CAS-004 Security Architecture — 100 Questions

Question 1

A company is deploying a cloud access security broker (CASB) to gain visibility into shadow IT. Which mode of operation would allow the CASB to inspect traffic without requiring proxy configuration on endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

API-based mode. API-based (out-of-band) CASB mode connects directly to sanctioned cloud services via their published APIs to scan data at rest, classify content, and detect shadow IT usage — no endpoint proxy or traffic redirection is required. Because it works through provider APIs rather than inline traffic inspection, it provides visibility without touching the endpoint network path.

Answer

Reverse proxy mode

Answer

Inline mode

Answer

Forward proxy mode

Question 2

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

Accepted Answer

Pod Security Policies. Pod Security Policies (PSPs) were the Kubernetes-native control to restrict what pods can run, including privileged containers, host namespaces, and volume types. They allowed cluster admins to define a set of conditions a pod must meet to be admitted. This directly addresses ensuring only authorized containers run.

Answer

Secrets management

Answer

Network policies

Answer

RBAC

Question 3

An organization wants to enforce that only signed container images are deployed in production. Which of the following should be implemented?

Accepted Answer

Image signing and verification in the registry. Enforcing that only signed container images are deployed requires cryptographic signing at build/push time and verification at pull/deploy time. Image signing and verification in the registry (e.g., Docker Content Trust/Notary, Sigstore Cosign, or cloud-native equivalents) provides the cryptographic guarantee of provenance and integrity. Without signing and verification, there is no way to prove an image is trusted.

Answer

Network policies

Answer

Container runtime security (e.g., seccomp)

Answer

Admission controllers

Question 4

A company is implementing a defense-in-depth strategy for its web application. Which THREE of the following are layers that should be included? (Select THREE.)

Accepted Answer

Application security controls (WAF, input validation). Option A is correct because application-layer defenses such as a WAF and strict input validation directly protect the web app from injection, XSS, and other OWASP-style attacks, forming a key layer in defense-in-depth. Option C is correct because encrypting data at rest (e.g., AES-256 on storage) and in transit (e.g., TLS 1.2/1.3) ensures confidentiality and integrity even if perimeter or host controls are bypassed. Option D is correct because network firewalls and IDS/IPS provide perimeter and monitoring controls that detect and block malicious traffic before it reaches the application tier. Option B does not belong because SSO without MFA weakens authentication rather than adding a defensive layer, and Option E, while a valid control, is not one of the three layers the question expects for this web-application defense-in-depth scenario.

Answer

Single sign-on (SSO) without MFA

Answer

Physical security of the data center

Question 5

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode CASB deployment connects directly to the SaaS provider's public APIs (e.g., Microsoft Graph, Google Workspace APIs) using privileged credentials, allowing it to inspect data at rest, scan for sensitive content, and enforce DLP without any client software or inline traffic interception. Because it works out-of-band via APIs, it can see encrypted SaaS data after the provider decrypts it, without needing to break TLS itself. This matches the requirement of inspecting encrypted traffic without client software.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 6

A company needs to connect its on-premises data center to a public cloud provider with low latency and high bandwidth while avoiding the public internet. Which connectivity method should be used?

Accepted Answer

Direct Connect. Direct Connect provides a dedicated, private physical network connection between an on-premises data center and the cloud provider, bypassing the public internet entirely. This delivers consistent low latency, high bandwidth, and predictable performance that internet-based connections cannot guarantee. It is the standard AWS/Azure/GCP solution for hybrid connectivity requiring private, high-throughput links.

Answer

Client VPN

Answer

Site-to-site VPN

Answer

SD-WAN

Question 7

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

Accepted Answer

SWG. The Secure Web Gateway (SWG) is the SASE component that inspects web traffic — both on-premises and remote — enforcing URL filtering, malware scanning, and data loss prevention regardless of user location. It sits in the cloud-delivered security stack and proxies or inspects all web-bound traffic, which is exactly the 'security inspection for all traffic, regardless of location' described.

Answer

ZTNA

Answer

CASB

Answer

SD-WAN

Question 8

An organization is implementing a CASB to secure their SaaS applications. Which CASB deployment mode is most appropriate for monitoring and controlling data in transit between users and cloud apps without modifying the user's device?

Accepted Answer

API-based. API-based CASB connects directly to the cloud app's API to monitor and control data, without requiring client software.

Answer

Reverse proxy

Answer

Forward proxy

Answer

Inline gateway

Question 9

A company is deploying containers in a Kubernetes cluster and needs to enforce that containers run with reduced capabilities. Which Linux security feature should be configured to drop unnecessary capabilities?

Accepted Answer

AppArmor. To drop unnecessary capabilities in a Linux container, the correct Linux security feature is AppArmor. AppArmor is a Mandatory Access Control (MAC) system that can be configured with profiles to restrict capabilities granted to processes. By defining an AppArmor profile that drops specific capabilities (e.g., using the 'capability' rule set to deny), administrators can enforce that containers run with reduced privileges. While Seccomp filters system calls, it does not directly manage capabilities. PodSecurityPolicy is a Kubernetes resource, not a Linux feature. SELinux can also control capabilities but is more complex and less commonly used for this specific purpose in container environments.

Answer

PodSecurityPolicy

Answer

Seccomp

Answer

SELinux

Question 10

An organization is concerned about future quantum computer attacks on their public key infrastructure. Which NIST-standardized algorithm is designed for digital signatures and is resistant to quantum attacks?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is one of the NIST-standardized post-quantum cryptographic algorithms (FIPS 204) specifically designed for digital signatures, based on the hardness of module lattice problems. It was selected by NIST in July 2022 as the primary signature standard for quantum resistance.

Answer

Falcon

Answer

RSA-4096

Answer

CRYSTALS-Kyber

Question 11

An organization is hardening its Kubernetes cluster. Which THREE of the following are effective controls to limit the blast radius of a compromised container?

Accepted Answer

Implementing Kubernetes network policies to restrict pod-to-pod communication. Option B is correct because Kubernetes NetworkPolicies enforce pod-level firewall rules that restrict which pods can communicate with each other, so a compromised container cannot freely reach other workloads or exfiltrate data laterally. Option D is correct because seccomp profiles restrict the set of Linux system calls a container may invoke, shrinking the kernel attack surface and blocking exploit primitives even if the container is compromised. Option E is correct because enforcing Pod Security Standards, especially the 'restricted' policy, blocks privileged pods, host namespace sharing, and other risky settings that would otherwise let a compromised container escalate to the node. Option A is not among the marked answers: RBAC limits what API actions a service account can perform, but it does not directly contain the runtime blast radius of a compromised container. Option C is also not marked: image scanning is a preventive supply-chain control that finds known vulnerabilities before deployment, not a runtime containment mechanism for an already compromised container.

Answer

Using RBAC to restrict service account permissions

Answer

Performing regular container image scanning for vulnerabilities

Question 12

A company is migrating sensitive workloads to the cloud and must comply with FedRAMP requirements. Which of the following is the most appropriate cloud deployment model?

Accepted Answer

Community cloud. A community cloud is shared by several organizations with common compliance, security, or regulatory requirements, and FedRAMP-authorized community clouds are specifically designed to meet U.S. federal security standards. This model lets the company leverage a pre-authorized environment that already satisfies FedRAMP controls, reducing the burden of achieving compliance independently. It is the most appropriate because it balances compliance alignment with cost-sharing among similarly regulated tenants.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 13

An organization is deploying a Kubernetes cluster and needs to harden security. Which THREE controls should be implemented? (Choose three.)

Accepted Answer

Role-Based Access Control (RBAC). RBAC (A) is correct because it enforces least-privilege access by binding Roles/ClusterRoles to users, groups, and ServiceAccounts, restricting who can perform verbs on Kubernetes API resources. Admission controllers (B) are correct because they intercept API requests before persistence, enabling enforcement of policies such as PodSecurity admission, image signature verification, and mutation/validation of manifests. Network policies (D) are correct because they implement pod-level segmentation, controlling ingress and egress traffic between pods and namespaces to limit lateral movement. Seccomp profiles (C) are not marked correct here because, while they restrict syscalls at the container runtime, they are a workload-level hardening control rather than one of the three controls this scenario expects. Service mesh (E) is not marked correct because it primarily provides mTLS, traffic management, and observability, which are valuable but not a core cluster-hardening control in this context.

Answer

Seccomp profiles

Answer

Service mesh

Question 14

An organization is implementing a zero trust architecture and needs to enforce identity-centric access for all resources. Which THREE components are essential to this approach?

Accepted Answer

User and entity behavior analytics (UEBA). In a zero trust architecture, identity is the primary control plane, so multi-factor authentication (MFA) (E) is essential because it strengthens identity verification beyond a single credential and directly supports the 'never trust, always verify' principle for every access request. A policy enforcement point (PEP) (C) is also essential because it is the component that actually allows, denies, or revokes access to a resource based on the decision from the policy decision point (PDP), making identity-centric enforcement technically possible at each resource. User and entity behavior analytics (UEBA) (A) is essential because zero trust requires continuous verification and risk evaluation, and UEBA provides behavioral baselines and anomaly detection that feed adaptive policy decisions about users and entities. Network segmentation (B) is useful in zero trust and defense-in-depth, but it is a network-centric control rather than an identity-centric component, so it is not one of the three essential identity-focused components here. A virtual private network (VPN) (D) is not essential because zero trust replaces implicit trust based on network location with per-request identity and policy evaluation, and a VPN alone grants broad network-level access rather than enforcing identity-centric access to each resource.

Answer

Network segmentation

Answer

Virtual private network (VPN)

Question 15

An organization is implementing SASE to secure remote user access. Which component of SASE is responsible for enforcing identity-based access policies and inspecting traffic?

Accepted Answer

Secure Web Gateway. The Secure Web Gateway (SWG) is the SASE component that inspects web traffic, enforces acceptable-use and identity-based access policies, and blocks malicious content for remote users. In a SASE architecture, SWG provides URL filtering, TLS inspection, malware detection, and data loss prevention for web-bound traffic. This makes it the component responsible for policy enforcement and traffic inspection in the remote-access use case.

Answer

SD-WAN

Answer

Cloud Access Security Broker

Answer

Next-Generation Firewall

Question 16

A security engineer is integrating API security for a RESTful service. Which mechanism is used to verify that the API request has not been tampered with and originates from a legitimate client?

Accepted Answer

JWT. JWT (JSON Web Token) is used to verify the integrity and authenticity of API requests. A JWT is digitally signed, allowing the recipient to verify that the token was issued by a legitimate authority and has not been tampered with. OAuth 2.0 is for authorization, API keys are for identification, and rate limiting is for throttling.

Answer

OAuth 2.0 authorization code

Answer

API key in query parameter

Answer

Rate limiting

Question 17

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which algorithm is recommended for digital signatures?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is one of the NIST Post-Quantum Cryptography (PQC) standards selected for digital signatures, finalized in FIPS 204 (ML-DSA). It is a lattice-based signature scheme chosen for its strong security and efficient performance across a range of platforms. NIST selected Dilithium as the primary recommended algorithm for digital signatures in its PQC standardization effort.

Answer

Falcon

Answer

CRYSTALS-Kyber

Answer

RSA-4096

Question 18

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which THREE algorithms are currently selected for standardization? (Select THREE).

Accepted Answer

CRYSTALS-Kyber. NIST has selected CRYSTALS-Kyber (for key encapsulation), CRYSTALS-Dilithium (for digital signatures), and FALCON (for digital signatures, with SPHINCS+ as a backup) for standardization. RSA and ECDH are not quantum-resistant.

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

RSA-4096

Question 19

An enterprise is securing a hybrid cloud environment with on-premises and AWS workloads. They need to ensure that on-premises systems can privately access VPC resources without traversing the public internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet. It offers consistent low latency and high bandwidth, making it ideal for hybrid cloud environments requiring private access to VPC resources. Site-to-site VPN uses the public internet, while Transit Gateway and PrivateLink serve different purposes.

Answer

AWS VPN (site-to-site)

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 20

An organization is designing a PKI for certificate lifecycle management. Which TWO practices are critical for maintaining the security of the certificate authority (CA)? (Select TWO.)

Accepted Answer

Storing the root CA private key in a hardware security module (HSM). Option B is correct because storing the root CA private key in a hardware security module (HSM) protects the most sensitive secret in the PKI: the HSM provides tamper-resistant key storage, enforces cryptographic operations without exposing the key material, and supports FIPS 140-2/140-3 validated modules, so compromise of the CA host does not directly yield the root key. Option E is correct because implementing Online Certificate Status Protocol (OCSP) enables real-time revocation checking, allowing relying parties to detect certificates that were revoked before expiration (e.g., due to key compromise), which is essential to limiting the damage from a compromised issuing CA or leaf certificate. Option A is not appropriate because long validity periods increase the window of exposure and delay revocation-driven remediation, weakening CA security rather than strengthening it. Option C is not a CA-hardening practice; certificate pinning is a client-side control against mis-issuance/MITM but does not protect the CA itself. Option D is not a security practice for a CA, since self-signed certificates for internal services bypass a trusted hierarchy and provide no third-party validation or revocation infrastructure.

Answer

Setting long certificate validity periods to reduce renewal frequency

Answer

Using certificate pinning to prevent man-in-the-middle attacks

Answer

Using self-signed certificates for all internal services