CAS-004 Security Engineering Practice Test 13 — 15 Questions

Question 1

A security administrator is configuring a RADIUS server for a wireless network. The administrator wants to ensure that the shared secret between the access point and the RADIUS server is protected against eavesdropping. Which protocol should be used to encapsulate RADIUS traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RADIUS over TLS (RadSec). RadSec (RADIUS over TLS) is the standard protocol for securely encapsulating RADIUS traffic. It uses TLS to encrypt the entire RADIUS conversation, including the shared secret, protecting against eavesdropping. Other options either do not encrypt the RADIUS packet fully or are authentication methods that do not address the shared secret protection.

Answer

RADIUS with MS-CHAPv2

Answer

RADIUS over UDP with IPsec transport mode

Answer

RADIUS with EAP-TTLS

Question 2

A security architect is designing a zero trust architecture for a hybrid environment where users access internal applications from managed and unmanaged devices. The requirement is that access decisions consider device health and user identity on every request rather than relying on network location. Which of the following BEST implements this requirement?

Accepted Answer

Implement a policy engine that evaluates user identity and device posture from a device attestation service for each access request, brokered through a policy enforcement point. Zero trust requires a policy decision point that consumes identity and device-posture telemetry and a policy enforcement point that applies the decision to each request. Perimeter, bastion, and segmentation approaches all evaluate trust at connection or network admission time and do not continuously factor device health into every access decision.

Answer

Segment the internal network into microsegments with host-based firewalls and require 802.1X for all wired and wireless access

Answer

Require all users to connect through a bastion host that performs multi-factor authentication before reaching internal applications

Answer

Deploy a next-generation firewall with IP-based allow lists for the corporate VPN address pool and enable TLS inspection

Question 3

A security architect is designing a system that requires cryptographic separation of duties for key management. The organization wants to ensure that no single administrator can both generate and use a key without oversight. Which of the following key management practices BEST achieves this requirement?

Accepted Answer

Implementing dual control with split knowledge for key generation and usage. Dual control and split knowledge are specifically designed to enforce separation of duties. Dual control requires multiple authorizations, while split knowledge ensures that components of a key are divided among individuals. This combination prevents any single administrator from unilaterally generating and using a key, which is essential for high-assurance key management and compliance with standards like FIPS 140-2.

Answer

Using a hardware security module (HSM) to store all keys

Answer

Rotating keys automatically every 24 hours

Answer

Encrypting all keys with a master key stored in a software vault

Question 4

A security engineer is deploying a zero trust architecture for a hybrid cloud environment. The organization wants to enforce least privilege access to internal APIs. The engineer must select TWO mechanisms that provide continuous authentication and authorization for each API request. (Choose two.)

Accepted Answer

Mutual TLS (mTLS) with short-lived client certificates issued by an internal CA.. Continuous authentication and authorization in zero trust require identity-based mechanisms that evaluate every request. Mutual TLS with short-lived certificates verifies the client's identity cryptographically, while a service mesh sidecar enforces per-request authorization policies based on workload identity. Together, they ensure that each API call is authenticated and authorized based on dynamic policy, not static network trust.

Answer

OAuth 2.0 access tokens with a one-hour expiry and no refresh tokens.

Answer

Static API keys stored in a configuration file and rotated every 90 days.

Answer

IP allowlisting based on the source subnet of the API caller.

Question 5

A security architect is designing a zero trust architecture for a hybrid workforce that accesses internal applications from managed and unmanaged devices. The architect wants to enforce continuous verification of device and user trust for every session. Which TWO controls are essential to meet this goal? (Choose two.)

Accepted Answer

Enforce identity-aware access proxies that mediate every session and apply the policy decision to each request.. Continuous verification in zero trust depends on two functions working together: a policy decision point that evaluates identity, device posture, and context on every request, and identity-aware enforcement points that mediate sessions and apply those decisions inline. Together they replace implicit network trust with per-request authorization; perimeter rules, long-lived VPN sessions, and VLAN segmentation do not evaluate trust dynamically.

Answer

Require all traffic to traverse a traditional perimeter firewall with static rules based on internal IP subnets.

Answer

Issue long-lived VPN credentials so users authenticate once and retain access for the duration of the workday.

Answer

Segment the internal network into VLANs and rely on switch ACLs to isolate application tiers.

Question 6

A security engineer is implementing a solution to protect sensitive data stored in a database. The requirement is to ensure that even if the database files are stolen, the data cannot be read without access to a hardware security module (HSM). Which of the following should the engineer implement?

Accepted Answer

Transparent Data Encryption (TDE) with keys stored in an HSM. Transparent Data Encryption with keys stored in an HSM ensures that the encryption keys are protected by hardware and never exposed in software or configuration files. This means that even if the database files are stolen, decryption is impossible without the HSM. The other options either store keys insecurely or do not provide hardware-based key protection.

Answer

Application-level encryption with keys derived from a user password

Answer

Column-level encryption with keys stored in a configuration file

Answer

Disk encryption on the database server with keys stored in the operating system keyring

Question 7

A security architect is designing a network segmentation strategy for a critical industrial control system (ICS) environment. The architect must ensure that unauthorized devices cannot communicate with the ICS network even if they gain physical access to a network port. The architect decides to implement IEEE 802.1X with MAC Authentication Bypass (MAB) as a fallback. Which of the following is the MOST significant security weakness introduced by enabling MAB?

Accepted Answer

MAB allows any device to authenticate by spoofing a known MAC address, bypassing 802.1X authentication controls.. MAB authenticates devices by their MAC address, which is not a secret and can be easily spoofed. In an ICS environment where physical port access might be possible, an attacker could clone a permitted MAC address and bypass 802.1X controls. This defeats the goal of preventing unauthorized devices from communicating. Certificate-based methods or strict port security would be more robust, but MAB as a fallback introduces this spoofing vulnerability.

Answer

MAB transmits credentials in clear text, allowing an attacker to capture them and authenticate to the network.

Answer

MAB disables the use of RADIUS, forcing authentication to occur locally on the switch and reducing centralized control.

Answer

MAB requires the use of digital certificates on all endpoints, increasing administrative overhead and complexity.

Question 8

A security administrator is hardening a web server and wants to ensure that browsers cannot be tricked into sending requests over plain HTTP after an initial HTTPS visit. The administrator also wants to prevent protocol-downgrade attacks against the site. Which response header should be configured?

Accepted Answer

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Strict-Transport-Security tells the browser to rewrite future requests for the domain to HTTPS and to refuse insecure connections for the max-age window, which blocks downgrade attacks. The other headers address resource loading, framing, and referrer leakage respectively, none of which enforce transport security or prevent a fallback to HTTP.

Answer

Content-Security-Policy: default-src 'self'

Answer

X-Frame-Options: DENY

Answer

Referrer-Policy: no-referrer

Question 9

A security analyst is investigating a compromised Linux web server. The analyst needs to preserve volatile evidence before shutting the system down for forensic imaging. Which action should the analyst perform FIRST?

Accepted Answer

Capture the contents of physical memory and the current network connections.. Forensic handling follows the order of volatility, so the most transient data is collected first. RAM and network connections vanish on power loss or reboot, while disk contents persist. Capturing memory and live connections before imaging or analysis preserves evidence that would otherwise be unrecoverable.

Answer

Create a forensic image of the server's disk drives.

Answer

Review the application and system logs for signs of intrusion.

Answer

Shut down the server gracefully to prevent further attacker activity.

Question 10

A security engineer is implementing a hardware security module (HSM) to protect cryptographic keys used by a certificate authority (CA). The engineer must ensure that the HSM provides strong protections against key extraction and unauthorized use. Which of the following are security properties that the HSM should provide? (Choose two.)

Accepted Answer

Tamper-responsive mechanisms that zeroize keys upon physical intrusion.. Tamper-responsive mechanisms and role-based access control with separation of duties are essential security properties for an HSM protecting CA keys. Tamper responsiveness prevents physical key extraction, while RBAC with separation of duties prevents unauthorized logical access. The other options either provide insufficient protection or weaken security.

Answer

FIPS 140-2 Level 1 validation for the cryptographic module.

Answer

Support for exporting private keys in plaintext for backup purposes.

Answer

The ability to run arbitrary code within the HSM to extend functionality.

Question 11

A security engineer is implementing a secure enclave using Intel SGX for a sensitive application. The engineer must ensure that the enclave's memory is protected from a compromised operating system. Which of the following BEST describes how SGX achieves this protection?

Accepted Answer

The enclave's memory is encrypted by the CPU's memory encryption engine (MEE) and integrity-protected, so the OS cannot read or tamper with it.. Intel SGX protects enclave memory using the CPU's memory encryption engine, which encrypts data leaving the CPU and verifies integrity on return. This prevents a compromised OS from reading or altering enclave memory. Other options incorrectly describe SGX as using VMs, ACLs, or separate secure elements, which are not how SGX provides isolation.

Answer

The enclave runs in a separate virtual machine that is isolated by the hypervisor, preventing the OS from accessing its memory.

Answer

The enclave's memory is protected by a hardware-based access control list (ACL) that the OS cannot modify.

Answer

The enclave's code and data are stored in a dedicated secure element (SE) that is physically separate from the main CPU.

Question 12

A security engineer is configuring a web application firewall (WAF) to protect against injection attacks. The application uses a relational database and reflects user input in HTML pages. The engineer must choose a WAF rule set that provides the BEST protection with minimal false positives. Which approach should the engineer take?

Accepted Answer

Deploy the WAF in learning mode to baseline normal traffic, then enable targeted rules for SQL injection and XSS with virtual patching for known vulnerabilities.. The best approach is to use learning mode to understand normal traffic, then enable targeted SQL injection and XSS rules along with virtual patching for known vulnerabilities. This minimizes false positives while providing strong protection. Generic blocking rules, overly broad regex, or disabling WAF rules entirely either cause operational issues or reduce defense-in-depth.

Answer

Create custom regular expression rules that block any request containing single quotes, double quotes, or angle brackets.

Answer

Enable the WAF's generic SQL injection and cross-site scripting (XSS) rules in blocking mode with a default action of deny.

Answer

Rely solely on the database's parameterized queries and disable all WAF injection rules to avoid false positives.

Question 13

A security engineer is configuring a secure boot process for a Linux server using UEFI. The engineer wants to ensure that only signed bootloaders and kernels are executed. Which of the following components is responsible for verifying the signature of the bootloader?

Accepted Answer

The UEFI signature database (db). In UEFI Secure Boot, the firmware uses the signature database (db) to validate the bootloader's signature. The db contains trusted certificates and hashes. When the bootloader is loaded, the firmware checks its signature against the db. If it matches, the bootloader runs; otherwise, boot is halted or an error is shown. This ensures only trusted code executes.

Answer

The bootloader's own signature check

Answer

The Key Exchange Key (KEK)

Answer

The UEFI firmware's Platform Key (PK)

Question 14

A security administrator must ensure that log data collected from servers across multiple sites cannot be altered or deleted by an attacker who compromises a single server. Which of the following BEST achieves this?

Accepted Answer

Forward logs in real time to a centralized logging platform with append-only storage and restricted administrative access. Centralizing logs with real-time forwarding removes the single point of failure and append-only storage with restricted access prevents tampering or deletion even if one server is fully compromised. Local encryption, retention changes, and database encryption all leave authoritative copies within reach of the compromised host.

Answer

Configure each server to write logs to a local encrypted volume and enable file integrity monitoring on the log directory

Answer

Increase local log retention to one year and rotate log files daily with compression enabled

Answer

Enable verbose logging on all servers and store the logs in a database that uses transparent data encryption

Question 15

A security engineer is reviewing how a Transport Layer Security session derives its keys and protects data. The engineer wants to identify the mechanisms that provide confidentiality and integrity for application data in TLS 1.3. (Choose two.)

Accepted Answer

HKDF-based key schedule using the transcript hash. In TLS 1.3, confidentiality and integrity for application data come from AEAD ciphers such as AES-GCM and ChaCha20-Poly1305, whose keys are produced by the HKDF-based key schedule bound to the handshake transcript. The certificate signature authenticates the peer, while randoms, session IDs, and compression do not protect record data.

Answer

The server certificate's RSA signature over the handshake

Answer

The ClientHello random value and session ID

Answer

Compression of the record payload before encryption