CAS-004 Security Architecture Practice Test 4 — 15 Questions

Question 1

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a NIST-approved post-quantum cryptographic algorithm designed for key encapsulation (KEM), selected in the NIST PQC standardization process. It is based on module learning with errors (MLWE) and provides secure key exchange resistant to quantum attacks. RSA-4096 and ECDHE are classical algorithms vulnerable to quantum computers, and CRYSTALS-Dilithium is designed for digital signatures, not key encapsulation.

Answer

RSA-4096

Answer

ECDHE

Answer

CRYSTALS-Dilithium

Question 2

During a security assessment, a penetration tester discovers that a web application fails to validate the size of user input, leading to a buffer overflow. Which application security control would have BEST prevented this vulnerability?

Accepted Answer

Input validation. Input validation is the application security control that directly prevents buffer overflow by ensuring that user-supplied data does not exceed the allocated buffer size. It checks the length, type, and format of input before processing, thereby mitigating the vulnerability at its source.

Answer

Static application security testing (SAST)

Answer

Web application firewall (WAF)

Answer

Rate limiting

Question 3

A company is deploying a SASE architecture. Which component is responsible for securing web traffic and enforcing acceptable use policies at the edge?

Accepted Answer

Secure Web Gateway (SWG). A Secure Web Gateway (SWG) sits at the network edge and inspects outbound web traffic, enforcing URL filtering, malware blocking, and acceptable use policies — exactly the function described. In a SASE architecture, SWG is the component that governs user web access regardless of location, applying policy based on categories, reputation, and content inspection. It is distinct from ZTNA (which controls application access), CASB (which governs cloud service usage), and SD-WAN (which optimizes WAN transport).

Answer

Zero Trust Network Access (ZTNA)

Answer

Cloud Access Security Broker (CASB)

Answer

SD-WAN

Question 4

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

Accepted Answer

Hardware Security Module (HSM). A Hardware Security Module (HSM) is a dedicated tamper-resistant appliance that generates, stores, and uses cryptographic keys without exposing them, performing operations like signing and encryption inside the hardware boundary. It is the standard component for protecting private keys in an enterprise PKI. HSMs provide FIPS 140-2/3 validated protection and resist physical and logical extraction attempts.

Answer

Certificate Revocation List (CRL)

Answer

Key Management Service (KMS)

Answer

Certificate Authority (CA)

Question 5

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. The most significant security concern is that multiple services share the same symmetric key. With a shared symmetric key, any service can forge tokens that are accepted by other services, leading to a lack of non-repudiation and increased blast radius if one service is compromised. This violates the principle of least privilege and increases the risk of token forgery.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set

Question 6

An organization wants to enforce consistent security policies across multiple cloud providers (AWS, Azure, GCP). Which tool is designed to continuously monitor and remediate misconfigurations in cloud environments?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM (Cloud Security Posture Management) tools are purpose-built to continuously scan multi-cloud environments (AWS, Azure, GCP) against benchmarks like CIS, NIST, and PCI DSS, detecting misconfigurations such as public S3 buckets, overly permissive IAM roles, or unencrypted storage. They provide automated remediation workflows and drift detection across providers, which is exactly what the organization needs for consistent policy enforcement. CASB, SIEM, and CWPP address different layers (data access, log correlation, workload runtime) and do not natively deliver cross-cloud configuration posture management.

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 7

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. Option C is correct because an SBOM's core purpose is to enumerate every software component — including open-source libraries and their exact versions — so that downstream consumers can identify what is inside a product and trace provenance. Option E is correct because SBOMs enable dependency analysis, allowing organizations to correlate listed components and versions against vulnerability databases (e.g., NVD/CVE feeds) to detect known vulnerabilities in the supply chain. Together, these two form the essential SBOM strategy: knowing what components exist and analyzing their dependencies for risk. Option A (penetration testing results) is a point-in-time security assessment, not a component inventory, so it is not an SBOM element. Option B (employee background checks) is a personnel security control unrelated to software composition. Option D (network flow logs) captures runtime traffic metadata, not the software components or dependencies that an SBOM documents.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 8

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

Accepted Answer

Least privilege access with just-in-time privileges. Option B is correct because identity-centric zero trust enforces least privilege access, granting users only the minimum permissions needed and elevating privileges just-in-time rather than permanently, which limits the blast radius of compromised accounts. Option C is correct because zero trust requires continuous verification of identity and device health on every access request, rather than trusting a session once authenticated, using signals such as device compliance and risk scores. Option D is correct because MFA for all users strengthens identity assurance by requiring multiple factors, directly supporting the identity-centric principle that no user is trusted by default. Option A is incorrect because implicit trust based on network location is the opposite of zero trust, which assumes no implicit trust regardless of where the request originates. Option E is incorrect because a single static firewall perimeter reflects the traditional castle-and-moat model, whereas zero trust replaces perimeter-based trust with identity- and policy-based controls.

Answer

Implicit trust based on network location

Answer

Single static firewall perimeter

Question 9

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

Accepted Answer

Identity-based access policies. Identity-based access policies are essential for zero-trust micro-segmentation because they authorize every request based on the verified identity of the user, device, or workload — not on network location. In a multi-cloud zero-trust model, policy decisions follow the identity (via IAM, OIDC, SPIFFE, or mTLS) so that workloads are segmented by who they are, not where they sit. This is the core of identity-centric micro-segmentation.

Answer

VPN concentrators

Answer

Network address translation

Answer

Perimeter firewalls

Question 10

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

Accepted Answer

IaaS. IaaS (Infrastructure as a Service) places the most security responsibility on the customer because the provider only manages the physical hardware, hypervisor, and network fabric. The customer is responsible for the guest OS, middleware, runtime, applications, and data — including patching, hardening, IAM, and encryption. Under SOC 2, this means the customer must implement and evidence most of the Trust Services Criteria controls themselves.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 11

During a secure SDLC, a development team wants to identify vulnerabilities in running code. Which type of testing should be performed?

Accepted Answer

DAST. DAST (Dynamic Application Security Testing) tests running applications from the outside by simulating attacks against a live deployment, which is exactly what is needed to identify vulnerabilities in running code. It analyzes the application in its deployed state, including runtime configuration and environment-specific issues.

Answer

IAST

Answer

SAST

Answer

RASP

Question 12

A security team is hardening a Kubernetes cluster. Which control should be implemented to restrict a container's system calls to only those required by the application?

Accepted Answer

Seccomp. Seccomp (secure computing mode) is a Linux kernel feature that filters the system calls a process can make, using a BPF-based profile to allow or deny specific syscalls. In Kubernetes, seccomp profiles are applied via the securityContext.seccompProfile field (or the older seccomp.security.alpha.kubernetes.io/pod annotation), restricting a container to only the syscalls its application requires. This directly matches the requirement to limit a container's system calls.

Answer

AppArmor

Answer

Network policies

Answer

Pod security policies

Question 13

An organization wants to protect cryptographic keys used for TLS termination. Which hardware solution should be deployed to prevent key extraction?

Accepted Answer

HSM. A Hardware Security Module (HSM) is a dedicated tamper-resistant hardware appliance designed to generate, store, and manage cryptographic keys, with physical and logical protections that prevent key extraction. For TLS termination, HSMs provide FIPS 140-2/3 validated key storage and can perform cryptographic operations without exposing private keys. This directly addresses the requirement to prevent key extraction.

Answer

KMS

Answer

TPM

Answer

UEFI

Question 14

A security architect is designing a public key infrastructure (PKI). Which component is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority. The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Answer

Validation Authority

Answer

Certificate Repository

Answer

Registration Authority

Question 15

A company is preparing for post-quantum cryptography migration. According to NIST PQC standards, which algorithm is a candidate for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is the NIST-standardized algorithm for key encapsulation (KEM), selected in the post-quantum cryptography standardization process. It is designed for secure key exchange and is efficient for both client and server. NIST selected Kyber as the primary KEM standard (FIPS 203).

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Answer

Falcon