CAS-004 Security Architecture Practice Test 9 — 15 Questions

Question 1

A security architect is designing a zero trust architecture for a financial institution. Which principle is fundamental to the zero trust model?

Accepted Answer

Assume breach and verify explicitly. Zero trust assumes no implicit trust based on network location; all access requests must be authenticated and authorized regardless of origin. Micro-segmentation and identity-centric controls support this, but the core principle is 'trust no one by default'.

Answer

Trust but verify all network traffic

Answer

Use VPNs for all remote access

Answer

Perimeter-based security is sufficient

Question 2

A company is migrating critical workloads to AWS and must secure data at rest. They need to maintain control over the encryption keys. Which service should they use to meet this requirement?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated Hardware Security Modules (HSMs) that allow customers to maintain full control over their encryption keys. Unlike AWS KMS, where AWS manages the underlying hardware, CloudHSM gives customers exclusive ownership and management of keys, meeting the requirement to maintain control over encryption keys.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS Shield

Question 3

An organization is adopting a SASE architecture to provide secure access to cloud applications. Which component is essential for enforcing security policies based on user identity and device posture?

Accepted Answer

Zero Trust Network Access (ZTNA). SASE converges networking and security functions, with the Security Service Edge (SSE) component including SWG, CASB, ZTNA, and FWaaS. While CASB focuses on data security and compliance for cloud applications, ZTNA is the component specifically designed to enforce security policies based on user identity and device posture, providing granular access control regardless of location.

Answer

Firewall as a Service (FWaaS)

Answer

Secure Web Gateway (SWG)

Answer

Cloud Access Security Broker (CASB)

Question 4

A security analyst is reviewing a Kubernetes cluster's security configuration. Which component should be used to ensure that only authorized pods can communicate with each other?

Accepted Answer

Network Policies. Kubernetes Network Policies allow you to define ingress and egress rules for pods, controlling traffic at the IP address or port level, which is essential for micro-segmentation.

Answer

Pod Security Policies (PSP)

Answer

Seccomp profiles

Answer

RBAC roles

Question 5

During a threat modeling exercise for a new web application, the team identifies a risk of API abuse due to lack of rate limiting. Which security control should be implemented at the API gateway to mitigate this risk?

Accepted Answer

Rate limiting policies. Rate limiting at the API gateway restricts the number of requests per client over a specified time, preventing abuse and DoS attacks.

Answer

Input validation

Answer

OAuth 2.0 scopes

Answer

JWT token expiration

Question 6

A company is required to comply with FedRAMP for its cloud deployment. Which of the following is a key requirement for FedRAMP compliance?

Accepted Answer

Third-party assessment by an accredited organization. FedRAMP requires third-party assessment by an accredited organization (3PAO) to verify that the cloud service provider meets the security controls.

Answer

Continuous monitoring and incident response

Answer

Implementation of AES-256 encryption for all data

Answer

Annual penetration testing by internal team

Question 7

An enterprise is securing a hybrid cloud environment with on-premises and AWS workloads. They need to ensure that on-premises systems can privately access VPC resources without traversing the public internet. Which AWS service should they use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the internet for lower latency and increased security.

Answer

AWS VPN (site-to-site)

Answer

AWS Transit Gateway

Answer

AWS PrivateLink

Question 8

A security architect is designing a defense-in-depth strategy for a web application. Which combination of controls provides overlapping protection against SQL injection attacks?

Accepted Answer

Input validation and parameterized queries. Defense-in-depth layers multiple controls. Input validation prevents malicious input from reaching the application, while parameterized queries ensure that SQL statements are safe even if validation fails. WAFs can detect and block injection attempts at the network layer.

Answer

Encryption and hashing

Answer

Intrusion detection system (IDS) and antivirus

Answer

Web application firewall (WAF) and network segmentation

Question 9

A company uses a multi-cloud strategy with workloads in AWS and Azure. They need a centralized solution to enforce consistent security policies across both cloud environments. Which type of tool should they deploy?

Accepted Answer

Cloud Security Posture Management (CSPM). A Cloud Security Posture Management (CSPM) tool provides visibility and policy enforcement across multiple cloud providers, helping to ensure compliance with security best practices.

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Security Information and Event Management (SIEM)

Question 10

An organization is migrating to an immutable infrastructure model for its containerized applications. Which practice is essential to ensure the integrity of the immutable infrastructure?

Accepted Answer

Image scanning and signing in the CI/CD pipeline. Immutable infrastructure means that components are replaced rather than modified. Image scanning ensures that only secure, approved images are deployed, preventing tampered or vulnerable images from running.

Answer

Regular patching of running containers

Answer

Runtime security monitoring with seccomp

Answer

Use of configuration management tools like Ansible

Question 11

A security engineer is hardening a Kubernetes environment. Which THREE of the following are effective controls for securing the cluster? (Select THREE.)

Accepted Answer

Enabling Pod Security Admission (PSA) to enforce pod security standards. RBAC controls API access, Pod Security Standards (or admission controllers) enforce pod security, and Network Policies restrict pod communication. All three are Kubernetes-native controls for cluster hardening.

Answer

Configuring load balancers for high availability

Answer

Installing antivirus on all nodes

Question 12

Which TWO of the following are key benefits of using a software-defined perimeter (SDP) in a zero trust architecture? (Select TWO.)

Accepted Answer

Reduces the attack surface by hiding network resources. SDP hides network infrastructure and enforces identity-based access, reducing the attack surface and preventing lateral movement.

Answer

Automates patch management

Answer

Eliminates the need for encryption

Answer

Simplifies network architecture by removing firewalls

Question 13

A security architect is evaluating cryptographic agility for a system that must be resistant to quantum computing attacks. Which TWO algorithms are part of the NIST PQC standards? (Select TWO.)

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Kyber is a key encapsulation mechanism, and CRYSTALS-Dilithium is a digital signature scheme; both are NIST-selected PQC algorithms.

Answer

RSA-4096

Answer

AES-256

Answer

SHA-256

Question 14

A company is implementing a secure SDLC and wants to integrate application security testing early. Which THREE tools are most appropriate for shift-left security? (Select THREE.)

Accepted Answer

Static Application Security Testing (SAST). SAST scans source code early, SCA identifies open-source vulnerabilities, and IAST combines static and dynamic analysis within the CI/CD pipeline. DAST and RASP are typically run later or in production.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 15

An organization is designing a PKI for certificate lifecycle management. Which TWO practices are critical for maintaining the security of the certificate authority (CA)? (Select TWO.)

Accepted Answer

Storing the root CA private key in a hardware security module (HSM). HSMs protect private keys, and OCSP provides real-time revocation status. Both are essential for CA security.

Answer

Setting long certificate validity periods to reduce renewal frequency

Answer

Using certificate pinning to prevent man-in-the-middle attacks

Answer

Using self-signed certificates for all internal services