CAS-004 Security Engineering Practice Test 3 — 15 Questions

Question 1

Match each command-line tool to its primary function.

Question 2

Match each cloud service model to its scope.

Question 3

A security engineer needs to implement a solution that provides both confidentiality and integrity for data at rest. Which cryptographic method BEST meets these requirements?

Accepted Answer

AES-256-GCM. AES-256-GCM is an authenticated encryption mode that provides both confidentiality (encryption) and integrity (authentication) in a single algorithm. RSA-2048 is asymmetric and does not provide data integrity directly. SHA-256 is a hash function only. Diffie-Hellman is a key exchange protocol.

Answer

SHA-256

Answer

Diffie-Hellman

Answer

RSA-2048

Question 4

A company is deploying IoT sensors in a remote area with limited connectivity. The sensors must be able to securely transmit data using minimal bandwidth. Which protocol should the engineer choose?

Accepted Answer

MQTT with TLS. MQTT with TLS is a lightweight publish-subscribe protocol that uses minimal bandwidth and provides security through TLS. HTTPS has higher overhead. SSH is not designed for many-to-one telemetry. SNMPv3 is for network management, not general IoT data.

Answer

SNMPv3

Answer

HTTPS

Answer

SSH

Question 5

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

Accepted Answer

The key length is insufficient against modern attacks. 1024-bit RSA keys are considered weak because they can be factored with moderate computational resources, allowing an attacker to forge firmware updates. While the signature algorithm (RSA) is not obsolete, the key length is insufficient. Firmware encryption is not required for integrity; signing key rotation is secondary.

Answer

The firmware is not encrypted

Answer

The signature algorithm is obsolete

Answer

The signing key is not rotated

Question 6

An organization wants to implement a zero-trust architecture for remote access. Which of the following is the MOST important component?

Accepted Answer

Micro-segmentation. Micro-segmentation is fundamental to zero-trust because it restricts lateral movement by dividing the network into small, isolated segments. VPN concentrators are traditional perimeter controls. RAID 5 is storage redundancy. Syslog is logging.

Answer

RAID 5

Answer

Syslog server

Answer

VPN concentrator

Question 7

A financial institution needs to ensure that transaction logs are tamper-proof after creation. Which solution should be implemented?

Accepted Answer

Cryptographic hashing with chain hashing. Cryptographic chained hashing (e.g., blockchain) links each log entry to the previous one via a hash, making tampering detectable. Encryption does not protect integrity. ACLs can be bypassed. Digital signatures are effective but more complex to manage for every entry.

Answer

Access control lists

Answer

Encryption with AES

Answer

Digital signatures on each log entry

Question 8

A cloud security architect is designing a multi-region active-active application. The application must maintain high availability even if an entire AWS region fails. Which architecture BEST meets this requirement?

Accepted Answer

Deploy identical stacks in two regions with Route 53 weighted routing and DynamoDB global tables. Active-active across two regions with Route 53 weighted routing and DynamoDB global tables provides automatic failover and data replication without human intervention. Single-region setups cannot survive a region outage. Active-passive requires manual failover.

Answer

Active-active in one region with auto scaling

Answer

Single region with multiple AZs and RDS Multi-AZ

Answer

Two regions with active-passive failover using Route 53 health checks

Question 9

A small business wants to protect endpoints from malware without incurring per-device licensing costs. Which approach is MOST cost-effective?

Accepted Answer

Use built-in Windows Defender and periodically scan with free tools. Built-in Windows Defender is free and adequate for basic protection. Periodically scanning with free tools (e.g., Microsoft Safety Scanner) enhances security at no cost. Enterprise EDR, network IPS, and host firewalls (some free) but enterprise products incur costs.

Answer

Implement network-based IPS

Answer

Use open-source host firewall

Answer

Purchase enterprise EDR suite

Question 10

During a penetration test, an engineer discovers that the application uses client-side JavaScript to validate input before submission. What is the MOST significant vulnerability?

Accepted Answer

Server-side validation is missing. Client-side validation can be easily bypassed by disabling JavaScript or sending crafted HTTP requests. Without server-side validation, attackers can submit malicious payloads, leading to injection attacks. XSS and IDOR are separate issues; weak session management is unrelated to input validation.

Answer

Cross-site scripting

Answer

Insecure direct object reference

Answer

Weak session management

Question 11

An organization is migrating to a hybrid cloud model. The security policy mandates that all keys used for data encryption must be managed on-premises. Which key management solution should be used?

Accepted Answer

HSM on-premises with key escrow. An on-premises Hardware Security Module (HSM) ensures keys never leave the local environment. BYOK still involves key material being processed in the cloud. Cloud HSM is managed by the provider. Software key stores lack physical security.

Answer

Cloud KMS with BYOK

Answer

Software-based key store on-premises

Answer

Cloud HSM

Question 12

A security engineer is designing a secure wireless network for a corporate office. Which TWO configurations should be implemented to maximize security?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise provides the strongest encryption and authentication. 802.1X with EAP-TLS allows certificate-based authentication, further enhancing security. WPA2-PSK is vulnerable to brute force attacks. Disabling SSID broadcast and MAC filtering are security-through-obscurity measures and do not provide real protection.

Answer

WPA2-PSK

Answer

MAC address filtering

Answer

Disable SSID broadcast

Question 13

An incident responder is analyzing a compromised server. Which THREE indicators are MOST likely to confirm a successful attack?

Accepted Answer

Corrupted system files. New unauthorized accounts indicate adversary persistence. Unusual outbound connections suggest command-and-control or data exfiltration. Corrupted system files are a sign of malware or unauthorized changes. High CPU usage can be from legitimate loads, and failed logins are not proof of success.

Answer

Multiple failed login attempts

Answer

High CPU usage due to legitimate processes

Question 14

A security team is implementing controls to meet PCI DSS requirements for cardholder data. Which THREE controls are required?

Accepted Answer

Encrypt cardholder data at rest. PCI DSS requires encryption of cardholder data at rest (Requirement 3.4), unique user IDs (Requirement 8.1.1), and quarterly vulnerability scans (Requirement 11.2). Regular antivirus updates (Requirement 5) are also required but many organizations also use MFA for remote access (Requirement 8.3); however, the three listed are undeniably mandatory per the current version.

Answer

Regularly update antivirus software

Answer

Perform quarterly vulnerability scans

Question 15

The security engineer notices that SSH login attempts to 192.168.1.1 from the untrust zone are being blocked. Which policy misconfiguration is MOST likely causing this?

Accepted Answer

The source zone is not permitted. The Remote-Admin policy only permits traffic from the vpn zone, not untrust. Therefore, SSH attempts from untrust are implicitly denied by the firewall's default deny policy. The destination address and application are correctly specified. The log setting does not affect access. A policy for SSH from untrust is missing.

Answer

The application is incorrect

Answer

The log setting prevents connections

Answer

The destination address is incorrect