CAS-004 Security Architecture Practice Test 2 — 15 Questions

Question 1

A security engineer is integrating API security for a RESTful service. Which mechanism is used to verify that the API request has not been tampered with and originates from a legitimate client?

Accepted Answer

JWT. JWT (JSON Web Token) is used to verify the integrity and authenticity of API requests. A JWT is digitally signed, allowing the recipient to verify that the token was issued by a legitimate authority and has not been tampered with. OAuth 2.0 is for authorization, API keys are for identification, and rate limiting is for throttling.

Answer

OAuth 2.0 authorization code

Answer

API key in query parameter

Answer

Rate limiting

Question 2

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which algorithm is recommended for digital signatures?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is one of the NIST Post-Quantum Cryptography (PQC) standards selected for digital signatures, finalized in FIPS 204 (ML-DSA). It is a lattice-based signature scheme chosen for its strong security and efficient performance across a range of platforms. NIST selected Dilithium as the primary recommended algorithm for digital signatures in its PQC standardization effort.

Answer

Falcon

Answer

CRYSTALS-Kyber

Answer

RSA-4096

Question 3

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which THREE algorithms are currently selected for standardization? (Select THREE).

Accepted Answer

CRYSTALS-Kyber. NIST has selected CRYSTALS-Kyber (for key encapsulation), CRYSTALS-Dilithium (for digital signatures), and FALCON (for digital signatures, with SPHINCS+ as a backup) for standardization. RSA and ECDH are not quantum-resistant.

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

RSA-4096

Question 4

An enterprise is securing a hybrid cloud environment with on-premises and AWS workloads. They need to ensure that on-premises systems can privately access VPC resources without traversing the public internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from on-premises to AWS, bypassing the public internet. It offers consistent low latency and high bandwidth, making it ideal for hybrid cloud environments requiring private access to VPC resources. Site-to-site VPN uses the public internet, while Transit Gateway and PrivateLink serve different purposes.

Answer

AWS VPN (site-to-site)

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 5

An organization is designing a PKI for certificate lifecycle management. Which TWO practices are critical for maintaining the security of the certificate authority (CA)? (Select TWO.)

Accepted Answer

Storing the root CA private key in a hardware security module (HSM). Option B is correct because storing the root CA private key in a hardware security module (HSM) protects the most sensitive secret in the PKI: the HSM provides tamper-resistant key storage, enforces cryptographic operations without exposing the key material, and supports FIPS 140-2/140-3 validated modules, so compromise of the CA host does not directly yield the root key. Option E is correct because implementing Online Certificate Status Protocol (OCSP) enables real-time revocation checking, allowing relying parties to detect certificates that were revoked before expiration (e.g., due to key compromise), which is essential to limiting the damage from a compromised issuing CA or leaf certificate. Option A is not appropriate because long validity periods increase the window of exposure and delay revocation-driven remediation, weakening CA security rather than strengthening it. Option C is not a CA-hardening practice; certificate pinning is a client-side control against mis-issuance/MITM but does not protect the CA itself. Option D is not a security practice for a CA, since self-signed certificates for internal services bypass a trusted hierarchy and provide no third-party validation or revocation infrastructure.

Answer

Setting long certificate validity periods to reduce renewal frequency

Answer

Using certificate pinning to prevent man-in-the-middle attacks

Answer

Using self-signed certificates for all internal services

Question 6

A multinational corporation is adopting a zero trust architecture for its enterprise network. The security team is evaluating mechanisms to enforce granular access controls and segment workloads. Which TWO components are most critical for implementing a zero trust model? (Choose TWO.)

Accepted Answer

Micro-segmentation. Micro-segmentation (B) is critical because zero trust requires dividing the network into isolated workload-level segments so that east-west traffic between workloads is explicitly authorized and inspected, rather than trusting anything inside a perimeter. Identity-centric access controls (D) are equally essential because zero trust bases every access decision on verified user, device, and workload identity (e.g., via strong authentication, conditional access, and least-privilege policies) instead of network location. Together these two components enforce the core zero trust principles of 'never trust, always verify' and least-privilege access at both the identity and workload layers. SASE (A) and SDP (E) are useful zero trust-aligned technologies, but they are delivery/connectivity architectures rather than the fundamental enforcement mechanisms for granular access control and workload segmentation, and perimeter-based firewalls (C) contradict zero trust by relying on a trusted internal network boundary.

Answer

Secure Access Service Edge (SASE)

Answer

Perimeter-based firewalls

Answer

Software-defined perimeter (SDP)

Question 7

A security architect is designing a cloud security strategy for a healthcare organization that uses a hybrid cloud environment with AWS and Azure. The organization must comply with HIPAA and needs to protect sensitive patient data. Which THREE cloud security controls should be prioritized? (Choose THREE.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Option B, Cloud Workload Protection Platform (CWPP), is correct because it secures workloads across hybrid AWS/Azure environments by providing runtime protection, vulnerability management, and malware detection for VMs, containers, and serverless functions that process ePHI. Option C, Cloud Access Security Broker (CASB), is correct because it enforces data protection policies, DLP, encryption, and access controls for cloud services and shadow IT, which is essential for HIPAA compliance across multi-cloud SaaS usage. Option E, Cloud Security Posture Management (CSPM), is correct because it continuously monitors AWS and Azure configurations against HIPAA-aligned benchmarks, detecting misconfigurations such as public S3 buckets or unencrypted storage that could expose patient data. Option A, Virtual Private Cloud (VPC), is not among the marked answers because it is a foundational network isolation construct rather than a prioritized security control for this multi-cloud compliance scenario. Option D, Identity and Access Management (IAM), is not among the marked answers because, while important, it is a baseline access control mechanism rather than one of the three specialized cloud security controls selected for this hybrid HIPAA strategy.

Answer

Virtual Private Cloud (VPC)

Answer

Identity and Access Management (IAM)

Question 8

A company is migrating critical applications to a multi-cloud architecture using AWS and Google Cloud Platform (GCP). The security team must ensure secure connectivity between on-premises data centers and cloud environments while meeting data residency requirements in the EU. Which TWO solutions should the architect implement to address these requirements? (Choose TWO.)

Accepted Answer

Dedicated physical connections (e.g., AWS Direct Connect, GCP Dedicated Interconnect). Option A is correct because AWS Direct Connect and GCP Dedicated Interconnect provide dedicated, private physical network connections between on-premises data centers and each cloud provider, ensuring consistent bandwidth, lower latency, and traffic that bypasses the public internet, which is essential for secure multi-cloud connectivity of critical applications. Option B is correct because AWS PrivateLink and GCP Private Service Connect create private, unidirectional endpoints that expose services to consumers without traversing the public internet, keeping traffic within the provider backbone and helping enforce data residency by controlling where service access occurs. Together, these two solutions deliver the private, predictable, and compliant connectivity the security team requires across AWS, GCP, and on-premises. Option C (CASB) is not correct here because a CASB enforces policy and visibility for cloud service usage (e.g., shadow IT, DLP) rather than providing the underlying private network transport between data centers and clouds. Option D (SASE) is not correct because SASE converges networking and security functions (SD-WAN, SWG, ZTNA, FWaaS) for user and branch access, not the dedicated data-center-to-cloud private interconnectivity this scenario demands. Option E (site-to-site VPN with IPsec) is not correct because, while it encrypts traffic, it typically runs over the public internet and does not provide the dedicated, predictable private paths or the private service-endpoint model needed to meet the strict EU data residency and secure connectivity requirements as directly as options A and B.

Answer

Cloud Access Security Broker (CASB)

Answer

Secure Access Service Edge (SASE)

Answer

Site-to-site VPN with IPsec

Question 9

A security architect is designing a Kubernetes cluster for a government agency that requires high security and compliance with FedRAMP. The cluster will host microservices processing sensitive data. Which TWO configurations are most critical for hardening the Kubernetes environment? (Choose TWO.)

Accepted Answer

Implementing Role-Based Access Control (RBAC). Option C is correct because implementing Role-Based Access Control (RBAC) enforces least-privilege access to the Kubernetes API, binding users, groups, and service accounts to narrowly scoped Roles/ClusterRoles, which is a foundational control for FedRAMP-mandated access control (AC) and separation-of-duties requirements in a cluster handling sensitive data. Option E is correct because Kubernetes network policies provide pod-level microsegmentation, restricting east-west traffic between microservices so that a compromised pod cannot freely reach other workloads, directly supporting FedRAMP SC-7 boundary protection and least functionality for sensitive-data microservices. Option A is not among the marked answers: while seccomp and AppArmor are valuable runtime hardening controls, they are host/container-level mitigations rather than the cluster-wide authorization and segmentation controls most critical to the stated design. Option B is not marked: image scanning is a supply-chain/vulnerability-management practice typically performed in CI/CD or via an admission scanner, and it does not by itself enforce runtime access or traffic restrictions. Option D is not marked: PodSecurityPolicy is deprecated and removed as of Kubernetes 1.25 (replaced by Pod Security Admission), so it is not the most critical hardening configuration for a modern FedRAMP cluster.

Answer

Deploying runtime security with seccomp and AppArmor

Answer

Enabling container image scanning

Answer

Using admission controllers like PodSecurityPolicy

Question 10

A security architect is reviewing API security for a financial services platform that uses OAuth 2.0 for authorization and JWTs for token exchange. The platform must protect against common API threats such as token theft and injection attacks. Which TWO controls should be implemented to mitigate these specific threats? (Choose TWO.)

Accepted Answer

Rate limiting on API endpoints. Rate limiting on API endpoints (C) is correct because it directly mitigates token theft abuse by throttling the number of requests an attacker can make with a stolen token, limiting credential-stuffing, brute-force, and automated replay attacks against the financial API. Input validation and sanitization (D) is correct because it defends against injection attacks (such as SQL injection, command injection, and XSS payloads embedded in API parameters or JSON bodies) by rejecting or neutralizing malicious input before it reaches backend services. The other options, while useful in a broader API security program, do not specifically address the two threats named: an API gateway (A) is an architectural enforcement point rather than a targeted mitigation, OAuth 2.0 scopes (B) constrain what a token can access but do not stop theft or injection, and short token expiration times (E) reduce the window of token misuse but do not prevent injection attacks or stop theft itself.

Answer

Implementing an API gateway

Answer

Using OAuth 2.0 scopes

Answer

Short token expiration times

Question 11

A security architect is designing a network segmentation strategy for an industrial control system (ICS) environment. The organization must prevent lateral movement from corporate IT to the ICS network and ensure that critical controllers remain available even if a corporate workstation is compromised. Which TWO of the following controls should the architect implement? (Choose two.)

Accepted Answer

Deploy a unidirectional gateway (data diode) between the corporate network and the ICS network. A unidirectional gateway and a DMZ with protocol-aware firewalls both enforce strict segmentation and prevent direct lateral movement from corporate IT to ICS. The gateway blocks all inbound traffic, while the DMZ brokers only necessary protocols, together protecting controller availability and integrity.

Answer

Install host-based firewalls on each ICS controller to block all inbound traffic

Answer

Use a shared jump host with multi-factor authentication for both corporate and ICS administrators

Answer

Enable a flat network with VLANs to simplify management and reduce latency

Question 12

A multinational corporation is adopting a Zero Trust architecture. The security team wants to enforce fine-grained access control for employees accessing internal applications from various devices and locations. They require continuous verification of user and device posture. Which of the following components is MOST critical to achieve this?

Accepted Answer

Software-defined perimeter (SDP) controller. Zero Trust requires a policy decision point that continuously verifies user identity, device health, and context before granting access. An SDP controller embodies this by authenticating and authorizing each session, often using single-packet authorization and dynamic policies. It integrates with identity providers and endpoint agents to assess posture, making it the most critical component for fine-grained access control in a Zero Trust architecture.

Answer

Identity and access management (IAM) system with adaptive authentication

Answer

Next-generation firewall (NGFW) with deep packet inspection

Answer

Security information and event management (SIEM) system

Question 13

A security architect is designing a hybrid identity solution. Employees must authenticate to on-premises applications and to Microsoft 365 using the same credentials, and the organization wants authentication to continue working for on-premises resources if the internet connection to the cloud identity provider fails. Which design best meets these requirements?

Accepted Answer

Deploy Active Directory Federation Services (AD FS) in the on-premises network and federate with Microsoft Entra ID.. The requirement for on-premises authentication to survive a cloud connectivity outage points to an on-premises authentication authority. AD FS provides exactly that: it issues tokens locally and federates with Microsoft Entra ID for cloud access. Password hash synchronization and pass-through authentication both depend on the cloud service being reachable, and adding another cloud provider does not remove that dependency.

Answer

Implement password hash synchronization with Microsoft Entra ID and enable seamless single sign-on.

Answer

Configure pass-through authentication with multiple on-premises authentication agents.

Answer

Enable federation with a third-party cloud identity provider and replicate directory objects to it.

Question 14

A security architect is evaluating a hardware security module (HSM) for a certificate authority that must issue high-assurance certificates. The architect needs to ensure the HSM provides tamper evidence and meets regulatory requirements for key protection. Which TWO of the following capabilities are most critical for this use case? (Choose two.)

Accepted Answer

Role-based access control with separation of duties for administrative functions. For a high-assurance certificate authority, the HSM must provide independently validated cryptographic protection and strong administrative controls. FIPS 140-2/140-3 validation confirms tamper evidence and key management meets government standards, while RBAC with separation of duties prevents unilateral key compromise. These two capabilities directly address the regulatory and security requirements for protecting CA private keys.

Answer

Integration with a hardware random number generator (HRNG) for key generation

Answer

Ability to export private keys in plaintext for backup purposes

Answer

Support for hot-swappable redundant power supplies

Question 15

A security architect is designing a hybrid environment where on-premises applications must communicate with workloads in a public cloud. The CISO requires that all traffic between the two environments be encrypted, mutually authenticated, and routed through a dedicated logical tunnel that never traverses the public internet. The architect must select a technology that meets these requirements without deploying dedicated physical leased lines. Which of the following should the architect implement?

Accepted Answer

Site-to-site IPsec VPN between the on-premises edge firewall and the cloud virtual network gateway. A site-to-site IPsec VPN is the standard mechanism for securely interconnecting an on-premises network with a cloud virtual network over commodity internet links. It provides encryption, integrity, and peer authentication through IKE, and it creates a dedicated logical tunnel that satisfies the no-public-internet traversal requirement without the recurring cost and lead time of dedicated physical circuits.

Answer

Remote-access SSL VPN terminating on the cloud load balancer for each application server

Answer

Software-defined WAN with forward error correction enabled on all WAN links

Answer

Transport Layer Security inspection at the cloud web application firewall for all inbound flows