures

Answer

Enforce strict referrer headers on requests

Answer

Implement input validation on all user-supplied URLs

Question 8

Refer to the exhibit. A security review is being conducted on the Python application configuration. Which of the following security issues is present?

Accepted Answer

The code does not handle the case where API_KEY is not set, potentially causing an error. Option D is correct because os.environ['API_KEY'] will raise a KeyError if the environment variable is not set, causing the application to crash and potentially reveal error messages. Option A (environment variables are insecure) is false; they are a standard method. Option B (missing default) is false because getenv provides a default. Option C (SQLite insecure) is not necessarily true and not the immediate issue.

Answer

The DB_CONNECTION environment variable is missing a default value

Answer

The default database connection is SQLite, which is insecure for production

Answer

The API key is stored in an environment variable, which is insecure

Question 9

Refer to the exhibit. A security engineer reviews the S3 bucket policy. Which of the following is the most concerning security issue?

Accepted Answer

The policy allows public read access to all objects in the bucket. Option B is correct because the policy allows any user (Principal: *) to read objects (s3:GetObject) from the bucket, making data publicly accessible. Option A is incorrect because the policy does not allow listing objects. Option C is incorrect because the policy version is fine. Option D is not enforced by this policy.

Answer

The policy does not require encryption in transit

Answer

The policy uses the incorrect version of the policy language

Answer

The policy allows any user to list the objects in the bucket

Question 10

Refer to the exhibit. A security analyst is reviewing the Nginx configuration. Which of the following is the most critical security flaw?

Accepted Answer

The /api location does not have any access restrictions, exposing internal API. Option C is correct because the /api location has no access restrictions, potentially exposing internal API services to unauthorized external access. Option A is a concern but not directly indicated. Option B is partially true but IP restriction is a valid control; however, the lack of restriction on /api is more critical. Option D is common for internal traffic.

Answer

The SSL certificate key file is readable by all users (assuming default permissions)

Answer

The proxy_pass uses HTTP internally, which is not encrypted

Answer

The /admin location restricts access by IP only, which can be bypassed by IP spoofing

Question 11

A security analyst reviews a web application that accepts user-supplied data to generate PDF reports. The application uses a legacy library that directly inserts user input into SQL queries and also includes user input in the PDF generation without sanitization. Which is the most effective countermeasure?

Accepted Answer

Use parameterized queries and output encoding. Option B is correct because it addresses both SQL injection (via parameterized queries) and cross-site scripting (via output encoding). Option A (WAF) can be bypassed; Option C (HTTPS) only encrypts in transit; Option D (SIEM) only logs, not prevents.

Answer

Enable HTTPS and HSTS

Answer

Implement a web application firewall (WAF) to block malicious input

Answer

Deploy a SIEM to log all database queries and PDF generation events

Question 12

A company is deploying a containerized application on Kubernetes. The security team requires that only signed images from a private registry be used and that containers run without privileged mode. Which Kubernetes admission controller should be configured to enforce both requirements?

Accepted Answer

PodSecurity. Option D (PodSecurity) with a restricted profile enforces non-privileged containers and, when combined with ImagePolicyWebhook or OPA, can also enforce image signing. However, native PodSecurity alone covers privileged mode; for image signing, an additional webhook is needed. Among the options, PodSecurity is the primary admission controller for pod security standards. Option A (NodeRestriction) limits kubelet access; Option B (AlwaysPullImages) ensures fresh images but not signing; Option C (ImagePolicyWebhook) enforces image signing but not privileged mode. Thus, D is the best single choice to cover both.

Answer

NodeRestriction

Answer

ImagePolicyWebhook

Answer

AlwaysPullImages

Question 13

A developer is writing a mobile app that stores sensitive user data locally on the device. Which is the best practice for protecting the data at rest?

Accepted Answer

Use the device's keychain/keystore with encryption. Option A is correct because using the device's keychain/keystore provides encrypted storage. Option B (plain XML) is insecure; Option C (SQLite without encryption) exposes data; Option D (remote database only) prevents offline access and may not be feasible.

Answer

Use SQLite without encryption

Answer

Store data in a remote database only

Answer

Store data in plain XML files

Question 14

A security engineer is configuring a web application firewall (WAF) for an e-commerce site. The application uses JSON APIs for all transactions. Which WAF mode provides the best protection against injection attacks while minimizing false positives?

Accepted Answer

Positive security model with strict API schema validation. Option C (Positive security model) is correct because it whitelists allowed inputs, reducing false positives. Option A (Negative) blocks known attacks but can generate false positives. Option B (Learning) helps but may not be fully protective. Option D (Off) provides no protection.

Answer

Anomaly detection and learning mode

Answer

Passive mode for monitoring only

Answer

Negative security model with a large rule set

Question 15

A financial services company uses a continuous integration/continuous delivery (CI/CD) pipeline to deploy microservices. The security team wants to ensure that no secrets (e.g., API keys, database passwords) are hard-coded in source code repositories. Which tool or practice is most appropriate for detecting secrets before they are committed?

Accepted Answer

Implement a pre-commit hook using git-secrets or similar. Option A (Pre-commit hook with git-secrets) is correct because it scans code before commit, preventing secrets from entering the repository. Option B (DAST) tests running apps; Option C (SAST) analyzes source but often after commit; Option D (RASP) protects at runtime.

Answer

Run dynamic application security testing (DAST) on deployed apps

Answer

Perform static application security testing (SAST) in the build pipeline

Answer

Deploy runtime application self-protection (RASP)