CAS-004 Security Architecture Practice Test 2 — 15 Questions

Question 1

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

Accepted Answer

Identity-based access policies. In a zero-trust model, identity is the primary security boundary. Micro-segmentation uses identity and context to enforce least-privilege access, regardless of network location.

Answer

VPN concentrators

Answer

Network address translation

Answer

Perimeter firewalls

Question 2

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

Accepted Answer

IaaS. In IaaS, the customer manages the OS, applications, and data, while the provider secures the physical infrastructure. SOC 2 compliance requires customer to handle many controls.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 3

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 4

A company needs to connect its on-premises data center to a public cloud provider with low latency and high bandwidth while avoiding the public internet. Which connectivity method should be used?

Accepted Answer

Direct Connect. Direct Connect (or ExpressRoute) provides a dedicated private connection from on-premises to the cloud, bypassing the internet for better performance and security.

Answer

Client VPN

Answer

Site-to-site VPN

Answer

SD-WAN

Question 5

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

Accepted Answer

SWG. SWG (Secure Web Gateway) is the SASE component that provides security inspection for all traffic, regardless of user location, by enforcing policies and protecting against web-based threats. It inspects all outbound traffic from users, whether on-premises or remote, to ensure security compliance.

Answer

ZTNA

Answer

CASB

Answer

SD-WAN

Question 6

During a secure SDLC, a development team wants to identify vulnerabilities in running code. Which type of testing should be performed?

Accepted Answer

DAST. DAST (Dynamic Application Security Testing) tests running applications from the outside, simulating attacks to find vulnerabilities in runtime behavior.

Answer

IAST

Answer

SAST

Answer

RASP

Question 7

A security team is hardening a Kubernetes cluster. Which control should be implemented to restrict a container's system calls to only those required by the application?

Accepted Answer

Seccomp. seccomp (secure computing mode) filters system calls a process can make, reducing the kernel attack surface. It is a Linux kernel feature commonly used in container security.

Answer

AppArmor

Answer

Network policies

Answer

Pod security policies

Question 8

An organization wants to protect cryptographic keys used for TLS termination. Which hardware solution should be deployed to prevent key extraction?

Accepted Answer

HSM. Hardware Security Modules (HSMs) are dedicated hardware that securely generate, store, and manage cryptographic keys, making them resistant to extraction even if the host is compromised.

Answer

KMS

Answer

TPM

Answer

UEFI

Question 9

A security architect is designing a public key infrastructure (PKI). Which component is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority. The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Answer

Validation Authority

Answer

Certificate Repository

Answer

Registration Authority

Question 10

A company is preparing for post-quantum cryptography migration. According to NIST PQC standards, which algorithm is a candidate for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a NIST-selected algorithm for key encapsulation, designed to resist quantum attacks. It is used for establishing symmetric keys.

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Answer

Falcon

Question 11

An enterprise is implementing a cloud security posture management (CSPM) solution. What is the primary function of CSPM?

Accepted Answer

Monitoring and remediating misconfigurations. CSPM continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks, providing automated remediation and reporting.

Answer

Brokering access to cloud apps

Answer

Protecting workloads from malware

Answer

Encrypting data at rest

Question 12

A security analyst is investigating an API that uses JSON Web Tokens (JWT) for authentication. Which field in a JWT contains the token expiration time?

Accepted Answer

exp. The 'exp' (expiration) claim in the JWT payload specifies the time after which the token is no longer valid, preventing replay attacks.

Answer

iss

Answer

iat

Answer

sub

Question 13

A security architect is implementing network segmentation in a hybrid cloud environment. Which TWO controls are most effective for reducing east-west traffic risks?

Accepted Answer

Micro-segmentation. Micro-segmentation allows granular policies per workload, and east-west traffic inspection detects lateral movement. Both are key to reducing risks inside the network.

Answer

VPN concentrator

Answer

NAT gateway

Answer

Perimeter firewall

Question 14

A DevSecOps team is integrating security into the CI/CD pipeline. Which THREE practices should be included to ensure supply chain security?

Accepted Answer

Dependency analysis. SBOMs provide transparency of components, dependency scanning reveals known vulnerabilities, and image scanning ensures container images are free of malware. Together they strengthen supply chain security.

Answer

Network segmentation

Answer

Runtime application self-protection

Question 15

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Accepted Answer

Runtime protection. CWPP should provide vulnerability management across different environments and runtime protection (e.g., intrusion detection) for workloads regardless of location.

Answer

Security information and event management

Answer

Identity and access management

Answer

Data loss prevention