CAS-004 Security Engineering Practice Test 4 — 15 Questions

Question 1

The engineer needs to prevent brute-force attacks while allowing legitimate access. Which security control is MOST effective?

Accepted Answer

Implement fail2ban with a threshold of 5 attempts per minute. Fail2ban dynamically blocks IP addresses after a configurable number of failed attempts, stopping brute-force while allowing legitimate users (e.g., 10.0.0.50) to connect. Disabling root login only prevents root access but not attacks on other users. Changing the SSH port is security by obscurity. IP whitelisting for 10.0.0.0/8 would block all other legitimate users and is not flexible.

Answer

Disable root login

Answer

Change SSH port to 2222

Answer

Implement IP whitelist for 10.0.0.0/8

Question 2

A security analyst reviews this configuration and identifies a vulnerability. What is the MOST critical issue?

Accepted Answer

The redirect URI uses HTTP. The redirect URI uses HTTP (plaintext), which could allow an attacker to intercept the authorization code returned by the OAuth provider. Hardcoded secrets are a problem but can be mitigated with secrets management. The grant type and token endpoint are correct.

Answer

The grant type is authorization_code

Answer

The client secret is hardcoded

Answer

The token endpoint uses HTTPS

Question 3

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX provides hardware-based memory encryption that isolates code and data in enclaves, protecting data in use from other processes. TPM is for attestation and key storage, HSM for dedicated cryptographic operations, and Secure Boot for boot integrity.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 4

A company has implemented a hardware security module (HSM) to manage cryptographic keys for a payment processing system. Which of the following best describes an advantage of using an HSM over software-based key storage?

Accepted Answer

Tamper-resistant key storage. HSMs are tamper-resistant devices that protect keys from physical and logical attacks, offering a higher level of security than software-based storage. While HSMs can be costly and may have slower key generation, their primary advantage is physical security.

Answer

Easier key rotation

Answer

Faster cryptographic operations

Answer

Lower implementation cost

Question 5

During a security assessment, a penetration tester discovers that a web application uses a custom encryption algorithm to protect session tokens. According to secure engineering principles, what is the primary concern?

Accepted Answer

Lack of peer review and cryptanalysis. Custom cryptographic algorithms often lack peer review and may contain subtle flaws that compromise security. The primary concern is the absence of public cryptanalysis, not performance, key length (assuming sufficient), or browser compatibility.

Answer

Performance overhead of the custom algorithm

Answer

Insufficient key length used in the algorithm

Answer

Incompatibility with modern browsers

Question 6

An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?

Accepted Answer

FIPS 140-2. FIPS 140-2 (or its successor 140-3) is the U.S. government standard for validating cryptographic modules. NIST SP 800-53 is for security controls, PCI DSS for payment card data, and ISO 27001 for management systems.

Answer

ISO 27001

Answer

PCI DSS

Answer

NIST SP 800-53

Question 7

A security engineer is designing a secure boot process for embedded devices. Which component is responsible for verifying the signature of the bootloader before execution?

Accepted Answer

Root of trust (RoT). The root of trust (RoT), typically implemented as a small section of immutable code in ROM or a dedicated microcontroller, checks the bootloader's signature using a public key stored in fuses. The TPM can store measurements but is not the verifier. UEFI is a firmware interface, and Secure Boot is the process itself.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

UEFI firmware

Question 8

An organization wants to implement a zero-trust architecture for remote access. Which component is most critical for enforcing least-privilege access to internal applications?

Accepted Answer

Software-defined perimeter (SDP). A software-defined perimeter (SDP) uses a controller to authenticate users and devices before granting access to specific applications, hiding the network from unauthorized users. VPNs extend network access, IDS only detects, and firewalls enforce network-level rules but not user/device granularity.

Answer

Virtual private network (VPN) concentrator

Answer

Next-generation firewall (NGFW)

Answer

Intrusion detection system (IDS)

Question 9

A company wants to ensure that only authorized code runs on its point-of-sale (POS) terminals. Which technology should be implemented?

Accepted Answer

Code signing. Code signing ensures that executables are digitally signed by a trusted publisher, and the system verifies the signature before execution. TPM is for attestation, application whitelisting is a policy, and secure boot focuses on boot-time integrity.

Answer

Application whitelisting

Answer

Trusted Platform Module (TPM)

Answer

Secure Boot

Question 10

A security engineer is deploying a wireless network for a high-security facility. Which protocol should be used to provide the strongest authentication and encryption for client devices?

Accepted Answer

WPA3-Enterprise with 802.1X. WPA3-Enterprise with 802.1X provides per-user authentication using EAP and the strongest encryption (GCMP-256). WPA2-PSK uses a shared passphrase, WPA3-Personal also uses SAE but for personal use, and WEP is obsolete.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with AES

Answer

WPA3-Personal with SAE

Question 11

During a security incident, a forensic analyst needs to acquire a memory dump from a Linux server without altering the system state. Which tool is most appropriate for this task?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is designed to acquire memory dumps with minimal impact, loading as a kernel module and exporting memory to a file or network. dd is for disk, memdump is limited, and Volatility is for analysis, not acquisition.

Answer

Volatility framework

Answer

dd if=/dev/mem of=mem.dump

Answer

memdump utility

Question 12

A security engineer is evaluating options for securing firmware updates on IoT devices. Which TWO methods provide integrity verification of the update?

Accepted Answer

Hash-based message authentication code (HMAC). Correct: Digital signature verification and HMAC. Digital signatures use asymmetric cryptography to ensure authenticity and integrity. HMAC uses a shared secret to verify integrity. AES encryption alone does not provide integrity, obfuscation is not security, and secure boot is about boot-time integrity, not update verification.

Answer

Obfuscation of the firmware code

Answer

AES encryption of the firmware

Answer

Secure Boot

Question 13

Which THREE of the following are key components of a zero-trust security architecture? (Select THREE).

Accepted Answer

Micro-segmentation. Zero trust requires micro-segmentation to limit lateral movement, continuous monitoring to verify every session, and least privilege access to enforce minimal permissions. VPN is a perimeter technology, and implicit trust violates zero trust principles.

Answer

VPN concentrator

Answer

Implicit trust for internal network traffic

Question 14

A cloud security architect is designing a key management system for a multi-tenant SaaS application. Which TWO practices are essential for ensuring cryptographic key security? (Select TWO).

Accepted Answer

Separate key management from data storage. Key rotation limits exposure if a key is compromised, and separating key management from data storage reduces attack surface. Storing keys in plaintext is insecure, using a single master key increases risk, and auditing is a detective control but not as fundamental as the other two.

Answer

Store keys in plaintext configuration files for easy retrieval

Answer

Use a single master key for all customers

Answer

Audit all key access events

Question 15

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

Accepted Answer

The certificate uses the SHA-1 hash algorithm. The certificate uses SHA-1 as the signature algorithm, which is cryptographically weak and deprecated by major browsers and industry standards. Self-signed would show issuer == subject, key length 2048 is acceptable, and one-year validity is normal.

Answer

The RSA key length is 2048 bits

Answer

The certificate is self-signed

Answer

The validity period is only one year

CAS-004 Security Engineering Practice Test 4 — 15 Questions

Exhibit

CAS-004 Security Engineering Practice Test 4 — 15 Questions

Exhibit