CAS-004 Security Architecture Practice Test 15 — 15 Questions

Question 1

A security architect is evaluating a software-defined wide area network (SD-WAN) solution to connect branch offices to cloud services. The architect wants to ensure that traffic from branches to cloud applications is inspected for threats without backhauling all traffic to the data center. Which capability should the architect prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local internet breakout with integrated next-generation firewall (NGFW) and secure web gateway (SWG) at the branch. Local internet breakout with integrated NGFW and SWG at the branch enables direct cloud access while still inspecting traffic for threats. This design eliminates the need to backhaul traffic to a central data center for security inspection, balancing performance and security for branch offices.

Answer

Dynamic multipoint VPN (DMVPN) with hub-and-spoke topology

Answer

Quality of service (QoS) policies that prioritize business-critical applications

Answer

Application-aware routing that selects the best path based on performance metrics

Question 2

A startup is building a new application on a public cloud and wants to minimize the attack surface of its virtual machines. The security architect recommends replacing SSH key-based administration with a model where no inbound management ports are exposed and access is granted per session with short-lived credentials. Which of the following should be implemented?

Accepted Answer

A just-in-time access broker that issues short-lived certificates and proxies sessions.. A just-in-time access broker removes standing inbound management access by issuing short-lived credentials and proxying sessions only when needed. This eliminates persistent SSH keys and exposed ports, directly minimizing the attack surface on the virtual machines while still allowing controlled administrative access.

Answer

Security groups that allow SSH only from the administrator's home IP address.

Answer

A bastion host in a public subnet with SSH restricted to the corporate CIDR range.

Answer

VPN concentrators that place administrators on the same private network as the VMs.

Question 3

A multinational retailer operates an on-premises data center and two public cloud regions. Regulations require that customer payment data never leave the home country, but the company wants centralized security analytics. The architect needs a design that keeps raw payment records local while enabling global threat detection. Which design best meets these constraints?

Accepted Answer

Keep raw payment records in the home country and forward only normalized security telemetry to a central SIEM.. Local retention of raw payment records meets the residency regulation, while exporting only normalized security telemetry to a central SIEM preserves the global correlation needed for threat detection. This separates regulated data from operational telemetry. Full replication, per-region silos, and encrypted offsite storage each either move regulated records across borders or prevent the centralized analytics the company requires.

Answer

Replicate the full payment database to a central cloud data lake for analytics.

Answer

Deploy independent SIEM instances per region with no cross-region data sharing.

Answer

Encrypt payment records with a customer-managed key and store them in the nearest cloud region.

Question 4

A security architect is designing a zero trust architecture for a company with a large remote workforce. The requirement is to verify device health and user identity for every session to internal applications, regardless of network location, and to prevent session hijacking after initial authentication. Which of the following BEST meets these requirements?

Accepted Answer

Implement a zero trust network access (ZTNA) service that continuously evaluates identity and device posture and issues per-session, context-bound tokens.. ZTNA continuously evaluates identity and device posture and issues per-session tokens bound to context, so every access request is verified regardless of network location. Because tokens are tied to the session and device context, a stolen token cannot be replayed elsewhere, which directly prevents session hijacking after initial authentication.

Answer

Require all remote users to connect through a cloud access security broker (CASB) that applies data loss prevention policies to cloud applications.

Answer

Use a reverse proxy with mutual TLS client certificates and enforce certificate revocation checks at each connection.

Answer

Deploy a VPN concentrator with split tunneling and require users to authenticate with a username and password plus a one-time code.

Question 5

A security architect is designing a zero trust network access (ZTNA) solution for a company with remote workers. The architect must ensure that access to internal applications is granted based on user identity and device posture, without exposing applications to the internet. Which TWO design elements are essential for this ZTNA implementation? (Choose two.)

Accepted Answer

An outbound-only connection from the application to the trust broker, so the application is never directly exposed to the internet.. ZTNA requires a trust broker to authenticate users and devices and enforce access policies, and it relies on outbound-only connections from applications to the broker to avoid exposing them to the internet. Together, these elements ensure that access is granted based on identity and device posture rather than network location, which is the core of zero trust.

Answer

A public DNS record that maps each internal application to a routable IP address for direct access.

Answer

A next-generation firewall (NGFW) in the DMZ that performs deep packet inspection on all inbound traffic to internal applications.

Answer

A site-to-site VPN between each remote worker's home router and the corporate data center.

Question 6

A security architect is designing a network for a company that requires high availability and confidentiality for data in transit between two data centers. The company wants to use a protocol that operates at the network layer, supports perfect forward secrecy (PFS), and can be implemented in hardware for high throughput. Which protocol BEST meets these requirements?

Accepted Answer

IPsec with IKEv2. IPsec with IKEv2 operates at the network layer, supports perfect forward secrecy through Diffie-Hellman, and is widely implemented in hardware for high throughput. The other protocols either operate at higher layers or are not typically hardware-accelerated for site-to-site network-layer encryption.

Answer

Secure Shell (SSH) tunneling

Answer

Datagram Transport Layer Security (DTLS)

Answer

Transport Layer Security (TLS) 1.3

Question 7

A security architect is designing a network for a hospital that must keep its electronic health record (EHR) servers completely isolated from the internet while still allowing a small group of vendors to perform remote maintenance. The vendors use laptops that are not managed by the hospital. The architect proposes a jump host architecture. Which of the following designs best satisfies the requirement while minimizing risk?

Accepted Answer

Deploy a hardened jump host in a screened subnet, require vendor laptops to connect through a VPN with MFA, and then RDP to the EHR servers from the jump host after session recording is enabled.. The correct design uses a jump host in a screened subnet, VPN with MFA, and RDP with session recording. This combination isolates the EHR servers, authenticates the unmanaged vendor laptops, and provides an auditable path for maintenance. The other options either place the jump host on the protected VLAN, expose RDP directly, or use a reverse proxy that does not support direct server maintenance, all of which weaken isolation or control.

Answer

Publish the EHR servers through a reverse proxy with client certificate authentication, and let vendors connect directly to the EHR web interface without a jump host.

Answer

Deploy a jump host directly on the same VLAN as the EHR servers, allow vendors to connect to it over RDP from the internet after authenticating with a local account, and disable session logging to protect vendor privacy.

Answer

Create a site-to-site IPsec tunnel from each vendor's office to the EHR VLAN, and allow the vendors to use their own remote administration tools directly against the EHR servers.

Question 8

A security architect is reviewing the company's incident response plan and wants to ensure that the team can detect and respond to threats in real time across endpoints, networks, and cloud workloads. The architect needs a solution that correlates events from multiple sources and provides automated response actions. Which technology should the architect recommend?

Accepted Answer

Security information and event management (SIEM) with security orchestration, automation, and response (SOAR) capabilities.. A SIEM with SOAR capabilities is the correct choice because it centralizes log collection and correlation from diverse sources and enables automated response workflows. This combination provides the real-time detection and orchestrated response across endpoints, networks, and cloud workloads that the incident response plan requires.

Answer

Endpoint detection and response (EDR) deployed only on servers.

Answer

Network detection and response (NDR) with full packet capture at the perimeter.

Answer

A vulnerability scanner with scheduled scans of all assets.

Question 9

A security architect for a healthcare provider must ensure that a new patient portal can exchange data with an external partner's system without the two organizations having to share or manage each other's identity credentials. The portal must support SAML assertions, provide centralized session revocation, and allow attribute-based authorization decisions at the relying party. Which of the following should the architect implement?

Accepted Answer

Deploy an identity federation gateway that consumes SAML assertions from the partner IdP and maps attributes to local authorization roles.. Federating identities through a gateway that consumes SAML assertions allows the portal to trust the partner's identity provider without exchanging credentials. Attributes carried in assertions can drive authorization decisions locally, and SAML single logout supports centralized session termination. The other approaches either require shared or duplicated credentials, lack SAML support, or expose internal directory services to an external party, none of which meet the stated interoperability and revocation requirements.

Answer

Configure the partner as a trusted certificate authority in the portal's internal PKI and issue client certificates to partner users.

Answer

Publish the portal's user directory as an LDAP endpoint and require partner applications to bind directly against it during authentication.

Answer

Create duplicate local accounts for every partner user in the portal's directory and synchronize passwords on a nightly schedule.

Question 10

A security architect is designing a microsegmentation strategy for a data center hosting both legacy monolithic applications and modern containerized workloads. The organization wants to enforce least-privilege network access between workloads without relying on IP addresses or VLANs, and it requires the ability to define policy based on workload identity and tags that follow the workload across environments. Which technology best meets these requirements?

Accepted Answer

Host-based microsegmentation using identity and tag-based policies. Host-based microsegmentation is the only option that enforces policy based on workload identity and tags, decoupling security from IP addresses and VLANs. This allows consistent least-privilege enforcement across legacy and containerized workloads and supports policy portability across environments.

Answer

Traditional stateful firewalls with static IP-based rules

Answer

Software-defined networking (SDN) with VLAN segmentation

Answer

Network access control (NAC) with 802.1X port-based authentication

Question 11

A security architect is reviewing the identity architecture for a company that uses a hybrid cloud. Employees authenticate to an on-premises Active Directory Domain Services (AD DS) domain and also need to access SaaS applications. The company wants to avoid storing separate passwords for each SaaS application and wants to enforce on-premises account status and group membership in real time. Which of the following should the architect implement?

Accepted Answer

Federate the on-premises AD DS with each SaaS application using SAML 2.0, and configure the SaaS applications to trust the on-premises identity provider.. Federating on-premises AD DS with SAML 2.0 makes the domain the identity provider for SaaS applications. Users authenticate once with their AD credentials, and the SaaS application receives assertions about group membership and account status at each login. This satisfies the requirements for no separate passwords and real-time enforcement of on-premises account state, unlike cloud LDAP, local accounts, or RADIUS.

Answer

Deploy a standalone LDAP directory in the cloud and synchronize user passwords from AD DS using a one-way hash, then point each SaaS application to the cloud LDAP service.

Answer

Configure each SaaS application with a separate local account for every employee, and use a password manager to generate and store unique passwords.

Answer

Implement RADIUS authentication between the SaaS applications and the on-premises AD DS, and rely on RADIUS attributes to convey group membership.

Question 12

A financial services firm is designing a new internal API platform. The security architect must ensure that every service-to-service call is authenticated, that a compromised service cannot impersonate another service, and that credentials are short-lived and automatically rotated. The platform runs on Kubernetes and uses an external secrets manager. Which of the following designs best meets these requirements?

Accepted Answer

Use mutual TLS with certificates issued by a service mesh certificate authority that binds each certificate to the service's Kubernetes service account and rotates it automatically.. Binding a cryptographic identity to each service's Kubernetes service account through a service mesh certificate authority ensures that a compromised service cannot present another service's identity. Mutual TLS authenticates both ends of every call, and the mesh can issue short-lived certificates and rotate them automatically without manual intervention. The other options either share secrets across services, rely only on network reachability, or use long-lived credentials that are not bound to a specific service identity.

Answer

Rely on network policies that restrict pod-to-pod traffic to approved namespaces and assume that only authorized services can reach each other.

Answer

Issue a long-lived shared API key to each service and store it in a Kubernetes Secret mounted as an environment variable.

Answer

Require services to present a JSON Web Token signed with a symmetric key that is distributed to all services in the cluster.

Question 13

A healthcare organization is architecting a secure data exchange with a partner hospital. The partners need to share patient records in near real time, but they do not want to expose their internal databases directly. The security architect must ensure that only specific, authorized fields are exchanged, that the data is validated against a predefined schema, and that the exchange is auditable and resistant to tampering. Which approach best satisfies these requirements?

Accepted Answer

A mutually authenticated API gateway with schema validation and signed messages. A mutually authenticated API gateway with schema validation and signed messages enables selective field exchange, real-time communication, strict schema enforcement, and tamper-resistant auditing. It avoids exposing internal databases and provides the necessary security controls for partner data sharing.

Answer

A shared message queue using AMQP with no message signing

Answer

SFTP file drops of full database exports on a scheduled basis

Answer

Direct database replication between the two organizations over a VPN

Question 14

A security architect is designing a data loss prevention (DLP) program for a company that uses Microsoft 365 and a SaaS CRM. The architect must reduce false positives while still detecting sensitive data leaving the environment. Which TWO capabilities should be prioritized? (Choose two.)

Accepted Answer

Trainable classifiers that learn from labeled examples of the organization's confidential documents. High-fidelity DLP combines exact data matching, which fingerprints the organization's own sensitive records, with trainable classifiers that recognize document categories from labeled examples. Together they detect both known data and semantically sensitive content while avoiding the noise of generic regex or keyword rules. Size limits and broad patterns do not target sensitive content and increase false positives.

Answer

Blocking all outbound email attachments larger than 10 MB

Answer

Keyword lists built from common industry terms such as 'confidential' and 'internal use'

Answer

Regular expressions that match any nine-digit number as a potential account identifier

Question 15

A security architect is designing a Zero Trust architecture for a multinational corporation. The organization wants to enforce least-privilege access to applications based on device health, user identity, and contextual factors, and it requires continuous verification of trust. Which TWO of the following are core enforcement mechanisms that should be implemented to achieve these goals? (Choose two.)

Accepted Answer

Microsegmentation with identity-based policies. The PDP/PEP separation and microsegmentation with identity-based policies are core Zero Trust enforcement mechanisms. The PDP/PEP model enables dynamic, context-aware access decisions, while identity-based microsegmentation enforces least privilege and limits lateral movement, together supporting continuous verification and device health evaluation.

Answer

Static VPN access with split tunneling for all employees

Answer

A single-factor password authentication for all internal applications

Answer

Implicit trust for devices on the corporate LAN