CAS-004 Security Architecture Practice Test 11 — 15 Questions

Question 1

A security architect is designing a defense-in-depth strategy for a web application. Which combination of controls provides overlapping protection against SQL injection attacks?

Accepted Answer

Input validation and parameterized queries. Input validation and parameterized queries provide overlapping, defense-in-depth protection against SQL injection: input validation rejects malformed or malicious input at the application boundary, while parameterized queries ensure user input is treated as data, not executable SQL, even if validation is bypassed. Together they address the root cause of SQLi at multiple layers.

Answer

Encryption and hashing

Answer

Intrusion detection system (IDS) and antivirus

Answer

Web application firewall (WAF) and network segmentation

Question 2

A company uses a multi-cloud strategy with workloads in AWS and Azure. They need a centralized solution to enforce consistent security policies across both cloud environments. Which type of tool should they deploy?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM continuously monitors cloud configurations against security benchmarks and compliance frameworks across multiple providers, providing a centralized view and policy enforcement for misconfigurations, drift, and compliance violations in AWS and Azure. This directly addresses the need for consistent security policy enforcement across both clouds.

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Security Information and Event Management (SIEM)

Question 3

An organization is migrating to an immutable infrastructure model for its containerized applications. Which practice is essential to ensure the integrity of the immutable infrastructure?

Accepted Answer

Image scanning and signing in the CI/CD pipeline. In an immutable infrastructure model, containers are never modified after deployment — instead, new images replace old ones. Therefore, integrity must be enforced at build time: scanning images for vulnerabilities and cryptographically signing them in the CI/CD pipeline ensures only trusted, verified artifacts are deployed. This shifts security left and guarantees that what runs in production is exactly what was tested and approved.

Answer

Regular patching of running containers

Answer

Runtime security monitoring with seccomp

Answer

Use of configuration management tools like Ansible

Question 4

A security engineer is hardening a Kubernetes environment. Which THREE of the following are effective controls for securing the cluster? (Select THREE.)

Accepted Answer

Enabling Pod Security Admission (PSA) to enforce pod security standards. Option B is correct because Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces the Privileged, Baseline, and Restricted Pod Security Standards at the namespace level, preventing pods from running with dangerous settings like privileged containers or hostPath mounts. Option C is correct because RBAC (Role-Based Access Control) restricts who can perform which verbs on which API resources via Roles/ClusterRoles and RoleBindings/ClusterRoleBindings, directly limiting unauthorized API server access and privilege escalation. Option D is correct because Network Policies are the native Kubernetes mechanism (enforced by a CNI such as Calico or Cilium) to control ingress and egress traffic between pods and namespaces, providing workload segmentation and limiting lateral movement. Option A is not a security control—load balancers configured for high availability address availability and resilience, not confidentiality, integrity, or access control. Option E is not appropriate for Kubernetes hardening: node-level antivirus does not secure the cluster's control plane, API access, or pod-level isolation, and containerized workloads are typically immutable and scanned via image scanning instead.

Answer

Configuring load balancers for high availability

Answer

Installing antivirus on all nodes

Question 5

Which TWO of the following are key benefits of using a software-defined perimeter (SDP) in a zero trust architecture? (Select TWO.)

Accepted Answer

Reduces the attack surface by hiding network resources. Option A is correct because SDP uses a "black cloud" or dark network approach where resources are cloaked and do not respond to unauthenticated probes, so attackers cannot see or scan them, directly shrinking the attack surface. Option D is correct because SDP enforces access decisions based on verified user and device identity (often via mutual TLS, SAML, or OIDC with a controller and gateway), which is the core identity-centric principle of zero trust. Option B is wrong because patch management is a vulnerability/patch lifecycle function, not a benefit of SDP. Option C is wrong because SDP actually depends on strong encryption such as mTLS and IPsec/TLS tunnels rather than eliminating it. Option E is wrong because SDP complements rather than removes firewalls, and it typically adds controller/gateway components instead of simplifying the architecture by deleting firewalls.

Answer

Automates patch management

Answer

Eliminates the need for encryption

Answer

Simplifies network architecture by removing firewalls

Question 6

A security architect is evaluating cryptographic agility for a system that must be resistant to quantum computing attacks. Which TWO algorithms are part of the NIST PQC standards? (Select TWO.)

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium (option B) is correct because NIST selected it in July 2022 as a post-quantum digital signature algorithm, standardized in FIPS 204 (ML-DSA), designed to resist quantum attacks via lattice-based cryptography. CRYSTALS-Kyber (option E) is also correct because NIST selected it as the post-quantum key-encapsulation mechanism (KEM), standardized in FIPS 203 (ML-KEM), also based on module-lattice hardness. RSA-4096 (option A) is not a PQC algorithm; its security relies on integer factorization, which Shor's algorithm on a quantum computer can break. AES-256 (option C) is a symmetric cipher, not a NIST PQC standard, though it retains quantum resistance via Grover only reducing effective strength to 128 bits. SHA-256 (option D) is a hash function, not a PQC algorithm, and is likewise not part of the NIST PQC standardization selections.

Answer

RSA-4096

Answer

AES-256

Answer

SHA-256

Question 7

A company is implementing a secure SDLC and wants to integrate application security testing early. Which THREE tools are most appropriate for shift-left security? (Select THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST (B) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find vulnerabilities like injection flaws during coding in the IDE or CI pipeline — the essence of shift-left. IAST (C) is correct because it instruments the running application (often via agents) during functional testing to detect vulnerabilities in real time with code-level detail, fitting early integration into dev/test workflows. SCA (D) is correct because it scans dependencies and third-party libraries for known CVEs and license issues, which is critical for shifting left since most modern code is composed of open-source components. RASP (A) is not appropriate here because it runs inside the application at runtime in production, protecting against live attacks rather than enabling early pre-deployment testing. DAST (E) is not selected because it tests a deployed running application from the outside (black-box), typically later in the pipeline, making it less aligned with early shift-left integration than SAST, IAST, and SCA.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 8

A financial institution is implementing a secure software development lifecycle (SSDLC) for a new web application that will handle sensitive transactions. The security architect must ensure that application security testing is integrated into the development process. Which THREE testing techniques should be used to identify vulnerabilities early and throughout the lifecycle? (Choose THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST (A) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find flaws such as injection patterns, insecure coding, and hardcoded secrets early in the SSDLC, even in CI pipelines. IAST (C) is correct because it instruments the running application and combines static and dynamic analysis to detect vulnerabilities during functional testing with high accuracy and code-level context, fitting continuous integration. DAST (D) is correct because it tests the deployed application from the outside by sending crafted requests to find runtime and configuration issues such as SQL injection, XSS, and authentication flaws in the running web app. RASP (B) is not a testing technique but a runtime protection mechanism that detects and blocks attacks in production, so it does not identify vulnerabilities early in development. Threat modeling (E) is a design-phase risk analysis activity, not an application security testing technique, so it does not satisfy the requirement for testing throughout the lifecycle.

Answer

Runtime Application Self-Protection (RASP)

Answer

Threat modeling

Question 9

An organization is planning to modernize its cryptographic infrastructure to protect sensitive data for the next 10 years. The security architect must consider future threats from quantum computing. Which TWO quantum-resistant algorithms should the architect prioritize for key encapsulation and digital signatures? (Choose TWO.)

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium (A) is correct because it is a NIST-selected post-quantum digital signature algorithm based on lattice cryptography, designed to resist attacks from both classical and quantum computers, making it suitable for long-term signing needs. CRYSTALS-Kyber (E) is correct because it is the NIST-selected post-quantum key encapsulation mechanism (KEM), also lattice-based, intended for establishing shared secrets resistant to quantum cryptanalysis. Together they cover the two required functions: Kyber for key encapsulation and Dilithium for digital signatures. AES-256 with GCM (B) is a symmetric cipher and does not provide quantum-resistant key encapsulation or signatures, though symmetric keys are less affected by quantum attacks. ECDSA with P-521 (C) and RSA-4096 (D) are classical asymmetric algorithms whose security would be broken by Shor's algorithm on a sufficiently large quantum computer, so they are not quantum-resistant.

Answer

AES-256 with GCM

Answer

ECDSA with P-521

Answer

RSA-4096

Question 10

A security architect is designing a hybrid environment in which on-premises applications must consume APIs hosted in a public cloud. The architect wants to ensure that if the primary cloud region fails, API consumers continue to receive responses without changing client configuration. Which design element BEST satisfies this requirement?

Accepted Answer

Deploy a global server load balancing tier that performs health-checked DNS failover across regional API endpoints.. Continuity across regions for API consumers is achieved by abstracting endpoints behind a health-aware global load balancing layer that removes failed regions from resolution and returns healthy ones. Caching, versioning, and single-region reverse proxies all leave the consumer dependent on the failed region or require client changes, so they do not meet the requirement.

Answer

Configure a forward proxy on the on-premises network that caches API responses for the duration of the outage.

Answer

Place the API behind a reverse proxy that terminates TLS and inspects request payloads for malicious content.

Answer

Implement API versioning so consumers can switch to an alternate endpoint when the primary region becomes unavailable.

Question 11

A financial services firm must allow third-party partners to call internal REST APIs. Partners authenticate with their own OAuth 2.0 authorization servers, and the firm must validate tokens without sharing secrets and enforce per-partner rate limits and scopes. Which approach BEST meets these requirements?

Accepted Answer

Configure the API gateway to trust partner-issued JWTs by validating signatures against published JSON Web Key Sets and mapping claims to scopes and rate limits.. Trusting externally issued tokens through published JSON Web Key Sets allows signature verification with public keys, eliminating secret sharing. Claim mapping at the gateway then enforces scopes and per-partner throttling, which is exactly the combination the scenario demands. Symmetric keys, VPN client certificates, and session reissuance each fail at least one stated requirement.

Answer

Terminate partner tokens at the gateway and reissue firm-issued session cookies for subsequent API calls.

Answer

Require partners to connect through a dedicated VPN and authenticate with client certificates issued by the firm's internal certificate authority.

Answer

Issue each partner a shared symmetric key and validate HMAC-signed requests at the API gateway.

Question 12

A security architect at a financial services firm must ensure that virtual machine workloads on a private cloud cannot execute unauthorized binaries, even if an attacker gains root access. The solution must enforce policy at the hypervisor layer without relying on agents inside the guest OS. Which of the following should the architect implement?

Accepted Answer

Virtual machine introspection (VMI) with hypervisor-enforced integrity monitoring. Hypervisor-based introspection enforces policy outside the guest OS, so even root-level malware cannot disable the control. It provides tamper-resistant visibility and can prevent execution of unauthorized binaries, meeting the agentless and root-resistant requirements. Agent-based tools and log correlation are either bypassable or detective only.

Answer

File integrity monitoring (FIM) of /usr/bin on each virtual machine

Answer

Security information and event management (SIEM) correlation with guest OS logs

Answer

Host-based intrusion prevention system (HIPS) installed on each guest OS

Question 13

A security architect is designing a microsegmentation strategy for a data center hosting both legacy monolithic applications and new containerized workloads. The architect must reduce lateral movement while minimizing disruption to existing traffic flows. (Choose two.)

Accepted Answer

Map application dependencies and traffic flows before defining segmentation policy so that legitimate communication paths are preserved.. Effective microsegmentation starts with understanding real traffic dependencies, then enforces least-privilege rules anchored to workload identity so policy survives address churn in mixed legacy and container environments. Blanket deny-with-manual-opening, perimeter-only appliances, and uniform static lists either disrupt operations or fail to constrain east-west movement.

Answer

Apply identical static access control lists to every subnet regardless of the workloads hosted there.

Answer

Replace all existing firewalls with a single perimeter appliance that inspects north-south traffic at the data center edge.

Answer

Disable all inter-tier communication by default and require application teams to open ports manually after each deployment.

Question 14

A healthcare provider must allow clinicians to access patient records from personal mobile devices while ensuring that data cannot be copied to unauthorized apps or stored locally. The organization wants to enforce this without managing the entire device. Which of the following should the security architect implement?

Accepted Answer

Mobile application management (MAM) with app-level encryption and containerization. MAM with app-level encryption and containerization enforces data protection at the application layer, allowing personal device use while preventing patient data from being copied to unauthorized apps or stored locally. It avoids the privacy concerns of full device management and directly addresses the data leakage requirement.

Answer

Virtual desktop infrastructure (VDI) with clipboard redirection disabled

Answer

Mobile threat defense (MTD) with behavioral anomaly detection

Answer

Mobile device management (MDM) with full device wipe capability

Question 15

A security architect at a healthcare provider must design a solution that lets clinicians access patient records from managed laptops and personal tablets without exposing the internal electronic health record (EHR) network. The requirement is that no inbound firewall ports be opened and that access decisions evaluate device posture and user identity on every session. Which solution best meets these requirements?

Accepted Answer

Implement a Zero Trust Network Access (ZTNA) service that brokers outbound-only connections after continuous identity and device-posture checks.. Zero Trust Network Access matches the stated constraints because it inverts the traditional model: users connect outbound to a broker, the internal EHR network is never published, and authorization is continuously re-evaluated based on identity and device posture. VPN concentrators, reverse proxies, and network access control all require either inbound exposure or do not deliver per-session verification.

Answer

Publish the EHR through a reverse proxy in the DMZ and require digital certificates on all client devices.

Answer

Segment the clinical VLAN and apply 802.1X port-based authentication to all wired and wireless access switches.

Answer

Deploy a hardware VPN concentrator in the DMZ and issue IPsec client profiles to all clinical endpoints.