CAS-004 Security Architecture Practice Test 14 — 15 Questions

Question 1

A healthcare organization is architecting a microsegmentation strategy for its hybrid data center. The security architect must limit lateral movement between workloads, enforce policy based on workload identity rather than IP addresses, and maintain visibility into inter-workload flows. Which TWO of the following controls BEST support these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a software-defined perimeter (SDP) controller that authenticates endpoints before granting access to protected workload segments.. A software-defined perimeter and a service mesh with mutual TLS both base access decisions on authenticated workload identity rather than IP addresses, which limits lateral movement and supports visibility into inter-workload flows. The other controls either rely on static IP or zone constructs, or address layer 2 threats without providing identity-based segmentation.

Answer

Enable dynamic ARP inspection and DHCP snooping on all access-layer switches.

Answer

Place all workloads behind a next-generation firewall and create zone-based policies for north-south traffic.

Answer

Implement host-based firewalls with rules based on IP address ranges that mirror the existing VLAN segmentation.

Question 2

A security architect is designing a hybrid identity solution for a company that wants to enforce device-based conditional access for Microsoft 365. Employees use personal Android and iOS devices, and the company wants to ensure that only compliant devices can access email and SharePoint. The architect must minimize on-premises infrastructure and avoid a full VPN. Which solution should the architect recommend?

Accepted Answer

Deploy Microsoft Entra ID with Conditional Access policies that require device compliance, and enroll devices in Microsoft Intune.. Microsoft Entra ID Conditional Access combined with Intune device compliance is the correct approach because it enforces device-based access decisions for cloud applications without requiring on-premises infrastructure or a full VPN. Conditional Access evaluates signals such as device compliance state and can block or grant access to Microsoft 365 accordingly, while Intune manages device configuration and compliance for both Android and iOS.

Answer

Configure a full-tunnel VPN that routes all mobile traffic through the corporate network and enforce network access control (NAC) at the edge.

Answer

Implement Active Directory Federation Services (AD FS) with a Web Application Proxy and require certificate-based authentication for all devices.

Answer

Use Microsoft Entra ID with Security Defaults enabled and require multi-factor authentication (MFA) for all users.

Question 3

A security architect is designing segmentation for a manufacturing network where legacy programmable logic controllers cannot be patched or run endpoint agents. The architect wants to prevent a compromised business workstation from initiating connections to the controllers while still allowing the controllers to send telemetry to a historian server. Which of the following design elements best achieves this objective?

Accepted Answer

A unidirectional gateway enforcing one-way data flow from the controller network out to the historian. A unidirectional gateway enforces that data can flow only from the protected controller network outward, so telemetry reaches the historian while no inbound path exists from the business network. This protects unpatched controllers that cannot run agents or be hardened, precisely matching the constraint that a compromised workstation must never initiate connections to them.

Answer

Network address translation between the business network and the controller subnet with private addressing

Answer

An intrusion prevention system deployed inline on the business network with industrial protocol signatures

Answer

A stateful firewall rule permitting any internal source to reach the controller subnet on the industrial protocol port

Question 4

A healthcare provider is designing a data protection scheme for patient records stored in a cloud object store. Regulatory requirements mandate that encryption keys never leave the organization's on-premises hardware security modules (HSMs), while the cloud provider must still be able to perform server-side encryption on upload. The architect needs a key management approach that satisfies both constraints. Which of the following should the architect implement?

Accepted Answer

External key store backed by on-premises HSMs integrated with the cloud KMS. An external key store keeps the root key material inside the organization's HSMs while allowing the cloud KMS to call out for encrypt and decrypt operations, so server-side encryption still occurs without the provider holding plaintext keys. This satisfies the dual constraint of regulatory key residency and provider-side encryption. The other approaches either place key custody with the provider or shift encryption to the client, breaking one of the two requirements.

Answer

Provider-managed customer master keys stored in the cloud KMS

Answer

Client-side encryption with locally generated data keys

Answer

Envelope encryption using a customer-provided key uploaded to the KMS

Question 5

A software company wants to ensure that every container image deployed to production is free of known critical vulnerabilities and is cryptographically signed by its build pipeline. The security architect must implement controls that verify the signature and vulnerability status before the container runtime starts the image. Which of the following should the architect implement?

Accepted Answer

A Kubernetes admission controller that validates image signatures and vulnerability scan results before allowing a pod to run.. The requirement is to verify image signatures and vulnerability status before the container runtime starts the image. A Kubernetes admission controller enforces these checks at pod creation, rejecting non-compliant images. SAST analyzes code, registry scanning only alerts, and runtime agents act after startup, so none provide the required pre-runtime enforcement.

Answer

A container image scanner in the registry with automated alerts to the security team.

Answer

A runtime security agent that monitors container behavior and kills suspicious processes.

Answer

A static application security testing (SAST) tool integrated into the CI pipeline.

Question 6

A security architect is designing a microsegmentation strategy for a data center that hosts both legacy virtual machines and modern containerized workloads. The architect must ensure that security policies follow the workload regardless of its location and that lateral movement is restricted even if a host is compromised. (Choose two.)

Accepted Answer

Implement a host-based firewall on each virtual machine that enforces allow-list rules based on workload tags. Host-based firewalls with tag-based rules and an SDN overlay using identity-based security groups both enforce policy at the workload level, ensuring that protections follow the workload regardless of location. These controls restrict lateral movement even if a host is compromised, unlike perimeter or physical segmentation approaches.

Answer

Enable port security on all physical switch ports to limit MAC addresses

Answer

Deploy a centralized next-generation firewall (NGFW) at the data center perimeter to inspect all north-south traffic

Answer

Segment the network into VLANs based on physical rack location and apply ACLs between VLANs

Question 7

A security architect is designing a system that must provide confidentiality and integrity for data at rest and in transit. The organization wants to minimize the risk of key compromise and ensure that a single compromised key does not expose all data. Which key management strategy best meets these requirements?

Accepted Answer

Implement a hierarchical key management system with data encryption keys wrapped by key encryption keys. A hierarchical key management system with unique data encryption keys wrapped by key encryption keys ensures that compromise of one data key only affects the data it protects. This limits the blast radius and meets the requirement that a single compromised key does not expose all data. Other strategies create single points of failure.

Answer

Derive all encryption keys from a single password using PBKDF2

Answer

Use a single master key to encrypt all data, stored in a hardware security module (HSM)

Answer

Store all encryption keys in a centralized key vault without additional wrapping

Question 8

A software company wants to strengthen the integrity of its build pipeline. Developers currently commit code directly to the main branch, and build servers pull dependencies from public repositories without verification. The security architect must ensure that only reviewed code is built and that dependencies have not been tampered with. Which combination of controls best addresses these requirements?

Accepted Answer

Enforce signed commits with mandatory peer review and verify dependency signatures against a trusted allowlist.. Signed commits with mandatory peer review and branch protection ensure only reviewed, attributable code is built, while verifying dependency signatures against a trusted allowlist confirms that third-party components match their publishers' originals. These preventive controls address both halves of the requirement. Authentication, static analysis, and artifact storage protections each cover different concerns and leave the provenance and dependency integrity gaps open.

Answer

Store build artifacts in an encrypted repository and enable versioning on the storage bucket.

Answer

Run static application security testing on every build and block releases with high-severity findings.

Answer

Require developers to use multi-factor authentication when pushing to the repository.

Question 9

A global retailer is deploying a microsegmentation strategy in its data center to limit lateral movement after a breach. The security architect must enforce policy based on workload identity and allow only required east-west flows, even when workloads are migrated between hosts. Which of the following should be implemented?

Accepted Answer

Host-based firewalls with workload identity labels and a central policy controller.. Host-based firewalls with identity labels and a central policy controller enforce microsegmentation based on workload identity rather than IP addresses. This design allows only necessary east-west flows and automatically follows workloads during migration, which is essential in a dynamic data center where lateral movement must be contained.

Answer

VLAN segmentation with ACLs applied on the core switches.

Answer

A next-generation firewall (NGFW) deployed at the data center perimeter.

Answer

802.1X port-based network access control on all switch ports.

Question 10

A retail company is designing a new payment processing environment and wants to reduce the scope of its PCI DSS assessment. The architect proposes isolating the cardholder data environment from the rest of the corporate network so that most systems fall outside the audit boundary. Which of the following design approaches best supports this goal?

Accepted Answer

A segmented enclave with strict ingress and egress controls, dedicated management, and no shared authentication with corporate systems. Isolating the cardholder data environment in a segmented enclave with strict ingress and egress filtering, dedicated administration, and no shared authentication lets assessors treat the surrounding corporate network as out of scope. This directly reduces the number of systems subject to the audit while keeping a defensible, monitored boundary around the payment systems that handle card data.

Answer

Outsourcing card processing to a validated service provider while keeping card data in local point-of-sale databases

Answer

A flat network with VLANs for logical separation and a shared domain for authentication

Answer

Encrypting card data at rest in the corporate data warehouse and granting broad read access to analysts

Question 11

A financial services company is designing a secure multi-tenant SaaS application hosted on AWS. The security architect must ensure that each tenant's data is isolated and that encryption keys are unique per tenant, while allowing the company to manage keys centrally. Which AWS service should the architect use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys (CMKs) and encryption context per tenant.. AWS KMS with customer managed keys allows the architect to create a unique key for each tenant and use encryption context to enforce that only the intended tenant can decrypt its data. This centralizes key management while providing cryptographic isolation, satisfying both the per-tenant key requirement and the need for central administration.

Answer

AWS Certificate Manager (ACM) with a wildcard certificate per tenant.

Answer

AWS CloudHSM with a single cluster shared across all tenants.

Answer

AWS Secrets Manager with automatic rotation for each tenant's database credentials.

Question 12

A security architect is designing a data loss prevention (DLP) program for a global enterprise that uses Microsoft 365, endpoint devices, and a custom web application. The requirement is to detect and block sensitive data exfiltration across all three channels while minimizing false positives caused by legitimate business data that resembles regulated data. The architect needs a control that classifies data consistently and applies policy at the point of egress. Which of the following BEST meets this requirement?

Accepted Answer

Apply sensitivity labels with unified DLP policies that use exact data match and trainable classifiers across Microsoft 365, endpoints, and the custom application.. Sensitivity labels with unified DLP policies classify data persistently and apply consistent enforcement across Microsoft 365, endpoints, and integrated applications. Exact data match and trainable classifiers improve accuracy by matching real regulated records and learning business context, which reduces false positives while blocking exfiltration at egress points across all channels.

Answer

Require full-disk encryption on all endpoints and enforce TLS for all data in transit to external destinations.

Answer

Implement database activity monitoring on all repositories and alert on bulk read operations of sensitive tables.

Answer

Deploy network DLP appliances at each internet egress point and configure regex patterns for regulated data types.

Question 13

A security architect is evaluating a cloud service provider's ability to support a customer's compliance with PCI DSS. The customer will store cardholder data in the cloud. The architect needs to determine which party is responsible for configuring encryption of the data at rest and managing the encryption keys. According to the shared responsibility model, which of the following is the MOST accurate statement?

Accepted Answer

The customer is responsible for enabling encryption at rest and managing keys, but the provider may offer key management services.. In the shared responsibility model, the customer is responsible for securing data in the cloud, including enabling encryption at rest and managing keys. The cloud provider may offer key management services, but the customer must configure them to meet PCI DSS requirements. The other options either reverse responsibilities or incorrectly assign full responsibility to one party.

Answer

The customer is responsible for physical security of the data center, and the provider handles encryption.

Answer

PCI DSS compliance is solely the cloud provider's responsibility because they own the infrastructure.

Answer

The cloud provider is always responsible for encrypting cardholder data at rest and managing keys.

Question 14

A software company is designing an internal developer platform where engineers need short-lived credentials to access production databases. The security architect wants to eliminate long-lived static database passwords, bind access to the identity of the calling workload, and automatically revoke credentials when a deployment is removed. Which of the following should the architect implement?

Accepted Answer

Issue dynamic, lease-based database credentials through a secrets engine tied to workload identity. Dynamic secrets with workload identity binding issue credentials only after the platform verifies the caller, and the credentials expire automatically with their lease. This removes static passwords from the environment and ensures that deleting a deployment terminates its database access without manual intervention. Secrets storage, mutual TLS, and auditing each address part of the problem but do not deliver identity-bound, automatically revoked credentials.

Answer

Configure database native auditing and alert on anomalous query patterns

Answer

Enable TLS client certificate authentication for all database connections

Answer

Store database passwords in a centralized secrets manager and inject them at runtime

Question 15

A company is implementing a secure software development lifecycle (SDLC). The security architect wants to ensure that vulnerabilities are identified early in the development process and that developers receive immediate feedback. Which of the following should be integrated into the CI/CD pipeline?

Accepted Answer

Static application security testing (SAST) integrated into the build process.. Integrating SAST into the build process enables automated security testing on every code commit, providing immediate feedback to developers. This shifts security left, allowing vulnerabilities to be found and fixed early when they are cheaper and easier to remediate. SAST is well-suited for CI/CD pipelines because it does not require a running application and can be triggered automatically.

Answer

Interactive application security testing (IAST) run manually by the security team quarterly.

Answer

Software composition analysis (SCA) performed only before major releases.

Answer

Dynamic application security testing (DAST) run after deployment to production.