CAS-004 Security Architecture Practice Test 8 — 15 Questions

Question 1

A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Direct Connect / ExpressRoute. Direct Connect (AWS) and ExpressRoute (Azure) provide dedicated private circuits from on-premises to the cloud provider, bypassing the public internet entirely. This delivers predictable low latency, higher bandwidth, and stronger security than internet-based options. It directly satisfies the 'private connectivity, bypassing the public internet' requirement.

Answer

Site-to-site VPN over the internet

Answer

Private link (e.g., AWS PrivateLink)

Answer

SD-WAN with internet breakout

Question 2

An organization is migrating critical workloads to the cloud and must comply with FedRAMP. Which cloud service model provides the most customer control over security configuration while still leveraging the provider's FedRAMP authorization?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives the customer control over the operating system, middleware, runtime, and applications while the provider manages the physical infrastructure, hypervisor, and network fabric. Under FedRAMP, the provider's authorization covers the underlying infrastructure, but the customer retains responsibility for configuring and securing everything above the hypervisor — offering the most security configuration control among the listed models while still leveraging the provider's FedRAMP package.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 3

A company uses a CASB to monitor cloud application usage. Which primary function does a CASB provide for enforcing security policies between users and cloud services?

Accepted Answer

Policy enforcement point for cloud services. A CASB (Cloud Access Security Broker) acts as a policy enforcement point (PEP) that sits between users and cloud service providers, intercepting traffic to apply security policies such as authentication, authorization, data loss prevention (DLP), and compliance controls. It provides visibility and control over cloud application usage, ensuring that only authorized actions and data flows are permitted. Unlike other cloud security tools, the CASB's primary role is to enforce policies in real time, not to manage keys or scan for vulnerabilities. Thus, option C correctly identifies the core function.

Answer

Encryption key management for cloud storage

Answer

Vulnerability scanning of cloud infrastructure

Answer

Workload protection runtime monitoring

Question 4

A security architect is implementing an API gateway to protect microservices. Which security capability is uniquely provided by an API gateway compared to a traditional web application firewall (WAF)?

Accepted Answer

Rate limiting per API consumer. Rate limiting per API consumer is a capability unique to API gateways because the gateway understands API keys, OAuth tokens, and consumer identities, allowing it to enforce quotas and throttling on a per-client basis. A traditional WAF operates at the network/HTTP layer and inspects traffic patterns for attacks but does not natively identify API consumers or apply per-consumer quotas. This makes per-consumer rate limiting the distinguishing capability in this comparison.

Answer

TLS termination

Answer

SQL injection prevention

Answer

Cross-site scripting (XSS) filtering

Question 5

An organization wants to implement an immutable infrastructure for its containerized applications. Which security benefit is most directly achieved by immutability?

Accepted Answer

Prevents unauthorized modifications to running containers. Immutable infrastructure means containers are deployed from a fixed, versioned image and are never modified in place — any change requires redeploying a new container. This design directly prevents unauthorized or accidental modifications to running containers, since the running instance is treated as read-only and any drift is discarded on replacement. The security benefit is integrity enforcement: attackers cannot persist by editing files inside a live container because the container is ephemeral and replaced from a trusted image.

Answer

Eliminates need for runtime security monitoring

Answer

Allows use of privileged containers securely

Answer

Reduces image scanning frequency

Question 6

In the shared responsibility model for cloud security, which of the following is generally the responsibility of the cloud customer?

Accepted Answer

Configuration of network access controls. In the cloud shared responsibility model, the customer is always responsible for 'security IN the cloud' — their data, configurations, and access controls. Network access control configuration (security groups, NACLs, firewall rules) is a customer-managed setting in IaaS/PaaS, so option A is correct. The provider handles 'security OF the cloud' — physical, host, and hypervisor layers.

Answer

Hardware maintenance of servers

Answer

Hypervisor vulnerability patching

Answer

Physical security of data centers

Question 7

A security architect is evaluating a SASE solution. Which component of SASE is primarily responsible for inspecting encrypted traffic for threats?

Accepted Answer

Secure web gateway (SWG). The Secure Web Gateway (SWG) is the SASE component that proxies outbound user web traffic and performs full TLS inspection, URL filtering, malware scanning, and DLP on decrypted content. Because it terminates and re-originates TLS sessions, it can inspect encrypted traffic for threats. This is its core function within the SASE stack.

Answer

Zero Trust Network Access (ZTNA)

Answer

Next-generation firewall (NGFW)

Answer

SD-WAN edge

Question 8

During a secure SDLC, a security architect wants to identify design flaws early. Which activity is most appropriate for the design phase?

Accepted Answer

Threat modeling. Threat modeling is a structured design-phase activity that identifies potential threats, attack vectors, and design weaknesses before code is written. It uses frameworks like STRIDE or PASTA to map data flows and trust boundaries, surfacing architectural flaws early when they're cheapest to fix. This aligns exactly with the goal of identifying design flaws during the design phase.

Answer

Penetration testing

Answer

Dynamic application security testing (DAST)

Answer

Static application security testing (SAST)

Question 9

To protect against quantum computing attacks, a security architect is planning to transition to post-quantum cryptography. Which algorithm has been selected by NIST for general encryption (key encapsulation) in the PQC standard?

Accepted Answer

CRYSTALS-Kyber. NIST selected CRYSTALS-Kyber as the primary standard for general encryption and key encapsulation (FIPS 203) in its post-quantum cryptography program. Kyber is a lattice-based KEM designed for efficient key establishment, making it the correct choice for general encryption.

Answer

Falcon

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Question 10

A company uses Kubernetes for container orchestration. Which security control should be implemented to enforce that only specific images from a trusted registry can run in the cluster?

Accepted Answer

Admission controller (e.g., OPA/Gatekeeper). An admission controller such as OPA/Gatekeeper intercepts API server requests before objects are persisted and can enforce policies — including image registry allow-lists — so only images from trusted registries are admitted to the cluster. Gatekeeper's ConstraintTemplates and Constraints let you write Rego policies that validate image fields in Pod specs.

Answer

Pod security admission (PSA)

Answer

Network policies

Answer

RBAC roles

Question 11

Which cryptographic best practice ensures that a private key remains protected even if the server it is stored on is compromised?

Accepted Answer

Storing keys in a hardware security module (HSM). A hardware security module (HSM) is a dedicated physical device that securely generates, stores, and manages cryptographic keys, ensuring the private key never leaves the tamper-resistant hardware. Even if the server is compromised, the attacker cannot extract the key from the HSM. This provides the strongest protection for private keys.

Answer

Encrypting keys with AES-256

Answer

Using short key rotation intervals

Answer

Using strong key derivation functions

Question 12

A security architect is designing a defense-in-depth strategy for a cloud-native application. Which TWO controls are most effective for protecting east-west traffic between microservices?

Accepted Answer

Service mesh with mutual TLS. Option A (Service mesh with mutual TLS) is correct because a service mesh provides identity-based, encrypted, and authenticated communication between microservices, and mutual TLS ensures both sides of an east-west connection verify each other's certificates, preventing spoofing and eavesdropping inside the cluster. Option C (Micro-segmentation of virtual networks) is correct because it enforces least-privilege reachability between workloads by applying granular policies at the virtual network or workload level, which directly limits lateral movement if a microservice is compromised. Option B is not the best fit because an IDS on the gateway monitors north-south traffic entering the environment rather than internal service-to-service flows, and it is detective rather than preventive. Option D is not appropriate because a WAF protects HTTP/HTTPS applications from external web attacks at the edge, not east-west microservice traffic. Option E is not appropriate because perimeter ACLs filter traffic at the network boundary and do not provide the identity-aware, workload-level controls needed for internal microservice communication.

Answer

Intrusion detection system (IDS) on the gateway

Answer

Web application firewall (WAF)

Answer

Network access control lists (ACLs) at the perimeter

Question 13

A security architect is reviewing supply chain security for a software product. Which TWO artifacts are most important for verifying the integrity and provenance of third-party components?

Accepted Answer

Software bill of materials (SBOM). Option B, the software bill of materials (SBOM), is correct because it enumerates every third-party and open-source component, library, and version in the product, which is the foundation for verifying provenance and detecting tampered or vulnerable dependencies. Option C, the dependency analysis report, is correct because it maps direct and transitive dependencies and flags known vulnerabilities, license conflicts, and unexpected or unvetted components, directly supporting integrity verification of the supply chain. Together, the SBOM provides the authoritative component inventory while the dependency analysis validates those components against known-good and known-bad data. Option A, penetration test results, is not correct because pen testing assesses exploitable weaknesses in a running system, not the provenance or integrity of third-party components. Option D, network flow logs, is not correct because they record traffic metadata for monitoring and forensics, not component-level supply chain integrity. Option E, database encryption configuration, is not correct because it addresses data-at-rest protection and is unrelated to verifying third-party component provenance.

Answer

Penetration test results

Answer

Network flow logs

Answer

Database encryption configuration

Question 14

A security architect is designing a zero trust architecture for a financial services company. Which component is MOST critical to enforce identity-centric access control in a zero trust model?

Accepted Answer

Software-defined perimeter. A software-defined perimeter (SDP) is the most critical component for enforcing identity-centric access control in zero trust because it creates a 'black cloud' where resources are invisible until users and devices are authenticated and authorized. SDP uses a controller that brokers connections based on identity, device posture, and policy, rather than network location. This directly implements the zero trust principle of 'never trust, always verify' at the access layer.

Answer

Network firewall

Answer

Intrusion prevention system

Answer

VPN concentrator

Question 15

In a cloud shared responsibility model, which of the following is typically the customer's responsibility for IaaS?

Accepted Answer

Guest OS patch management. In the cloud shared responsibility model for IaaS, the customer is responsible for managing the guest operating system, including patch management, security updates, and configuration. The cloud provider is responsible for the hypervisor, hardware, and physical security of data centers. Therefore, guest OS patch management is the customer's responsibility.

Answer

Hypervisor security

Answer

Hardware maintenance

Answer

Physical security of data centers