CAS-004 Security Engineering Practice Test 5 — 15 Questions

Question 1

A security engineer is implementing a secure remote access solution using IPsec in tunnel mode. The engineer must ensure that the solution provides both confidentiality and integrity for traffic between two sites. Which two protocols should be used together to achieve these security goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internet Key Exchange (IKE). To achieve confidentiality and integrity in an IPsec tunnel, ESP is used for encryption and optional authentication, while IKE handles the negotiation and establishment of security associations. ESP in tunnel mode encapsulates the entire original IP packet and encrypts it, and IKE automates the key exchange and algorithm negotiation. Together, they provide a secure VPN tunnel.

Answer

Authentication Header (AH)

Answer

Secure Sockets Layer (SSL)

Answer

Generic Routing Encapsulation (GRE)

Question 2

An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?

Accepted Answer

AH in tunnel mode. IPsec AH (Authentication Header) provides data integrity and authentication but not confidentiality (no encryption). Tunnel mode encapsulates the entire IP packet, which is suitable for site-to-site VPNs. Since confidentiality is not a concern, AH in tunnel mode is the correct choice. ESP would provide confidentiality, which is unnecessary here.

Answer

ESP in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 3

An organization wants to implement a privileged access management (PAM) solution to manage administrative credentials. They require that administrators request temporary access to privileged accounts and that these credentials are automatically rotated after each use. Which PAM approach best meets these requirements?

Accepted Answer

Just-in-time access provisioning with credential rotation. Just-in-time (JIT) access provisioning grants privileged credentials only for the duration of a task and automatically rotates or revokes them afterward, directly matching the requirement for temporary access with post-use rotation. This approach minimizes standing privileges and the attack surface. Password vaulting with checkout (A) provides temporary access but does not inherently rotate credentials after each use unless combined with rotation workflows.

Answer

Password vaulting with checkout

Answer

Privileged account session management

Answer

Break-glass account procedures

Question 4

A company is deploying IoT sensors that require secure firmware updates over the air (OTA). To ensure integrity and authenticity of the firmware, which of the following should be implemented?

Accepted Answer

Code signing with a trusted certificate. Code signing with a trusted certificate provides both integrity and authenticity: the firmware is hashed and signed by the vendor's private key, and the device verifies the signature using the vendor's public key. This ensures the firmware has not been tampered with and originates from a trusted source. Hash verification alone only checks integrity, not authenticity.

Answer

Secure boot on the device

Answer

Hash verification only

Answer

Encryption of the firmware image

Question 5

Which of the following certificate types is most appropriate for an organization that needs to validate the identity of individuals for email encryption and signing?

Accepted Answer

S/MIME certificate. S/MIME certificates are specifically designed for securing email. Client certificates are for authentication. Code signing is for software. DV certificates are for websites.

Answer

Domain Validation (DV) certificate

Answer

Client authentication certificate

Answer

Code signing certificate

Question 6

A security administrator is hardening SSH access to a jump host. The requirement is to allow only key-based authentication and restrict the use of weak cryptographic algorithms. Which of the following configurations accomplishes this?

Accepted Answer

Set PubkeyAuthentication yes, PasswordAuthentication no, and configure Ciphers and MACs to strong algorithms only. It explicitly enables public key authentication (PubkeyAuthentication yes), disables password-based authentication (PasswordAuthentication no), and restricts cryptographic algorithms by configuring the Ciphers and MACs directives to only strong algorithms. This directly satisfies both requirements: key-only authentication and elimination of weak crypto. The other options either leave password authentication enabled or do not address weak algorithms.

Answer

Set PermitRootLogin prohibit-password and PasswordAuthentication yes

Answer

Set PasswordAuthentication yes and use a strong password policy

Answer

Set AuthenticationMethods publickey,keyboard-interactive

Question 7

An organization is implementing a PKI to issue certificates for internal applications. The security team wants to minimize the risk of compromise to the root CA. Which of the following is the BEST practice to protect the root CA?

Accepted Answer

Keep the root CA offline and store its private key in a hardware security module. Keeping the root CA offline and using a hardware security module (HSM) for key storage ensures its private key is never exposed to network threats. This is a standard best practice.

Answer

Delegate root CA responsibilities to a public CA

Answer

Install the root CA on a VM with strict firewall rules

Answer

Use a self-signed certificate for the root CA and distribute it manually

Question 8

An organization is deploying a new IoT device that must securely update its firmware over the air (OTA). The device has limited processing power and memory. Which cryptographic solution would provide the BEST balance of security and performance for verifying firmware updates?

Accepted Answer

Ed25519 digital signatures. Ed25519 is a fast and secure digital signature algorithm that performs well on constrained devices. RSA 4096 is computationally expensive. HMAC-SHA256 is a symmetric key technique and requires key management overhead. AES-256-GCM is for encryption, not verification.

Answer

RSA-4096 digital signatures

Answer

HMAC-SHA256 with pre-shared key

Answer

AES-256-GCM for authentication

Question 9

An enterprise is deploying a multi-factor authentication (MFA) solution. The security team requires a factor that is resistant to phishing and does not rely on shared secrets. Which of the following MFA types BEST meets this requirement?

Accepted Answer

FIDO2/WebAuthn security keys. FIDO2/WebAuthn uses public-key cryptography, with the private key stored on the device, and the protocol is designed to be phishing-resistant by binding credentials to the origin. TOTP/HOTP rely on shared secrets and are vulnerable to phishing. Hardware tokens like YubiKey can implement FIDO2. Biometrics are a factor but not inherently phishing-resistant alone.

Answer

Biometric fingerprint scanner

Answer

SMS one-time passcodes

Answer

TOTP via authenticator app

Question 10

A security administrator is configuring IPsec VPN between two sites. The data transmitted includes sensitive financial records. The administrator wants to ensure both confidentiality and integrity of the data, and also wants to authenticate the source. Which IPsec protocol and mode should be used?

Accepted Answer

ESP in tunnel mode. ESP (Encapsulating Security Payload) provides both confidentiality and integrity (optionally authentication). AH only provides integrity and authentication but not confidentiality. Transport mode encrypts only the payload, while tunnel mode encrypts the entire IP packet. For site-to-site VPN, tunnel mode is typically used.

Answer

AH in tunnel mode

Answer

ESP in transport mode

Answer

AH in transport mode

Question 11

A security architect is designing a just-in-time (JIT) privileged access management (PAM) solution. Which TWO of the following are key characteristics of JIT access?

Accepted Answer

Access rights are automatically revoked after use or expiry.. Option B is correct because a defining property of JIT PAM is that elevated rights are time-bound and automatically revoked once the task completes or the approved window expires, eliminating lingering standing privileges. Option D is correct because JIT access grants privileges on-demand only when needed, for a limited duration, rather than provisioning them permanently in advance. Together, B and D capture the core JIT model: just-in-time, just-enough, and time-limited elevation. Option A is wrong because JIT privileges are temporary, not permanent, even if approval workflows are involved. Option C is wrong because break-glass accounts are an emergency fallback mechanism, not a defining characteristic of JIT access itself. Option E is wrong because standing privileges for routine tasks directly contradict the JIT principle of eliminating always-on access.

Answer

Privileges are permanent but require approval each time.

Answer

Break-glass accounts are used for emergency access.

Answer

Users have standing privileges for routine tasks.

Question 12

A security engineer is hardening an SSH server. The policy requires disabling all legacy algorithms and using only modern, secure cryptography. Which THREE of the following configurations should the engineer apply?

Accepted Answer

Set HMAC algorithms to use only SHA-2 or stronger.. Option A is correct because configuring the MAC (HMAC) list to SHA-2 or stronger (e.g., hmac-sha2-256, hmac-sha2-512) removes weak legacy integrity algorithms such as hmac-md5 and hmac-sha1, which are vulnerable to collision and downgrade attacks. Option D is correct because disabling password authentication and permitting only public-key authentication eliminates brute-force and credential-replay risks, since SSH keys provide stronger, non-reusable cryptographic proof of identity. Option E is correct because restricting KEX algorithms to curve25519-sha256 uses modern elliptic-curve Diffie-Hellman with strong forward secrecy, excluding outdated groups like diffie-hellman-group1-sha1. Option B is wrong because SSH protocol version 1 is deprecated and insecure (vulnerable to MITM and CRC-32 attacks); only SSH-2 should be allowed. Option C is wrong because enabling direct root login with a password violates least-privilege and hardening best practices, exposing the most privileged account to brute-force attacks.

Answer

Allow only SSH protocol version 1 for compatibility.

Answer

Enable root login with password for administrative convenience.

Question 13

A security architect is selecting a cipher suite for TLS 1.3 to ensure forward secrecy and high performance. Which cipher suite should be recommended?

Accepted Answer

TLS_AES_256_GCM_SHA384. TLS_AES_256_GCM_SHA384 is the only option that is a valid TLS 1.3 cipher suite. TLS 1.3 removed RSA key transport and all CBC-mode ciphers, mandating AEAD (Authenticated Encryption with Associated Data) ciphers and ephemeral key exchange for forward secrecy. This suite uses AES-256 in GCM mode for authenticated encryption and SHA-384 for the HKDF-based key schedule, delivering both high performance (AES-NI accelerated) and strong security.

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Answer

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Answer

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Question 14

An organization is implementing SSH hardening for server access. Which configuration change most effectively reduces the attack surface against brute-force and credential theft?

Accepted Answer

Enable public-key authentication and disable password authentication.. Public-key authentication replaces the shared secret (password) with an asymmetric key pair, so there is no reusable credential an attacker can brute-force or steal via phishing/keylogging. Disabling password authentication also eliminates the entire class of credential-guessing attacks against SSH. This is the single most impactful hardening step because it removes the attack vector rather than merely slowing it down.

Answer

Change the default SSH port from 22 to a high-numbered port.

Answer

Set MaxAuthTries to 6 to limit login attempts.

Answer

Use TCP wrappers to restrict source IP addresses.

Question 15

A system administrator needs to securely store cryptographic keys and perform signing operations in a tamper-resistant hardware device. Which solution should be used?

Accepted Answer

A Hardware Security Module (HSM) with FIPS 140-2 Level 3 certification.. An HSM (Hardware Security Module) is designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment.

Answer

A secure enclave like Intel SGX.

Answer

A software-based key store with encrypted files.

Answer

A Trusted Platform Module (TPM) 2.0.