CAS-004 Security Architecture Practice Test 4 — 15 Questions

Question 1

An enterprise is adopting a DevOps model and wants to integrate security into the CI/CD pipeline. The security architect recommends adding automated security testing. Which phase of the pipeline should static application security testing (SAST) be introduced to minimize rework?

Accepted Answer

During the build phase after code commit. SAST is most effective when run early, ideally during the build phase, so developers can fix vulnerabilities before deployment. In production, it's too late. During deployment might cause delays. SAST is not typically run on running applications.

Answer

During the production deployment phase

Answer

After the code is promoted to production

Answer

During runtime in the staging environment

Question 2

A company is designing a hybrid cloud architecture with AWS and an on-premises data center. They need to ensure that all data transmitted between environments is encrypted and that the connection is resilient. Which design should the architect choose?

Accepted Answer

Establish multiple redundant IPsec VPN tunnels to the VPC. A VPN tunnel using IPsec with IKEv2 provides encryption and authentication; redundant tunnels ensure failover. Direct Connect is private but often requires separate encryption. SSL tunnel would work but typically for web traffic. MPLS is a carrier service, not inherently encrypted.

Answer

Deploy a single MPLS connection with network-based encryption

Answer

Set up a single AWS Direct Connect connection and rely on the provider's encryption

Answer

Use an SSL VPN tunnel from the on-premises firewall to the VPC

Question 3

A security architect is reviewing the network segmentation of a healthcare organization that must comply with HIPAA. The current flat network allows all devices to communicate. Which segmentation approach provides the best balance of security and manageability?

Accepted Answer

Segment using VLANs and ACLs to limit traffic to necessary flows. Implementing VLANs with access control lists (ACLs) to restrict communication between segments provides logical isolation without requiring new hardware. Air gaps are impractical. DMZ for all systems is not appropriate. Full 1:1 VLAN per device is unmanageable.

Answer

Create a physical air gap between all systems

Answer

Assign each device its own VLAN with no inter-VLAN routing

Answer

Place all critical systems in a single DMZ subnet

Question 4

An organization uses a multi-cloud strategy with workloads in AWS and Azure. The security architect needs to implement a single identity provider for all cloud resources while maintaining on-premises Active Directory as the authoritative source. Which architecture minimizes latency and complexity?

Accepted Answer

Federate on-premises AD directly with both AWS and Azure using ADFS. Using Azure AD Connect for Azure and AWS SSO with SAML federation from on-premises AD centralizes identity without synchronizing to two clouds separately. Direct federation from on-prem to each cloud is acceptable but using separate identity sources increases complexity. A third-party IdP could work but adds cost.

Answer

Use a third-party cloud-based identity provider and sync AD to it

Answer

Synchronize AD to Azure AD and then use Azure AD as an identity source for AWS via SAML

Answer

Create separate identity stores in AWS and Azure and sync from AD

Question 5

A security architect is designing a secure wireless network for a government facility. Which TWO of the following measures should be implemented to ensure the highest level of security? (Select TWO.)

Accepted Answer

Disable SSID broadcast on the access points. WPA3-Enterprise with EAP-TLS is the most secure for authentication and encryption, and disabling SSID broadcast hides the network from casual scanning, though it is not a strong security measure. MAC filtering is easily spoofed. WPA2-PSK is less secure. Captive portals do not provide strong access control.

Answer

Use WPA2-PSK with a strong pre-shared key

Answer

Implement a captive portal with social login

Answer

Enable MAC address filtering on the access points

Question 6

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings or seals and identity-based authentication, along with physical security. Tamper resistance with zeroization is more Level 4. Role-based authentication is Level 3 but identity-based is more specific. Plaintext key export is disallowed at Level 3.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 7

A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)

Accepted Answer

Implement just-in-time (JIT) temporary privilege elevation. Time-limited accounts enforce temporary access, application-level VPNs restrict access to specific applications, and just-in-time (JIT) privileges reduce standing access. Full VPN access provides too much network access, shared accounts lack accountability, and permanent accounts are against least privilege.

Answer

Allow contractors to use a shared account for simplicity

Answer

Provide full network-level VPN access

Question 8

A security architect reviews the iptables firewall rules above. A new web server with IP 192.168.1.100 must be reachable from the internet on ports 80 and 443. Which of the following changes is necessary to allow inbound HTTPS while maintaining security?

Accepted Answer

Change rule 3 source to 0.0.0.0/0 and restrict rule 2 to a management subnet. The current rule 3 only allows HTTPS from the 192.168.1.0/24 subnet. To allow from the internet, the source must be changed to 0.0.0.0/0. However, the existing SSH rule (rule 2) already allows from any source, which is a risk. The correct action is to change rule 3's source to 0.0.0.0/0 and also restrict rule 2 to management subnet. Option A is correct. Adding a new rule would work but leave rule 3 misconfigured.

Answer

Delete rule 3 and add a rule: ACCEPT tcp from any to 192.168.1.100 dpt 80,443

Answer

Change default INPUT policy to ACCEPT and rely on application security

Answer

Add a new rule before rule 5: ACCEPT tcp from any to 192.168.1.100 dpt 443

Question 9

A security architect finds this IAM policy attached to an S3 bucket. Which of the following best describes a critical security flaw in this policy?

Accepted Answer

The second statement allows public access from the 10.0.0.0/8 IP range. The second statement uses "Principal": "*" which allows any user or service to access the bucket if they meet the IP condition. Since "Effect": "Allow", it grants public access from the specified IP range. This is a major risk because the bucket is named "my-sensitive-bucket" and the IP range 10.0.0.0/8 is an internal private range that could be spoofed or used by anyone on that network. The first statement is fine for EC2 assume role. The flaw is that the policy allows anonymous access from a broad private IP range.

Answer

The condition on the second statement uses StringEquals instead of IpAddress

Answer

The first statement allows EC2 to assume any role in the account

Answer

The policy should use a NotPrincipal element to restrict access

Question 10

A security architect reviews this Cisco router ACL configuration. The web server at 192.168.1.100 is accessible from the internet. What additional security measure should be implemented to protect the internal network (10.0.0.0/24)?

Accepted Answer

Replace the ACLs with a stateful firewall that inspects connection states. The INSIDE_OUT ACL allows all traffic from the internal network to any destination, including potentially malicious outbound connections. Implementing a stateful firewall would track connection states and provide better inspection. Egress filtering could be added, but stateful inspection is more comprehensive. The OUTSIDE_IN ACL only allows inbound web traffic, which is good. The missing piece is stateful awareness to prevent internal hosts from initiating connections to malicious external hosts.

Answer

Remove the log statement from the deny rules to improve performance

Answer

Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web ports only

Answer

Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound

Question 11

A company is designing a new multi-tier web application. The security team recommends placing a web application firewall (WAF) in front of the web servers and a network firewall between the web and application tiers. Which security architecture principle does this represent?

Accepted Answer

Defense in depth. Defense in depth (layered security) uses multiple controls to protect assets. Option A is wrong because it is not just a single control. Option B is wrong because separation of duties is about dividing responsibilities. Option D is wrong because least privilege limits access rights.

Answer

Separation of duties

Answer

Least privilege

Answer

Single point of failure

Question 12

An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?

Accepted Answer

Deploy a forward proxy with SSL/TLS inspection. An SSL/TLS inspection proxy can decrypt outbound traffic for inspection, allowing detection of malicious content while still allowing legitimate HTTPS. Option A is wrong because blocking all outbound 443 breaks functionality. Option B is wrong because increasing logging does not detect encrypted content. Option D is wrong because IDS cannot inspect encrypted traffic without decryption.

Answer

Block outbound TCP 443 and require users to use a VPN

Answer

Enable logging on the firewall for all outbound 443 traffic

Answer

Install a network-based IDS on the internal side of the firewall

Question 13

A security architect at a financial institution is designing a cloud-native application using AWS. The application processes sensitive customer data and must comply with PCI DSS. Which of the following security architecture decisions best supports both compliance and operational efficiency?

Accepted Answer

Implement a cloud access security broker (CASB) and use customer-managed encryption keys (CMKs) for data at rest. Using a CASB provides visibility and control over cloud traffic, and encryption with customer-managed keys satisfies PCI DSS requirements. Option A is wrong because ignoring cloud risks is not acceptable. Option B is wrong because a cloud-based WAF is not specifically for data protection compliance. Option D is wrong because VPC endpoints reduce exposure but do not address data protection requirements directly.

Answer

Place all application resources in a VPC with no internet gateway and use VPC endpoints for AWS services

Answer

Use a cloud-based web application firewall (WAF) and enable logging for all API calls

Answer

Deploy the application on a single tenant dedicated instance and rely on the cloud provider's compliance certifications

Question 14

During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?

Accepted Answer

Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services. Using a reverse proxy for inbound traffic and preventing DMZ hosts from initiating connections to internal networks enforces a trust direction. Option A is wrong because a stateful firewall alone does not enforce directionality if rules allow outbound from DMZ. Option B is wrong because DMZ hosts should not initiate internal connections. Option D is wrong because a VPN does not prevent DMZ-to-internal traffic.

Answer

Allow only specific IPs in the DMZ to connect to internal servers

Answer

Replace the DMZ firewall with a next-generation firewall that includes IPS

Answer

Move all DMZ services to a cloud provider and use a site-to-site VPN

Question 15

A company is implementing a zero-trust network architecture. Which of the following components is essential for enforcing micro-segmentation?

Accepted Answer

Software-defined networking (SDN) with distributed firewalls. Micro-segmentation divides the network into small zones, each with its own security controls. Software-defined networking (SDN) enables dynamic policy enforcement at the hypervisor level. Option A is wrong because NAC controls access but not segmentation. Option B is wrong because MFA is an authentication mechanism. Option D is wrong because a SIEM correlates logs but does not enforce policies.

Answer

Security information and event management (SIEM) system

Answer

Multi-factor authentication (MFA)

Answer

Network access control (NAC)