CAS-004 Multiple Select — 20 Questions

Question 1

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement just-in-time (JIT) temporary privilege elevation. Just-in-time (JIT) temporary privilege elevation ensures contractors only receive the minimum necessary permissions for a limited duration, reducing the attack surface and preventing standing privileges. This aligns with the principle of least privilege and zero-trust architectures, often implemented via tools like Microsoft Entra PIM or AWS IAM Access Analyzer with time-bound policies.

Answer

Allow contractors to use a shared account for simplicity

Answer

Provide full network-level VPN access

Question 2

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 3

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC)?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.

Answer

Continuous deployment

Answer

Code signing

Question 4

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) (C) belongs in the development phase because it analyzes source code or bytecode without executing the application, letting developers find injection flaws, insecure coding patterns, and other defects while code is still being written. Threat modeling (D) is a development-phase design activity that systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE) so that controls are built into the architecture before coding is complete. Dependency analysis for open-source libraries (E) is also a development-phase activity, typically implemented as software composition analysis (SCA) that inspects manifests such as package.json, pom.xml, or requirements.txt to detect vulnerable or outdated third-party components and their transitive dependencies. By contrast, RASP (A) is a runtime protection mechanism that instruments the executing application in production or test, so it is a deployment/operations control rather than a development activity, and penetration testing on production (B) is an assurance activity performed after deployment against a running system, not during development.

Answer

Runtime application self-protection (RASP) deployment

Answer

Penetration testing on production environment

Question 5

A regional bank is preparing for its annual regulatory examination and must demonstrate that its third-party risk management program is mature. The examiner asks which practices provide continuous, rather than point-in-time, oversight of critical vendors. (Choose two.)

Accepted Answer

Establishing contractual rights to audit, receive breach notifications within defined timeframes, and obtain regular independent assurance reports. Continuous third-party oversight combines recurring independent validation with enforceable contractual information rights. Periodic assessments with remediation tracking confirm that identified weaknesses are corrected, while audit rights, breach notification clauses, and independent assurance requirements keep the bank informed between reviews. One-time questionnaires, spend-based ranking, and reliance on vendor marketing all capture stale or unverified information.

Answer

Relying on the vendor's own marketing materials and public certifications page to confirm its security posture

Answer

Ranking vendors solely by annual contract value and assigning oversight resources proportionally to spend

Answer

Collecting a completed security questionnaire from each vendor once during initial onboarding and archiving the response

Question 6

An organization is creating a data classification policy. Which THREE of the following are common classification levels used in government and defense? (Select THREE.)

Accepted Answer

Top Secret. Top Secret is a standard classification level in government and defense, indicating information that would cause exceptionally grave damage to national security if disclosed without authorization. It is the highest level in the U.S. classification system, defined under Executive Order 13526, and requires the most stringent access controls and handling procedures.

Answer

Private

Answer

Public

Question 7

A security architect is implementing a zero trust architecture for a corporate network. Which TWO principles are fundamental to the zero trust approach? (Choose two.)

Accepted Answer

Verify every access request regardless of source. Option D is correct because zero trust requires that every access request be authenticated and authorized explicitly, regardless of whether it originates inside or outside the traditional network perimeter—no user or device is trusted by default. Option E is correct because least privilege access is a core zero trust principle, granting users and devices only the minimum permissions needed for their tasks and limiting lateral movement if credentials are compromised. Options A, B, and C are incorrect because they reflect perimeter-based, castle-and-moat security models: granting access by network location, assuming implicit trust for internal users, and relying on a single perimeter firewall all contradict zero trust's 'never trust, always verify' philosophy.

Answer

Grant access based on network location

Answer

Assume implicit trust for internal users

Answer

Use a single perimeter firewall

Question 8

Which TWO of the following are advantages of using a hardware security module (HSM) over a software-based cryptographic module? (Select exactly 2.)

Accepted Answer

Physical tamper resistance and protection against key extraction.. Option C is correct because an HSM is a dedicated physical device designed with tamper-resistant and tamper-evident mechanisms (such as epoxy encapsulation, sensors, and zeroization) that protect cryptographic keys from extraction even under physical attack, which a software module running on general-purpose hardware cannot guarantee. Option E is correct because HSMs include dedicated cryptographic accelerators and optimized processors that offload symmetric and asymmetric operations from the host CPU, yielding higher throughput and lower latency for bulk encryption and key operations. Option A is not generally true, since HSMs can be harder to deploy and integrate in cloud environments than pure software modules, which are simply installed or linked. Option B is incorrect because HSM firmware updates typically require manual or vendor-managed intervention and are not automatically applied like some software patch pipelines. Option D is incorrect because HSMs are typically far more expensive than software-based cryptographic modules due to specialized hardware, certification, and management overhead.

Answer

Easier to deploy in cloud environments than software.

Answer

Automatically receive security patches without manual intervention.

Answer

Lower cost than software modules.

Question 9

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an insider is using encrypted tunnels to transfer data. Which TWO of the following network traffic analysis (NTA) indicators are most likely to suggest encrypted exfiltration? (Choose two.)

Accepted Answer

Large data transfers to an external IP address during non-business hours. Option A is correct because large outbound data transfers to an external IP address outside normal business hours are a classic NTA indicator of exfiltration, as insiders often schedule bulk transfers when monitoring and user activity are lower. Option D is correct because repeated TLS connections to an external host on a non-standard port strongly suggest an encrypted tunnel or covert channel, since TLS hides payload contents and the non-standard port deviates from normal HTTPS/443 behavior. Option B is not correct because multiple HTTP GET requests to a known CDN are typically normal web browsing or content retrieval and do not indicate large-scale encrypted exfiltration. Option C is not correct because a single large upload to a cloud storage provider during work hours may be legitimate business activity and lacks the suspicious timing or tunneling characteristics of insider exfiltration. Option E is not correct because high DNS query volume to one domain more likely indicates DNS tunneling or beaconing, but the question specifically asks for indicators of encrypted exfiltration tunnels rather than DNS-based covert channels.

Answer

Multiple HTTP GET requests to a known content delivery network

Answer

A single large file upload to a cloud storage provider during work hours

Answer

High volumes of DNS queries to a single external domain

Question 10

A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)

Accepted Answer

Record and monitor all privileged sessions. Option A is correct because recording and monitoring all privileged sessions provides an audit trail and enables real-time detection of malicious or anomalous activity by administrators, which is a core PAM control. Option B is correct because just-in-time (JIT) access provisioning grants elevated privileges only when needed and for a limited time, reducing the standing attack surface and the window for credential misuse. Option C is correct because break-glass accounts provide controlled emergency access when normal PAM workflows fail, and when properly vaulted, monitored, and alerted on, they preserve availability without creating unmanaged privileged access. Option D is not the best fit because MFA for all users is a general identity control, not a PAM-specific practice for critical server privileged access. Option E is not correct because periodic password rotation for service accounts is a legacy practice that can weaken security and is not a core PAM enhancement compared to session monitoring, JIT access, and break-glass procedures.

Answer

Enforce multi-factor authentication for all users

Answer

Require periodic password rotation for all service accounts

Question 11

A SOC team is implementing a SOAR playbook to automate the response to phishing emails reported by users. The playbook should perform initial triage and, if the email is determined to be malicious, take containment actions. Which TWO of the following actions should be included in the playbook? (Choose TWO.)

Accepted Answer

Automatically block the sender's email address in the email gateway. Option E is correct because extracting embedded URLs and file hashes is a core initial triage step in a phishing SOAR playbook — these indicators are submitted to threat intelligence platforms (e.g., VirusTotal, MISP) to determine whether the email is malicious before any containment action is taken. Option C is correct because, once the email is confirmed malicious, blocking the sender's address at the email gateway is a standard, low-risk containment action that prevents further messages from that sender reaching other users. Option A is not appropriate because requiring manager approval introduces a manual delay that defeats the purpose of an automated SOAR playbook and is not a triage or containment action. Option B is not a triage or containment action; ticketing is a documentation/notification step, not part of the initial decision or containment logic. Option D is not indicated here because a full antivirus scan on the workstation is a host-level remediation action that is not triggered by email triage alone and would typically follow only if the user executed an attachment or payload.

Answer

Send an alert to the user's manager for approval

Answer

Automatically create a ticket in the service desk system

Answer

Initiate a full antivirus scan on the user's workstation

Question 12

A senior security architect is designing a detection strategy for advanced persistent threats (APTs) that employ living-off-the-land (LotL) techniques. Which THREE of the following approaches are most effective for detecting LotL activities? (Choose three.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). Option A (UEBA) is correct because LotL attacks abuse legitimate credentials and tools, so baselining normal user and entity behavior and flagging anomalies (e.g., unusual process lineage, off-hours privileged activity) is one of the few ways to surface attacker activity that leaves no malicious binary. Option B (honeytokens and honeypots) is correct because decoy credentials, files, and hosts have no legitimate use, so any interaction with them is high-fidelity evidence of an intruder performing reconnaissance or lateral movement with native tooling. Option D (monitoring native tool usage with EDR and command-line argument logging) is correct because LotL techniques rely on built-in binaries such as PowerShell, WMI, certutil, and rundll32, and capturing process creation with full command lines (e.g., via Sysmon Event ID 1 or EDR telemetry) exposes suspicious invocations like encoded PowerShell or certutil -urlcache. Option C is not correct because signature-based detection on known malicious file hashes cannot detect LotL activity, which by definition uses already-installed, signed, legitimate system binaries that have no malicious hash. Option E is not correct because blanket blocking of all scripts and macros is a preventive hardening control, not a detection approach, and it is impractical and would not identify an adversary already operating with native tools.

Answer

Signature-based detection on malicious file hashes

Answer

Blocking all scripts and macros by default

Question 13

A risk manager is applying the FAIR model to quantify a risk. Which TWO of the following are primary components used in FAIR analysis? (Select TWO.)

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO) are used in quantitative risk analysis (e.g., ALE), but not primary FAIR components. Exposure Factor (EF) is part of SLE calculation. Annual Loss Expectancy (ALE) is a result, not a component.

Answer

Single Loss Expectancy (SLE)

Answer

Annual Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 14

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Option A is correct because dynamic application security testing (DAST) and penetration testing exercise the running application before release, detecting runtime vulnerabilities such as injection, authentication flaws, and misconfigurations that static analysis cannot see. Option C is correct because static application security testing (SAST) analyzes source code or binaries during development, catching insecure coding patterns like buffer overflows and hardcoded secrets early when remediation is cheapest. Option E is correct because threat modeling during the design phase systematically identifies assets, trust boundaries, data flows, and threats (e.g., via STRIDE), allowing architectural security controls to be built in before code exists. Option B does not belong because user acceptance testing validates functional business requirements, not security engineering controls. Option D does not belong because daily stand-ups are an Agile project-management ceremony with no direct security engineering function.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 15

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Accepted Answer

Use ECDSA P-384 for authentication. Option A (ECDSA P-384) is correct because elliptic-curve signatures at the 384-bit level provide roughly 192-bit security strength, far exceeding RSA-2048, and are well supported in IKEv2 for strong peer authentication. Option C (AES-256-GCM) is correct because AES-256 gives a 256-bit key and GCM is an AEAD mode that provides both confidentiality and integrity in a single efficient primitive, making it the strongest symmetric choice here. Option E (perfect forward secrecy via DHE) is correct because Diffie-Hellman ephemeral key exchange ensures that compromise of the long-term key cannot decrypt previously captured sessions, which is essential for 'strongest possible security' in an IKEv2 deployment. Option B (SHA-1) is not appropriate because SHA-1 is cryptographically broken for integrity and should be replaced by SHA-256 or stronger. Option D (IKEv1) is not appropriate because IKEv2 is more secure, more robust, and supports modern features like MOBIKE and stronger authentication methods.

Answer

Use SHA-1 for integrity

Answer

Use IKEv1 instead of IKEv2

Question 16

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. Option A is correct because an IPsec VPN tunnel between the AWS VPC and the on-premises network creates an encrypted, private path over the internet, satisfying both the requirement to minimize public exposure and to ensure encryption in transit. Option B is correct because AWS Direct Connect provides a dedicated private network connection from on-premises to AWS that bypasses the public internet entirely, and it can be combined with encryption (e.g., MACsec or VPN over Direct Connect) to meet the in-transit encryption requirement. Option C is not correct here because Secrets Manager handles credential storage and rotation, not the secure network path or encryption in transit between the web app and the database. Option D is not correct because VPC peering only connects VPCs within AWS (or between AWS VPCs), not an AWS VPC to an on-premises network. Option E is not correct because TLS encrypts the application-to-database session but does not by itself minimize internet exposure, since the traffic could still traverse the public internet.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.

Question 17

A penetration tester is performing reconnaissance against a target. Which TWO of the following are examples of active reconnaissance? (Select TWO.)

Accepted Answer

Banner grabbing. Banner grabbing (A) is active reconnaissance because the tester directly connects to target services (e.g., via netcat or telnet to a port) and reads the service's response banner, which generates traffic and can be logged by the target. Port scanning (C) is also active reconnaissance since tools like Nmap send TCP SYN, TCP connect, or UDP probes directly to the target's IP addresses to discover open ports, again interacting with the target's systems. In contrast, social media profiling (B), WHOIS lookup (D), and searching job postings (E) are passive reconnaissance techniques that rely on publicly available third-party information without directly touching the target's infrastructure, so they do not qualify as active reconnaissance.

Answer

Social media profiling

Answer

WHOIS lookup

Answer

Searching job postings for technology details

Question 18

A security assessor is reviewing a containerized application. Which three of the following practices help secure the container runtime environment? (Select the three best options.)

Accepted Answer

Run the container with a read-only root filesystem. Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Answer

Use the latest base image from Docker Hub

Question 19

A security architect is designing a PKI for a large enterprise that issues certificates to thousands of users and devices. The architect wants to implement a mechanism to efficiently check certificate revocation status without requiring clients to download a full CRL. Which TWO technologies should be considered?

Accepted Answer

OCSP stapling. Option C (OCSP stapling) is correct because it lets the server obtain a signed, time-stamped OCSP response from the CA and present it during the TLS handshake, so clients get revocation status without contacting the OCSP responder themselves, reducing latency and load. Option D (Online Certificate Status Protocol, OCSP) is correct because it is the standard protocol for querying a responder about a single certificate's revocation status, returning good, revoked, or unknown, which avoids downloading an entire CRL. Option A (CRL distribution points) is not appropriate here because it points clients to full CRLs, which is exactly the bulk-download behavior the architect wants to avoid. Option B (certificate transparency logs) is unrelated to revocation checking; CT logs provide public auditability of issued certificates, not revocation status. Option E (delta CRL) still relies on CRL downloads (a base CRL plus deltas), so it does not meet the goal of avoiding full CRL retrieval.

Answer

CRL distribution points

Answer

Certificate transparency logs

Answer

Delta CRL

Question 20

During a penetration test, an assessor successfully exploits a timing side-channel attack to extract an ECDSA private key from a secure enclave. Which TWO mitigations should the development team implement to prevent such attacks? (Select TWO.)

Accepted Answer

Implement constant-time cryptographic operations. Option A is correct because constant-time cryptographic operations ensure that execution time and memory access patterns do not depend on secret data, which directly eliminates the timing side-channel that leaked the ECDSA private key from the enclave. Option D is correct because ECDSA signing blinding (e.g., randomizing the nonce k and/or the private key d with a random value before the scalar multiplication) decorrelates the timing of the modular exponentiation/scalar multiplication from the actual secret, so an attacker cannot recover the key even if timing varies. Option B is not appropriate because adding random delays only obfuscates timing and is statistically defeatable by averaging many traces; it is not a sound cryptographic countermeasure. Option C does not belong because disabling debug interfaces addresses physical/JTAG-style access, not a timing side-channel observed through normal cryptographic execution. Option E does not belong because Ed25519 is also vulnerable to timing side-channels if implemented without constant-time code and blinding, so simply swapping algorithms does not fix the root cause.

Answer

Add random delays to cryptographic operations

Answer

Disable debug interfaces on the secure enclave

Answer

Replace ECDSA with Ed25519