CAS-004 Security Architecture Practice Test 5 — 15 Questions

Question 1

An organization's containerized application is deployed on Kubernetes. The security team wants to enforce that containers run with the least privilege and cannot access the host file system. Which Kubernetes security mechanism should be configured?

Accepted Answer

Pod Security Policy (PSP) with readOnlyRootFilesystem and runAsNonRoot. Pod Security Policies (now deprecated, but in CASP context is still valid) or Pod Security Standards control security contexts; readOnlyRootFilesystem and runAsNonRoot directly address the requirement. Option A is wrong because network policies control traffic, not file system. Option B is wrong because secrets management does not enforce file system restrictions. Option D is wrong because RBAC controls API access, not container runtime privileges.

Answer

Secrets management with Vault

Answer

Role-based access control (RBAC) for service accounts

Answer

Network policies to restrict egress traffic

Question 2

A security architect is evaluating a new identity management solution. The requirement is to allow users to authenticate using their existing social media accounts while maintaining corporate control over access policies. Which architecture best meets this requirement?

Accepted Answer

Federated identity management using Security Assertion Markup Language (SAML). Federated identity management allows external identity providers (e.g., social media) to be used, while the enterprise retains policy control through a federation server. Option A is wrong because it refers to non-repudiation. Option B is wrong because it describes SSO without federation. Option D is wrong because it describes credential management.

Answer

Privileged access management (PAM) solution

Answer

Single sign-on (SSO) using a corporate LDAP directory

Answer

Public Key Infrastructure (PKI) with digital signatures

Question 3

During a merger, two companies need to integrate their networks securely. Company A uses RFC 1918 addresses (10.0.0.0/8) and Company B also uses 10.0.0.0/8. Which architectural solution prevents routing conflicts and maintains security?

Accepted Answer

Deploy network address translation (NAT) on the border routers to translate one company's addresses to a unique range. NAT at the boundary translates overlapping addresses, allowing communication without conflict. Option A is wrong because it disrupts routing. Option B is wrong without NAT, traffic may not route correctly. Option D is wrong as it does not address IP overlap.

Answer

Configure a site-to-site VPN with no address translation

Answer

Enable direct BGP peering between the two networks

Answer

Implement a firewall between the networks and allow all traffic

Question 4

A company wants to protect its intellectual property stored on a file server. The security architect proposes implementing rights management services (RMS) integrated with Active Directory. Which attack is this architecture primarily designed to mitigate?

Accepted Answer

Unauthorized distribution of sensitive documents outside the organization. RMS encrypts documents and controls access even if the file is copied or emailed externally, mitigating data exfiltration. Option A is wrong because RMS does not prevent client-side attacks. Option B is wrong because phishing is a social engineering attack. Option D is wrong because RMS does not prevent server-side exploits if the attacker gains server access.

Answer

Phishing attacks targeting user credentials

Answer

Malware infection on the file server

Answer

Buffer overflow attack on the file server

Question 5

A security architect is designing a secure enclave for processing classified data. Which TWO of the following controls are essential for ensuring data confidentiality in such an enclave? (Select TWO.)

Accepted Answer

Data diodes for one-way data transfer from the enclave to external networks. Full-disk encryption protects data at rest if a device is lost; data diodes ensure one-way data flow, preventing exfiltration. Option B is misleading because air gaps are common but not a 'control' per se; the question asks for controls. Option D is not essential as SCAP is for compliance assessment. Option E is about availability, not confidentiality.

Answer

Physical air gap between the enclave and other networks

Answer

Security Content Automation Protocol (SCAP) vulnerability scanning

Answer

Redundant power supplies and cooling

Question 6

When evaluating the security architecture of a containerized application, which THREE of the following practices should be implemented to minimize the attack surface? (Select THREE.)

Accepted Answer

Use minimal base images (e.g., Alpine Linux) instead of full OS images. Using minimal base images reduces vulnerabilities; read-only file system prevents malware persistence; dropping unnecessary capabilities limits kernel attack surface. Option B is not about attack surface reduction; it's about data protection. Option C is about authentication, not attack surface.

Answer

Encrypt sensitive data at rest within the container

Answer

Implement multi-factor authentication for container registries

Question 7

A company is implementing a software-defined perimeter (SDP) architecture. Which TWO of the following are key characteristics of SDP? (Select TWO.)

Accepted Answer

The infrastructure is invisible to unauthorized users. SDP hides infrastructure from unauthorized users and enforces device authentication before granting access. Option A is wrong because SDP does not inherently use public keys; it can use various authentication methods. Option D is wrong because SDP uses a controller, not peering. Option E is wrong because SDP is not based on VLANs.

Answer

Network segmentation is implemented via VLANs

Answer

Peering between SDP components is done via BGP

Answer

All communications are encrypted using public key cryptography

Question 8

An organization has recently migrated its on-premises data center to a public cloud. The security team notices that several virtual machines (VMs) in the same subnet are communicating with each other without any restrictions. The company policy requires that only specific application traffic (e.g., database queries from web servers) be allowed between VMs, and all other inter-VM traffic must be blocked to comply with a zero-trust model. The cloud provider offers native security group and network ACL features. The architect must design a solution that enforces the policy with minimal administrative overhead and supports future expansion.

Which of the following is the BEST course of action?

Accepted Answer

Place all VMs in the same subnet and configure security groups that only allow necessary inter-VM traffic (e.g., web-to-db), with a default deny rule. Using security groups (instance-level firewalls) allows per-VM permit rules and denies by default, meeting zero-trust requirements. Option B is wrong because network ACLs are stateless and require rules for both directions, increasing complexity. Option C is wrong because moving to different VPCs breaks application connectivity unnecessarily. Option D is wrong because a third-party firewall is an additional cost and complexity without clear benefit over native security groups.

Answer

Move each application tier to a separate VPC and use VPC peering with strict routing policies

Answer

Place all VMs in the same subnet and configure network ACLs with explicit allow rules for required traffic and a deny-all rule for other traffic

Answer

Keep all VMs in the same subnet but deploy a third-party next-generation firewall as a virtual appliance to inspect and filter inter-VM traffic

Question 9

A multinational corporation is deploying a new application that will be accessed by employees, partners, and customers. The security architecture must support single sign-on (SSO) across different identity providers (IdPs) while maintaining strict access control based on user attributes such as role, location, and device posture. The company uses Active Directory for employees, a cloud IdP for partners, and self-registration for customers. The architect needs to design a centralized policy enforcement point that can evaluate access requests from multiple IdPs and enforce dynamic access policies before granting access to the application.

Which of the following is the BEST architectural approach?

Accepted Answer

Implement an externalized authorization management system (e.g., OAuth 2.0 with OpenID Connect) using a policy decision point (PDP) and a policy enforcement point (PEP) at the application gateway. A Policy Enforcement Point (PEP) integrated with a Policy Decision Point (PDP) can abstract authentication from authorization, allowing unified policy regardless of IdP. Option A is wrong because relying on each IdP for authorization leads to policy fragmentation. Option B is wrong because a SAML federation server handles authentication but not authorization. Option D is wrong because a proxy alone does not provide the policy decision capabilities.

Answer

Deploy a SAML/WS-Federation federation server that authenticates users and then passes the identity to the application for authorization

Answer

Have each IdP enforce its own access policies and pass the authorization decision via SAML assertions

Answer

Configure a reverse proxy to authenticate users from any IdP and pass their identity to the application

Question 10

A security architect is designing a network segmentation strategy for a data center to reduce the attack surface. Which TWO of the following are best practices for implementing effective network segmentation?

Accepted Answer

Use VLANs to logically isolate traffic between different security zones.. Option A (Use VLANs for isolation) is correct because VLANs provide logical separation at Layer 2. Option B (Implement microsegmentation with firewalls) is correct because microsegmentation uses granular firewall rules to isolate workloads. Option C is incorrect because a shared DMZ for all external services increases risk. Option D is incorrect because NAC focuses on device authentication, not segmentation. Option E is incorrect because any-to-any traffic defeats segmentation.

Answer

Deploy network access control (NAC) to authenticate devices before granting network access.

Answer

Place all external-facing services in a single shared DMZ segment.

Answer

Allow any-to-any communication within each security zone to avoid performance bottlenecks.

Question 11

A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?

Accepted Answer

Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.. Option B (Review microsegmentation firewall rules for the application's subnet) is the most direct step because the architect suspects the microsegmentation rules are blocking traffic. Option A (Deploy a VPN) would bypass zero-trust principles. Option C (Increase log verbosity) is a diagnostic step but not the first action. Option D (Reset user credentials) is unrelated to the issue.

Answer

Deploy a VPN to provide a secure tunnel for remote users.

Answer

Reset the affected users' credentials and force them to re-authenticate.

Answer

Increase logging verbosity on the identity-aware proxy to capture more details.

Question 12

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

Accepted Answer

Add a WAF rule to block common SQL injection payloads and signatures.. Option D (Implement parameterized queries in the application code) is the most effective long-term fix, but since the development team is slow, the best immediate control is to add a WAF rule to block SQL injection patterns. Option A (Disable the search feature) is too disruptive. Option B (Increase IDS sensitivity) would only detect, not prevent. Option C (Segment the database server) is good but does not address the vulnerability at the application layer.

Answer

Disable the search feature until the code is fixed.

Answer

Isolate the database server on a separate network segment with strict firewall rules.

Answer

Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.

Question 13

A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?

Accepted Answer

Use EDR to identify the process or service generating the outbound connections on the web server.. Option C (Check EDR telemetry on the host to identify the process making the outbound connections) is the best first step because it provides visibility into the exact source of the traffic. Option A (Block the outbound HTTPS rule immediately) may disrupt legitimate traffic and does not help identify the scope. Option B (Enable full SSL inspection on the firewall) is resource-intensive and can be deployed later. Option D (Isolate the host from the network) is a containment step but should follow identification to ensure proper forensic collection.

Answer

Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.

Answer

Isolate the web server from the network to prevent further data exfiltration.

Answer

Immediately remove the outbound HTTPS rule to block the traffic.

Question 14

A security architect is designing a zero-trust network architecture for a hybrid cloud environment. Which TWO principles should be implemented to enforce the "never trust, always verify" model?

Accepted Answer

Micro-segmentation between workloads. Micro-segmentation and continuous authentication are core zero-trust principles. Options A and D imply implicit trust based on network location, which violates zero-trust. Option E is a technology, not a principle.

Answer

Trust based on network location

Answer

Implicit trust for internal IP ranges

Answer

Use of a single VPN for all remote access

Question 15

Refer to the exhibit. A security analyst notices that users from the internet can reach the web server at 10.0.1.100 on port 443, but they cannot reach it on port 8443. What is the most likely cause?

Accepted Answer

The web server is not listening on port 8443. The firewall ACL permits both ports, so the firewall is not the issue. The most likely cause is that the web server is not listening on port 8443. Option A is incorrect because the ACL permits it. Option C is incorrect because the ACL order is fine. Option D is incorrect because the ACL permits any source.

Answer

The ACL only permits traffic from specific source IPs

Answer

The firewall rule order is incorrect

Answer

The firewall is blocking all traffic on port 8443