CAS-004 Security Architecture Practice Test 7 — 15 Questions

Question 1

A security architect is designing a zero trust architecture for a financial services company. Which component is MOST critical to enforce identity-centric access control in a zero trust model?

Accepted Answer

Software-defined perimeter. In zero trust, every access request is authenticated, authorized, and encrypted. A software-defined perimeter (SDP) provides identity-centric, micro-segmented access that hides network resources and enforces least privilege.

Answer

Network firewall

Answer

Intrusion prevention system

Answer

VPN concentrator

Question 2

In a cloud shared responsibility model, which of the following is typically the customer's responsibility for IaaS?

Accepted Answer

Guest OS patch management. In IaaS, the customer manages the guest OS, applications, and data, while the cloud provider secures the physical hosts and hypervisor.

Answer

Hypervisor security

Answer

Hardware maintenance

Answer

Physical security of data centers

Question 3

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

Accepted Answer

AWS Config. AWS Config continuously monitors and evaluates AWS resource configurations against desired policies, helping meet compliance requirements like SOC 2.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Shield

Question 4

A security architect is designing a secure connectivity solution between an on-premises data center and a public cloud provider. The solution must provide low latency, high bandwidth, and avoid traversing the public internet. Which approach BEST meets these requirements?

Accepted Answer

Direct Connect. Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the internet for low latency and high bandwidth.

Answer

SSL VPN

Answer

SD-WAN over internet

Answer

Site-to-site VPN over internet

Question 5

An organization is implementing SASE to secure remote user access. Which component of SASE is responsible for enforcing identity-based access policies and inspecting traffic?

Accepted Answer

Secure Web Gateway. SWG (Secure Web Gateway) enforces security policies for web traffic, including URL filtering, malware detection, and data loss prevention.

Answer

SD-WAN

Answer

Cloud Access Security Broker

Answer

Next-Generation Firewall

Question 6

A security engineer is integrating API security for a RESTful service. Which mechanism is used to verify that the API request has not been tampered with and originates from a legitimate client?

Accepted Answer

JWT. JWT (JSON Web Token) is a compact, self-contained token that includes claims and a digital signature to verify integrity and authenticity.

Answer

OAuth 2.0 authorization code

Answer

API key in query parameter

Answer

Rate limiting

Question 7

During a secure SDLC, a development team is reviewing code for security flaws early in the development process. Which type of testing is MOST appropriate for identifying vulnerabilities in source code before it is compiled?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code at rest to find vulnerabilities like injection flaws, without executing the code.

Answer

DAST

Answer

IAST

Answer

RASP

Question 8

A container security team wants to enforce that containers run with the least privileges possible. Which Linux security module can be used to restrict system calls available to a container?

Accepted Answer

seccomp. seccomp allows filtering system calls, enabling a whitelist of allowed calls to reduce the kernel attack surface.

Answer

Pod Security Policy

Answer

AppArmor

Answer

SELinux

Question 9

An organization is designing a PKI to issue certificates to thousands of IoT devices. Which architectural decision will BEST support automated certificate lifecycle management?

Accepted Answer

Automated enrollment using SCEP. Automated certificate enrollment using SCEP or ACME protocols enables devices to request and renew certificates without manual intervention.

Answer

Online root CA with self-signed certificates

Answer

Using a public CA for all IoT devices

Answer

Offline root CA with manual issuance

Question 10

A security analyst is reviewing a Kubernetes cluster and wants to ensure that only authorized users can create or modify pods. Which Kubernetes object should be configured to enforce this?

Accepted Answer

RBAC. RBAC (Role-Based Access Control) in Kubernetes controls access to API resources, including pod creation, based on roles and bindings.

Answer

Admission controllers

Answer

Pod security policies

Answer

Network policies

Question 11

A company must protect cryptographic keys used to sign financial transactions. The solution must be FIPS 140-2 Level 3 compliant and provide tamper-resistant hardware. Which technology should be deployed?

Accepted Answer

Hardware security module. HSMs (Hardware Security Modules) provide tamper-resistant, FIPS 140-2 Level 3+ certified hardware for key generation, storage, and signing operations.

Answer

Software-based key management system

Answer

Cloud KMS

Answer

TPM

Question 12

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which algorithm is recommended for digital signatures?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is one of the NIST-selected post-quantum digital signature algorithms, providing security against quantum attacks.

Answer

Falcon

Answer

CRYSTALS-Kyber

Answer

RSA-4096

Question 13

A security architect is evaluating Cloud Security Posture Management (CSPM) tools. Which TWO capabilities are typically provided by CSPM? (Choose two.)

Accepted Answer

Detection of compliance violations. CSPM tools continuously monitor cloud environments for misconfigurations and compliance violations, and they provide remediation guidance.

Answer

Web application firewall (WAF) management

Answer

Vulnerability scanning of container images

Answer

DDoS protection

Question 14

A company is implementing a defense-in-depth strategy for its web application. Which THREE security controls should be included in the architecture? (Choose three.)

Accepted Answer

Web application firewall (WAF). Defense-in-depth uses multiple layers. WAF filters malicious traffic, network segmentation limits lateral movement, and RASP protects the application at runtime.

Answer

Load balancer with SSL termination

Answer

Single sign-on (SSO)

Question 15

An organization is architecting a hybrid cloud environment with AWS and on-premises resources. Which THREE considerations are essential for meeting data residency requirements? (Choose three.)

Accepted Answer

Selecting the correct AWS region for data storage. Data residency requires control over data location. AWS region selection determines physical storage location. Data classification policies enforce where data can reside. Encryption keys stored in a specific region ensure data remains under jurisdictional control.

Answer

Using only on-premises storage for all data

Answer

Using a global AWS account without region constraints