CAS-004 Security Architecture Practice Test 10 — 15 Questions

Question 1

An organization is adopting a DevSecOps approach and wants to integrate security early in the development lifecycle. Which practice involves creating visual representations of threats and identifying potential attack vectors during the design phase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat modeling. Threat modeling is a structured process that visually maps system components, data flows, and trust boundaries to identify potential threats and attack vectors during the design phase. It aligns with DevSecOps by shifting security left, enabling teams to address risks before code is written. Frameworks like STRIDE and tools like Microsoft Threat Modeling Tool are commonly used to create these visual representations.

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Answer

Runtime application self-protection (RASP)

Question 2

A company is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run in the cluster. Which Kubernetes resource should be used to enforce policies on what containers can run, including image source restrictions?

Accepted Answer

Admission controllers. Admission controllers intercept requests to the Kubernetes API server before objects are persisted, and can validate or mutate them — including rejecting pods whose images come from unauthorized registries or lack required signatures. This is the correct enforcement point for cluster-wide policy on what containers may run.

Answer

Role-Based Access Control (RBAC)

Answer

Network policies

Answer

Seccomp profiles

Question 3

Which of the following is a benefit of using an immutable infrastructure approach?

Accepted Answer

Elimination of configuration drift. Immutable infrastructure means servers are never modified in place — instead, new instances are built from a known-good image and old ones are replaced. This eliminates configuration drift because every instance is identical to its image, and any change requires a new image and redeployment. Manual patching and hardware reuse are not benefits of this model.

Answer

Reduced need for configuration management

Answer

Easier manual patching of running servers

Answer

Lower cost due to reusable hardware

Question 4

An organization uses a hardware security module (HSM) to protect cryptographic keys. Which aspect of key management does an HSM primarily address?

Accepted Answer

Secure key storage and cryptographic operations. An HSM (Hardware Security Module) is a tamper-resistant physical device whose primary purpose is to securely generate, store, and use cryptographic keys without ever exposing them in plaintext outside the device boundary. It performs cryptographic operations (signing, encryption, key derivation) internally, so keys never leave the protected hardware. This directly addresses secure key storage and cryptographic operations.

Answer

Key rotation

Answer

Key escrow

Answer

Digital certificate issuance

Question 5

A security architect is evaluating a SASE solution. Which capability is expected to be part of a SASE platform?

Accepted Answer

Secure web gateway (SWG). Secure Web Gateway (SWG) is one of the core converged capabilities of a SASE platform, alongside CASB, ZTNA, FWaaS, and SD-WAN. SASE merges network and security functions into a cloud-delivered service, and SWG provides web filtering, malware inspection, and policy enforcement for user web traffic. It is explicitly expected in a SASE architecture.

Answer

Intrusion prevention system (IPS) at the data center

Answer

Network segmentation via VLANs

Answer

Virtual private network (VPN) concentrator

Question 6

An organization must comply with FedRAMP requirements for a cloud service. Which aspect of cloud security is most directly assessed under FedRAMP?

Accepted Answer

Security controls of the cloud service provider. FedRAMP most directly assesses the security controls of the cloud service provider (CSP). The entire FedRAMP process is designed to evaluate, authorise, and continuously monitor the security posture of a CSP's offering against NIST SP 800-53 controls. While data residency, cost, and performance may be considerations, they are not the primary focus of FedRAMP assessment.

Answer

Data residency compliance

Answer

Cost optimization of cloud resources

Answer

Performance SLA

Question 7

Which of the following is a key feature of TLS 1.3 compared to earlier versions?

Accepted Answer

Reduced handshake latency. TLS 1.3 reduces handshake latency by combining the ClientHello and key share into a single round trip (1-RTT) and supporting 0-RTT resumption for repeat connections. It also removes legacy features like static RSA key exchange, RC4, and SSL 3.0 compatibility. The net effect is faster connection establishment without sacrificing security.

Answer

Mandatory use of static RSA key exchange

Answer

Support for RC4 cipher

Answer

Backward compatibility with SSL 3.0

Question 8

A security architect is designing a zero trust network architecture and needs to implement micro-segmentation. Which TWO of the following techniques are commonly used to achieve micro-segmentation? (Select TWO).

Accepted Answer

Software-defined networking (SDN) policies. Option B (Software-defined networking (SDN) policies) is correct because SDN centralizes control-plane policy and lets you program fine-grained, workload-level segmentation rules (e.g., via flow tables and distributed policy enforcement) rather than relying only on coarse network boundaries. Option D (Host-based firewalls) is correct because enforcing allow/deny rules directly on each workload's OS (e.g., Windows Defender Firewall, iptables/nftables, or a host agent) provides identity- and workload-centric micro-segmentation that follows the host even across network changes. Option A (NAC) is not the intended answer here because NAC primarily controls device admission and compliance at the network edge, not granular east-west workload-to-workload policy. Option C (IPsec VPN tunnels between subnets) is not correct because it provides encrypted connectivity between subnets, not the fine-grained segmentation policy itself. Option E (VLAN segmentation) is not correct because VLANs are coarse Layer 2 broadcast-domain partitions, not the granular, often identity-based micro-segmentation required in zero trust.

Answer

Network Access Control (NAC)

Answer

IPsec VPN tunnels between subnets

Answer

VLAN segmentation

Question 9

A company is implementing API security for its web services. Which THREE of the following are considered best practices for securing APIs? (Select THREE).

Accepted Answer

Validate all input. Option B (Validate all input) is correct because input validation defends against injection attacks such as SQL injection and cross-site scripting (XSS) by ensuring data conforms to expected formats, types, and lengths before processing. Option D (Implement rate limiting) is correct because throttling requests per client or API key mitigates brute-force, credential-stuffing, and denial-of-service abuse, and protects backend resources from being overwhelmed. Option E (Use OAuth 2.0 for authorization) is correct because OAuth 2.0 provides delegated, token-based authorization with scoped access, allowing APIs to grant limited permissions without exposing user credentials. Option A does not belong because relying solely on symmetric encryption for data at rest ignores transport security, key management, and other layers of defense. Option C does not belong because WPA3 is a Wi-Fi (802.11) security standard for wireless LANs, not a transport encryption mechanism for web APIs, which should use TLS.

Answer

Rely solely on symmetric encryption for data at rest

Answer

Use WPA3 for transport encryption

Question 10

A security architect is designing a zero trust architecture for a financial institution. Which principle is fundamental to the zero trust model?

Accepted Answer

Assume breach and verify explicitly. The fundamental principle of zero trust is 'assume breach and verify explicitly,' meaning no user or device is trusted by default, regardless of location. Every access request must be authenticated and authorized based on multiple factors, and least privilege is enforced. This principle is core to zero trust architecture as defined by NIST SP 800-207.

Answer

Trust but verify all network traffic

Answer

Use VPNs for all remote access

Answer

Perimeter-based security is sufficient

Question 11

A company is migrating critical workloads to AWS and must secure data at rest. They need to maintain control over the encryption keys. Which service should they use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated hardware security modules that give the customer full control over encryption keys, including key generation, storage, and management. It meets the requirement of maintaining control over keys for data at rest because the keys are stored in tamper-resistant hardware and are not accessible to AWS. Other services like Secrets Manager and ACM manage keys but do not offer the same level of customer-controlled key custody.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Question 12

An organization is adopting a SASE architecture to provide secure access to cloud applications. Which component is essential for enforcing security policies based on user identity and device posture?

Accepted Answer

Zero Trust Network Access (ZTNA). Zero Trust Network Access (ZTNA) is essential for enforcing security policies based on user identity and device posture in a SASE architecture. ZTNA provides secure, identity-based access to applications, ensuring that only authenticated and authorized users with compliant devices can connect, regardless of location.

Answer

Firewall as a Service (FWaaS)

Answer

Secure Web Gateway (SWG)

Answer

Cloud Access Security Broker (CASB)

Question 13

A security analyst is reviewing a Kubernetes cluster's security configuration. Which component should be used to ensure that only authorized pods can communicate with each other?

Accepted Answer

Network Policies. Network Policies in Kubernetes are the native mechanism for controlling pod-to-pod traffic. They use label selectors to define which pods can communicate with which other pods on specified ports and protocols, effectively acting as a firewall at the pod level. Without a Network Policy, all pods in a cluster can communicate freely by default, so applying one is the correct way to restrict east-west traffic to only authorized flows.

Answer

Pod Security Policies (PSP)

Answer

Seccomp profiles

Answer

RBAC roles

Question 14

During a threat modeling exercise for a new web application, the team identifies a risk of API abuse due to lack of rate limiting. Which security control should be implemented at the API gateway to mitigate this risk?

Accepted Answer

Rate limiting policies. Rate limiting policies are the direct control to mitigate API abuse by restricting the number of requests a client can make within a time window. Implemented at the API gateway, they prevent denial-of-service, brute-force, and excessive consumption of backend resources. While other controls like input validation or OAuth scopes address different threats, rate limiting specifically targets the risk of API abuse due to lack of throttling.

Answer

Input validation

Answer

OAuth 2.0 scopes

Answer

JWT token expiration

Question 15

A company is required to comply with FedRAMP for its cloud deployment. Which of the following is a key requirement for FedRAMP compliance?

Accepted Answer

Third-party assessment by an accredited organization. FedRAMP requires that cloud service offerings undergo an independent third-party assessment by a FedRAMP-accredited Third Party Assessment Organization (3PAO) to validate security controls against NIST SP 800-53. This assessment is a cornerstone of the FedRAMP authorization process, ensuring an unbiased evaluation before a Joint Authorization Board (JAB) or agency grants an Authority to Operate (ATO). While continuous monitoring and incident response are also required, the key differentiator is the mandatory third-party assessment.

Answer

Continuous monitoring and incident response

Answer

Implementation of AES-256 encryption for all data

Answer

Annual penetration testing by internal team