CAS-004 Security Engineering Practice Test 5 — 15 Questions

Question 1

A security assessor is evaluating an application that uses ChaCha20-Poly1305 for encryption. Which TWO of the following are true about this cryptographic algorithm?

Accepted Answer

It is a stream cipher. ChaCha20-Poly1305 is a stream cipher (ChaCha20) combined with a MAC (Poly1305). It is an AEAD cipher. It is not a block cipher, and it does not require padding.

Answer

It is based on the AES algorithm

Answer

It requires padding to achieve correct block sizes

Answer

It is a block cipher

Question 2

A security architect is designing a VPN that requires both authentication and encryption. Which IPsec protocol provides both services in a single protocol?

Accepted Answer

ESP in tunnel mode. ESP provides both encryption and optional authentication, while AH only provides authentication without encryption.

Answer

AH in transport mode

Answer

IKEv2

Answer

AH in tunnel mode

Question 3

An organization wants to implement a hardware root of trust for measuring system integrity at boot. Which technology should be used to store measurements in Platform Configuration Registers (PCRs) and support remote attestation?

Accepted Answer

TPM 2.0. TPM 2.0 provides PCRs for measured boot and supports attestation, making it suitable for hardware root of trust.

Answer

HSM

Answer

Secure Enclave

Answer

UEFI Secure Boot

Question 4

A security engineer is configuring a web server to use TLS 1.3. Which feature of TLS 1.3 should be disabled to prevent replay attacks in 0-RTT mode?

Accepted Answer

0-RTT. 0-RTT data is vulnerable to replay; disabling 0-RTT eliminates this risk. However, the question asks what should be disabled to prevent replay attacks in 0-RTT mode, so the answer is 0-RTT itself.

Answer

Session resumption

Answer

Forward secrecy

Answer

Cipher suite negotiation

Question 5

A PKI administrator is deploying certificates for code signing. Which certificate type should be used to ensure that the signed code can be verified by clients without requiring a full chain validation?

Accepted Answer

Code signing certificate. Code signing certificates are specifically designed for signing software; they are typically issued by a publicly trusted CA.

Answer

EV certificate

Answer

S/MIME certificate

Answer

DV certificate

Question 6

An organization requires a cryptographic algorithm that provides both encryption and authentication in a single pass. Which algorithm should be selected?

Accepted Answer

AES-256-GCM. AES-256-GCM is an authenticated encryption mode that provides both confidentiality and integrity in a single operation.

Answer

AES-256-CBC

Answer

SHA-256

Answer

RSA 4096

Question 7

A company is implementing a passwordless authentication solution using FIDO2/WebAuthn. What is the primary security advantage of this approach over traditional password-based authentication?

Accepted Answer

It prevents phishing attacks by using cryptographic keys.. FIDO2 uses public key cryptography, so private keys never leave the device, preventing credential theft.

Answer

It allows users to share passwords securely.

Answer

It reduces server storage requirements.

Answer

It eliminates the need for multi-factor authentication.

Question 8

During a security assessment, an engineer discovers that a smartcard used for authentication is vulnerable to side-channel attacks. Which countermeasure would best mitigate power analysis attacks?

Accepted Answer

Adding redundant cryptographic operations to equalize power consumption. Power analysis attacks exploit variations in power consumption; constant-time algorithms and power smoothing hardware help mitigate this.

Answer

Using a shielded enclosure to reduce electromagnetic emissions

Answer

Increasing the key length

Answer

Implementing a hardware random number generator

Question 9

A company wants to ensure that a compromised root CA does not affect the validity of previously issued certificates. Which PKI control should be implemented?

Accepted Answer

Offline root CA and online issuing CA. CRLs and OCSP allow revocation, but offline root CA and issuing CA separation ensure that compromise of root does not directly affect issued certs if root is kept offline.

Answer

Certificate pinning

Answer

Certificate transparency logs

Answer

Short-lived certificates

Question 10

Which key exchange algorithm provides perfect forward secrecy (PFS) and is recommended for use in TLS 1.3?

Accepted Answer

ECDHE. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides PFS as session keys are ephemeral.

Answer

RSA key exchange

Answer

Pre-shared key (PSK)

Answer

Diffie-Hellman (DH)

Question 11

An IoT device manufacturer wants to ensure secure firmware updates. Which approach best protects against malicious firmware being installed on devices?

Accepted Answer

Digitally sign the firmware with a private key. Code signing with a trusted key ensures only authorized firmware can be installed.

Answer

Compress the firmware to reduce size

Answer

Use a hash of the firmware for integrity verification

Answer

Encrypt the firmware with a symmetric key

Question 12

A security architect is designing a system that requires hardware-enforced isolation for sensitive computations. Which technology provides the strongest isolation by running code in a protected environment within the CPU?

Accepted Answer

Intel SGX. Intel SGX provides enclaves that isolate code and data even from the operating system, offering strong hardware isolation.

Answer

HSM

Answer

TPM 2.0

Answer

ARM TrustZone

Question 13

A company is implementing a Privileged Access Management (PAM) solution to manage admin credentials. Which feature allows administrators to request temporary elevated access for a specific task?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provisioning grants rights only when needed, reducing standing privileges.

Answer

Session recording

Answer

Password vaulting

Answer

Break-glass accounts

Question 14

A security engineer is hardening SSH server configuration. Which TWO options improve security? (Select TWO.)

Accepted Answer

Restrict allowed key exchange algorithms to strong ones. Restricting key exchange algorithms to strong ones (B) prevents downgrade attacks and ensures only secure cryptographic methods are used. Using key-based authentication only (C) eliminates password-based vulnerabilities such as brute-force and credential theft. Option D (disable root login) is also a security best practice but is not one of the two required selections in this question. Option A weakens security by allowing weak ciphers, and option E introduces password authentication which increases attack surface.

Answer

Allow all cipher suites for compatibility

Answer

Disable root login via SSH

Answer

Enable password authentication for convenience

Question 15

An organization is deploying a new PKI and wants to ensure certificate revocation is performed efficiently. Which THREE methods should be implemented? (Select THREE.)

Accepted Answer

Online Certificate Status Protocol (OCSP). CRL, OCSP, and OCSP stapling are all standard revocation checking mechanisms; OCSP stapling improves performance by having the server present the OCSP response.

Answer

Short-lived certificates

Answer

Certificate transparency logs