CAS-004 Scripting, Containers and Automation Practice Test 4 — 15 Questions

Question 1

In a CI/CD pipeline, a security gate fails because a high-severity vulnerability is found in the base image of a container. The pipeline is configured to block deployment on such findings. What is the appropriate remediation step?

Accepted Answer

Update the base image to a patched version. Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Answer

Override the security gate and proceed with deployment

Answer

Rebuild the image using the same base image

Answer

Add the vulnerability to an exception list

Question 2

An organization uses AWS, Azure, and GCP for different workloads. They want a single tool to manage infrastructure consistently across all providers. Which approach is most appropriate?

Accepted Answer

Use Terraform with provider plugins. Terraform supports multiple providers via plugins, enabling consistent management. Provider-specific tools are limited to one cloud, and writing scripts for each is inefficient.

Answer

Use Azure Resource Manager templates

Answer

Write provider-specific scripts in PowerShell

Answer

Use AWS CloudFormation

Question 3

Refer to the exhibit. A security analyst reviews this pod specification. Which attack surface is most increased by the added capabilities?

Accepted Answer

The container can install new kernel modules. SYS_ADMIN grants many powerful privileges including loading kernel modules, which can lead to host compromise. NET_ADMIN allows network configuration but is less critical. The combination significantly increases attack surface.

Answer

The container can modify network settings

Answer

The container can kill other processes

Answer

The container can read all host files

Question 4

Refer to the exhibit. A security administrator finds this IAM policy attached to a Lambda execution role. What is the most critical security risk?

Accepted Answer

The Lambda has full IAM management capabilities. The policy grants full IAM management capabilities (iam:*) on all resources, allowing the Lambda to create, modify, or delete IAM resources. This could lead to privilege escalation or resource destruction.

Answer

The Lambda can invoke any other Lambda

Answer

The Lambda can assume any role

Answer

The Lambda can access any S3 bucket

Question 5

Refer to the exhibit. A system administrator creates a systemd service to run a daily patching script. Which security concern is most prevalent?

Accepted Answer

The script runs as root. Running the service as root grants the script full system privileges. If the patching script has vulnerabilities, an attacker could gain root access. Running as a non-root user with required permissions is better.

Answer

The service restarts on failure

Answer

The script location is non-standard

Answer

The service depends on the network

Question 6

A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)

Accepted Answer

Dropping all capabilities (CAP_DROP=ALL). Setting USER to non-root prevents the container from running as root, and dropping all capabilities removes many known escalation vectors. Using host networking and mounting the Docker socket increase risk. SELinux helps but is not specific to privilege escalation.

Answer

Enabling SELinux

Answer

Using host networking

Answer

Mounting /var/run/docker.sock

Question 7

A DevOps team is automating server configuration using configuration management tools. Which THREE principles should be followed to ensure secure automation? (Choose three.)

Accepted Answer

Store secrets in encrypted variables or vaults. Storing secrets encrypted, ensuring idempotency, and applying least privilege to automation agents are key security practices. Hardcoding credentials is insecure. While unit testing is good, it is not specifically a security principle.

Answer

Hardcode credentials in automation scripts

Answer

Perform unit testing on scripts

Question 8

An analyst wants to automate incident response tasks in a SOC environment. Which THREE scripting languages are commonly used for automation? (Choose three.)

Accepted Answer

Python. Python, Bash, and PowerShell are widely used for security automation due to cross-platform support, extensive libraries, and native system integration. Java is less common for quick automation, and COBOL is obsolete.

Answer

Java

Answer

COBOL

Question 9

A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?

Accepted Answer

Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.. Integrating image scanning into the CI pipeline ensures vulnerabilities are detected before deployment. Option C is correct because tools like Trivy or Clair can be run as pipeline stages. Option A is incorrect because relying on developers is inconsistent. Option B is incorrect because scanning after deployment doesn't prevent vulnerabilities. Option D is incorrect because infrastructure as code does not directly address image scanning.

Answer

Schedule a weekly cron job to scan the container registry and generate reports.

Answer

Use Terraform to enforce that only images from a trusted registry are deployed.

Answer

Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.

Question 10

An organization needs to ensure consistent configuration across multiple Linux servers. They want to automate this process with a solution that requires minimal agent installation and uses push-based communication. Which approach is most appropriate?

Accepted Answer

Use Ansible playbooks to define and enforce server configurations.. Ansible is agentless and push-based via SSH. Option A is correct. Option B (Puppet) is pull-based and requires agents. Option C (Docker) is for containers, not direct server config. Option D (PowerShell DSC) works well in Windows but is less common for Linux.

Answer

Use PowerShell Desired State Configuration (DSC) with Linux extensions.

Answer

Run a Docker container on each server with a configuration management tool inside.

Answer

Deploy Puppet with a master server and agents on each system.

Question 11

A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?

Accepted Answer

Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].. Using read-only root filesystem and dropping all capabilities limits the attack surface. Option D is correct. Option A allows privileged access. Option B keeps default capabilities. Option C runs as root, increasing risk.

Answer

Set runAsNonRoot: false and readOnlyRootFilesystem: true.

Answer

Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].

Answer

Set privileged: true and readOnlyRootFilesystem: false.

Question 12

A systems administrator must automate the patching of 200 Windows servers. The environment has strict security requirements and change management. Which scripting approach best balances automation and control?

Accepted Answer

Use PowerShell DSC (Desired State Configuration) with a pull server and authorized users via JEA.. PowerShell with Just Enough Administration (JEA) provides both automation and secure access. Option B is correct. Option A is unreliable for enterprise. Option C bypasses change management. Option D is too manual.

Answer

Write a Python script that uses WMI to apply patches and reboot servers.

Answer

Create a scheduled task on each server that runs a script from a network share.

Answer

Use Group Policy to install updates during the next restart.

Question 13

A development team wants to deploy a microservices application using containers. They need a solution to automate the deployment, scaling, and management of the containers across a cluster. Which technology is most suitable?

Accepted Answer

Kubernetes with Helm charts.. Kubernetes is designed for orchestrating containerized applications at scale. Option D is correct. Option A is for single hosts. Option B is for VMs. Option C is for CI/CD.

Answer

VMware vSphere with container support.

Answer

Jenkins with Docker plugins.

Answer

Docker Compose with manual scaling.

Question 14

A security team needs to automate the enforcement of cloud security policies across multiple accounts in AWS. They want a solution that uses code to define policies and automatically remediate violations. Which approach best meets these requirements?

Accepted Answer

Use AWS Config with managed rules and custom Lambda functions for auto-remediation.. AWS Config Rules with custom Lambda functions can automate remediation. Option C is correct. Option A is manual. Option B is a separate tool. Option D is reactive, not automated.

Answer

Write Python boto3 scripts that run on a schedule to check and update security groups.

Answer

Enable AWS GuardDuty and rely on its threat detection alerts.

Answer

Deploy a third-party cloud security posture management (CSPM) tool like Prisma Cloud.

Question 15

A company is adopting container security best practices. Which TWO actions should be implemented to reduce the attack surface of container images? (Select TWO.)

Accepted Answer

Set the container filesystem as read-only where possible.. Using signed images (A) ensures integrity, and read-only root filesystem (C) prevents runtime modifications. Distractors B and D are insecure, and E is good but not as critical for attack surface reduction.

Answer

Disable vulnerability scanning to optimize build time.

Answer

Store secrets in environment variables.

Answer

Run containers with the root user to simplify permissions.