CAS-004 Security Architecture Practice Test 3 — 15 Questions

Question 1

A security architect is designing a software-defined perimeter (SDP) for a remote workforce. The architect must ensure that the SDP provides dynamic, need-to-know access to applications while hiding them from unauthorized users. Which TWO of the following are core components of the SDP architecture as defined by the Cloud Security Alliance (CSA)? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Single Packet Authorization (SPA) to authenticate and authorize before granting network access. The Cloud Security Alliance SDP architecture defines the controller and the gateway as core components, with Single Packet Authorization (SPA) as a key mechanism for authentication and concealment. The controller authenticates and authorizes clients, while SPA ensures that services remain hidden until a legitimate, authenticated request is received.

Answer

A client that initiates connections and performs mutual authentication with the controller

Answer

A demilitarized zone (DMZ) with reverse proxies that expose application endpoints to the internet

Answer

A public DNS server that resolves application names to routable IP addresses

Question 2

A security architect is designing a microservices-based application deployed on Kubernetes. The architect needs to ensure that inter-service communication is secure and that services can be authenticated and authorized. Which TWO of the following should be implemented to achieve mutual TLS (mTLS) and fine-grained access control between services? (Choose two.)

Accepted Answer

Deploy a service mesh with a sidecar proxy that enforces mTLS and authorization policies.. To achieve mTLS and fine-grained access control between microservices, a service mesh with sidecar proxies and a certificate authority issuing unique service certificates are both effective. The service mesh automates mTLS and policy enforcement, while a CA-based approach with application-level mTLS provides strong identity. Together or separately, they enable secure, authenticated communication and granular authorization.

Answer

Enable network policies in Kubernetes to restrict traffic between pods.

Answer

Implement a centralized API gateway that terminates TLS and authenticates services.

Answer

Use Kubernetes Secrets to store TLS certificates and mount them into each pod.

Question 3

A financial services company is designing a new application that must authenticate users without storing passwords on its servers. The security architect wants to leverage an open standard that allows third-party applications to obtain limited access to user accounts on an HTTP service, with the user's consent and without sharing credentials. Which standard BEST fits this requirement?

Accepted Answer

OAuth 2.0. OAuth 2.0 is the open standard for delegated authorization, enabling third-party applications to obtain limited access to user accounts on an HTTP service without sharing credentials. It uses access tokens and scopes to constrain permissions, and user consent is obtained through an authorization server, exactly as described.

Answer

Kerberos

Answer

OpenID Connect (OIDC)

Answer

Security Assertion Markup Language (SAML) 2.0

Question 4

A healthcare provider is architecting a system to share patient records with external clinics. The requirement is that external clinics can verify the integrity and origin of each record without the provider and clinic sharing a symmetric key, and that the provider cannot later deny having signed a record. Which of the following should the architect implement?

Accepted Answer

Digital signatures using the provider's private key and the clinic's public key for verification.. Digital signatures using asymmetric cryptography satisfy integrity, origin authentication, and non-repudiation simultaneously. The provider signs with its private key, and any clinic verifies with the widely distributable public key, eliminating the need for shared symmetric secrets. This design ensures the provider cannot later deny signing a record.

Answer

TLS mutual authentication between the provider and each external clinic.

Answer

HMAC-SHA256 with a shared secret distributed to each external clinic.

Answer

AES-256-GCM encryption of each record with a key derived from the provider's master key.

Question 5

A healthcare provider is moving a patient portal to containers on a Kubernetes cluster. The security architect must ensure that a compromised pod cannot reach the internal billing API or the cluster metadata service, even if the pod's network namespace is fully controlled by an attacker. Which control should the architect implement to enforce this at the network layer?

Accepted Answer

A Kubernetes NetworkPolicy that allows only egress to the portal's own namespace and denies all other traffic. Network-layer isolation in Kubernetes is enforced by NetworkPolicy, which selects pods and specifies allowed ingress and egress. A default-deny egress posture with an explicit allow for required destinations prevents a compromised pod from reaching the billing API and the metadata service. Admission control, mTLS, and RBAC address different layers and do not block the lateral network paths described.

Answer

PodSecurity admission set to the restricted profile

Answer

A service mesh with mutual TLS between all sidecars

Answer

Role-based access control that removes the portal service account's permissions

Question 6

A financial services firm is designing a hybrid identity architecture where on-premises Active Directory Domain Services accounts must be synchronized to Microsoft Entra ID and used for conditional access decisions. The security architect wants to ensure that authentication decisions for cloud applications are evaluated against real-time on-premises account status, including immediate account disablement, without requiring password hash synchronization. Which Microsoft Entra Connect authentication method should the architect select?

Accepted Answer

Microsoft Entra Connect with federation using Active Directory Federation Services (AD FS). Federation with AD FS is the only option that delegates authentication to on-premises infrastructure so that every access request is evaluated against live Active Directory account status. This provides immediate enforcement of account disablement and avoids password hash synchronization, which is critical for the stated hybrid identity and conditional access requirements.

Answer

Microsoft Entra Connect with password hash synchronization (PHS)

Answer

Microsoft Entra Connect with pass-through authentication (PTA)

Answer

Microsoft Entra Connect with password writeback enabled

Question 7

A security architect is asked to reduce the risk of credential theft on a fleet of Linux servers that run automated backup jobs. The jobs currently use long-lived SSH keys stored on disk, and auditors want the private key material to never exist on the servers. Which approach best meets this requirement?

Accepted Answer

Issue each server a SPIFFE SVID and use it to obtain short-lived SSH credentials from a workload identity broker. The requirement that private key material never reside on the servers points to workload identity with short-lived credentials. A SPIFFE SVID, issued and rotated by an agent, lets the backup process authenticate to an identity broker and receive a temporary SSH credential. Certificates, HSM-backed keys, and MFA all improve key handling but still leave usable material or credentials accessible on the host.

Answer

Enforce multi-factor authentication for all interactive SSH sessions

Answer

Deploy SSH certificates issued by a short-lived CA and rotate them hourly

Answer

Move the SSH private keys into a hardware security module and reference them via PKCS#11

Question 8

A startup is designing its first cloud-native application. The architect wants to reduce the attack surface by removing unnecessary components from container images and by ensuring that a compromised container cannot escalate privileges on the host. Which two practices should the architect prioritize?

Accepted Answer

Use minimal base images and run containers as a non-root user with read-only filesystems.. Minimal base images strip out tools attackers rely on after exploitation, and running as non-root with read-only filesystems restricts what a compromised container can do to its host. These two practices directly reduce attack surface and contain privilege escalation. Logging, public IPs, and larger resource limits address observability, exposure, and performance rather than the stated security objectives.

Answer

Increase the container memory and CPU limits to improve performance under load.

Answer

Enable verbose application logging and ship logs to a central collector.

Answer

Assign each container a public IP address for easier management.

Question 9

A financial services company is designing a new application that processes credit card transactions. The security architect must ensure that the application meets PCI DSS requirements for protecting cardholder data at rest and in transit. The company wants to minimize the scope of the cardholder data environment (CDE). Which of the following design decisions best supports this goal?

Accepted Answer

Store all cardholder data in a dedicated database server that is isolated in its own network segment, and encrypt the data at rest using AES-256 with keys managed by a hardware security module (HSM).. Isolating cardholder data in a dedicated database server on its own network segment limits the CDE to that segment, which is the most effective way to minimize scope. Encrypting the data at rest with AES-256 and managing keys in an HSM satisfies PCI DSS cryptography requirements. The other options either mix cardholder data with other data, rely solely on tokenization without addressing residual data, or allow broad network access that expands the CDE.

Answer

Store cardholder data in the same database as other business data, but encrypt the entire database with Transparent Data Encryption (TDE) and rely on database access controls to restrict access.

Answer

Tokenize cardholder data at the point of entry so that the application never stores the primary account number (PAN), and use a third-party tokenization service that is PCI DSS certified.

Answer

Encrypt cardholder data in transit using TLS 1.2 and store it in a cloud object storage bucket with server-side encryption, allowing broad access from the corporate network.

Question 10

A security architect is reviewing an application that stores user session tokens in a client-side cookie. The tokens are signed with HMAC-SHA256 but are not encrypted, and the application team wants to add confidentiality without changing the token format or breaking existing signature verification. Which change should the architect recommend?

Accepted Answer

Encrypt the token payload with AES-GCM and keep the HMAC signature over the ciphertext. Adding confidentiality to a signed cookie is best done by encrypting the payload while preserving the existing signature over the ciphertext. AES-GCM provides authenticated encryption, and keeping the HMAC maintains the current verification path. Longer keys, transport controls, and relocation of the token do not hide the payload from parties who can read the cookie.

Answer

Move the session token from the cookie to a URL query parameter

Answer

Replace HMAC-SHA256 with a longer HMAC-SHA512 key

Answer

Shorten the token lifetime and enable HTTP Strict Transport Security

Question 11

A security architect is evaluating a cloud service provider's offering for a new application. The provider advertises that the service abstracts the underlying infrastructure, automatically scales, and requires no server management by the customer. The architect needs to understand the shared responsibility model for this service. Which cloud service model is being described, and what is the customer's primary security responsibility?

Accepted Answer

Function as a Service (FaaS); the customer is responsible for securing the function code and its dependencies. Function as a Service (FaaS) is a serverless model where the provider manages all infrastructure and scaling, and the customer secures only the function code, dependencies, and data. This aligns with the scenario's description of no server management and automatic scaling, and it defines the customer's primary security responsibility.

Answer

Platform as a Service (PaaS); the customer is responsible for securing the application and its data

Answer

Infrastructure as a Service (IaaS); the customer is responsible for securing the hypervisor and physical hosts

Answer

Software as a Service (SaaS); the customer is responsible for securing user access and data governance

Question 12

A security architect is designing a hybrid cloud environment in which on-premises applications must access sensitive data stored in a public cloud object store. The chief information security officer requires that data in transit be protected with organization-controlled keys, that the cloud provider never have access to plaintext keys, and that both ends of the connection be authenticated. The architect is evaluating a virtual private network and a MACsec-based approach. Which TWO controls best satisfy these requirements? (Choose two.)

Accepted Answer

IPsec tunnel between the on-premises gateway and the cloud virtual private gateway using IKEv2. An IPsec tunnel with IKEv2 and mutual TLS both provide encryption with keys held by the organization's endpoints and authenticate both parties. IPsec secures the network path between gateways, while mutual TLS secures the application session to the object store endpoint. Together they ensure the provider transports ciphertext and cannot access plaintext keys, satisfying the confidentiality and authentication mandates.

Answer

MACsec encryption on the dedicated interconnects between the data center and the cloud provider

Answer

SSH port forwarding from the on-premises host to the cloud object store

Answer

Transport Layer Security with a provider-issued certificate and provider-managed certificate authority

Question 13

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

Accepted Answer

Isolating workloads at the virtual network interface level with granular security policies. Micro-segmentation in a zero trust architecture isolates individual workloads at the virtual network interface level and enforces granular, per-workload security policies. This limits lateral movement because each workload becomes its own security zone, and traffic between workloads is explicitly allowed or denied based on identity and policy rather than network location. It is a foundational zero trust control that assumes no implicit trust based on being 'inside' the network.

Answer

Creating a single perimeter around the entire network

Answer

Using VLANs to separate departments

Answer

Implementing a VPN for remote access

Question 14

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

Question 15

A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.

Answer

Site-to-site VPN over the internet

Answer

AWS Client VPN

Answer

AWS Transit Gateway with internet gateway