CAS-004 Security Engineering — 100 Questions

Question 1

A security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn uses public key cryptography and is designed to resist phishing; it supports passwordless authentication. TOTP/HOTP are time-based and can be phished. X.509 certificates are not inherently passwordless. Kerberos requires passwords or tickets.

Answer

Kerberos with PKINIT

Answer

TOTP/HOTP

Answer

X.509 certificates with smart cards

Question 2

A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?

Accepted Answer

Publish a CRL from the compromised CA listing all certificates it issued. The best method is to use a CRL issued by the compromised CA, marking all its unexpired certificates as revoked. Revoking the CA certificate itself invalidates all certificates issued by it, including valid ones. Distributing a new CRL from the root CA would require the root to be online. Individual certificate revocation is inefficient.

Answer

Re-issue all certificates from a different issuing CA without revocation

Answer

Use OCSP to individually check and revoke each certificate

Answer

Revoke the compromised CA certificate and issue a new CRL from the root CA

Question 3

A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?

Accepted Answer

SHA-3. SHA-3 is built on the Keccak sponge construction, which is structurally immune to length extension attacks — unlike SHA-256, whose Merkle–Damgård construction is vulnerable when used naively as a MAC. SHA-3 also offers strong performance on modern 64-bit hardware and is the NIST-standardized successor family (FIPS 202), making it the best fit for integrity verification where length extension resistance is required.

Answer

BLAKE3

Answer

SHA-256

Answer

MD5

Question 4

A security analyst is configuring a TPM 2.0 for a new fleet of laptops. The requirement is to ensure that only authorized operating systems can boot and that any tampering with the boot process is detected. Which TPM feature should be used?

Accepted Answer

Measured boot with attestation. Measured boot records measurements of boot components in PCRs, and attestation allows a remote verifier to check these measurements. Secure boot only verifies signatures, not measurements. Sealed storage ties data to PCR values. Key attestation is for keys.

Answer

Secure boot

Answer

Sealed storage

Answer

Key attestation

Question 5

A web server is configured to use TLS 1.3. Which of the following is a key security benefit of TLS 1.3 over earlier versions?

Accepted Answer

Forward secrecy for all key exchanges. TLS 1.3 provides forward secrecy by default, meaning session keys are not compromised even if the server's long-term private key is compromised. 0-RTT is a performance feature but can be vulnerable to replay. Removed cipher suites is a cleanup. Certificate pinning is not part of TLS 1.3.

Answer

Removal of weak cipher suites

Answer

Support for 0-RTT handshake

Answer

Mandatory certificate pinning

Question 6

A security engineer is selecting an asymmetric encryption algorithm for a system that must provide non-repudiation and long-term security (at least 20 years). The system has limited computational resources. Which of the following is the best choice?

Accepted Answer

Ed25519. Ed25519 offers high security with small key sizes and efficient computation, and is suitable for long-term security. RSA 4096 is slower and has larger keys. ECDSA P-384 is secure but slower than Ed25519. DSA is older and less efficient.

Answer

RSA 4096

Answer

ECDSA P-384

Answer

DSA 3072

Question 7

During a security assessment, an analyst discovers that an HSM used for key generation is FIPS 140-2 Level 2 compliant. The organization requires a higher level of physical security to prevent tampering. Which upgrade would best address this requirement?

Accepted Answer

Upgrade to FIPS 140-2 Level 3. FIPS 140-2 Level 3 adds identity-based authentication and physical tamper-detection/response mechanisms (e.g., zeroization of keys on intrusion), which directly addresses the requirement for stronger physical security against tampering. Level 2 only requires tamper-evident coatings or seals and role-based authentication. Upgrading from Level 2 to Level 3 is the correct incremental step.

Answer

Implement a TPM 2.0 instead

Answer

Upgrade to FIPS 140-2 Level 4

Answer

Use a software-based key store

Question 8

An organization is implementing a PKI with a three-tier hierarchy (root CA, intermediate CA, issuing CA). The security team wants to ensure that certificate revocation information is available quickly and efficiently. Which TWO mechanisms should they implement? (Select TWO.)

Accepted Answer

CRL distribution points (CRL DP). Option D (CRL distribution points) is correct because CRL DPs are the standard X.509 extension (cRLDistributionPoints) that tells relying parties where to fetch the CA's Certificate Revocation List, which is the baseline mechanism for distributing revocation data in a three-tier PKI. Option E (OCSP responders) is correct because the Online Certificate Status Protocol lets clients query a responder for near-real-time, per-certificate revocation status, which is faster and more efficient than downloading full CRLs and directly satisfies the requirement for quick revocation information. Option A (OCSP stapling) is not selected here because it is a TLS extension where the server presents a pre-fetched, signed OCSP response to the client; while it improves efficiency, it depends on an OCSP responder already existing and is not itself the PKI revocation infrastructure the team must implement. Option B (delta CRLs) is not selected because delta CRLs only publish changes since the last full CRL and still rely on CRL DPs, so they are an optimization rather than one of the two primary mechanisms. Option C (Certificate Transparency) is not selected because CT logs provide public auditability of issued certificates and detect mis-issuance; they do not distribute revocation status.

Answer

OCSP stapling

Answer

Delta CRLs

Answer

Certificate Transparency (CT) logs

Question 9

A company is migrating from RSA to elliptic curve cryptography for digital signatures. They require a signature algorithm that provides at least 128 bits of security strength and is resistant to quantum computing attacks in the foreseeable future. Which TWO algorithms meet these requirements? (Select TWO.)

Accepted Answer

DSA 3072. DSA 3072 and RSA 4096 are both considered to provide at least 128 bits of security strength. Although all classical public-key algorithms are theoretically vulnerable to quantum attacks via Shor's algorithm, in practice DSA and RSA with large key sizes are currently believed to be more resistant to quantum computing attacks in the foreseeable future compared to elliptic curve algorithms like ECDSA and Ed25519, which are more susceptible due to their smaller key sizes and the efficiency of Shor's algorithm on elliptic curves.

Answer

ECDSA P-256

Answer

Ed25519

Answer

ECDSA P-384

Question 10

A security engineer is evaluating hardware security modules (HSMs) for key management. The HSM must support key generation, storage, and cryptographic operations without exposing private keys. Additionally, the solution must comply with FIPS 140-2 Level 3. Which THREE features are essential for this requirement? (Select THREE.)

Accepted Answer

Physical security mechanisms (e.g., locks, tamper switches). Option A (Physical security mechanisms such as locks and tamper switches) is essential because FIPS 140-2 Level 3 specifically requires physical tamper detection and response mechanisms that detect and react to unauthorized physical access, which is a defining distinction between Level 2 and Level 3. Option B (Cryptographic boundary) is essential because the HSM must define and enforce a cryptographic boundary that contains the key generation, storage, and cryptographic operations, ensuring private keys never leave the boundary in plaintext. Option D (Tamper-evident seals and coatings) is essential because Level 3 mandates tamper-evident physical security mechanisms, including seals and coatings, that provide evidence of tampering attempts. Option C (Key ceremony support) is a useful operational practice for initializing keys with dual control and split knowledge, but it is not a FIPS 140-2 Level 3 hardware requirement. Option E (Secure boot of the HSM firmware) is a good security practice but is not one of the specific physical security requirements that define FIPS 140-2 Level 3 compliance.

Answer

Key ceremony support

Answer

Secure boot of the HSM firmware

Question 11

A security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ChaCha20-Poly1305 with ECDHE key exchange and Ed25519. ChaCha20-Poly1305 is a symmetric cipher that offers excellent performance on mobile and low-power devices, while providing authenticated encryption. ECDHE provides forward secrecy, and Ed25519 provides efficient authentication. AES-256-GCM is also good but ChaCha20 often performs better in software. RSA key exchange does not provide forward secrecy. SHA-256 is a hashing algorithm, not an encryption algorithm.

Answer

AES-128-CBC with HMAC-SHA256 and RSA-2048

Answer

ChaCha20-Poly1305 with static ECDH and SHA-384

Answer

AES-256-GCM with RSA key exchange and SHA-256

Question 12

A company is migrating its internal services to use SSH key-based authentication instead of passwords. The security policy requires using the strongest supported algorithms. The SSH server supports the following key exchange algorithms: diffie-hellman-group14-sha256, ecdh-sha2-nistp384, curve25519-sha256. Which algorithm should the administrator choose to meet the policy?

Accepted Answer

curve25519-sha256. Curve25519 (X25519) is the recommended elliptic curve for key exchange due to its strong security and performance advantages. It is considered more secure than NIST curves and traditional Diffie-Hellman.

Answer

ecdh-sha2-nistp384

Answer

diffie-hellman-group14-sha256

Answer

All three are equally strong

Question 13

A security auditor is reviewing the cryptographic controls of a financial application that processes transactions. The application uses digital signatures with RSA 4096 and SHA-256. The auditor recommends migrating to a stronger algorithm due to concerns about long-term security and quantum resistance. Which of the following would be the MOST appropriate replacement?

Accepted Answer

Ed25519. Ed25519 offers strong security, smaller keys, and better performance than RSA. It is also resistance to some side-channel attacks. While not quantum-resistant, it is a forward-looking choice. ECDSA P-384 is also strong but larger key sizes. SHA-3 is a hash function, not a signature algorithm.

Answer

SHA-3

Answer

ECDSA P-521

Answer

ECDSA P-256

Question 14

A security engineer is configuring a new web server to support TLS 1.3. The server must provide forward secrecy and support clients that may not have updated certificates frequently. Which of the following is a feature of TLS 1.3 that addresses these requirements?

Accepted Answer

Mandatory use of ephemeral Diffie-Hellman key exchange. TLS 1.3 mandates the use of ephemeral Diffie-Hellman key exchange, which provides forward secrecy by ensuring that session keys are not compromised even if the server's long-term private key is later compromised. This addresses the requirement for forward secrecy. Additionally, TLS 1.3 simplifies cipher suites and removes support for static RSA and other non-forward-secret key exchanges, making it inherently more secure.

Answer

Support for certificate pinning

Answer

Support for 0-RTT handshake

Answer

Removal of cipher suites that use RSA key exchange

Question 15

An organization is implementing a Windows Hello for Business deployment to enable passwordless authentication. The solution uses TPM 2.0 for key storage. Which of the following TPM features ensures that the system has not been tampered with before the user authenticates?

Accepted Answer

Measured boot. Measured boot records measurements of boot components in PCR banks, which can be used for attestation to verify system integrity. Secure boot prevents execution of unauthorized code, but measured boot provides evidence of the boot chain. Sealed storage uses PCR values to restrict access to keys. Attestation is the process of proving the measurements to a verifier.

Answer

Secure boot

Answer

Sealed storage

Answer

Attestation

Question 16

A security architect is evaluating hardware security modules (HSMs) for a new PKI deployment. The HSM must be compliant with FIPS 140-2 Level 3. Which of the following is a requirement for Level 3 that distinguishes it from Level 2?

Accepted Answer

Identity-based authentication for operators. FIPS 140-2 Level 3 requires identity-based authentication for all operators, meaning each user must be uniquely identified and authenticated (e.g., via username/password, smart card, or biometric) before accessing cryptographic services. This is a key differentiator from Level 2, which only requires role-based authentication (e.g., a shared password for a role). Level 3 also mandates stronger physical security (tamper detection and response) and environmental failure protections, but identity-based authentication is the specific requirement that distinguishes it from Level 2.

Answer

Cryptographic boundary includes all critical components

Answer

Environmental failure protections

Answer

Physical security mechanisms that provide tamper evidence

Question 17

An organization uses a PKI with a three-tier hierarchy: root CA, issuing CA, and registration authority. The root CA is kept offline. An intermediate CA certificate must be renewed. Which of the following is the correct process?

Accepted Answer

The root CA signs the new intermediate CA certificate after being brought online.. The root CA signs the intermediate CA certificate. Since the root CA is offline, it must be brought online temporarily to sign the new intermediate certificate. The RA does not sign certificates; it handles verification requests. The intermediate CA cannot self-sign its own certificate.

Answer

The intermediate CA self-signs its new certificate.

Answer

The issuing CA signs the new intermediate CA certificate.

Answer

The registration authority signs the new intermediate CA certificate.

Question 18

During a security assessment, a penetration tester discovers that a smart card used for authentication is vulnerable to a timing attack. The card uses a cryptographic algorithm that has data-dependent timing variations. Which of the following algorithms is MOST likely being used on the smart card?

Accepted Answer

RSA with Chinese Remainder Theorem. RSA decryption (using CRT) is known to be vulnerable to timing attacks if not implemented with constant-time functions. AES is typically resistant if implemented correctly. SHA-256 is a hash function, not used for signing/decryption. ECDSA can be vulnerable to timing attacks if not constant-time, but RSA is more commonly associated with classic timing vulnerabilities.

Answer

ECDSA P-384

Answer

SHA-256

Answer

AES-256-CBC

Question 19

An organization is planning to deploy digital certificates for various use cases. Which TWO of the following certificate types are typically used for email security?

Accepted Answer

Client certificates. Option A (Client certificates) is correct because in email security they are used for S/MIME, where each user holds a personal certificate and private key to digitally sign outgoing messages and decrypt incoming encrypted mail, providing sender authentication and non-repudiation. Option D (S/MIME certificates) is correct because S/MIME is the standard protocol for email encryption and digital signing, and S/MIME certificates bind a user's email address to a public key so messages can be encrypted and signatures verified. Option B (Code signing certificates) is not for email; they sign software binaries to prove publisher integrity. Option C (Extended validation certificates) is not for email; EV certificates are TLS/server certificates with extended identity vetting for websites. Option E (Domain-validated certificates) is not for email; DV certificates only validate domain control and are used for TLS on servers, not for signing or encrypting individual email messages.

Answer

Code signing certificates

Answer

Extended validation (EV) certificates

Answer

Domain-validated (DV) certificates

Question 20

A company wants to implement certificate pinning for its mobile app to prevent man-in-the-middle attacks. Which approach is most secure and maintainable?

Accepted Answer

Pin the SHA-256 hash of the server's public key.. Pinning the public key hash rather than the certificate itself allows certificate rotation without updating the app, as long as the key pair remains the same.

Answer

Pin the entire certificate chain, including the root CA certificate.

Answer

Pin the Subject Public Key Info (SPKI) using base64 encoding.

Answer

Pin the issuing CA certificate only.