CAS-004 Security Engineering Practice Test 4 — 15 Questions

Question 1

A company is implementing MFA for remote access. Which TWO factors are considered possession factors?

Accepted Answer

A hardware OTP token. Possession factors are things the user has: a hardware token or a smartphone (for soft tokens). Biometrics and passwords are not possession factors.

Answer

A fingerprint scan

Answer

A PIN

Answer

A password

Question 2

A security engineer is configuring a VPN between two sites and needs to ensure data confidentiality and integrity. Which IPsec mode and protocol combination should be used to encrypt the entire IP packet including the header?

Accepted Answer

Tunnel mode with ESP. IPsec tunnel mode with ESP encrypts and authenticates the entire IP packet, providing confidentiality and integrity. Transport mode only encrypts the payload, and AH provides integrity without encryption.

Answer

Transport mode with ESP

Answer

Transport mode with AH

Answer

Tunnel mode with AH

Question 3

An organization is implementing a hardware security module (HSM) to protect cryptographic keys used for code signing. The HSM is required to meet a government standard for physical security and tamper resistance. Which FIPS 140 security level must the HSM achieve to provide tamper-evident coatings and tamper response mechanisms?

Accepted Answer

FIPS 140-2 Level 3. FIPS 140-2 Level 3 requires tamper-evident coatings and tamper response mechanisms that zeroize keys upon tampering. Level 2 requires tamper-evident coatings but no response, Level 4 is for extreme environments.

Answer

FIPS 140-2 Level 4

Answer

FIPS 140-2 Level 2

Answer

FIPS 140-2 Level 1

Question 4

A company is deploying a new authentication system that leverages FIDO2/WebAuthn. Security architects want to ensure that the private key never leaves the authenticator device. Which attack vector is mitigated by this approach?

Accepted Answer

Server-side database breach exposing credentials. FIDO2/WebAuthn uses public-key cryptography where the private key is generated on the authenticator and never exported. This prevents server-side database breaches from compromising private keys, as there are no shared secrets stored on the server.

Answer

Man-in-the-middle attacks on TLS

Answer

Replay attacks on authentication tokens

Answer

Phishing attacks

Question 5

A security administrator is configuring SSH for a jump host used to access critical servers. Which of the following is the most secure configuration option to restrict authentication and reduce the attack surface?

Accepted Answer

Allow only key-based authentication. Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

Answer

Enable root login with a strong password

Answer

Allow only SSH protocol version 2

Answer

Change the default port to 2222

Question 6

An IoT device manufacturer wants to ensure that firmware updates are authentic and have not been tampered with. The device has limited computational resources. Which cryptographic primitive is most appropriate for verifying the integrity and authenticity of firmware images?

Accepted Answer

Digital signature using ECDSA P-384. Digital signatures provide both integrity and authenticity. RSA is too computationally intensive for constrained devices; ECDSA or Ed25519 are more suitable. The question asks for the primitive, so digital signatures is the correct category.

Answer

SHA-256 hash only

Answer

Symmetric MAC using AES-256-GCM

Answer

HMAC-SHA256 with a device-specific key

Question 7

An organization is implementing a PKI and wants to ensure that clients can quickly check if a certificate has been revoked without downloading a large list. Which protocol should be used?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP (Online Certificate Status Protocol) allows clients to check the revocation status of a single certificate in real time without downloading a full CRL.

Answer

Certificate Revocation List (CRL)

Answer

Certificate Transparency (CT)

Answer

Simple Certificate Enrollment Protocol (SCEP)

Question 8

A security architect is designing a secure boot process for a new line of embedded devices. The boot ROM loads the bootloader, which then loads the OS kernel. To ensure that only signed code is executed, which mechanism should the bootloader use to verify the kernel?

Accepted Answer

Verify a digital signature on the kernel using a public key stored in the boot ROM. The bootloader should verify a digital signature on the kernel image using a public key embedded in the boot ROM or bootloader. This ensures both integrity and authenticity of the kernel.

Answer

Decrypt the kernel using a symmetric key stored in the boot ROM

Answer

Check that the kernel file size matches the expected value

Answer

Compare the kernel hash against a list of known good hashes stored in the bootloader

Question 9

During a security audit, it was discovered that an application uses RSA with 1024-bit keys for encrypting sensitive data. The organization's security policy mandates a minimum of 128-bit symmetric equivalent security. Which of the following should be recommended as a replacement?

Accepted Answer

RSA with 3072-bit keys. RSA 2048 provides approximately 112-bit security, while RSA 3072 provides 128-bit. AES-256-GCM is symmetric, not asymmetric. ECDSA is for signatures, not encryption. So RSA 3072 is the correct choice.

Answer

AES-256-GCM

Answer

ECDSA P-384

Answer

RSA with 2048-bit keys

Question 10

A company is implementing a privileged access management (PAM) solution to reduce the risk of standing privileges. Which feature allows users to request temporary elevated access for a specific task, which is automatically revoked after the task is completed?

Accepted Answer

Just-in-time (JIT) access provisioning. Just-in-time (JIT) access provisioning grants temporary privileges that expire after use, reducing standing privileges. Break-glass accounts are emergency accounts, not time-based.

Answer

Break-glass accounts

Answer

Password vaulting

Answer

Session recording

Question 11

A security team wants to implement a certificate pinning strategy for their mobile application to prevent man-in-the-middle attacks. Which of the following should be pinned in the application code?

Accepted Answer

The server's public key. Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Answer

The intermediate CA certificate

Answer

The server's IP address

Answer

The root CA certificate

Question 12

An organization is moving to a passwordless authentication approach. They require a solution that supports hardware-based cryptographic authentication and is resistant to phishing. Which standard should they implement?

Accepted Answer

FIDO2/WebAuthn. FIDO2/WebAuthn uses public-key cryptography and hardware authenticators to provide phishing-resistant, passwordless authentication. TOTP is not passwordless and can be phished.

Answer

TOTP (Time-based One-Time Password)

Answer

SMS-based one-time codes

Answer

Password manager with autofill

Question 13

A security engineer is reviewing a TLS 1.3 configuration. Which of the following is a key feature of TLS 1.3 that improves security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 removes support for insecure cipher suites like CBC mode and RC4, and only supports AEAD ciphers. It also provides forward secrecy by default.

Answer

Support for RC4 cipher suite

Answer

Support for static RSA key exchange

Answer

Ability to downgrade to TLS 1.2

Question 14

An organization is setting up a PKI with a three-tier hierarchy (root CA, issuing CA, and registration authority). Which TWO of the following are best practices for securing the root CA?

Accepted Answer

Keep the root CA offline and physically secured. The root CA should be kept offline to prevent compromise, and its private key should be stored in an HSM. The issuing CA handles day-to-day operations.

Answer

Allow the root CA to be accessible over the network for certificate requests

Answer

Enable CRL distribution points on the root CA

Answer

Use the root CA to issue end-entity certificates directly

Question 15

An IoT device uses a Trusted Platform Module (TPM) 2.0 for secure boot and attestation. Which THREE of the following functions does the TPM provide to support these security features?

Accepted Answer

Platform Configuration Registers (PCRs) for storing measurements. TPM 2.0 provides secure boot (via PCR measurement), remote attestation (via quote operation), and sealed storage (binding data to PCR values). Measured boot is a process that uses TPM to record measurements.

Answer

Accelerated symmetric encryption

Answer

Hardware random number generation