CAS-004 Security Engineering Practice Test 12 — 15 Questions

Question 1

A financial services firm must protect cardholder data in a database and wants a control that renders the data unreadable to database administrators and to anyone who steals a backup, while still allowing the application to run equality lookups on the protected column. Which approach BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store a keyed hash of the column using HMAC-SHA-256 with a key held outside the database, and query by recomputing the hash of the search value.. A keyed hash computed with a secret key held outside the database is deterministic, so equality predicates can be evaluated directly against the stored digest while the original values stay hidden from administrators and backup thieves. This preserves index-based lookups and satisfies the confidentiality goal, whereas randomized encryption breaks equality queries and static-IV encryption introduces serious cryptographic weaknesses.

Answer

Store the column encrypted with AES-256-GCM using a key held in an HSM, and let the application decrypt rows after retrieving them by primary key.

Answer

Store the column in plaintext but restrict table access with database roles and enable transparent data encryption on the tablespace.

Answer

Store the column encrypted with AES-256-CBC using a static initialization vector so identical plaintexts produce identical ciphertext for lookups.

Question 2

A security engineer is implementing a zero trust architecture for a corporate network. The engineer must ensure that all access requests are continuously verified and that least privilege is enforced. Which TWO components are essential to achieve these goals? (Choose two.)

Accepted Answer

A policy administrator that establishes and maintains the trust relationship between the subject and the resource.. Zero trust architecture relies on a policy engine to make dynamic access decisions based on context, and a policy administrator to enforce those decisions by configuring the data plane. These two components form the control plane and are essential for continuous verification and least privilege. Other options like VPN, NGFW, and SIEM are supporting technologies but not core to the zero trust access decision process.

Answer

A VPN concentrator that provides encrypted tunnels for all remote access.

Answer

A next-generation firewall (NGFW) that inspects all traffic at the network perimeter.

Answer

A security information and event management (SIEM) system that aggregates logs for analysis.

Question 3

A security architect is designing a microservices platform that runs on a shared Kubernetes cluster. Each service must be able to prove its identity to other services, and the design must avoid long-lived shared secrets and support automatic credential rotation when a pod is rescheduled. Which approach BEST meets these requirements?

Accepted Answer

Issue each service a signed SPIFFE SVID through a SPIRE agent running as a DaemonSet, and use mTLS between services.. Workload identity frameworks such as SPIFFE/SPIRE bind a cryptographic identity to the actual workload through node and pod attestation, then issue short-lived certificates that rotate automatically. Using mTLS with those identities gives mutual authentication and encryption without shared static secrets, which is exactly what the microservices platform needs.

Answer

Enable Kubernetes service account token projection with a 24-hour expiration and use the token as a bearer credential for inter-service calls.

Answer

Store a unique API key for each service in a Kubernetes Secret and require services to present the key in an HTTP header.

Answer

Configure Kubernetes NetworkPolicies to allow traffic only between approved service namespaces.

Question 4

A security administrator is reviewing the configuration of a wireless network. The network uses WPA3-Enterprise with 802.1X authentication. The administrator wants to ensure that the authentication server validates the identity of the supplicant before granting network access. Which protocol should be used to encapsulate the authentication credentials?

Accepted Answer

EAP-TLS. EAP-TLS requires certificates on both the supplicant and the authentication server, enabling mutual authentication. This ensures the server validates the supplicant's identity before granting access. PEAP and EAP-TTLS typically authenticate only the server with a certificate, while EAP-MD5 lacks mutual authentication entirely. Thus, EAP-TLS is the correct choice for strong mutual identity validation.

Answer

EAP-MD5

Answer

EAP-TTLS

Answer

PEAP

Question 5

A security team is deploying a hardware security module (HSM) to protect the root of trust for a code-signing pipeline. The team must ensure that signing keys cannot be extracted and that all signing operations are attributable to an authorized operator. Which TWO controls BEST meet these requirements? (Choose two.)

Accepted Answer

Configure the HSM to mark signing keys as non-extractable and perform all cryptographic operations inside the module. Marking keys non-extractable and performing operations inside the module protects the signing key from extraction, while per-operator authentication with operation logging provides attribution. Backup exports and shared service accounts undermine both goals, and FIPS validation is a module-level compliance attribute rather than an operational control.

Answer

Store an encrypted backup of the HSM's key material on a network share protected by share-level permissions

Answer

Enable FIPS 140-3 validated mode on the HSM and publish the validation certificate internally

Answer

Configure the HSM to allow a shared service account to perform signing so that automation is not interrupted

Question 6

A security engineer is designing a system that must enforce mandatory access control (MAC) based on security labels. The system must ensure that users cannot read data above their clearance level and cannot write data to lower classification levels. Which security model BEST fits these requirements?

Accepted Answer

Bell-LaPadula model. The requirements describe the classic confidentiality model: prevent reading above clearance (no-read-up) and prevent writing to lower levels (no-write-down). The Bell-LaPadula model explicitly defines these properties. Biba is for integrity, Clark-Wilson for integrity transactions, and Brewer-Nash for conflict of interest. Thus, Bell-LaPadula is the correct choice.

Answer

Clark-Wilson model

Answer

Brewer-Nash model

Answer

Biba model

Question 7

A security architect is designing a microservices-based application deployed on a Kubernetes cluster. The architect needs to ensure that inter-service communication is secure, that services can authenticate each other, and that access to services is controlled based on identity. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Mutual TLS (mTLS) between services using short-lived certificates. Mutual TLS with short-lived certificates ensures encrypted and authenticated communication between services, while a service mesh with identity-based authorization policies provides centralized, fine-grained access control based on service identity. Together, they secure inter-service communication and enforce access control. The other options either lack encryption, use static secrets, or are overly permissive.

Answer

A shared secret used by all services for authentication

Answer

API keys stored in environment variables for each service

Answer

Network policies that allow all traffic within the cluster namespace

Question 8

A security engineer is configuring an internal certificate authority that must issue end-entity certificates to servers on a private network. Corporate policy requires that the CA's private key never reside on a network-connected host, and that certificate issuance be a deliberate, low-volume operation. Which of the following should the engineer implement to BEST meet these requirements?

Accepted Answer

Configure an offline root CA that signs an online issuing subordinate CA, which in turn issues end-entity certificates.. Keeping the root CA offline and delegating routine issuance to an online subordinate CA separates the trust anchor from day-to-day operations. The root key is only used to sign the subordinate CA certificate, so it can stay on an isolated host, while the subordinate handles end-entity certificates. This limits exposure and matches the policy of deliberate, low-volume root signing.

Answer

Configure a cross-certified bridge CA that exchanges certificates with external partners using automated enrollment.

Answer

Issue self-signed certificates directly to each server and distribute them to clients through a configuration management tool.

Answer

Deploy a single online root CA that issues all end-entity certificates and keeps its key in a network HSM.

Question 9

A security engineer is designing a system that must protect data at rest on a database server. The organization requires that the encryption keys never leave a hardware module and that the module be resistant to physical tampering. The engineer deploys a hardware security module (HSM) that is validated to FIPS 140-2 Level 3. Which of the following BEST describes the security property provided by this validation level?

Accepted Answer

It provides tamper-evident physical mechanisms and identity-based authentication to access cryptographic keys.. FIPS 140-2 Level 3 validation requires tamper-evident physical mechanisms and identity-based authentication, ensuring that keys remain within a hardened hardware boundary and that only authenticated operators can access them. This matches the stated requirements of keys never leaving the module and resistance to physical tampering. Levels 1 and 2 lack these physical protections, while Level 4 adds environmental protections beyond what is needed here.

Answer

It provides zeroization of keys when the module is powered down, but does not require any authentication for administrative access.

Answer

It provides the highest level of physical security with environmental failure protection and formal method verification.

Answer

It provides a software-only cryptographic module that can be deployed on any commodity server without hardware dependencies.

Question 10

A security architect is evaluating a hardware security module (HSM) deployment for a certificate authority. The requirement is that private keys must never leave the HSM in plaintext, and that key operations must be auditable. During a review, the architect learns that the HSM supports key wrapping for backup. Which of the following is the MOST important control to verify?

Accepted Answer

That the key wrapping key is stored in a separate, tamper-resistant HSM under a different administrator's control, and that wrapping operations are logged.. The strongest control is to separate the key wrapping key into an independent, tamper-resistant HSM under different administrative control and to log all wrapping operations. This enforces separation of duties and ensures that compromise of one HSM does not expose all backed-up private keys. Exportable wrapping keys, weak ciphers like ECB, or insecure transport channels all undermine the security of the backup process.

Answer

That the private keys are backed up to an encrypted network share using the HSM's built-in FTP client for offsite storage.

Answer

That the key wrapping key is stored in the same HSM and is itself exportable for disaster recovery.

Answer

That the HSM uses AES-128 in ECB mode for key wrapping to maximize performance during backup operations.

Question 11

A security engineer is configuring a wireless network for a corporate office. The network must support 802.1X authentication with EAP-TLS, and the engineer wants to ensure that only devices with valid certificates issued by the corporate CA can connect. Which of the following should the engineer configure on the RADIUS server to enforce this requirement?

Accepted Answer

Configure EAP-TLS and validate client certificates against the corporate CA.. EAP-TLS is the only method that mandates client-side certificates, allowing the RADIUS server to validate them against the corporate CA. This ensures that only devices with certificates from that CA can connect. The other methods either rely on user credentials, tunneled legacy authentication, or PACs, none of which enforce device certificate validation.

Answer

Enable PEAP with MSCHAPv2 and require domain credentials.

Answer

Deploy EAP-FAST with PACs and require machine authentication.

Answer

Implement EAP-TTLS with a tunneled authentication protocol and check user group membership.

Question 12

A security architect is designing segmentation for an industrial control network that runs Modbus/TCP between engineering workstations and programmable logic controllers. The architect wants to prevent an attacker who compromises a workstation from issuing unauthorized write commands to the controllers, while avoiding disruption of legitimate polling traffic. Which control BEST addresses the specific risk?

Accepted Answer

Implement a deep packet inspection device that understands the protocol and blocks write function codes from workstations.. The risk is a compromised workstation sending unauthorized write commands over a legitimate protocol. Only a control that inspects the industrial protocol at the application layer can distinguish reads from writes and block the dangerous function codes while allowing polling. Address, port, and device-authentication controls operate below that layer and cannot enforce command-level policy.

Answer

Apply network address translation so controllers are not directly reachable from the workstation subnet.

Answer

Enable 802.1X port-based authentication on the switches that connect the controllers.

Answer

Deploy a stateful firewall that permits only the workstation-to-controller TCP port used by the protocol.

Question 13

A security engineer is hardening a Linux bastion host that provides administrative access to production servers. The organization requires that all administrative sessions be cryptographically bound to a hardware-backed credential and that session recordings be tamper-evident. Which TWO controls BEST satisfy these requirements? (Choose two.)

Accepted Answer

Deploy a session recording solution that writes audit logs to a remote syslog server protected by TLS and stores a hash chain of each session.. Hardware-backed authentication and tamper-evident recording are distinct requirements that need complementary controls. FIDO2-backed sk-ssh-ed25519 keys bind administrative sessions to a physical authenticator, while remote TLS-protected logging with a hash chain ensures session recordings cannot be altered undetectably. Together they satisfy both the credential-binding and recording-integrity objectives without relying on weaker password or SMS mechanisms.

Answer

Enable PasswordAuthentication and enforce a 20-character complexity policy with quarterly rotation.

Answer

Configure sshd to permit only keyboard-interactive authentication with one-time passwords delivered by SMS.

Answer

Store session recordings locally on the bastion host in a directory writable only by root, and rely on file permissions for integrity.

Question 14

A cloud security engineer is designing an architecture where workloads in a virtual private cloud must reach an on-premises database over a site-to-site VPN. The requirement is that only the database subnet can be reached, no other on-premises networks, and traffic must be encrypted in transit. Which design BEST satisfies this?

Accepted Answer

Configure a customer gateway and virtual private gateway with a static route limited to the database subnet CIDR. A site-to-site IPsec VPN between a customer gateway and a virtual private gateway encrypts traffic, and constraining the static route to the database subnet CIDR enforces least-privilege reachability. Transit gateway full propagation, VPC peering, and public-IP exposure either broaden access or fail to provide an encrypted private path to the on-premises database.

Answer

Deploy a transit gateway and attach every on-premises VPC to it with full route propagation

Answer

Use VPC peering between the workload VPC and the on-premises database VPC

Answer

Create an internet gateway and allow the workload subnet to reach the database's public IP over TLS

Question 15

A security engineer is configuring a hardware security module (HSM) to protect a root certificate authority's private key. The requirement is that the key must never exist in plaintext outside the HSM and must be usable by multiple authorized administrators under dual control. Which configuration BEST satisfies these requirements?

Accepted Answer

Generate the CA key inside the HSM as a non-extractable key and configure M of N quorum authentication for administrative operations.. The strongest protection is to have the HSM itself generate the key as non-extractable, so the private material is created and used only within the tamper-resistant boundary. Layering M of N quorum authentication ensures that no single administrator can perform sensitive CA operations, providing the dual control the scenario requires.

Answer

Generate the CA key on a hardened offline workstation, wrap it with a passphrase-derived AES key, and import the wrapped blob into the HSM.

Answer

Generate the CA key inside the HSM as an extractable key so that a secure backup can be made, and rely on HSM role-based access control for administrator separation.

Answer

Generate the CA key inside the HSM and store a passphrase-protected copy in an encrypted configuration management database for disaster recovery.