CAS-004 Security Engineering Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A security analyst is reviewing the firewall rule set for a corporate network. Which misconfiguration is present?

Accepted Answer

No default deny rule present. The rule set lacks an explicit deny rule at the end. Without a default deny, traffic that does not match any rule may be implicitly permitted depending on the firewall platform. Most security best practices require a deny-all trailing rule to ensure only explicitly allowed traffic passes.

Answer

Overly permissive source IP addresses

Answer

Unnecessary allowed ports

Answer

Missing logging on permit rules

Question 2

Refer to the exhibit. A cloud security engineer is reviewing an AWS S3 bucket policy. What security issue does the policy contain?

Accepted Answer

Public read access is allowed. The policy allows any principal ('*') to perform s3:GetObject on the bucket, making the bucket publicly readable. This exposes objects to anyone on the internet. No encryption, logging, or versioning issues are indicated by this JSON snippet.

Answer

No server-side encryption is specified

Answer

No version ID is specified in the resource

Answer

No logging is enabled for the bucket

Question 3

A security architect is designing a secure enclave for a high-value application. Which of the following is the BEST approach to isolate the application from the rest of the network?

Accepted Answer

Deploy the application in a DMZ behind a stateful firewall with least-privilege rules.. Option B is correct because an enclave uses a DMZ with strict firewall rules to isolate the application. Option A is wrong because VLANs alone do not provide the same level of isolation; they can be misconfigured or bypassed. Option C is wrong because jump boxes are for administrative access, not isolation. Option D is wrong because IDS/IPS is detection, not isolation.

Answer

Install an intrusion detection system (IDS) on the application subnet.

Answer

Configure a jump box with two-factor authentication to access the application.

Answer

Place the application on a separate VLAN with an ACL.

Question 4

A security engineer must select a cryptographic algorithm to ensure non-repudiation for digitally signed documents. Which algorithm is most appropriate?

Accepted Answer

RSA with SHA-256. Option D is correct because RSA with SHA-256 provides asymmetric encryption and hashing for digital signatures, ensuring non-repudiation. Option A is wrong because AES is symmetric and does not provide non-repudiation. Option B is wrong because HMAC is symmetric and does not provide non-repudiation. Option C is wrong because ECDH is a key exchange algorithm, not a signature algorithm.

Answer

HMAC-SHA256

Answer

AES-256 in GCM mode

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Question 5

A company deploys a web application behind a WAF. The security team discovers that the WAF allows traffic from a known malicious IP. After investigating, they find the WAF is configured to allow all traffic from a specific country for business reasons. Which of the following is the BEST course of action?

Accepted Answer

Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.. Option C is correct because creating a geo-IP exception list for the malicious IP within the allowed country maintains business requirements while blocking the threat. Option A is wrong because removing the entire country block may disrupt business and is too broad. Option B is wrong because an IPS is a different control; adjusting WAF rules is more direct. Option D is wrong because changing the WAF to block mode may cause false positives and is a drastic change.

Answer

Deploy an additional IPS device to block the IP.

Answer

Remove the country-based allow rule immediately.

Answer

Change the WAF from detection mode to blocking mode.

Question 6

A security engineer is implementing a solution to securely store and manage cryptographic keys for a fleet of IoT devices. The devices have limited processing power and cannot perform asymmetric operations. Which of the following is the BEST approach?

Accepted Answer

Use a cloud-based Hardware Security Module (HSM) to generate and store keys, and provision them to devices during manufacturing.. Option A is correct because a cloud HSM offers secure key management and offloads cryptographic operations, suitable for simple symmetric operations on IoTs. Option B is wrong because TPM is typically used for device identity and limited storage, not scalable for fleet management. Option C is wrong because storing keys in firmware is insecure; they can be extracted. Option D is wrong because key wrapping via KMS still requires the IoT to store keys, which is insecure.

Answer

Install a Trusted Platform Module (TPM) in each device to store keys on the device.

Answer

Use a cloud KMS to generate and wrap keys, then store the wrapped key in the device.

Answer

Store keys in obfuscated form in the device firmware and use a custom algorithm for encryption.

Question 7

A security architect is designing a zero-trust network architecture. Which of the following is a fundamental principle of zero trust?

Accepted Answer

Authenticate and authorize every device and user for every resource access, and encrypt all communication.. Option B is correct because zero trust requires all resources to be accessed securely regardless of location, and all communication should be encrypted. Option A is wrong because zero trust does not rely on network perimeter; it assumes no implicit trust. Option C is wrong because VPNs are a perimeter technology; zero trust uses micro-segmentation. Option D is wrong because VLANs are not a primary zero-trust control; they are network segmentation.

Answer

Place all resources on the internal network and rely on perimeter firewalls.

Answer

Implement VLANs to separate traffic based on user roles.

Answer

Use a VPN to secure all remote access to the corporate network.

Question 8

A company's security team is reviewing the integration of a legacy application that only supports NTLM authentication. The infrastructure must be updated to meet modern security standards. Which of the following is the BEST approach to mitigate the risk of using NTLM?

Accepted Answer

Deploy an authentication federation service that translates modern Kerberos/SAML to NTLM for the legacy application.. Option D is correct because extending the application's authentication to support Kerberos or modern SSO via a federation service like ADFS or SAML proxy allows the legacy app to use modern authentication without modifying the app. Option A is wrong because network isolation does not address the weakness of NTLM in the authentication protocol. Option B is wrong because disabling NTLM would break the application. Option C is wrong because applying patches may not be possible if the application is no longer supported, and NTLMv2 is still vulnerable.

Answer

Place the application on an isolated network segment and restrict access with IP whitelisting.

Answer

Apply vendor patches to upgrade NTLM to NTLMv2 and enable extended protection for authentication.

Answer

Disable NTLM and force the application to use Kerberos directly.

Question 9

During a security assessment, a penetration tester discovers that a web application's session tokens are predictable. The application uses a custom session management system. Which of the following is the MOST effective remediation to ensure secure session tokens?

Accepted Answer

Generate session tokens using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy.. Option C is correct because using a cryptographically secure random number generator (CSPRNG) ensures unpredictability. Option A is wrong because a short timeout does not address the predictability issue; tokens must be random. Option B is wrong because HMAC of a timestamp offers some unpredictability but is not as robust as a CSPRNG; if the key is known, tokens can be predicted. Option D is wrong because regenerating on each request is inefficient and does not fix root cause.

Answer

Regenerate the session token on each page request.

Answer

Implement a short session timeout of 5 minutes.

Answer

Generate tokens using HMAC-SHA256 of a timestamp and a secret key.

Question 10

A security engineer is tasked with designing a cryptographic solution to protect data at rest in a multi-tenant cloud storage system. Each tenant's data must be encrypted with a unique key, and the system must support key rotation with minimal performance impact. Which of the following is the BEST approach?

Accepted Answer

Implement envelope encryption: generate a unique data encryption key (DEK) per tenant, encrypt each DEK with a key encryption key (KEK) stored in an HSM, and store the wrapped DEK alongside the data.. Option D is correct because envelope encryption with a unique data key per tenant allows independent rotation and minimizes performance impact by only wrapping new data keys. Option A is wrong because storing keys in the same database violates separation. Option B is wrong because a single master key for all tenants violates isolation; if compromised, all data is at risk. Option C is wrong because a monthly rotation of a single master key does not provide per-tenant isolation; also key synchronization can be complex.

Answer

Generate a unique key per tenant and encrypt each key with a master key, then store both in the same database column.

Answer

Use a single master key for all tenants and store the key in a hardware security module (HSM) with access controls.

Answer

Implement a periodic key rotation schedule that rotates all tenant keys every month manually.

Question 11

Which of the following is the primary purpose of implementing a public key infrastructure (PKI)?

Accepted Answer

To bind public keys to identities through certificates for authentication and encryption.. Option A is correct because PKI provides certificate-based trust to enable authentication and encryption. Option B is wrong because VPNs use PKI but that's not the primary purpose. Option C is wrong because PKI can help with code signing but it's a subset. Option D is wrong because password hashing is separate from PKI.

Answer

To store and verify password hashes for user authentication.

Answer

To sign software and files to verify integrity and origin.

Answer

To provide a secure method for remote access via VPN.

Question 12

Which TWO of the following are advantages of using a hardware security module (HSM) over a software-based cryptographic module? (Select exactly 2.)

Accepted Answer

Physical tamper resistance and protection against key extraction.. Options B and D are correct. HSM provides tamper resistance and dedicated hardware acceleration. Option A is wrong because HSMs are generally more expensive. Option C is wrong because HSMs can be integrated into cloud environments. Option E is wrong because HSMs are managed by the organization or provider, not automatically patched.

Answer

Easier to deploy in cloud environments than software.

Answer

Automatically receive security patches without manual intervention.

Answer

Lower cost than software modules.

Question 13

Which TWO of the following are valid techniques to mitigate the risk of side-channel attacks on cryptographic implementations? (Select exactly 2.)

Accepted Answer

Implementing constant-time algorithms to avoid timing variations.. Options B and E are correct. Constant-time operations and power analysis protection are direct mitigations. Option A is wrong because longer keys do not prevent side-channel leakage. Option C is wrong because using a CSPRNG is about key generation, not execution. Option D is wrong because obfuscation is not a cryptographic defense against side channels.

Answer

Obfuscating the source code of the cryptographic library.

Answer

Using a cryptographically secure random number generator for key generation.

Answer

Increasing the key length to 4096 bits.

Question 14

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Accepted Answer

Dynamic application security testing (DAST) and penetration testing before release.. Options A, C, and E are correct. Threat modeling, static analysis, and penetration testing are core SSDLC activities. Option B is wrong because daily stand-ups are project management, not security specific. Option D is wrong because user acceptance testing focuses on functionality, not security.

Answer

User acceptance testing (UAT) to validate business requirements.

Answer

Daily stand-up meetings for developers.

Question 15

An engineer reviews the TLS configuration for a web server. Which of the following is a security concern present in this configuration?

Accepted Answer

The server does not require client certificates for authentication.. Option A is correct because mutual TLS (mTLS) is not enforced; ssl_verify_client is set to optional, allowing clients to connect without a certificate. Option B is wrong because TLS 1.2 and 1.3 are strong protocols. Option C is wrong because the key path is outside document root and is typical. Option D is wrong because the cipher suite uses strong ciphers.

Answer

The cipher suite does not include perfect forward secrecy (PFS).

Answer

The configuration supports outdated TLS 1.2 protocols.

Answer

The private key is stored in an accessible location.

CAS-004 Security Engineering Practice Test 5 — 15 Questions

Exhibit

CAS-004 Security Engineering Practice Test 5 — 15 Questions

Exhibit