CAS-004 Security Architecture Practice Test 7 — 15 Questions

Question 1

A global company must comply with data residency regulations that require customer data to stay within specific geographic boundaries. The company uses a multi-cloud architecture. Which THREE strategies should the architect implement to ensure compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using cloud provider's region-specific services and data centers. Option A is correct because using region-specific services and data centers ensures that data is physically stored and processed within the required geographic boundaries, directly satisfying data residency mandates. Option D is correct because data classification tags identify which data is subject to residency regulations, enabling architects to apply location-based controls and policies only to regulated data. Option E is correct because DLP policies can detect and block cross-border transfers of regulated data, preventing accidental or unauthorized movement outside approved regions. Option B is not correct because encryption at rest and in transit protects confidentiality but does not restrict where data is stored or transferred, so it does not ensure residency. Option C is not correct because IAM policies control who can access data, not where data resides or whether it crosses borders.

Answer

Encrypting all data at rest and in transit

Answer

Implementing strict identity and access management (IAM) policies

Question 2

Which of the following is a core principle of the Zero Trust security model?

Accepted Answer

Never trust, always verify. The core principle of Zero Trust is 'never trust, always verify,' which means that no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Every access request must be authenticated, authorized, and encrypted before access is granted. This principle eliminates implicit trust based on network location.

Answer

Perimeter-based trust

Answer

Trust based on network location

Answer

Trust but verify

Question 3

A security architect is designing a cloud security strategy for a company that uses multiple cloud providers. The architect needs a solution that provides visibility into cloud application usage, enforces security policies, and protects data. Which technology is most appropriate?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) sits between cloud consumers and cloud providers to provide visibility into cloud application usage, enforce security policies (e.g., DLP, access control), and protect data across multiple cloud services. It is specifically designed for multi-cloud visibility and policy enforcement.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Security Posture Management (CSPM)

Answer

Secure Access Service Edge (SASE)

Question 4

An organization is implementing a hybrid cloud architecture and must ensure secure connectivity between its on-premises network and a public cloud VPC. The traffic includes sensitive data that must not traverse the internet. The solution must provide high bandwidth and low latency. Which connectivity option should the architect choose?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection between on-premises and AWS that does not traverse the internet, delivering high bandwidth and consistent low latency. It is the only option that satisfies both the 'must not traverse the internet' and 'high bandwidth, low latency' requirements.

Answer

Site-to-Site VPN over the internet

Answer

AWS Client VPN

Answer

Internet gateway with encryption

Question 5

A company is adopting a defense-in-depth strategy. Which of the following is an example of a preventive control at the network layer?

Accepted Answer

Network segmentation. Network segmentation is a preventive control because it proactively restricts lateral movement by dividing the network into isolated segments using firewalls, VLANs, or subnets. This limits an attacker's ability to move freely after compromising a host, thereby preventing the spread of an attack. It operates at the network layer (Layer 3) and enforces access control policies between segments, making it a classic example of a preventive control in a defense-in-depth strategy.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Penetration testing

Question 6

An organization is implementing a Secure Access Service Edge (SASE) architecture. Which of the following is a key component of SASE?

Accepted Answer

Cloud Access Security Broker (CASB). SASE (Secure Access Service Edge) converges networking (SD-WAN) with a stack of cloud-delivered security services, and CASB is one of its core security pillars alongside SWG, ZTNA, and FWaaS. CASB provides visibility and control over cloud application usage, enforces DLP, and detects shadow IT — functions that SASE delivers from a globally distributed edge. DMZ, IPS, and VPN are traditional on-premises or point-solution constructs that SASE is explicitly designed to replace or absorb, not core defining components.

Answer

Demilitarized Zone (DMZ)

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Question 7

A security architect is designing an API security strategy for a microservices-based application. The architect needs to ensure that only authenticated and authorized clients can invoke APIs, and that rate limiting is enforced to prevent abuse. Which technology should be placed in front of the microservices?

Accepted Answer

API Gateway. An API Gateway is designed to handle authentication, authorization, rate limiting, and other cross-cutting concerns for APIs in a microservices architecture. It acts as a single entry point for all API calls, enforcing security policies before requests reach the microservices. This centralizes API security and simplifies management.

Answer

Web Application Firewall (WAF)

Answer

Reverse proxy

Answer

Load balancer

Question 8

Which of the following is a cloud-native security control provided by a cloud service provider to manage user permissions and access to resources?

Accepted Answer

Identity and Access Management (IAM). IAM is the cloud-native service that manages identities, roles, and permissions, controlling who can do what on which resources. It is the foundational access control plane in every major cloud provider (AWS IAM, Azure Entra ID/RBAC, GCP IAM). The question asks specifically about managing user permissions and access, which is IAM's core purpose.

Answer

Virtual Private Cloud (VPC)

Answer

CloudTrail

Answer

Key Management Service (KMS)

Question 9

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

Accepted Answer

seccomp. seccomp (secure computing mode) is a Linux kernel feature that filters system calls made by a process. In container security, seccomp profiles define which syscalls a containerized process can invoke, directly restricting its ability to interact with the kernel. This is the primary mechanism used by container runtimes like Docker and containerd to enforce syscall-level restrictions.

Answer

AppArmor

Answer

chroot

Answer

SELinux

Question 10

A security architect is designing a PKI for a large organization. The architect wants to ensure that private keys are stored securely and that cryptographic operations are performed in a tamper-resistant environment. Which solution should be used?

Accepted Answer

Hardware Security Module (HSM). An HSM is a dedicated, tamper-resistant hardware appliance that generates, stores, and uses cryptographic keys without ever exposing them to the host OS or application memory. It provides FIPS 140-2/3 validated key protection and performs crypto operations (signing, encryption, key wrapping) inside the secure boundary. For a PKI requiring secure private key storage and tamper-resistant cryptographic operations at scale, an HSM (or cloud HSM service) is the correct answer.

Answer

Trusted Platform Module (TPM)

Answer

Software-based keystore

Answer

Key Management Service (KMS) in the cloud

Question 11

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption. In the shared responsibility model for cloud security, the customer is always responsible for the security of their data, including classification and encryption. This includes determining data sensitivity, applying appropriate encryption at rest and in transit, and managing encryption keys. The cloud provider is responsible for security of the cloud (physical, network, hypervisor), while the customer is responsible for security in the cloud.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 12

An organization wants to implement infrastructure as code (IaC) with immutable infrastructure. Which security benefit does immutable infrastructure provide?

Accepted Answer

Reduced attack surface due to consistent configurations. Immutable infrastructure means servers and components are never modified after deployment — instead, changes require replacing the entire instance with a newly built, tested image. This eliminates configuration drift, ensures every instance matches a known-good baseline, and removes the accumulated patches, leftover packages, and ad-hoc changes that attackers exploit, thereby reducing the attack surface. The other options describe operational or performance benefits, not the core security advantage.

Answer

Better performance through caching

Answer

Simpler network segmentation

Answer

Easier patch management

Question 13

A security architect is implementing a zero trust architecture for a corporate network. Which TWO principles are fundamental to the zero trust approach? (Choose two.)

Accepted Answer

Verify every access request regardless of source. Option D is correct because zero trust requires that every access request be authenticated and authorized explicitly, regardless of whether it originates inside or outside the traditional network perimeter—no user or device is trusted by default. Option E is correct because least privilege access is a core zero trust principle, granting users and devices only the minimum permissions needed for their tasks and limiting lateral movement if credentials are compromised. Options A, B, and C are incorrect because they reflect perimeter-based, castle-and-moat security models: granting access by network location, assuming implicit trust for internal users, and relying on a single perimeter firewall all contradict zero trust's 'never trust, always verify' philosophy.

Answer

Grant access based on network location

Answer

Assume implicit trust for internal users

Answer

Use a single perimeter firewall

Question 14

A company is developing a secure software development lifecycle (SDLC) and wants to integrate security testing early. Which THREE techniques should be used to find vulnerabilities in code during development? (Choose three.)

Accepted Answer

Threat modeling. Threat modeling (C) is correct because it is a design-phase activity that systematically identifies threats, attack surfaces, and mitigations before code is written, making it a foundational shift-left technique. SAST (E) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find flaws such as injection sinks and insecure coding patterns directly in the IDE or CI pipeline. DAST (D) is correct because it tests the running application from the outside, exercising inputs and runtime behavior to uncover vulnerabilities like authentication and configuration flaws that static analysis may miss. Penetration testing (A) is not one of the three because it is typically a later, point-in-time adversarial assessment rather than an early development-phase code-testing technique, and SBOM analysis (B) is a supply-chain inventory and component-transparency practice, not a method for finding vulnerabilities in first-party code during development.

Answer

Penetration testing

Answer

Software Bill of Materials (SBOM) analysis

Question 15

In a zero trust architecture, which concept ensures that an attacker who compromises one segment cannot move laterally to other segments?

Accepted Answer

Micro-segmentation. Micro-segmentation divides a network into granular, isolated segments — often down to individual workloads or identities — and enforces policy between each segment so that compromise of one segment does not grant lateral movement to others. In zero trust, micro-segmentation is the enforcement mechanism that operationalizes 'never trust, always verify' at the network layer, typically using software-defined policies rather than physical firewalls.

Answer

Software-defined perimeter

Answer

Defense-in-depth layering

Answer

Identity-centric access