CAS-004 Hard Questions — 25 Difficult Questions

Question 1

A security audit reveals that Docker containers are built with multiple unnecessary layers and utilities. Which practice reduces the attack surface of the container image?

Accepted Answer

Use a base image with only the required packages. Using a base image with only the required packages directly reduces the attack surface by eliminating unnecessary binaries, libraries, and services that could contain vulnerabilities. This practice aligns with the principle of minimalism in container security, where every extra package increases the potential for exploitation. Unlike multi-stage builds or RUN command consolidation, this approach targets the root cause: the contents of the image itself.

Answer

Use multi-stage builds

Answer

Combine multiple RUN commands into one

Answer

Delete the apt cache in the Dockerfile

Question 2

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 3

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit

Question 4

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 5

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 6

To protect against quantum computing attacks, a security architect is planning to transition to post-quantum cryptography. Which algorithm has been selected by NIST for general encryption (key encapsulation) in the PQC standard?

Accepted Answer

CRYSTALS-Kyber. NIST selected CRYSTALS-Kyber as the primary standard for general encryption and key encapsulation (FIPS 203) in its post-quantum cryptography program. Kyber is a lattice-based KEM designed for efficient key establishment, making it the correct choice for general encryption.

Answer

Falcon

Answer

CRYSTALS-Dilithium

Answer

SPHINCS+

Question 7

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC)?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.

Answer

Continuous deployment

Answer

Code signing

Question 8

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 9

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 10

A large enterprise is migrating its critical financial applications to a public cloud provider. The security architecture team has designed a multi-region deployment to ensure availability and disaster recovery. The applications use TLS for data in transit and rely on a key management service (KMS) for encryption keys. During a penetration test, it was discovered that the KMS master keys are stored in a single region, creating a single point of failure. Additionally, the load balancer configuration exposes internal application health check ports to the internet. The security architect must remediate these issues while minimizing latency and cost. Which of the following is the BEST course of action?

Accepted Answer

Implement cross-region replication of KMS master keys and restrict health check ports to internal IP ranges only. The best course of action because it directly addresses both security issues: cross-region replication of KMS master keys eliminates the single point of failure, and restricting health check ports to internal IP ranges reduces exposure. Option A is incorrect because it replaces TLS with IPsec (unnecessary) and adds complexity. Option C consolidates to one region, which defeats the purpose of multi-region deployment for availability and disaster recovery. Option D embeds keys in code, violating key management best practices. Option B minimizes latency and cost while ensuring security.

Answer

Replace the TLS encryption with IPsec VPNs and use a third-party key management appliance in each region

Answer

Move all applications to a single region to simplify key management and use a single shared load balancer

Answer

Use client-side encryption with keys stored in the application code and disable the health checks entirely

Question 11

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 12

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

Accepted Answer

The policy violates the principle of least privilege. The IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Answer

The policy restricts access to specific resources

Answer

The policy does not enable logging

Answer

The policy does not allow any actions

Question 13

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment

Question 14

An organization is migrating to a zero-trust architecture. Which of the following components is CRITICAL for enforcing policy decisions based on user identity, device health, and context?

Accepted Answer

Policy enforcement point (PEP). In a zero-trust architecture, the Policy Enforcement Point (PEP) is the critical component that enforces access decisions by mediating all traffic between users and resources. It evaluates policies based on user identity, device health, and contextual attributes (e.g., location, time) before allowing or denying access, aligning with the NIST SP 800-207 zero-trust framework.

Answer

Intrusion prevention system (IPS)

Answer

Web application firewall (WAF)

Answer

Network access control (NAC)

Question 15

A regional bank is preparing for its annual regulatory examination and must demonstrate that its third-party risk management program is mature. The examiner asks which practices provide continuous, rather than point-in-time, oversight of critical vendors. (Choose two.)

Accepted Answer

Establishing contractual rights to audit, receive breach notifications within defined timeframes, and obtain regular independent assurance reports. Continuous third-party oversight combines recurring independent validation with enforceable contractual information rights. Periodic assessments with remediation tracking confirm that identified weaknesses are corrected, while audit rights, breach notification clauses, and independent assurance requirements keep the bank informed between reviews. One-time questionnaires, spend-based ranking, and reliance on vendor marketing all capture stale or unverified information.

Answer

Relying on the vendor's own marketing materials and public certifications page to confirm its security posture

Answer

Ranking vendors solely by annual contract value and assigning oversight resources proportionally to spend

Answer

Collecting a completed security questionnaire from each vendor once during initial onboarding and archiving the response

Question 16

An organization is concerned about future quantum computer attacks on their public key infrastructure. Which NIST-standardized algorithm is designed for digital signatures and is resistant to quantum attacks?

Accepted Answer

CRYSTALS-Dilithium. CRYSTALS-Dilithium is one of the NIST-standardized post-quantum cryptographic algorithms (FIPS 204) specifically designed for digital signatures, based on the hardness of module lattice problems. It was selected by NIST in July 2022 as the primary signature standard for quantum resistance.

Answer

Falcon

Answer

RSA-4096

Answer

CRYSTALS-Kyber

Question 17

An organization is implementing a CASB to secure their SaaS applications. Which CASB deployment mode is most appropriate for monitoring and controlling data in transit between users and cloud apps without modifying the user's device?

Accepted Answer

API-based. API-based CASB connects directly to the cloud app's API to monitor and control data, without requiring client software.

Answer

Reverse proxy

Answer

Forward proxy

Answer

Inline gateway

Question 18

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which THREE algorithms are currently selected for standardization? (Select THREE).

Accepted Answer

CRYSTALS-Kyber. NIST has selected CRYSTALS-Kyber (for key encapsulation), CRYSTALS-Dilithium (for digital signatures), and FALCON (for digital signatures, with SPHINCS+ as a backup) for standardization. RSA and ECDH are not quantum-resistant.

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

RSA-4096

Question 19

An organization's vulnerability management team discovers a critical vulnerability in a legacy application that cannot be patched because the vendor no longer supports it. The application is essential for business operations. Which of the following compensating controls would best reduce the risk of exploitation while maintaining functionality?

Accepted Answer

Implement network segmentation and restrict access to the application. Network segmentation with restricted access is the best compensating control because it limits the attack surface and prevents lateral movement or remote exploitation of the unpatched legacy application while keeping it operational for authorized users. Since the vendor no longer supports the application, patching is impossible, so reducing exposure through access controls is the most effective risk mitigation. This preserves business functionality while directly addressing the exploitation risk.

Answer

Apply a virtual patch using a web application firewall (WAF) rule

Answer

Disable the application until a replacement is found

Answer

Increase monitoring of the application without any access restrictions

Question 20

A security analyst is investigating a potential data exfiltration incident. The analyst has collected a memory dump from the affected server. Which Volatility command should the analyst use to extract the contents of the clipboard, which may contain copied sensitive data?

Accepted Answer

volatility -f dump.raw clipboard. The 'clipboard' plugin in Volatility extracts the contents of the Windows clipboard, which can contain copied text, including passwords or sensitive data.

Answer

volatility -f dump.raw clipboards

Answer

volatility -f dump.raw windows.clipboard

Answer

volatility -f dump.raw memdump --pid 1234