CAS-004 Security Architecture Practice Test 2 — 15 Questions

Question 1

A security architect is evaluating a new cloud SaaS application that will handle sensitive customer data. The SaaS provider offers a shared responsibility model where the customer is responsible for data classification, access management, and encryption of data at rest using customer-managed keys. The architect must ensure that the organization retains the ability to revoke access to the data if the provider is compromised. Which key management strategy best meets this requirement?

Accepted Answer

Implement bring-your-own-key (BYOK) with keys stored in a customer-controlled external KMS. Option D is correct because BYOK with keys stored in a customer-controlled external KMS ensures the organization retains full control over encryption keys, enabling immediate revocation of access to data at rest if the SaaS provider is compromised. This aligns with the shared responsibility model where the customer manages keys, and external KMS decouples key management from the provider's infrastructure, preventing the provider from accessing data after key revocation.

Answer

Escrow the encryption key with a third-party and rely on legal agreements for revocation

Answer

Use the provider's default encryption with a customer-managed key stored in the provider's KMS

Answer

Use a cloud hardware security module (HSM) to generate and store keys

Question 2

An organization is deploying a new wireless network for employees and guests. The security policy requires that all wireless traffic be encrypted using AES-CCMP, and that clients must authenticate using 802.1X with EAP-TLS. Which of the following wireless security standards should be implemented?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (D) is the correct choice because it supports AES-CCMP encryption and 802.1X authentication with EAP-TLS. WPA2-Enterprise uses a RADIUS server for centralized authentication, allowing per-user credentials via EAP methods, and mandates CCMP (AES-based) for data confidentiality and integrity, meeting all stated security policy requirements.

Answer

WPA2-Personal

Answer

WEP

Answer

WPA3-Enterprise

Question 3

A security architect is reviewing the network security controls for a critical industrial control system (ICS) environment. The architect must select two controls that are most effective at preventing unauthorized access to the ICS network from the corporate IT network, while still allowing necessary monitoring traffic. Which TWO controls should be implemented? (Choose two.)

Accepted Answer

Deploy a unidirectional gateway (data diode) between the networks. A unidirectional gateway (data diode) physically enforces one-way data flow, ensuring that no traffic can originate from the corporate IT network into the ICS network. This prevents unauthorized access while allowing monitoring data (e.g., syslog, SNMP traps) to be sent out from the ICS side. It is the most effective control for preventing any inbound attack vectors while preserving outbound monitoring traffic.

Answer

Configure a site-to-site VPN from the corporate network to the ICS network

Answer

Implement a network-based intrusion prevention system (IPS) on the ICS network

Answer

Segment the networks using VLANs only

Question 4

A network administrator is troubleshooting connectivity to a server at 192.168.1.100. The ACL shown is applied inbound on GigabitEthernet0/0. Which THREE statements are true regarding this ACL configuration? (Choose three.)

Accepted Answer

Traffic sourced from 192.168.1.100 going to the 10.0.0.0/24 network will be permitted. Option B is correct because the ACL, when applied inbound on GigabitEthernet0/0, evaluates traffic entering the interface. The permit statement allows traffic sourced from host 192.168.1.100 destined to the 10.0.0.0/24 network, so that specific traffic is explicitly permitted.

Answer

The ACL will block all traffic from the 192.168.1.0/24 network to 10.0.0.0/24

Answer

The implicit deny at the end of the ACL will block all other traffic not explicitly permitted

Question 5

A large healthcare organization has implemented a zero-trust network architecture (ZTNA) to secure access to its electronic health record (EHR) system. The architecture uses a software-defined perimeter (SDP) where all users must authenticate and be authorized before accessing the EHR. The EHR system is hosted in a private cloud and communicates with a legacy billing system that cannot support modern authentication protocols. The billing system is accessed by a small number of finance employees via a dedicated VPN. Recently, an auditor discovered that a finance employee's credentials were compromised, and the attacker used the VPN to access the billing system and exfiltrate patient billing data. The security architect must prevent such lateral movement while maintaining access for legitimate users. Which of the following is the BEST course of action?

Accepted Answer

Implement a jump server with multi-factor authentication (MFA) and session recording, and restrict the VPN to only allow access to the jump server. Option C is correct because a jump server with MFA and session recording creates a controlled, auditable choke point that prevents lateral movement from the VPN to the billing system. By restricting the VPN to only allow access to the jump server, the attacker cannot directly reach the billing system even with compromised VPN credentials, and MFA adds an additional layer of authentication. Session recording provides forensic evidence for post-incident analysis, addressing the auditor's concern without requiring the legacy billing system to support modern protocols.

Answer

Apply micro-segmentation to isolate the billing system and allow only finance VLAN traffic

Answer

Remove the VPN and allow finance employees to access the billing system directly via RDP over the internet

Answer

Upgrade the billing system to support OAuth 2.0 and integrate it with the ZTNA SDP

Question 6

A security architect is designing a network segmentation strategy for a multi-tier web application. The web servers must be accessible from the internet, while the application and database servers must only be accessible from the web tier. Which architecture best meets these requirements?

Accepted Answer

Deploy web servers in a DMZ, application servers in an internal network, and database servers in a separate restricted network with firewall rules allowing only necessary traffic.. Option C is correct because it implements a classic three-tier DMZ architecture: web servers in a DMZ (publicly accessible), application servers in an internal network (accessible only from the DMZ), and database servers in a restricted backend network (accessible only from the application tier). This layered segmentation enforces the principle of least privilege and uses firewall rules to control traffic between each tier, ensuring that internet-facing components cannot directly reach sensitive data stores.

Answer

Use a single VLAN with access control lists to restrict traffic between servers.

Answer

Place all servers in the same subnet and use host-based firewalls for isolation.

Answer

Use a VPN concentrator for all external access and place all servers in a private subnet.

Question 7

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

Accepted Answer

Enable SQL injection signature rules.. Option A is correct because enabling SQL injection signature rules allows the WAF to inspect HTTP requests for known SQL injection patterns, such as UNION, OR 1=1, or comment sequences like '--', using a predefined rule set. Option B is correct because input validation for all query parameters ensures that user-supplied data is sanitized or rejected before reaching the application, preventing malicious SQL syntax from being interpreted by the database. Together, these controls provide both signature-based detection and behavioral prevention against SQL injection attacks.

Answer

Enable rate limiting on login endpoints.

Answer

Enable IP reputation blocking.

Answer

Enable SSL/TLS inspection for all traffic.

Question 8

A security analyst observes that SSH connections to the server are failing, but HTTP and HTTPS traffic works. Based on the exhibit, what is the most likely cause?

Accepted Answer

The SSH service is being blocked by a firewall rule that drops TCP port 22 traffic.. The exhibit shows a firewall rule that explicitly drops TCP port 22 traffic, which is the default port for SSH. Since HTTP (port 80) and HTTPS (port 443) are unaffected, the issue is isolated to SSH. This rule is the most direct cause of the connection failures, as it blocks all SSH traffic regardless of source or destination.

Answer

The HTTPS rule is overriding the SSH rule.

Answer

The SSH service is only allowed from the 10.0.0.0/8 subnet.

Answer

The SSH service is misconfigured and not listening on the correct interface.

Question 9

Drag and drop the steps to configure a RADIUS server for 802.1X authentication into the correct order.

Question 10

Match each error code or HTTP status code to its meaning.

Question 11

A company is implementing a microservices architecture and needs to ensure secure service-to-service communication. Which of the following BEST describes the recommended approach?

Accepted Answer

Mutual TLS (mTLS) with certificate authentication. Mutual TLS (mTLS) provides mutual authentication and encryption, making it the most secure and scalable option for microservices. Shared API keys are less secure, IP whitelisting is not scalable, and basic HTTP authentication lacks encryption.

Answer

Basic HTTP authentication

Answer

IP whitelisting

Answer

Shared API keys

Question 12

A security architect is designing a network segmentation strategy for a multi-tenant cloud environment. Which of the following is the MOST effective technique to isolate tenant workloads while maintaining manageability?

Accepted Answer

Virtual private clouds (VPCs) with separate subnets. Virtual Private Clouds (VPCs) with separate subnets provide logical isolation at the cloud provider level, which is more manageable than VLAN tagging across physical networks. Stateful firewalls and host-based iptables are supplementary controls, not primary segmentation.

Answer

Host-based iptables

Answer

Stateful firewall rules

Answer

VLAN tagging

Question 13

An organization is migrating to a zero-trust architecture. Which of the following components is CRITICAL for enforcing policy decisions based on user identity, device health, and context?

Accepted Answer

Policy enforcement point (PEP). The Policy Enforcement Point (PEP) is the component that makes access decisions in a zero-trust architecture, often integrating with a policy engine. NAC, WAF, and IPS are related but not the core enforcement component in zero-trust.

Answer

Intrusion prevention system (IPS)

Answer

Web application firewall (WAF)

Answer

Network access control (NAC)

Question 14

A company wants to protect sensitive data stored in a public cloud bucket. Which of the following is the MOST effective control to prevent accidental public exposure?

Accepted Answer

Apply resource-based policies with explicit deny for public access. Applying resource-based policies with an explicit deny for public access directly prevents public exposure. Bucket logging, encryption, and lifecycle policies are important but do not prevent accidental exposure.

Answer

Enable bucket logging

Answer

Implement lifecycle policies

Answer

Use server-side encryption

Question 15

A security architect is evaluating a hardware security module (HSM) for key management. Which of the following is a PRIMARY benefit of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant physical protection of keys. HSMs provide tamper-resistant physical protection for cryptographic keys, which is their primary advantage. They are typically more expensive, and key rotation may be more complex. Cloud integration is possible but not a primary benefit.

Answer

Easier key rotation

Answer

Integration with cloud APIs

Answer

Lower cost