CAS-004 Security Architecture Practice Test 3 — 15 Questions

Question 1

A security architect is designing a zero trust architecture for a corporate network. Which principle is fundamental to the zero trust model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every access request must be verified regardless of origin.

Answer

Trust based on device compliance

Answer

Trust based on network location

Answer

Trust but verify

Question 2

A company is migrating to a public cloud and wants to ensure they understand their security responsibilities. According to the shared responsibility model, which of the following is typically the responsibility of the cloud customer?

Accepted Answer

Identity and access management. The customer is responsible for securing data, applications, and access management even in IaaS/PaaS/SaaS.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure security

Question 3

An organization is implementing a CASB to secure their SaaS applications. Which CASB deployment mode is most appropriate for monitoring and controlling data in transit between users and cloud apps without modifying the user's device?

Accepted Answer

API-based. API-based CASB connects directly to the cloud app's API to monitor and control data, without requiring client software.

Answer

Reverse proxy

Answer

Forward proxy

Answer

Inline gateway

Question 4

A security engineer is designing a secure hybrid cloud connection between an on-premises data center and AWS. Which service provides a dedicated, private network connection that bypasses the public internet?

Accepted Answer

Direct Connect. AWS Direct Connect provides a dedicated private connection from on-premises to AWS.

Answer

Site-to-Site VPN

Answer

Transit Gateway

Answer

VPC Peering

Question 5

An organization is adopting SASE to converge network and security functions. Which component of SASE provides secure web gateway (SWG) capabilities?

Accepted Answer

Secure Web Gateway. SWG is a key SASE component that protects users from web-based threats by filtering traffic.

Answer

ZTNA

Answer

SD-WAN

Answer

CASB

Question 6

During a threat modeling exercise for a new web application, the team identifies that the application uses JWT for authentication. Which vulnerability is most likely if the server does not properly verify the JWT signature?

Accepted Answer

JWT tampering. If signature verification is missing, an attacker can forge a JWT with arbitrary payload (e.g., admin role).

Answer

Cross-site scripting

Answer

SQL injection

Answer

Insecure direct object reference

Question 7

A security architect is implementing defense-in-depth for a critical application. Which of the following is an example of a detective control?

Accepted Answer

Intrusion detection system. Detective controls identify and record security events after they occur; an IDS monitors traffic for suspicious activity.

Answer

Data encryption

Answer

Access control list

Answer

Firewall

Question 8

A company is deploying containers in a Kubernetes cluster and needs to enforce that containers run with reduced capabilities. Which Linux security feature should be configured to drop unnecessary capabilities?

Accepted Answer

AppArmor. To drop unnecessary capabilities in a Linux container, the correct Linux security feature is AppArmor. AppArmor is a Mandatory Access Control (MAC) system that can be configured with profiles to restrict capabilities granted to processes. By defining an AppArmor profile that drops specific capabilities (e.g., using the 'capability' rule set to deny), administrators can enforce that containers run with reduced privileges. While Seccomp filters system calls, it does not directly manage capabilities. PodSecurityPolicy is a Kubernetes resource, not a Linux feature. SELinux can also control capabilities but is more complex and less commonly used for this specific purpose in container environments.

Answer

PodSecurityPolicy

Answer

Seccomp

Answer

SELinux

Question 9

An organization is concerned about future quantum computer attacks on their public key infrastructure. Which NIST-standardized algorithm is designed for digital signatures and is resistant to quantum attacks?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is a NIST PQC standard for digital signatures.

Answer

Falcon

Answer

RSA-4096

Answer

CRYSTALS-Kyber

Question 10

A security team is hardening a Kubernetes cluster. Which resource should be used to define fine-grained rules for which pods can communicate with each other?

Accepted Answer

NetworkPolicy. Kubernetes NetworkPolicies allow ingress/egress rules controlling pod-to-pod communication.

Answer

Admission Controller

Answer

PodSecurityPolicy

Answer

RBAC

Question 11

A company uses an API gateway to manage their microservices. Which security control should the gateway enforce to prevent abuse from excessive API calls?

Accepted Answer

Rate limiting. Rate limiting restricts the number of requests a client can make in a given period, preventing abuse.

Answer

JWT verification

Answer

Input validation

Answer

OAuth 2.0

Question 12

A security administrator needs to ensure that only authorized devices can access the corporate network. Which technology would best enforce this requirement at the network access layer?

Accepted Answer

802.1X. 802.1X provides port-based authentication, allowing only authorized devices to connect to the network.

Answer

TLS 1.3

Answer

IPsec VPN

Answer

DNSSEC

Question 13

A security architect is evaluating a CSPM tool for a multi-cloud environment. Which TWO capabilities should the architect consider essential for the CSPM? (Choose two.)

Accepted Answer

Continuous compliance monitoring against frameworks like CIS. CSPM automates security compliance and configuration monitoring across cloud environments.

Answer

Vulnerability scanning of container images

Answer

Real-time web application firewall

Answer

Data loss prevention for cloud storage

Question 14

An organization is implementing a software-defined perimeter (SDP) for zero trust network access. Which THREE characteristics are typical of an SDP architecture? (Choose three.)

Accepted Answer

Applications are invisible to unauthorized users. SDP hides infrastructure, requires authentication before connectivity, and creates per-session encrypted tunnels.

Answer

Relies on IP-based allowlists

Answer

Uses a single shared firewall for all traffic

Question 15

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). During development, SAST scans source code, dependency analysis checks libraries, and threat modeling identifies design flaws.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment