CAS-004 Security Architecture Practice Test 6 — 15 Questions

Question 1

In a zero trust architecture, which concept ensures that an attacker who compromises one segment cannot move laterally to other segments?

Accepted Answer

Micro-segmentation. Micro-segmentation divides the network into small, isolated segments and enforces granular access controls, preventing lateral movement.

Answer

Software-defined perimeter

Answer

Defense-in-depth layering

Answer

Identity-centric access

Question 2

A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?

Accepted Answer

Direct Connect / ExpressRoute. Direct Connect (AWS) or Azure ExpressRoute provide dedicated private network connections from on-premises to the cloud, offering low latency and security.

Answer

Site-to-site VPN over the internet

Answer

Private link (e.g., AWS PrivateLink)

Answer

SD-WAN with internet breakout

Question 3

An organization is migrating critical workloads to the cloud and must comply with FedRAMP. Which cloud service model provides the most customer control over security configuration while still leveraging the provider's FedRAMP authorization?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives the customer control over OS, applications, and security configurations, while the provider manages the physical infrastructure. FedRAMP authorization can cover the IaaS layer.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 4

A company uses a CASB to monitor cloud application usage. Which primary function does a CASB provide for enforcing security policies between users and cloud services?

Accepted Answer

Policy enforcement point for cloud services. A CASB acts as an intermediary to enforce security policies such as access control, data loss prevention, and threat protection between users and cloud services.

Answer

Encryption key management for cloud storage

Answer

Vulnerability scanning of cloud infrastructure

Answer

Workload protection runtime monitoring

Question 5

A security architect is implementing an API gateway to protect microservices. Which security capability is uniquely provided by an API gateway compared to a traditional web application firewall (WAF)?

Accepted Answer

Rate limiting per API consumer. An API gateway can enforce rate limiting and authentication (e.g., OAuth) at the API level, while a WAF typically focuses on HTTP-layer attacks like SQLi.

Answer

TLS termination

Answer

SQL injection prevention

Answer

Cross-site scripting (XSS) filtering

Question 6

An organization wants to implement an immutable infrastructure for its containerized applications. Which security benefit is most directly achieved by immutability?

Accepted Answer

Prevents unauthorized modifications to running containers. Immutable infrastructure ensures that once a container image is deployed, it is never modified. Any change requires a new image deployment, which prevents configuration drift and unauthorized changes.

Answer

Eliminates need for runtime security monitoring

Answer

Allows use of privileged containers securely

Answer

Reduces image scanning frequency

Question 7

In the shared responsibility model for cloud security, which of the following is generally the responsibility of the cloud customer?

Accepted Answer

Configuration of network access controls. The customer is responsible for security 'in' the cloud, including guest OS, applications, and access management, while the provider secures the infrastructure.

Answer

Hardware maintenance of servers

Answer

Hypervisor vulnerability patching

Answer

Physical security of data centers

Question 8

A security architect is evaluating a SASE solution. Which component of SASE is primarily responsible for inspecting encrypted traffic for threats?

Accepted Answer

Secure web gateway (SWG). SASE integrates SWG (Secure Web Gateway) for web filtering and threat inspection, including decryption and inspection of TLS traffic.

Answer

Zero Trust Network Access (ZTNA)

Answer

Next-generation firewall (NGFW)

Answer

SD-WAN edge

Question 9

During a secure SDLC, a security architect wants to identify design flaws early. Which activity is most appropriate for the design phase?

Accepted Answer

Threat modeling. Threat modeling is performed during the design phase to identify potential security threats and vulnerabilities before code is written.

Answer

Penetration testing

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Question 10

To protect against quantum computing attacks, a security architect is planning to transition to post-quantum cryptography. Which algorithm has been selected by NIST for general encryption (key encapsulation) in the PQC standard?

Accepted Answer

CRYSTALS-Kyber. NIST selected CRYSTALS-Kyber for key encapsulation (encryption) and CRYSTALS-Dilithium for digital signatures.

Answer

Falcon

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Question 11

A company uses Kubernetes for container orchestration. Which security control should be implemented to enforce that only specific images from a trusted registry can run in the cluster?

Accepted Answer

Admission controller (e.g., OPA/Gatekeeper). Admission controllers can intercept requests to the Kubernetes API server and enforce policies, such as allowing only images from a specific registry.

Answer

Pod security admission (PSA)

Answer

Network policies

Answer

RBAC roles

Question 12

Which cryptographic best practice ensures that a private key remains protected even if the server it is stored on is compromised?

Accepted Answer

Storing keys in a hardware security module (HSM). Hardware Security Modules (HSMs) provide tamper-resistant hardware to protect private keys, preventing extraction even if the server is compromised.

Answer

Encrypting keys with AES-256

Answer

Using short key rotation intervals

Answer

Using strong key derivation functions

Question 13

A security architect is designing a defense-in-depth strategy for a cloud-native application. Which TWO controls are most effective for protecting east-west traffic between microservices?

Accepted Answer

Service mesh with mutual TLS. Micro-segmentation isolates traffic between services, and service mesh provides encrypted, authenticated communication. Both address east-west traffic.

Answer

Intrusion detection system (IDS) on the gateway

Answer

Web application firewall (WAF)

Answer

Network access control lists (ACLs) at the perimeter

Question 14

An organization is implementing a zero trust architecture and needs to enforce identity-centric access for all resources. Which THREE components are essential to this approach?

Accepted Answer

User and entity behavior analytics (UEBA). Zero trust requires strong identity verification (MFA), dynamic policy enforcement (PEP), and continuous monitoring (UEBA).

Answer

Network segmentation

Answer

Virtual private network (VPN)

Question 15

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). SBOMs list all components and their versions; dependency analysis identifies vulnerabilities in those components.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration