CAS-004 Security Architecture Practice Test 12 — 15 Questions

Question 1

A security architect is designing a system that must detect tampering with archived audit logs even if an attacker later gains administrative access to the log storage. The logs must remain verifiable for seven years without exposing their contents to the storage provider. Which design BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute a hash chain over log entries, sign each checkpoint with a private key held in an offline hardware security module, and encrypt logs with keys the provider cannot access.. Tamper-evident archival requires cryptographic binding of entries plus signatures produced with a key the attacker cannot reach, combined with encryption whose keys the storage provider does not hold. Hash chains detect alteration, offline hardware security module signing prevents forgery of new checkpoints, and provider-inaccessible keys preserve confidentiality across the retention period.

Answer

Encrypt each log file with a symmetric key stored alongside the files and rely on file permissions to prevent modification.

Answer

Upload plaintext logs to object storage with versioning enabled and enable a write-once retention lock on the bucket.

Answer

Replicate logs to a second region and compare file checksums between regions during quarterly audits.

Question 2

A financial services firm is designing a microsegmentation strategy for its VMware-based private cloud. The security team wants to enforce east-west policy based on workload identity rather than IP address, and it must survive IP address changes during automated redeployments. Which approach best satisfies these requirements?

Accepted Answer

Install host-based firewall agents on each virtual machine and manage rules through a central console keyed to workload labels.. Microsegmentation requires policy that follows the workload rather than the network. Host-based enforcement managed by workload labels keeps rules valid across IP changes caused by automated redeployments and allows east-west policy expressed in terms of identity. VLAN, private VLAN, and perimeter firewall approaches all bind policy to topology, which the scenario explicitly rules out.

Answer

Create VLANs per application tier and enforce inter-VLAN access control lists on the core switches.

Answer

Deploy a next-generation firewall between the data center core and aggregation layers and define zones by subnet.

Answer

Use 802.1Q trunking to isolate each application into a dedicated broadcast domain and apply private VLANs.

Question 3

A financial services company is designing a hybrid cloud environment. The security architect must ensure that data in transit between the on-premises data center and the cloud provider is protected against interception and that the cloud provider cannot read the data. The company also needs to meet strict compliance requirements for key management. Which of the following should the architect implement to BEST meet these requirements?

Accepted Answer

Deploy a customer-managed VPN gateway with hardware security modules (HSMs) for key storage and use IPsec with customer-managed certificates.. The requirement is to protect data in transit from interception and ensure the cloud provider cannot read it, while meeting strict key management compliance. A customer-managed VPN gateway with HSMs and customer-managed certificates ensures that encryption keys are controlled by the company, not the provider. IPsec provides strong encryption, and HSMs offer secure key storage, satisfying both security and compliance.

Answer

Implement a dedicated AWS Direct Connect connection with MACsec encryption.

Answer

Use TLS 1.3 with mutual authentication for all data transfers and store private keys in a cloud-based key management service.

Answer

Configure a site-to-site VPN using IPsec with pre-shared keys managed by the cloud provider.

Question 4

A security architect is designing a data loss prevention (DLP) program for a multinational retailer that processes payment card data and personally identifiable information. The program must discover sensitive data at rest across on-premises file shares and cloud storage, and it must prevent sensitive data from leaving the organization through email and web uploads. Which two capabilities are essential for this program? (Choose two.)

Accepted Answer

Content inspection using pattern matching and data classifiers to identify regulated data types.. A functioning DLP program needs both accurate identification of regulated content and an enforcement point where policy can act. Content inspection with classifiers supplies the identification, while egress enforcement at email and web gateways supplies the prevention. Encryption, SIEM correlation, and segmentation are valuable controls but do not deliver either of the two required DLP capabilities.

Answer

Security information and event management (SIEM) correlation of DLP alerts with threat intelligence feeds.

Answer

Full-disk encryption on all endpoint devices and servers that store regulated data.

Answer

Network segmentation of the cardholder data environment using internal firewalls.

Question 5

A security architect is designing a microsegmentation strategy for a data center hosting a three-tier application (web, application, database). The organization wants to enforce least-privilege east-west traffic without relying on IP addresses, and must ensure that workloads can move between hypervisors without requiring rule changes. Which technology best meets these requirements?

Accepted Answer

Software-defined networking with distributed firewalls that apply policy based on workload identity tags. Microsegmentation requires granular, identity-based policy enforcement for east-west traffic that remains consistent as workloads move. Distributed firewalls integrated with SDN use workload tags to apply rules regardless of IP changes, providing least-privilege segmentation. Perimeter firewalls, VLAN ACLs, and host IPS lack the combination of identity awareness and mobility support needed here.

Answer

A next-generation firewall deployed at the perimeter with application-aware rules

Answer

VLAN segmentation with access control lists applied on the core switch

Answer

Host-based intrusion prevention systems installed on each virtual machine

Question 6

A security architect is designing a system that must detect tampering with archived audit logs even if an attacker later gains administrative access to the log storage. The logs must remain verifiable for seven years without exposing their contents to the storage provider. Which design BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transparent data encryption (TDE) at the database level. Transparent data encryption encrypts database files at rest without requiring application changes, providing confidentiality and integrity with minimal performance impact. It is specifically designed for the scenario's constraints, unlike application-level encryption or transit encryption.

Answer

Application-level encryption of each field before storage

Answer

Full disk encryption (FDE) on the database server's storage volumes

Answer

Network encryption using TLS for all database connections

Question 7

A financial services firm runs its customer portal on a Kubernetes cluster in AWS. During a penetration test, an attacker who compromised a front-end pod moved laterally to a database pod by directly connecting to its IP address, even though no NetworkPolicy existed. The security architect must implement a control that enforces least-privilege communication between pods and blocks all unauthorized east-west traffic by default. Which of the following should the architect implement?

Accepted Answer

Configure a Kubernetes NetworkPolicy with a default-deny ingress rule and explicit allow rules for required pod-to-pod flows.. The requirement is to enforce least-privilege pod-to-pod communication and block unauthorized east-west traffic by default. Kubernetes NetworkPolicy is the native control that operates at the pod level and can implement a default-deny posture with explicit allow rules. Node-level Security Groups and egress gateways do not provide pod-level segmentation, and mTLS without authorization policy does not deny connections.

Answer

Enable AWS Security Groups for the worker nodes and restrict inbound rules to the node CIDR block.

Answer

Deploy a service mesh sidecar proxy and enforce mutual TLS between all services.

Answer

Apply egress-only internet gateway rules to prevent pods from reaching external networks.

Question 8

A security architect is evaluating a third-party SaaS provider for a critical business function. The provider will process sensitive customer data and must demonstrate compliance with the organization's security requirements. The architect needs to obtain assurance about the provider's security controls without conducting an on-site audit. Which of the following should the architect request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent validation of control effectiveness over a period, directly addressing the need for assurance without an on-site audit. It is the standard mechanism for assessing SaaS providers' security and compliance posture.

Answer

Self-attestation questionnaire completed by the provider

Answer

SOC 2 Type I report

Answer

Penetration test summary from the provider

Question 9

A healthcare provider is designing a new system to process protected health information (PHI) in a public cloud. The security architect must ensure that data is encrypted at rest and that the organization retains full control over the encryption keys, including the ability to revoke access immediately if a cloud administrator account is compromised. The cloud provider must not be able to decrypt the data. Which of the following key management approaches BEST meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK) with keys stored in an external hardware security module (HSM) under the organization's control. HYOK with an external HSM ensures the organization retains sole control of root keys, preventing the cloud provider from decrypting data. Because the external HSM is outside the provider's environment, access can be revoked immediately by disabling the key, which meets the strict confidentiality and revocation requirements for PHI.

Answer

Customer-managed keys (CMK) stored in the cloud provider's KMS with key rotation enabled

Answer

Provider-managed keys stored in the cloud provider's key management service (KMS)

Answer

Bring Your Own Key (BYOK) where the customer imports keys into the provider's KMS

Question 10

A security architect at a healthcare provider must ensure that electronic protected health information (ePHI) stored in an on-premises Microsoft SQL Server database is unreadable if the physical media is stolen. The organization has strict performance requirements and cannot tolerate application changes or key management outside its own hardware security modules (HSMs). Which SQL Server feature BEST meets these requirements?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) encrypts the database files at rest without requiring application changes and supports key protection through an HSM via Extensible Key Management. The other options either require application modifications or do not encrypt data at rest, leaving the stolen media scenario unresolved.

Answer

Dynamic Data Masking (DDM)

Answer

Always Encrypted with secure enclaves

Answer

Row-Level Security (RLS)

Question 11

A healthcare provider must allow clinicians to access a SaaS electronic health record from unmanaged personal devices without installing agents. The security architect needs to enforce contextual access decisions based on device posture, user identity, and location, while keeping the EHR session isolated from the local browser. Which of the following should the architect implement?

Accepted Answer

A Secure Access Service Edge (SASE) platform with a remote browser isolation (RBI) component and identity-based policies.. The need is agentless access from unmanaged devices with contextual decisions and session isolation. A SASE platform with remote browser isolation and identity-based policies enforces access based on user, device posture, and location while keeping the EHR session in a cloud container. VDI, API-mode CASB, and NGFW each address parts of the problem but fail to deliver the combined agentless, contextual, isolated access.

Answer

A next-generation firewall (NGFW) with TLS inspection and application control.

Answer

A cloud access security broker (CASB) in API mode with data loss prevention policies.

Answer

A virtual desktop infrastructure (VDI) environment hosted in the provider's data center.

Question 12

A security architect at a financial services firm is designing the network for a new containerized trading platform. The platform must enforce Layer 7 policy, provide mutual TLS between all microservices, and eliminate the need to reconfigure each application for cryptographic identity. Which architecture should the architect implement?

Accepted Answer

A service mesh that uses sidecar proxies to intercept all service-to-service traffic and perform mutual TLS. The service mesh architecture uses sidecar proxies to intercept all service-to-service communication, enabling transparent mutual TLS and Layer 7 policy enforcement without modifying application code. This satisfies the demand for cryptographic identity across microservices and eliminates per-application reconfiguration, making it the appropriate design for a containerized trading platform.

Answer

A VPN concentrator that creates an encrypted overlay network between all container hosts

Answer

A network intrusion prevention system (NIPS) deployed inline at the cluster edge

Answer

An API gateway that terminates TLS and routes requests to backend microservices

Question 13

A healthcare organization is designing a new system to store patient records. The security architect must ensure that data at rest is encrypted and that cryptographic keys are rotated regularly without re-encrypting the entire database. Which of the following techniques should be used?

Accepted Answer

Envelope encryption using a data encryption key (DEK) per record and a key encryption key (KEK) managed by a key management service (KMS).. Envelope encryption separates data encryption keys from key encryption keys. Each record is encrypted with a unique DEK, and the DEK is encrypted with a KEK. Rotating the KEK only requires re-encrypting the DEKs, not the data, enabling regular key rotation without massive re-encryption. This is efficient, scalable, and limits the blast radius of a compromised key, making it ideal for healthcare data with strict compliance.

Answer

Transparent data encryption (TDE) with a single certificate used to encrypt the database.

Answer

Full database encryption with a single master key stored in a hardware security module (HSM).

Answer

Column-level encryption using a static symmetric key stored in a configuration file.

Question 14

A financial services firm is designing a new online banking platform. The security architect must ensure that if the session token issued to a customer is stolen via a cross-site scripting attack, the attacker cannot use it from a different device or network. Which of the following should be implemented to meet this requirement?

Accepted Answer

Token binding that cryptographically ties the session token to the client's TLS connection.. Token binding is the only mechanism that cryptographically links the session token to the client's TLS connection, so a token stolen via XSS cannot be replayed from a different device or network. Lifetime reduction, cookie flags, and local storage encryption mitigate other risks but do not satisfy the explicit cross-device reuse requirement.

Answer

Shortening the session token lifetime to five minutes and requiring re-authentication.

Answer

Encrypting the session token with AES-256 before writing it to the client's local storage.

Answer

Storing the session token in an HttpOnly cookie with the Secure and SameSite attributes.

Question 15

A company is modernizing its security operations center and wants to correlate logs from firewalls, endpoints, and cloud services in a single platform that supports long-term retention and custom detection rules. Which technology best fits this requirement?

Accepted Answer

A security information and event management (SIEM) platform.. The described need is centralized ingestion, normalization, correlation, retention, and custom detection across many log sources, which is the core purpose of a SIEM. Vulnerability scanners, network performance monitors, and configuration databases each serve different operational functions and none provides the combined correlation and retention capability required.

Answer

A network performance monitoring (NPM) appliance.

Answer

A vulnerability management scanner.

Answer

A configuration management database (CMDB).