CAS-004 Security Engineering Practice Test 3 — 15 Questions

Question 1

An organization is planning to deploy digital certificates for various use cases. Which TWO of the following certificate types are typically used for email security?

Accepted Answer

Client certificates. S/MIME certificates are specifically used for secure email (encryption and signing). Client certificates can also be used for email authentication (e.g., in some setups). Code signing is for software, DV/OV/EV are for websites.

Answer

Code signing certificates

Answer

Extended validation (EV) certificates

Answer

Domain-validated (DV) certificates

Question 2

A security architect is selecting a cipher suite for TLS 1.3 to ensure forward secrecy and high performance. Which cipher suite should be recommended?

Accepted Answer

TLS_AES_256_GCM_SHA384. TLS 1.3 requires forward secrecy and uses AEAD ciphers. AES-256-GCM is a recommended AEAD cipher with strong security and performance.

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Answer

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Question 3

A company wants to implement certificate pinning for its mobile app to prevent man-in-the-middle attacks. Which approach is most secure and maintainable?

Accepted Answer

Pin the SHA-256 hash of the server's public key.. Pinning the public key hash rather than the certificate itself allows certificate rotation without updating the app, as long as the key pair remains the same.

Answer

Pin the entire certificate chain, including the root CA certificate.

Answer

Pin the Subject Public Key Info (SPKI) using base64 encoding.

Answer

Pin the issuing CA certificate only.

Question 4

During a PKI migration, the security team discovers that some internal clients do not support OCSP stapling but require online certificate status checking. Which alternative should be configured to minimize latency and ensure validity?

Accepted Answer

Use a local OCSP responder to handle revocation checks within the internal network.. OCSP stapling is not supported; traditional OCSP requests add latency. A locally hosted OCSP responder reduces network round trips compared to relying on external CAs.

Answer

Switch to self-signed certificates to avoid revocation checking altogether.

Answer

Configure clients to use CRLDP with a local CRL distribution point.

Answer

Disable CRL checking and rely on certificate expiration only.

Question 5

An organization is implementing SSH hardening for server access. Which configuration change most effectively reduces the attack surface against brute-force and credential theft?

Accepted Answer

Enable public-key authentication and disable password authentication.. Disabling password authentication and requiring key-based authentication eliminates the risk of password brute-force attacks and credential theft via phishing.

Answer

Change the default SSH port from 22 to a high-numbered port.

Answer

Set MaxAuthTries to 6 to limit login attempts.

Answer

Use TCP wrappers to restrict source IP addresses.

Question 6

A system administrator needs to securely store cryptographic keys and perform signing operations in a tamper-resistant hardware device. Which solution should be used?

Accepted Answer

A Hardware Security Module (HSM) with FIPS 140-2 Level 3 certification.. An HSM (Hardware Security Module) is designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment.

Answer

A secure enclave like Intel SGX.

Answer

A software-based key store with encrypted files.

Answer

A Trusted Platform Module (TPM) 2.0.

Question 7

A security analyst is investigating a potential side-channel attack on an IoT device. The device's cryptographic operations show variable execution times based on the key and plaintext. Which mitigation is most effective against timing attacks?

Accepted Answer

Use constant-time cryptographic implementations.. Timing attacks exploit variations in execution time. Using constant-time algorithms ensures that operations take the same amount of time regardless of input, preventing information leakage.

Answer

Use a faster processor to reduce execution time.

Answer

Implement random delays in cryptographic operations.

Answer

Disable caching in the CPU during cryptographic operations.

Question 8

A PKI administrator is concerned about the risk of a compromised issuing CA. Which certificate transparency feature helps detect unauthorized certificate issuance?

Accepted Answer

Certificate Transparency logs. Certificate Transparency (CT) requires all certificates to be publicly logged in CT logs. This allows domain owners and CAs to monitor for misissuance.

Answer

CRL distribution points

Answer

OCSP stapling

Answer

Key usage extensions

Question 9

An organization wants to implement passwordless authentication for its employees using FIDO2/WebAuthn. What is a primary security advantage of this approach over traditional password-based MFA?

Accepted Answer

It is resistant to phishing attacks because credentials are bound to the origin.. FIDO2 uses public key cryptography; the private key never leaves the user's device, so phishing attacks cannot steal credentials. This provides strong resistance to phishing.

Answer

It eliminates the need for a second factor.

Answer

It allows users to reuse the same credential across multiple websites.

Answer

It does not require any client-side hardware.

Question 10

Which hashing algorithm is recommended for modern applications requiring high security and resistance to quantum computing threats, and offers improved performance over SHA-2?

Accepted Answer

SHA-3. SHA-3 is the latest NIST-standardized hash function, designed to be resistant to quantum attacks and offers a different structure from SHA-2, with good performance.

Answer

RIPEMD-160

Answer

MD5

Answer

SHA-256

Question 11

A security engineer is configuring IPsec VPN between two sites. The requirement is to encrypt the entire IP packet, including the original IP header. Which IPsec mode and protocol should be used?

Accepted Answer

Tunnel mode with ESP. Tunnel mode with ESP encrypts the entire original IP packet and adds a new IP header, which is required for gateway-to-gateway VPNs. ESP provides encryption and optional authentication.

Answer

Transport mode with AH

Answer

Tunnel mode with AH

Answer

Transport mode with ESP

Question 12

An organization is deploying a just-in-time (JIT) privileged access management solution. What is a key benefit of JIT access compared to standing privileged accounts?

Accepted Answer

It reduces the window of exposure for privileged credentials.. JIT access provides temporary privileges that are automatically revoked after use, reducing the attack surface and limiting lateral movement.

Answer

It allows users to permanently elevate privileges.

Answer

It eliminates the need for multi-factor authentication.

Answer

It requires no audit logging.

Question 13

A company is implementing measured boot using TPM 2.0. What is the primary purpose of storing boot measurements in Platform Configuration Registers (PCRs)?

Accepted Answer

To enable remote attestation of the system's boot state.. PCRs store hashes of boot components; these measurements are used for remote attestation to verify the integrity of the boot process.

Answer

To speed up the boot process.

Answer

To provide a root of trust for storage (sealed storage).

Answer

To encrypt the bootloader.

Question 14

A security architect is designing a secure OTA update mechanism for IoT devices. Which TWO features are essential to ensure the integrity and authenticity of firmware updates?

Accepted Answer

Secure boot chain that verifies the signature of the update before installation. Digital signatures ensure authenticity and integrity; a secure boot chain verifies the signature before executing the update, preventing unauthorized firmware.

Answer

Firmware encryption with AES-256-CTR

Answer

Use of a hardware security module (HSM) on the device for key storage

Answer

Compression of the firmware image to reduce transfer size

Question 15

An organization is planning to deploy a new internal CA hierarchy. Which THREE considerations are critical for ensuring the security and manageability of the PKI?

Accepted Answer

Keep the root CA offline and only bring it online for cross-certification or disaster recovery.. A multi-tier hierarchy (root offline, issuing CAs) limits exposure; strong hashing and key algorithms are essential; CRL/OCSP distribution points must be accessible for revocation checking.

Answer

Use SHA-1 for certificate signing to ensure compatibility with legacy systems.

Answer

Use a single-tier CA to simplify management.