CAS-004 Security Architecture Practice Test 5 — 15 Questions

Question 1

Which of the following is a core principle of the Zero Trust security model?

Accepted Answer

Never trust, always verify. Zero Trust assumes no implicit trust and requires verification for every access request, regardless of location.

Answer

Perimeter-based trust

Answer

Trust based on network location

Answer

Trust but verify

Question 2

A security architect is designing a cloud security strategy for a company that uses multiple cloud providers. The architect needs a solution that provides visibility into cloud application usage, enforces security policies, and protects data. Which technology is most appropriate?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, policy enforcement, and data protection across multiple cloud services.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 3

An organization is implementing a hybrid cloud architecture and must ensure secure connectivity between its on-premises network and a public cloud VPC. The traffic includes sensitive data that must not traverse the internet. The solution must provide high bandwidth and low latency. Which connectivity option should the architect choose?

Accepted Answer

AWS Direct Connect. Direct Connect provides a dedicated, private, high-bandwidth connection between on-premises and cloud, bypassing the internet.

Answer

Site-to-Site VPN over the internet

Answer

AWS Client VPN

Answer

Internet gateway with encryption

Question 4

A company is adopting a defense-in-depth strategy. Which of the following is an example of a preventive control at the network layer?

Accepted Answer

Network segmentation. Network segmentation limits lateral movement and reduces attack surface, making it a preventive network control.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Penetration testing

Question 5

An organization is implementing a Secure Access Service Edge (SASE) architecture. Which of the following is a key component of SASE?

Accepted Answer

Cloud Access Security Broker (CASB). SASE converges SD-WAN and security functions, including SWG, CASB, ZTNA, and FWaaS, delivered from the cloud.

Answer

Demilitarized Zone (DMZ)

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Question 6

A security architect is designing an API security strategy for a microservices-based application. The architect needs to ensure that only authenticated and authorized clients can invoke APIs, and that rate limiting is enforced to prevent abuse. Which technology should be placed in front of the microservices?

Accepted Answer

API Gateway. An API gateway handles authentication, authorization, rate limiting, and routing, providing a central security control point.

Answer

Web Application Firewall (WAF)

Answer

Reverse proxy

Answer

Load balancer

Question 7

Which of the following is a cloud-native security control provided by a cloud service provider to manage user permissions and access to resources?

Accepted Answer

Identity and Access Management (IAM). Identity and Access Management (IAM) is a fundamental cloud service for managing users, roles, and permissions.

Answer

Virtual Private Cloud (VPC)

Answer

CloudTrail

Answer

Key Management Service (KMS)

Question 8

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

Accepted Answer

seccomp. seccomp (secure computing mode) allows filtering of system calls, reducing the kernel attack surface.

Answer

AppArmor

Answer

chroot

Answer

SELinux

Question 9

A company is migrating sensitive workloads to the cloud and must comply with FedRAMP requirements. Which of the following is the most appropriate cloud deployment model?

Accepted Answer

Community cloud. FedRAMP requirements are stringent and often best met by a government community cloud or a dedicated cloud environment that has been FedRAMP authorized.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 10

A security architect is designing a PKI for a large organization. The architect wants to ensure that private keys are stored securely and that cryptographic operations are performed in a tamper-resistant environment. Which solution should be used?

Accepted Answer

Hardware Security Module (HSM). Hardware Security Modules (HSMs) provide dedicated, tamper-resistant hardware for key storage and cryptographic operations.

Answer

Trusted Platform Module (TPM)

Answer

Software-based keystore

Answer

Key Management Service (KMS) in the cloud

Question 11

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption. The customer is responsible for securing their data, applications, and access management, while the provider secures the infrastructure.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 12

An organization wants to implement infrastructure as code (IaC) with immutable infrastructure. Which security benefit does immutable infrastructure provide?

Accepted Answer

Reduced attack surface due to consistent configurations. Immutable infrastructure enforces that servers are never modified after deployment; updates are made by replacing the entire server, reducing configuration drift and vulnerabilities.

Answer

Better performance through caching

Answer

Simpler network segmentation

Answer

Easier patch management

Question 13

A security architect is implementing a zero trust architecture for a corporate network. Which TWO principles are fundamental to the zero trust approach? (Choose two.)

Accepted Answer

Verify every access request regardless of source. Zero Trust requires verifying every request and limiting access to only what is needed, regardless of user location or network.

Answer

Grant access based on network location

Answer

Assume implicit trust for internal users

Answer

Use a single perimeter firewall

Question 14

A company is developing a secure software development lifecycle (SDLC) and wants to integrate security testing early. Which THREE techniques should be used to find vulnerabilities in code during development? (Choose three.)

Accepted Answer

Threat modeling. Threat modeling identifies design issues, SAST finds vulnerabilities in source code, and DAST finds vulnerabilities in running applications.

Answer

Penetration testing

Answer

Software Bill of Materials (SBOM) analysis

Question 15

An organization is deploying a Kubernetes cluster and needs to harden security. Which THREE controls should be implemented? (Choose three.)

Accepted Answer

Role-Based Access Control (RBAC). RBAC controls access, network policies segment traffic, and admission controllers enforce policies before pods are created.

Answer

Seccomp profiles

Answer

Service mesh