CAS-004 Security Engineering — 40 Questions

Question 1

A security architect is designing a VPN solution for remote employees. The company requires strong authentication and integrity protection but is less concerned about confidentiality for non-sensitive traffic. Which protocol is most appropriate?

Accepted Answer

ESP in tunnel mode with null encryption. Option C is correct because ESP in tunnel mode with null encryption provides authentication and integrity via HMAC (e.g., HMAC-SHA256) while omitting encryption (ESP_NULL, RFC 2410). This satisfies the requirement for strong authentication and integrity without confidentiality for non-sensitive traffic, as the payload is authenticated but not encrypted.

Answer

L2TP/IPsec with ESP

Answer

SSL/TLS VPN

Answer

AH in transport mode

Question 2

A security engineer is troubleshooting a web application that uses OAuth 2.0 for authorization. Users report that after authenticating, they are unable to access resources that require a specific scope. The engineer inspects the authorization request and finds that the scope parameter is missing. Which OAuth flow is most likely being used?

Accepted Answer

Implicit grant. The implicit grant flow in OAuth 2.0 does not require the client to include the scope parameter in the authorization request; the access token is returned directly in the URL fragment without a separate token endpoint call. When the scope parameter is missing, the authorization server may issue a token with a default or limited scope, causing users to be unable to access resources that require a specific scope. This matches the described symptom, making the implicit grant the most likely flow in use.

Answer

Client credentials grant

Answer

Authorization code grant

Answer

Resource owner password credentials grant

Question 3

An organization wants to implement a hardware security module (HSM) to protect cryptographic keys. Which of the following is a primary benefit of using an HSM?

Accepted Answer

Tamper-resistant key storage. An HSM provides tamper-resistant key storage by using physical and logical safeguards, such as tamper switches, epoxy potting, and zeroization circuits, that destroy cryptographic keys if an attacker attempts to access the hardware. This ensures that private keys remain secure even if the device is compromised, which is a primary requirement for compliance with standards like FIPS 140-2 Level 3 or 4. Software-based storage cannot offer the same level of physical protection against extraction attacks.

Answer

Faster key generation than software

Answer

Reduced network latency for encryption

Answer

Automatic cloud backup of keys

Question 4

A network administrator is configuring a firewall to block traffic from a specific IP address range. The firewall uses ACLs. Which ACL entry would deny traffic from 192.168.1.0/24?

Accepted Answer

deny ip 192.168.1.0 0.0.0.255 any. Option A is correct because in Cisco ACL syntax, the wildcard mask 0.0.0.255 matches all addresses in the 192.168.1.0/24 network. The 'deny ip 192.168.1.0 0.0.0.255 any' entry blocks any IP traffic from the source subnet 192.168.1.0 through 192.168.1.255 to any destination.

Answer

deny ip 192.168.1.0 0.0.0.0 any

Answer

deny ip 192.168.1.0 0.0.0.127 any

Answer

deny ip 192.168.1.0 255.255.255.0 any

Question 5

A company is migrating to a zero trust architecture. Which of the following is a key principle of zero trust?

Accepted Answer

Assume breach and verify every request. Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

Answer

Allow all traffic within the corporate network

Answer

Trust devices based on their IP address

Answer

Trust but verify for all internal traffic

Question 6

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Accepted Answer

OAuth 2.0 tokens. OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

Answer

LDAP binds

Answer

SAML assertions

Answer

Kerberos tickets

Question 7

Which THREE of the following are common vulnerabilities in IoT devices? (Select THREE.)

Accepted Answer

Hardcoded credentials. Hardcoded credentials (Option B) are a common IoT vulnerability because manufacturers often embed default usernames and passwords (e.g., 'admin/admin') into device firmware for ease of deployment. Attackers can exploit these static credentials via SSH, Telnet, or web interfaces to gain unauthorized access, as seen in Mirai botnet attacks. This violates the principle of least privilege and secure credential management.

Answer

Large storage capacity

Answer

High compute power

Question 8

A security analyst is reviewing an AppArmor profile for an application. Based on the exhibit, which action would the application be denied?

Accepted Answer

Write to a file in /etc/config/. AppArmor profiles restrict applications by path and capability. The profile shown does not include any rule allowing write access to /etc/config/, so any write attempt to that directory or its files would be denied. This is because AppArmor enforces mandatory access control based on the profile's explicit allow rules.

Answer

Send a UDP packet to a remote server

Answer

Override discretionary access controls

Answer

Write to /var/log/app.log

Question 9

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Accepted Answer

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.. Option C is correct because the iptables rules show a default FORWARD policy of ACCEPT, but the INPUT chain has a default policy of DROP. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that only return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the FORWARD chain's default policy.

Answer

New connections from the internet to 10.0.1.0/24 are allowed.

Answer

All traffic is allowed by default because the policy is ACCEPT.

Answer

The rules apply to incoming traffic on the firewall itself.

Question 10

A company is designing a new data center with high availability requirements. The network team proposes using virtualized network functions (VNFs) on commodity hardware to reduce costs. Which security consideration is MOST important when implementing this design?

Accepted Answer

Isolate VNFs to prevent lateral movement if one VNF is compromised. Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Answer

Ensure VNFs are deployed across multiple physical hosts for redundancy

Answer

Encrypt all traffic between VNFs to prevent eavesdropping

Answer

Implement quality of service (QoS) to guarantee bandwidth for critical VNFs

Question 11

A security engineer is hardening a Linux web server. The team requires that the web server process cannot run with root privileges and that any file it writes must have minimal permissions. Which two controls should be implemented together? (Select TWO).

Accepted Answer

Run the web server process under a dedicated non-privileged user account. Running the web server process under a dedicated non-privileged user account (Option A) ensures that even if the process is compromised, the attacker does not gain root privileges. This is a fundamental principle of least privilege, typically implemented by creating a system user (e.g., 'www-data' or 'httpd') with no login shell and assigning ownership of web directories to that user.

Answer

Place the web server in a chroot jail

Answer

Enable SELinux in enforcing mode with a targeted policy for the web server

Answer

Use file capability bounding sets to limit the web server's capabilities

Question 12

An organization wants to implement a solution that ensures data cannot be read if a storage device is physically stolen. Which encryption approach BEST meets this requirement?

Accepted Answer

Full disk encryption (FDE) on the storage device. Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Answer

Transport Layer Security (TLS) for network traffic

Answer

File-level encryption on sensitive documents

Answer

Database column-level encryption for stored data

Question 13

A network administrator is configuring a firewall rule set. The requirement is to allow inbound HTTPS traffic from the internet to a web server at 10.1.1.10, and to allow the web server to respond. All other inbound traffic should be blocked. Which rule set accomplishes this?

Accepted Answer

Allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound. Option B is correct because HTTPS uses TCP port 443, and the rule set correctly allows inbound TCP 443 to the web server at 10.1.1.10, permits the server's outbound responses (stateful or explicit), and then denies all other inbound traffic. This matches the requirement to allow only HTTPS traffic from the internet while blocking everything else.

Answer

Allow inbound TCP 80 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Answer

Deny all inbound; allow inbound TCP 443 to 10.1.1.10; allow outbound TCP from 10.1.1.10

Answer

Allow inbound TCP 22 to 10.1.1.10; allow outbound TCP from 10.1.1.10; deny all inbound

Question 14

A security analyst reviews logs from a web application firewall (WAF) and notices that an attacker is bypassing the WAF by encoding malicious payloads using base64 and then sending them in HTTP headers. Which WAF configuration change would BEST detect and block such attacks?

Accepted Answer

Add custom signatures to detect base64-encoded patterns in headers. Option C is correct because base64-encoded payloads in HTTP headers are a known evasion technique that bypasses signature-based WAF rules designed for plaintext attacks. By adding custom signatures that specifically match base64-encoded patterns (e.g., detecting long strings of base64 characters or known malicious base64 strings), the WAF can decode and inspect the payload before applying detection logic. This directly addresses the attacker's encoding method without relying on generic protocol or rate controls.

Answer

Enable geoblocking to restrict traffic from the attacker's country

Answer

Implement strict HTTP protocol validation to reject malformed requests

Answer

Increase the rate limiting threshold to allow more requests per second

Question 15

Which TWO of the following are considered secure design principles for cryptographic systems?

Accepted Answer

Use well-vetted, standard cryptographic algorithms. Option C is correct because using well-vetted, standard cryptographic algorithms (e.g., AES, RSA, ECDSA) ensures the system benefits from years of public scrutiny, rigorous cryptanalysis, and proven security properties. Proprietary or custom algorithms often contain undiscovered vulnerabilities, making them unsuitable for secure systems.

Answer

Implement custom encryption algorithms designed in-house

Answer

Use the same key for encryption and authentication to reduce complexity

Answer

Rely on secrecy of the algorithm for security

Question 16

Which THREE of the following are common techniques to mitigate side-channel attacks?

Accepted Answer

Implement constant-time algorithms for cryptographic operations. Option B is correct because constant-time algorithms ensure that the execution time of cryptographic operations does not depend on secret data, such as keys. By avoiding conditional branches or variable-time instructions (e.g., multiplication or memory accesses) that vary with input, these algorithms prevent attackers from inferring secrets through timing measurements. This is a fundamental mitigation against timing side-channel attacks, as specified in standards like FIPS 140-3 and NIST SP 800-56B.

Answer

Disable CPU caching to prevent cache timing attacks

Answer

Use random delays in code execution paths

Question 17

An administrator runs the above iptables command on a Linux server. The server is directly connected to the internet. Which of the following is the MOST significant security issue with this configuration?

Accepted Answer

The OUTPUT chain default policy is ACCEPT, allowing any outbound traffic. The most significant security issue is that the OUTPUT chain default policy is ACCEPT, allowing any outbound traffic from the server. Since the server is directly connected to the internet, this means that if the server is compromised, an attacker can freely exfiltrate data, initiate outbound connections to command-and-control servers, or perform other malicious activities without any firewall restriction. A default DROP policy on the OUTPUT chain would require explicit rules for allowed outbound traffic, providing defense in depth.

Answer

The INPUT chain default policy is DROP, which will block legitimate traffic

Answer

SSH (port 22) is allowed from any source, which is overly permissive

Answer

ICMP echo requests are allowed, which could be used for network reconnaissance

Question 18

A security engineer is reviewing an S3 bucket policy for a bucket named 'corporate-data'. The policy is shown. Which of the following describes a vulnerability in this configuration?

Accepted Answer

The Allow statement's IP address condition uses a private IP range, which is ineffective for internet-facing buckets. Option C is correct because the Allow statement in the S3 bucket policy restricts access to a private IP address range (e.g., 10.0.0.0/8 or 192.168.0.0/16), which is non-routable on the public internet. Since the bucket is internet-facing, this condition is ineffective—any request from a public IP will fail the condition, effectively denying all external access, but the real vulnerability is that the policy relies on a private IP range that cannot be enforced for internet traffic, leaving the bucket either inaccessible or misconfigured. This misconfiguration can lead to unintended access if the condition is bypassed or if the bucket is intended to be public.

Answer

The Deny statement allows anonymous uploads over HTTP

Answer

The Deny statement allows any anonymous user to upload objects to the bucket

Answer

The Allow statement permits access over insecure HTTP

Question 19

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

Accepted Answer

Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.. Option C is correct because a Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Answer

Store the private keys in an encrypted database on a separate database server.

Answer

Use a software-based key vault that runs on the same operating system as the web server.

Answer

Store the private keys in a local file with restricted permissions on the application server.

Question 20

A security engineer needs to implement a solution that will detect and block command-and-control (C2) traffic from malware on the internal network. The solution must be able to inspect encrypted traffic and operate at the network layer. Which of the following is the BEST choice?

Accepted Answer

Deploy a next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering.. A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

Answer

Implement a web application firewall (WAF) to filter outbound HTTP/HTTPS traffic.

Answer

Install a network-based intrusion detection/prevention system (IDS/IPS) with signature updates.

Answer

Use endpoint detection and response (EDR) agents on all workstations and servers.