CAS-004 Hard Questions — 25 Difficult Questions

Question 1

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 2

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 3

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Accepted Answer

Add an SELinux policy module to allow httpd_t to connectto unconfined_t. The web server (httpd_t) is denied access to the local database socket because SELinux enforces mandatory access controls. Adding an SELinux policy module that allows httpd_t to connect to unconfined_t (the domain of the database socket) grants the necessary permission without disabling security. This is the targeted fix that preserves SELinux protection while resolving the connectivity issue.

Answer

Disable SELinux entirely

Answer

Restart the httpd service

Answer

Change the SELinux enforcing mode to permissive

Question 4

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

Accepted Answer

Use selective authentication and restrict the authorized accounts. Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint. Disabling the trust is not practical.

Answer

Remove the trust entirely and use individual local accounts

Answer

Configure the trust to use forest-wide authentication instead of selective

Answer

Enable SID filtering on both forest trusts

Question 5

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 6

A security assessor is evaluating an application that uses ChaCha20-Poly1305 for encryption. Which TWO of the following are true about this cryptographic algorithm?

Accepted Answer

It is a stream cipher. ChaCha20-Poly1305 is a stream cipher (ChaCha20) combined with a MAC (Poly1305). It is an AEAD cipher. It is not a block cipher, and it does not require padding.

Answer

It is based on the AES algorithm

Answer

It requires padding to achieve correct block sizes

Answer

It is a block cipher

Question 7

An incident response team is handling a ransomware incident. The team has successfully contained the threat and is now in the eradication phase. Which THREE actions are appropriate for the eradication phase? (Select THREE.)

Accepted Answer

Apply security patches to the vulnerability that allowed initial access. Eradication involves removing the threat completely: deleting malware, revoking compromised credentials, and patching vulnerabilities.

Answer

Restore systems from clean backups

Answer

Conduct a lessons learned meeting

Question 8

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

Accepted Answer

Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.. Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.

Answer

Using signature-based intrusion detection systems (IDS) to match known attack patterns.

Answer

Deploying honeypots to attract and analyze attacker behavior.

Question 9

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

Accepted Answer

The key length is insufficient against modern attacks. A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.

Answer

The firmware is not encrypted

Answer

The signature algorithm is obsolete

Answer

The signing key is not rotated

Question 10

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.

Question 11

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 12

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

Accepted Answer

Implement short-lived access tokens with refresh tokens that are automatically rotated. Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Answer

Extend the session token expiration time to reduce the frequency of re-authentication

Answer

Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture

Answer

Reduce the number of authentication factors required for re-authentication

Question 13

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. The best course of action because it directly addresses both security issues: cross-region replication of KMS master keys eliminates the single point of failure, and restricting health check ports to internal IP ranges reduces exposure. Option A is incorrect because it replaces TLS with IPsec (unnecessary) and adds complexity. Option C consolidates to one region, which defeats the purpose of multi-region deployment for availability and disaster recovery. Option D embeds keys in code, violating key management best practices. Option B minimizes latency and cost while ensuring security.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely

Question 14

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 15

An organization uses an EDR solution and wants to detect ransomware that encrypts files and then deletes volume shadow copies. Which EDR detection technique would be most effective for this behavior?

Accepted Answer

Behavioral detection for mass file modifications and vssadmin.exe execution. Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Answer

Signature-based detection using file hashes

Answer

Allowlisting of trusted applications

Answer

Network traffic analysis to detect C2 communication

Question 16

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 17

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. Using a shared symmetric key means any service with the key can forge tokens, compromising authentication integrity.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set

Question 18

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Accepted Answer

Lack of peer review and cryptanalysis. The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 19

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 20

A DevOps team integrates security into the CI/CD pipeline. They want to identify vulnerabilities in open-source libraries used by their application. Which tool or practice is specifically designed for this purpose?

Accepted Answer

Software Bill of Materials (SBOM) and dependency analysis. Software Bill of Materials (SBOM) is a list of all components in the application, including open-source libraries. Dependency analysis tools use SBOMs to identify known vulnerabilities. SAST analyzes source code, not libraries. DAST tests running applications. RASP provides runtime protection.

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)