CAS-004 Security Architecture Practice Test 4 — 15 Questions

Question 1

A security architect is implementing a zero trust model for a financial services company. The goal is to prevent lateral movement in the data center. Which approach best achieves this objective?

Accepted Answer

Deploying micro-segmentation to isolate workloads and enforce granular policies. Micro-segmentation divides the network into small, isolated segments to restrict lateral movement, which is a key zero trust principle. Software-defined perimeter (SDP) focuses on user-to-resource access, but micro-segmentation directly limits east-west traffic. Defense-in-depth is broader and not specific to lateral movement. Identity-centric access controls user authentication but does not prevent lateral movement.

Answer

Using a software-defined perimeter to hide network resources

Answer

Implementing identity-centric access controls across all resources

Answer

Applying defense-in-depth layering by adding multiple security controls

Question 2

A company uses a hybrid cloud model with workloads on AWS and on-premises. They need to ensure secure connectivity between the two environments with high bandwidth and low latency, bypassing the public internet. Which solution should they implement?

Accepted Answer

Configure AWS Direct Connect for dedicated private connectivity. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet for reliable and secure connectivity. VPN over the internet is less reliable and has higher latency. Private link exposes services privately but does not connect on-premises to cloud. SD-WAN can manage traffic but does not provide a direct dedicated connection.

Answer

Implement SD-WAN with integrated security

Answer

Establish a site-to-site VPN over the internet

Answer

Use AWS PrivateLink to access VPC endpoints

Question 3

An organization is deploying a containerized application on Kubernetes and must enforce that only approved container images are allowed to run, and that containers cannot escalate privileges. Which combination of controls should the architect implement?

Accepted Answer

Admission controllers with image signing and PodSecurityPolicy. Admission controllers intercept requests to the Kubernetes API server; PodSecurityPolicy (now replaced by Pod Security Standards) can enforce privilege escalation restrictions. Image signing ensures only approved images are run. Seccomp and AppArmor are runtime security profiles, but they don't enforce image approval. RBAC controls user access, not image approval. Network policies control traffic, not image approval.

Answer

Seccomp and AppArmor profiles with RBAC

Answer

Kubernetes network policies and RBAC

Answer

Container image scanning and network policies

Question 4

Which technology is used to discover and control cloud applications, enforce security policies, and provide visibility into cloud usage?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) is a security policy enforcement point that sits between cloud service consumers and providers to monitor activity and enforce policies. CSPM focuses on cloud configuration posture. CWPP protects cloud workloads. SASE combines network and security functions.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 5

A security architect is designing a cryptographic system for a government agency that must protect classified data for the next 30 years. The agency is concerned about the threat from quantum computers. Which NIST post-quantum cryptography algorithm is recommended for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for general encryption. CRYSTALS-Dilithium is a digital signature algorithm. RSA and ECDH are vulnerable to quantum attacks.

Answer

ECDH with NIST P-384

Answer

CRYSTALS-Dilithium

Answer

RSA-4096

Question 6

An organization is implementing a Secure Access Service Edge (SASE) architecture to support remote workers. Which key capability does SASE provide that traditional VPNs lack?

Accepted Answer

Identity-based access with zero trust principles. SASE convergences network and security functions and includes identity-based access, allowing granular policy enforcement based on user identity, device posture, and context. Traditional VPNs typically provide network-layer access without identity-driven security policies. SD-WAN is a component of SASE, not a unique capability. Web filtering is available separately. DLP is also available separately.

Answer

Software-defined WAN (SD-WAN) functionality

Answer

Network-layer encryption using IPsec

Answer

Web content filtering and DLP

Question 7

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. Software Bill of Materials (SBOM) is a list of all components in the application, including open-source libraries. Dependency analysis tools use SBOMs to identify known vulnerabilities. SAST analyzes source code, not libraries. DAST tests running applications. RASP provides runtime protection.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 8

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer when using an Infrastructure as a Service (IaaS) model?

Accepted Answer

Encryption of data at rest within the environment. In IaaS, the customer is responsible for securing the operating system, applications, and data. The cloud provider is responsible for the physical infrastructure, hypervisor, and network. Encryption of data at rest is typically a customer responsibility, as they control the data. Physical security is the provider's responsibility. Network infrastructure is the provider's responsibility.

Answer

Configuration of the hypervisor

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 9

A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?

Accepted Answer

Use a Hardware Security Module (HSM) for key management. Hardware Security Modules (HSMs) provide tamper-resistant, dedicated hardware for key generation and storage, offering the highest security for root CA keys. Smart cards are less secure for large-scale root CA operations. Encrypted files on a server are vulnerable. A dedicated VM provides software-based isolation but is less secure than HSM.

Answer

Store the key in an encrypted file on a secure server

Answer

Generate the key on a dedicated virtual machine

Answer

Keep the key on a smart card stored in a safe

Question 10

An organization uses a multi-cloud strategy with workloads on AWS, Azure, and GCP. They need a single tool to monitor and enforce security configurations across all cloud environments. Which cloud security solution is best suited for this requirement?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) automates the monitoring and remediation of security misconfigurations across multiple cloud providers. CASB focuses on application access. CWPP protects workloads. SASE is for network and security convergence.

Answer

Secure Access Service Edge (SASE)

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Question 11

Which of the following best describes the security benefit of using an API gateway in a microservices architecture?

Accepted Answer

It enforces security policies such as authentication and rate limiting centrally. An API gateway provides a centralized point for enforcing security policies like authentication, rate limiting, and input validation. This reduces the attack surface by offloading these responsibilities from individual services. Option A is incorrect because input validation is still needed at the service level for defense-in-depth. Option B is incorrect because encryption is typically handled by TLS, not solely the gateway. Option D is incorrect because load balancing is a traffic management function, not a direct security benefit.

Answer

It eliminates the need for input validation in individual microservices

Answer

It encrypts all data between the client and server using mTLS

Answer

It automatically load balances traffic to ensure high availability

Question 12

A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?

Accepted Answer

It prevents attackers from establishing persistence by modifying system files. Immutable infrastructure ensures that servers are never modified after deployment. This prevents configuration drift and makes it harder for attackers to persist. It also facilitates rapid recovery. It does not eliminate vulnerabilities or remove the need for patching; instead, patching is done by replacing instances. It simplifies forensics because instances are ephemeral and can be analyzed post-incident.

Answer

It eliminates all security vulnerabilities in the infrastructure

Answer

It removes the need for vulnerability scanning of base images

Answer

It simplifies compliance by eliminating the need for patching

Question 13

A security architect is evaluating an API security strategy for a SaaS application that supports OAuth 2.0. Which TWO controls should the architect recommend to protect against token interception and replay attacks?

Accepted Answer

Enforcing short-lived access tokens with refresh token rotation. Using short-lived access tokens reduces the window of opportunity for replay attacks. Token binding (proof-of-possession) ties the token to the client, making interception less useful. Rate limiting mitigates brute force but not token interception. Long-lived tokens increase risk. JWT encryption protects content but not replay.

Answer

Using long-lived access tokens to reduce authentication frequency

Answer

Encrypting JWT payloads with a symmetric key

Answer

Implementing rate limiting on the token endpoint

Question 14

A global company must comply with data residency regulations that require customer data to stay within specific geographic boundaries. The company uses a multi-cloud architecture. Which THREE strategies should the architect implement to ensure compliance?

Accepted Answer

Using cloud provider's region-specific services and data centers. To meet data residency requirements, data must be stored and processed locally. Encryption alone does not prevent data from leaving the region. Private links keep traffic within the cloud provider's network but do not guarantee data stays in region. Access controls do not prevent data movement. Data classification helps identify regulated data. Cloud provider's region-specific services ensure data remains in that region.

Answer

Encrypting all data at rest and in transit

Answer

Implementing strict identity and access management (IAM) policies

Question 15

An organization is hardening its Kubernetes cluster. Which THREE of the following are effective controls to limit the blast radius of a compromised container?

Accepted Answer

Implementing Kubernetes network policies to restrict pod-to-pod communication. Network policies restrict communication between pods, limiting lateral movement. Seccomp profiles restrict system calls, reducing attack surface. Pod Security Standards (PSS) enforce security contexts like not running as root. RBAC controls user access, not container-to-container. Image scanning identifies vulnerabilities but does not limit blast radius.

Answer

Using RBAC to restrict service account permissions

Answer

Performing regular container image scanning for vulnerabilities