CAS-004 Security Engineering Practice Test 10 — 15 Questions

Question 1

A security architect must protect a REST API that issues short-lived, signed access tokens. The design goal is to prevent a compromised authorization server from minting tokens that other resource servers will accept after the compromise is detected, without requiring resource servers to poll a central service on every request. Which design BEST meets this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Publish a signed token status list that resource servers fetch and cache, allowing revoked or suspect token identifiers to be rejected until the list's next refresh.. The goal is to bound how long a fraudulent token remains acceptable without adding a synchronous dependency on the issuer. A signed, cacheable token status list gives resource servers an offline-checkable revocation signal that they can refresh periodically, so tokens minted after detection can be rejected within the refresh interval while normal request processing stays fast and resilient.

Answer

Shorten the token lifetime to five minutes and require resource servers to validate the signature with the authorization server's public key.

Answer

Issue tokens bound to the client's TLS session so that a token is only usable from the connection on which it was issued.

Answer

Require mutual TLS between the authorization server and each resource server and pin the authorization server's certificate.

Question 2

A security architect is designing key management for a backup platform that stores encrypted archives in cloud object storage. The requirement is that destroying a single small piece of key material must render all archived data permanently unrecoverable, even if an attacker later obtains a full copy of the storage bucket and the wrapped data keys. Which design BEST meets this requirement?

Accepted Answer

Encrypt each archive with a unique data encryption key, wrap those keys with a customer-managed root key held in a hardware security module, and destroy the root key to crypto-shred the archives.. Envelope encryption with a hardware-protected root key separates the wrapped data keys from the material needed to use them, so deleting the root key makes every wrapped key permanently unusable and crypto-shreds the entire archive set in one action. Keeping the root key in an HSM prevents export or copying, so an attacker who later captures the bucket gains only undecryptable ciphertext.

Answer

Encrypt all archives with a single long-lived storage key protected by a passphrase that is rotated quarterly and distributed to backup administrators.

Answer

Encrypt each archive with a unique data encryption key and store those keys in the same object storage bucket alongside the ciphertext for operational simplicity.

Answer

Apply server-side encryption with provider-managed keys and rely on the cloud provider's internal key rotation schedule to invalidate old key versions over time.

Question 3

A security administrator is configuring a Linux server to enforce mandatory access control (MAC) for a web application. The administrator wants to confine the web server process to only access its own files and network ports, even if the process is compromised. Which of the following should the administrator implement?

Accepted Answer

SELinux in enforcing mode with a targeted policy.. SELinux in enforcing mode applies mandatory access control, restricting processes to only the resources defined in the policy. A targeted policy confines specific services like the web server, limiting the impact of a compromise. This meets the requirement to confine the web server process even if exploited.

Answer

A chroot jail for the web server process.

Answer

AppArmor in complain mode.

Answer

Standard Linux discretionary access control (DAC) with file permissions.

Question 4

A security engineer is configuring a Linux server that hosts a web application. The server must accept connections only from the internal network 10.0.0.0/24 and must reject all other incoming traffic. The engineer decides to use iptables. Which command sequence correctly implements this requirement?

Accepted Answer

iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT; iptables -A INPUT -j DROP. The requirement is to allow traffic only from 10.0.0.0/24 and drop everything else. In iptables, rules are evaluated in order, so the ACCEPT rule for the internal subnet must come before the DROP rule. Appending ACCEPT then DROP achieves this. Other orderings either block legitimate traffic or permit unauthorized traffic, violating the stated policy.

Answer

iptables -A INPUT -j DROP; iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/24 -j DROP; iptables -A INPUT -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/24 -j REJECT; iptables -A INPUT -j ACCEPT

Question 5

A security architect is designing a key management system for a multinational corporation that must comply with FIPS 140-3 Level 3. The system will store long-term asymmetric private keys used for digital signatures. The architect must ensure that the private keys are protected against physical extraction and that cryptographic operations are performed within a tamper-responsive environment. Which of the following is the MOST appropriate solution?

Accepted Answer

Use a Hardware Security Module (HSM) that is FIPS 140-3 Level 3 validated for key storage and cryptographic operations.. FIPS 140-3 Level 3 requires tamper-responsive physical security and identity-based authentication. An HSM validated to this level provides a hardened environment that detects and responds to tampering, such as by zeroizing keys. It also performs cryptographic operations internally, preventing key exposure. Software keystores, TPMs, and Level 2 cloud KMS solutions do not meet the tamper-responsive and physical extraction resistance requirements for Level 3.

Answer

Implement a Trusted Platform Module (TPM) 2.0 on each server to store private keys and perform signing operations.

Answer

Store private keys in a cloud key management service (KMS) that uses FIPS 140-2 Level 2 validated hardware.

Answer

Store private keys in a software-based keystore encrypted with a passphrase and implement strict access controls.

Question 6

A security administrator is configuring a firewall to allow only encrypted remote administration traffic to a server. The administrator wants to use a protocol that provides confidentiality and integrity for the management session. Which of the following should be used?

Accepted Answer

SSH. SSH is designed for secure remote administration, providing encryption and integrity. Telnet and HTTP are plaintext, and SNMPv3 without privacy lacks encryption. Only SSH meets the requirement for encrypted management traffic.

Answer

HTTP over port 8080

Answer

Telnet

Answer

SNMPv3 without privacy

Question 7

A systems administrator is hardening a Linux server that stores regulated data. The requirement is that the server's filesystem must detect unauthorized modification of files at rest, including offline tampering with the disk. Which control BEST meets this requirement?

Accepted Answer

Enable dm-verity on the filesystem so that reads are validated against a signed hash tree.. dm-verity provides cryptographic verification of filesystem blocks against a signed hash tree, so any offline modification of the disk causes verification to fail when the data is read. Encryption, integrity monitoring, and filesystem attributes each address different threats and none of them reliably detects offline tampering of the protected volume.

Answer

Deploy file integrity monitoring that hashes files and compares them against a known-good baseline on a schedule.

Answer

Enable full-disk encryption with LUKS using a passphrase entered at boot.

Answer

Set the immutable attribute on critical files using chattr +i and restrict root access.

Question 8

A security administrator is troubleshooting a web application that intermittently rejects valid user sessions. Logs show the application server's clock drifted several minutes behind the authentication service, and the tokens carry short validity windows with issued-at and expiry claims. Which action MOST directly resolves the intermittent rejections?

Accepted Answer

Configure the application server and authentication service to synchronize their clocks with the same trusted NTP time sources.. Time-based token claims are only meaningful when the issuer and validator share a common time reference. Synchronizing both systems to the same authenticated NTP sources eliminates the skew that causes valid tokens to be judged expired or not yet valid, fixing the rejections without loosening token lifetimes or removing expiry enforcement.

Answer

Increase the token validity window from five minutes to several hours so clock differences no longer matter.

Answer

Disable expiry claim validation on the application server so tokens are trusted until the session store marks them invalid.

Answer

Shorten the token validity window further so that affected tokens expire quickly and users reauthenticate more often.

Question 9

A security engineer is configuring a Linux server that hosts a web application. The engineer needs to ensure that the application runs with the least privilege necessary and that any compromise of the application is confined to a limited set of system resources. Which of the following should the engineer implement?

Accepted Answer

SELinux in enforcing mode with a targeted policy for the web server. SELinux in enforcing mode enforces a mandatory access control policy that restricts the web server to only the resources it needs, such as specific files and network ports. This provides strong confinement and least privilege. The other options either do not enforce restrictions, provide only partial isolation, or rely on traditional permissions that are insufficient for limiting a compromised process.

Answer

Running the web server as a non-root user without additional controls

Answer

chroot jail for the web server process

Answer

AppArmor with a complain-mode profile for the web server

Question 10

A security engineer is implementing network segmentation to isolate a PCI DSS environment from the corporate network. The engineer plans to use VLANs and a firewall. Which TWO of the following are essential to ensure that the segmentation is effective and compliant? (Choose two.)

Accepted Answer

Implement 802.1Q VLAN tagging on all switch ports that connect to the PCI environment and ensure that native VLANs are not used on trunk ports.. Effective network segmentation for PCI DSS requires both Layer 3 access control and Layer 2 isolation. A default-deny firewall rule between the PCI VLAN and other networks ensures that only necessary traffic is allowed. Proper VLAN tagging and avoiding native VLANs on trunk ports prevent VLAN hopping attacks that could bypass segmentation. Together, these controls establish a strong boundary. Other measures like DAI, IPS, and PVLANs enhance security but are not essential for the segmentation itself.

Answer

Use private VLANs (PVLANs) to isolate hosts within the PCI VLAN from each other.

Answer

Deploy a dedicated intrusion prevention system (IPS) on the PCI VLAN to monitor all traffic.

Answer

Enable dynamic ARP inspection (DAI) and DHCP snooping on all VLANs to prevent IP spoofing.

Question 11

A security architect is designing a data-at-rest protection scheme for a database that stores regulated records on a shared storage array. The requirement is to ensure that even if an administrator copies the raw storage volume, the data cannot be read, and that the keys are never accessible to the storage administrator. Which of the following BEST meets these requirements?

Accepted Answer

Application-level encryption of sensitive columns using keys held in a hardware security module (HSM) with strict role separation. The strongest control is application-level encryption whose keys live in an HSM with strict role separation, because the ciphertext on shared storage is meaningless without the HSM and the storage administrator cannot reach the keys. Controller, database, and filesystem encryption all leave key material accessible to privileged administrators in the same trust domain.

Answer

Transparent data encryption (TDE) enabled on the database instance with the master key stored in the database's internal keystore

Answer

Filesystem-level encryption on the database server with keys protected only by the operating system's file permissions

Answer

Full-disk encryption using the storage array's built-in controller-based encryption with keys managed by the array firmware

Question 12

A security architect is designing a system that requires secure key exchange over an untrusted network. The system must provide perfect forward secrecy (PFS) and must be resistant to quantum computer attacks. Which key exchange algorithm BEST meets these requirements?

Accepted Answer

Post-quantum key exchange using lattice-based cryptography (e.g., Kyber). The requirements are perfect forward secrecy and resistance to quantum attacks. Traditional key exchanges like RSA, DHE, and ECDHE provide PFS but are vulnerable to quantum computers. Lattice-based post-quantum algorithms such as Kyber are designed to withstand quantum attacks and can be used in ephemeral modes to achieve PFS, making them the only suitable option.

Answer

RSA key exchange with 4096-bit keys

Answer

Diffie-Hellman Ephemeral (DHE) with 2048-bit parameters

Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) with Curve25519

Question 13

A security engineer is configuring a Linux web server that hosts a public-facing application. The server's SSH daemon must be hardened to prevent brute-force attacks and unauthorized access. The engineer has already disabled root login and password authentication. Which additional control should the engineer implement to restrict access to only authorized administrative users?

Accepted Answer

Configure AllowUsers in /etc/ssh/sshd_config to list authorized usernames.. The AllowUsers directive in sshd_config explicitly whitelists user accounts permitted to authenticate over SSH. When combined with disabled password authentication and no root login, it ensures only named administrative users can connect, directly satisfying the hardening goal. Other options either add authentication methods or obscure the service without limiting user access.

Answer

Enable ChallengeResponseAuthentication and configure PAM modules.

Answer

Set PermitRootLogin to no in /etc/ssh/sshd_config.

Answer

Change the SSH port from 22 to a non-standard port.

Question 14

A security architect is designing a network segmentation scheme for a containerized workload running on a Kubernetes cluster. The requirement is to enforce least-privilege communication between microservices at Layer 3 and Layer 4, and to ensure that only explicitly allowed traffic can flow between pods, even within the same namespace. Which of the following should the architect implement?

Accepted Answer

Kubernetes Network Policies with a default-deny ingress and egress policy.. To enforce least-privilege communication between microservices at Layer 3 and Layer 4, the architect needs a mechanism that controls pod-to-pod traffic based on labels and ports. Kubernetes Network Policies with a default-deny stance provide exactly that: a whitelist model where only explicitly permitted flows are allowed. This prevents unauthorized lateral movement even within the same namespace and is the native, CNI-supported solution for microsegmentation in Kubernetes.

Answer

Pod Security Admission with the restricted profile applied to all namespaces.

Answer

A web application firewall (WAF) placed in front of the ingress controller.

Answer

Istio service mesh with mutual TLS (mTLS) enabled between all sidecars.

Question 15

A security engineer is reviewing the configuration of a web server that uses TLS 1.3. The engineer wants to ensure that the server supports perfect forward secrecy (PFS) and uses strong cipher suites. Which of the following cipher suites should be selected?

Accepted Answer

TLS_AES_256_GCM_SHA384. In TLS 1.3, all cipher suites provide forward secrecy because key exchange is always ephemeral. The only valid TLS 1.3 cipher suite among the options is TLS_AES_256_GCM_SHA384, which uses strong AES-256-GCM encryption. The others are TLS 1.2 suites or use weak algorithms.

Answer

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA