CAS-004 Security Architecture Practice Test 13 — 15 Questions

Question 1

A security architect is designing a microsegmentation strategy for a hybrid cloud environment. The organization wants to enforce least-privilege network access between workloads, prevent lateral movement, and maintain visibility into east-west traffic. Which TWO of the following controls are MOST appropriate to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Software-defined networking (SDN) overlay with distributed policy enforcement. Host-based firewalls with workload identity tags and an SDN overlay with distributed policy enforcement both enable granular, identity-aware microsegmentation across hybrid cloud environments. They enforce least-privilege access, limit lateral movement, and provide east-west visibility. The other options either provide broad connectivity, address non-security concerns, or operate only at the perimeter.

Answer

Network address translation (NAT) at the perimeter

Answer

Spanning Tree Protocol (STP) tuning on all switches

Answer

Virtual private network (VPN) concentrators between all subnets

Question 2

A healthcare provider must ensure that electronic protected health information (ePHI) stored in a public cloud object storage bucket is unreadable to the cloud provider and remains confidential even if the provider's infrastructure is compromised. The security architect wants to use a customer-managed key that never leaves the organization's on-premises hardware security module (HSM). Which approach should the architect implement?

Accepted Answer

Use client-side encryption with a key stored in an on-premises HSM, encrypting data before it is uploaded to the bucket. Client-side encryption with keys held in an on-premises HSM ensures that data is encrypted before it reaches the cloud, so the provider only stores ciphertext and never possesses the key. This architecture preserves confidentiality even if the provider's infrastructure is breached, which is essential for ePHI under strict regulatory requirements.

Answer

Configure default encryption on the bucket using a provider-managed key and enable versioning

Answer

Enable provider-side encryption with a customer-provided key (SSE-C) and upload the key with each object request

Answer

Implement bucket policies that restrict access to a specific VPC endpoint and enable access logging

Question 3

A security architect at a defense contractor must protect Controlled Unclassified Information (CUI) that flows between an on-premises data center and a government cloud enclave. The requirement states that data must remain confidential even if a cloud provider's hypervisor is compromised, and the provider must not be able to access plaintext at any layer. The architect needs a control that cryptographically isolates tenant workloads from the provider and from other tenants. Which of the following BEST satisfies this requirement?

Accepted Answer

Implement confidential computing using hardware-based trusted execution environments (TEEs) such as AMD SEV-SNP or Intel TDX.. Confidential computing with hardware TEEs encrypts guest memory using CPU-managed keys, so the hypervisor and provider administrators cannot read plaintext even during processing. The other controls protect keys, data in transit, or data at rest, but none prevent plaintext exposure in memory when the hypervisor is compromised, which is the specific threat in this scenario.

Answer

Encrypt all CUI at rest with customer-managed keys stored in a separate key management service outside the provider's control.

Answer

Deploy hardware security modules (HSMs) in the cloud provider's data center to store tenant encryption keys.

Answer

Require TLS 1.3 with mutual authentication for all data in transit between the data center and the cloud enclave.

Question 4

A security architect is designing a microsegmentation strategy for a hybrid cloud environment. The organization wants to enforce least-privilege network access between workloads, prevent lateral movement, and maintain visibility into east-west traffic. Which TWO of the following controls are MOST appropriate to achieve these goals? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Host-based firewall agents that enforce allow-list rules based on workload identity tags.. Microsegmentation requires policy that is based on workload identity and portable across hosts. Host-based firewall agents with identity-tag rules and an SDN overlay enforcing label-based policy both deliver explicit peer authorization and follow workloads during migration. VLAN ACLs, a single perimeter zone, and 802.1X either tie policy to topology or address admission rather than ongoing east-west control.

Answer

VLAN segmentation with ACLs applied at the core switch.

Answer

A next-generation firewall with a single perimeter zone for all internal servers.

Answer

802.1X port-based network access control for all server NICs.

Question 5

A security architect is designing a data loss prevention (DLP) strategy for a hybrid environment where sensitive records are stored on-premises and synchronized to a SaaS productivity suite. The architect needs to ensure that policy enforcement follows the data regardless of location and that violations are detected before data leaves the organization. Which TWO of the following capabilities are most critical to achieve these goals? (Choose two.)

Accepted Answer

Endpoint DLP agents with content-aware rules on managed workstations.. Inline CASB inspection enforces DLP policy at the cloud egress point, while endpoint DLP agents enforce policy at the source on managed devices. Together they cover both network and local egress paths, ensuring that sensitive data is inspected and blocked before it leaves the organization and that policy follows the data across hybrid locations.

Answer

Full-disk encryption (FDE) on all endpoints and servers storing sensitive records.

Answer

Security information and event management (SIEM) correlation of DLP alerts.

Answer

Network segmentation between the on-premises data center and the SaaS provider.

Question 6

A security architect is designing a system that must process sensitive personal data. The organization wants to ensure that even if the database is compromised, the data remains unreadable to the attacker. The architect also needs to support searching on a specific field without decrypting the entire dataset. Which cryptographic approach best meets these requirements?

Accepted Answer

Application-level encryption with deterministic encryption for the searchable field. Application-level encryption with deterministic encryption for the searchable field ensures that data is encrypted before storage and remains unreadable if the database is compromised. Deterministic encryption allows equality searches on that field without decrypting the entire dataset. Other methods either leave data readable in memory, prevent searching, or introduce a separate high-value target.

Answer

Transparent data encryption (TDE) on the database

Answer

Hashing the sensitive data with a salt

Answer

Tokenization of all sensitive fields with a centralized token vault

Question 7

A security architect is designing a platform for a hospital network. Clinical staff must access patient records from managed workstations, while third-party billing contractors use unmanaged personal laptops. The architect wants a single architecture that continuously validates device posture and user identity before granting access to each microservice, regardless of network location. Which approach should the architect implement?

Accepted Answer

Implement a zero trust architecture using a policy engine and policy enforcement points at each microservice.. A zero trust architecture with a policy engine and enforcement points at each microservice continuously validates identity and device posture for every request, independent of network location. This single architecture covers managed clinical workstations and unmanaged contractor laptops alike, unlike network-centric controls that authenticate once and then trust the connection. Per-microservice enforcement also limits lateral movement if a device is compromised.

Answer

Deploy a next-generation firewall with VLAN segmentation for clinical and contractor traffic.

Answer

Establish an IPsec VPN concentrator that assigns contractors to a restricted subnet.

Answer

Configure 802.1X port-based authentication on all wired switch ports.

Question 8

A security architect for a financial services firm is designing a new data protection scheme for account numbers stored in a PostgreSQL database. The business requires that the same account number always transforms to the same ciphertext so that existing equality-based lookups and unique constraints continue to work, while the raw values must remain unreadable to database administrators. Which cryptographic approach should the architect select?

Accepted Answer

Deterministic encryption using AES-SIV. The requirement for repeatable ciphertext that still supports equality lookups points to a deterministic authenticated encryption mode. AES-SIV derives its nonce from the plaintext and associated data, so the same input always yields the same output while still providing integrity. Randomized modes and salted hashing break the equality-search property the database design depends on.

Answer

SHA-256 hashing of the account number with a per-row salt

Answer

RSA-4096 OAEP encryption of each account number

Answer

AES-256-GCM with a random 96-bit nonce per record

Question 9

A financial services firm is designing its identity architecture for a Zero Trust program. Auditors require that authentication strength be continuously evaluated and that a compromised endpoint lose access to sensitive trading applications even after the user has already authenticated. The security architect must select TWO capabilities that directly support continuous, context-aware authorization decisions. (Choose two.)

Accepted Answer

Continuous access evaluation that revokes active sessions when risk signals change. Continuous access evaluation and device posture attestation together give the policy engine live signals to make and revisit authorization decisions. Continuous access evaluation enforces revocation the moment risk changes, while posture attestation supplies the endpoint trust data that fuels those decisions. Combined, they ensure that a compromised device loses access to sensitive applications mid-session, satisfying the auditors' requirement.

Answer

A single sign-on portal that caches user credentials for the trading session

Answer

Password complexity rules requiring rotation every 30 days for all identities

Answer

Longer-lived refresh tokens to reduce reauthentication prompts for trading users

Question 10

A financial services firm is designing a hybrid identity architecture. Employees authenticate on-premises to Active Directory Domain Services, while applications are hosted in multiple SaaS and IaaS providers. The security architect must ensure that a compromised on-premises domain controller cannot be used to forge tokens that grant access to cloud applications, and that cloud access decisions reflect real-time on-premises risk signals. Which of the following BEST achieves these goals?

Accepted Answer

Implement a cloud-based identity provider with conditional access that ingests on-premises risk telemetry through a secure API and uses short-lived tokens.. A cloud identity provider that uses conditional access and consumes on-premises risk telemetry issues short-lived tokens based on real-time evaluation, so cloud trust does not depend on on-premises token-signing keys. This prevents a compromised domain controller from forging cloud tokens while allowing risk signals to influence access decisions across SaaS and IaaS applications.

Answer

Use password hash synchronization with seamless single sign-on and enforce smart card authentication for all on-premises users.

Answer

Extend Active Directory Domain Services to the cloud using domain controllers deployed in IaaS virtual networks and replicate credentials.

Answer

Federate on-premises Active Directory Federation Services with each cloud provider using SAML or OIDC, and require MFA at the federation layer.

Question 11

A security architect at a financial services firm is designing the network segmentation for a new containerized trading platform running on Kubernetes. The platform must isolate workloads so that a compromise of the public-facing web tier cannot directly reach the database tier. The architect wants to enforce this isolation natively within the cluster and have policies applied automatically as new pods are scheduled. Which of the following should the architect implement?

Accepted Answer

NetworkPolicies applied to namespaces and selected pods. Kubernetes NetworkPolicies provide label-based, pod-level segmentation enforced by the CNI plugin, so isolation follows workloads wherever they are scheduled. The architect can default-deny traffic in a namespace and then allow only the specific web-to-API and API-to-database flows, which prevents a compromised front end from reaching the database tier. Encryption and edge controls address different concerns and do not restrict lateral movement inside the cluster.

Answer

A service mesh with mutual TLS between all sidecars

Answer

VLAN segmentation on the underlying hypervisor

Answer

An ingress controller with TLS termination and WAF rules

Question 12

A multinational retailer needs to protect cardholder data across its e-commerce platform, which spans on-premises and multiple cloud providers. The security architect must implement a solution that discovers sensitive data, classifies it consistently, and enforces encryption and access policies wherever the data resides, without relying on a single cloud provider's native tools. Which of the following should the architect implement?

Accepted Answer

A data security posture management (DSPM) solution with centralized policy and encryption key management.. The requirement is data-centric protection across on-premises and multiple clouds with consistent discovery, classification, encryption, and access policy. DSPM with centralized key management delivers cross-provider visibility and enforcement. CSPM addresses configuration, WAF addresses application attacks, and HSM addresses key operations, none of which provide the complete data discovery and policy enforcement needed.

Answer

A hardware security module (HSM) cluster in the primary data center.

Answer

A web application firewall (WAF) deployed in front of each e-commerce site.

Answer

A cloud security posture management (CSPM) tool integrated with each cloud provider.

Question 13

A multinational corporation is designing a hybrid cloud architecture that spans an on-premises data center and two public cloud regions. The security architect needs to ensure that all administrative access to cloud resources is brokered through a central identity provider, that access decisions consider device posture, and that no long-lived credentials are stored in the cloud. Which combination of technologies should the architect implement?

Accepted Answer

A cloud identity provider with SAML/OIDC federation, conditional access policies, and short-lived credentials issued via just-in-time elevation. Centralizing administrative access through federation, evaluating device posture with conditional access, and issuing short-lived credentials via just-in-time elevation collectively meet the requirements. This design removes long-lived credentials from the cloud and ensures that access decisions are context-aware, which is essential for a hybrid, multi-region architecture.

Answer

SAML federation with the on-premises identity provider and role-based access control (RBAC) in each cloud

Answer

OIDC federation combined with a cloud access security broker (CASB) and just-in-time access

Answer

A hardware security module (HSM) for key storage and a VPN for administrative access

Question 14

A security architect is reviewing the network design for a new branch office. The organization wants to ensure that all traffic from the branch is inspected for malware and that users are authenticated before accessing cloud applications, regardless of their location. Which technology should the architect recommend?

Accepted Answer

A Secure Access Service Edge (SASE) solution with integrated secure web gateway and zero trust network access. SASE delivers converged network and security services from the cloud, including secure web gateway for malware inspection and zero trust network access for user authentication. It enforces policy consistently for users anywhere, without backhauling traffic. This directly satisfies the branch office requirements for inspection and authentication before cloud access.

Answer

A remote access VPN concentrator at headquarters with split tunneling disabled

Answer

A software-defined wide area network (SD-WAN) overlay with local internet breakout

Answer

A next-generation firewall (NGFW) at the branch perimeter with IPsec VPN to headquarters

Question 15

A security architect at a financial services firm is designing a microsegmentation strategy for a data center running both virtual machines and containerized workloads. The architect must reduce east-west lateral movement and enforce least-privilege communication between tiers. Which TWO design elements are most appropriate? (Choose two.)

Accepted Answer

Use a service mesh with mutual TLS and authorization policies for service-to-service communication.. Identity-based host firewall policies and a service mesh with mutual TLS and authorization policies both enforce least-privilege communication at the workload level. Identity-based rules survive IP changes across VMs and containers, while the mesh cryptographically authenticates and authorizes service-to-service calls. Together they reduce east-west lateral movement, whereas perimeter, VLAN, and monitoring-only controls cannot enforce per-workload segmentation.

Answer

Enable promiscuous-mode intrusion detection on a SPAN port for all internal traffic.

Answer

Deploy a single perimeter firewall with rules based on source and destination IP ranges.

Answer

Rely on VLAN segmentation between application tiers to control east-west traffic.