CAS-004 Security Architecture Practice Test 6 — 15 Questions

Question 1

An organization is implementing a software-defined perimeter (SDP) for zero trust network access. Which THREE characteristics are typical of an SDP architecture? (Choose three.)

Accepted Answer

Applications are invisible to unauthorized users. Option B is correct because a core SDP principle is the "dark cloud" or black cloud model, where protected applications do not respond to unauthenticated probes and remain invisible until a user and device are authenticated and authorized by the controller. Option C is correct because SDP establishes dynamic, per-session encrypted connections (for example, mutual TLS or DTLS tunnels) between the initiating host and the accepting host, rather than granting broad network-level access. Option E is correct because SDP enforces device authentication and posture checks through the controller before any connection to the accepting host is brokered, which is fundamental to zero trust network access. Option A is not correct because SDP deliberately moves away from static IP-based allowlists and perimeter rules, relying instead on identity- and context-based authorization. Option D is not correct because SDP does not funnel all traffic through a single shared firewall; it uses distributed controllers and gateways to broker individualized, least-privilege connections.

Answer

Relies on IP-based allowlists

Answer

Uses a single shared firewall for all traffic

Question 2

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment

Question 3

A security architect is implementing a zero trust model for a financial services company. The goal is to prevent lateral movement in the data center. Which approach best achieves this objective?

Accepted Answer

Deploying micro-segmentation to isolate workloads and enforce granular policies. Micro-segmentation isolates workloads and enforces granular, identity- and label-based policies on east-west traffic, which directly prevents lateral movement inside the data center. In a zero trust model, micro-segmentation operationalizes the 'never trust, always verify' principle at the workload level, so a compromised host cannot freely reach other workloads. This is the most direct and effective control for the stated objective of stopping lateral movement.

Answer

Using a software-defined perimeter to hide network resources

Answer

Implementing identity-centric access controls across all resources

Answer

Applying defense-in-depth layering by adding multiple security controls

Question 4

A company uses a hybrid cloud model with workloads on AWS and on-premises. They need to ensure secure connectivity between the two environments with high bandwidth and low latency, bypassing the public internet. Which solution should they implement?

Accepted Answer

Configure AWS Direct Connect for dedicated private connectivity. AWS Direct Connect provides a dedicated, private network connection between on-premises infrastructure and AWS, bypassing the public internet entirely. It delivers consistent high bandwidth and low latency, which is exactly what hybrid workloads requiring predictable performance need. Because traffic never traverses the public internet, Direct Connect also improves security posture by reducing exposure to internet-based threats.

Answer

Implement SD-WAN with integrated security

Answer

Establish a site-to-site VPN over the internet

Answer

Use AWS PrivateLink to access VPC endpoints

Question 5

An organization is deploying a containerized application on Kubernetes and must enforce that only approved container images are allowed to run, and that containers cannot escalate privileges. Which combination of controls should the architect implement?

Accepted Answer

Admission controllers with image signing and PodSecurityPolicy. Admission controllers are the Kubernetes mechanism that intercepts API server requests before objects are persisted, so they can reject pods that violate policy. Combined with image signing (e.g., via cosign/Notary or an admission webhook that verifies signatures), they enforce that only approved images run. PodSecurityPolicy (or its successor, Pod Security Admission with restricted/baseline profiles) blocks privilege escalation by restricting privileged containers, hostPath mounts, and capabilities.

Answer

Seccomp and AppArmor profiles with RBAC

Answer

Kubernetes network policies and RBAC

Answer

Container image scanning and network policies

Question 6

Which technology is used to discover and control cloud applications, enforce security policies, and provide visibility into cloud usage?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) is specifically designed to discover cloud applications in use (shadow IT), enforce security policies, and provide visibility and governance over cloud service usage. It sits between users and cloud providers, applying policy via inline proxies or API integrations. This matches the question's three requirements — discovery, policy enforcement, and visibility — which are CASB's core functions.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 7

A security architect is designing a cryptographic system for a government agency that must protect classified data for the next 30 years. The agency is concerned about the threat from quantum computers. Which NIST post-quantum cryptography algorithm is recommended for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is the NIST-selected post-quantum algorithm for key encapsulation (KEM), standardized as FIPS 203 (ML-KEM). It is designed to resist attacks from both classical and quantum computers, making it appropriate for long-lived classified data. CRYSTALS-Dilithium is for digital signatures, not key encapsulation, and the classical algorithms (ECDH, RSA) are vulnerable to Shor's algorithm on a sufficiently powerful quantum computer.

Answer

ECDH with NIST P-384

Answer

CRYSTALS-Dilithium

Answer

RSA-4096

Question 8

An organization is implementing a Secure Access Service Edge (SASE) architecture to support remote workers. Which key capability does SASE provide that traditional VPNs lack?

Accepted Answer

Identity-based access with zero trust principles. SASE converges networking and security functions into a cloud-delivered service, with zero trust network access (ZTNA) as a core pillar. Unlike traditional VPNs that grant broad network-level access after authentication, SASE enforces identity-based, context-aware access policies per application or resource. This aligns with zero trust principles: never trust, always verify, and least-privilege access.

Answer

Software-defined WAN (SD-WAN) functionality

Answer

Network-layer encryption using IPsec

Answer

Web content filtering and DLP

Question 9

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. SBOM and dependency analysis are specifically designed to inventory open-source components and their transitive dependencies, then cross-reference them against vulnerability databases like the NVD or OSV. This directly addresses the need to identify vulnerabilities in third-party libraries, which is a core part of software supply chain security. Unlike code analysis tools that focus on first-party code, SBOM-driven scanning targets the exact problem of open-source component risk.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Question 10

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer when using an Infrastructure as a Service (IaaS) model?

Accepted Answer

Encryption of data at rest within the environment. In an IaaS model, the cloud provider manages the physical infrastructure, network, and hypervisor, while the customer is responsible for everything from the guest OS upward, including data encryption at rest. Encrypting data at rest within the environment is a customer responsibility because the customer controls the data and the encryption keys. The provider secures the underlying storage but does not automatically encrypt customer data unless the customer configures it.

Answer

Configuration of the hypervisor

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 11

A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?

Accepted Answer

Use a Hardware Security Module (HSM) for key management. A Hardware Security Module (HSM) is a tamper-resistant physical device that generates, stores, and uses cryptographic keys within its protected boundary, never exposing the private key in plaintext. For a root CA — the trust anchor of the entire PKI — an HSM provides FIPS 140-2 Level 3 (or higher) assurance, key backup/recovery controls, and audit logging that no software-based or portable storage method can match. This is the industry-standard approach for high-assurance root CA key protection.

Answer

Store the key in an encrypted file on a secure server

Answer

Generate the key on a dedicated virtual machine

Answer

Keep the key on a smart card stored in a safe

Question 12

An organization uses a multi-cloud strategy with workloads on AWS, Azure, and GCP. They need a single tool to monitor and enforce security configurations across all cloud environments. Which cloud security solution is best suited for this requirement?

Accepted Answer

Cloud Security Posture Management (CSPM). CSPM is correct because it continuously monitors cloud configurations against security benchmarks (CIS, NIST, PCI) and detects misconfigurations across AWS, Azure, and GCP from a single pane of glass. It is purpose-built for multi-cloud posture management — identifying publicly exposed buckets, overly permissive IAM roles, and unencrypted storage. This directly matches the requirement to monitor and enforce security configurations across all three clouds.

Answer

Secure Access Service Edge (SASE)

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Question 13

Which of the following best describes the security benefit of using an API gateway in a microservices architecture?

Accepted Answer

It enforces security policies such as authentication and rate limiting centrally. An API gateway sits in front of microservices and acts as a single entry point for all client requests, making it the ideal enforcement point for cross-cutting security controls. Centralizing authentication (e.g., OAuth2/JWT validation), authorization, rate limiting, and threat protection at the gateway means individual microservices don't each need to reimplement these policies. This reduces attack surface and ensures consistent policy enforcement across the entire API estate.

Answer

It eliminates the need for input validation in individual microservices

Answer

It encrypts all data between the client and server using mTLS

Answer

It automatically load balances traffic to ensure high availability

Question 14

A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?

Accepted Answer

It prevents attackers from establishing persistence by modifying system files. Immutable infrastructure means servers are never patched or modified in place; instead, a new image is built and instances are replaced. This prevents attackers from establishing persistence via modified system files, backdoors, or rootkits, because any tampering is discarded when the instance is recycled. It also makes the deployed state deterministic and auditable.

Answer

It eliminates all security vulnerabilities in the infrastructure

Answer

It removes the need for vulnerability scanning of base images

Answer

It simplifies compliance by eliminating the need for patching

Question 15

A security architect is evaluating an API security strategy for a SaaS application that supports OAuth 2.0. Which TWO controls should the architect recommend to protect against token interception and replay attacks?

Accepted Answer

Enforcing short-lived access tokens with refresh token rotation. Option B is correct because enforcing short-lived access tokens limits the window in which a stolen token can be replayed, and refresh token rotation invalidates the old refresh token each time a new one is issued, so a captured refresh token cannot be reused indefinitely. Option D is correct because token binding cryptographically ties an access or refresh token to a specific client session or TLS channel, so a token intercepted and replayed from a different session or connection will be rejected. Option A is wrong because long-lived access tokens increase the replay window and worsen the impact of interception. Option C is wrong because encrypting JWT payloads provides confidentiality of claims but does not prevent an attacker who captures the token from replaying it. Option E is wrong because rate limiting on the token endpoint only mitigates brute-force or flooding attempts; it does not stop interception or replay of a valid token.

Answer

Using long-lived access tokens to reduce authentication frequency

Answer

Encrypting JWT payloads with a symmetric key

Answer

Implementing rate limiting on the token endpoint