CAS-004 Security Engineering Practice Test 6 — 15 Questions

Question 1

A security engineer is evaluating the use of AES-256-GCM for encrypting sensitive data in transit. They note that the Additional Authenticated Data (AAD) field is empty. What is the security implication?

Accepted Answer

The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.. Option D is correct because AAD provides context binding; without it, an attacker could potentially substitute ciphertexts from different contexts. Option A is wrong because AES-256-GCM provides authentication even without AAD. Option B is wrong because the IV is not derived from the key; missing AAD does not affect key recovery. Option C is wrong because AAD is optional but recommended; the cipher is still secure, just less context bound.

Answer

The cipher is still secure, but missing AAD offers no additional protection against man-in-the-middle attacks.

Answer

The encryption provides no authentication because AAD is missing.

Answer

The cipher becomes vulnerable to key recovery attacks because AAD is missing.

Question 2

An OpenVPN configuration file is shown. A security auditor recommends replacing the cipher and auth directives. Which of the following is the BEST replacement pair from a security engineering perspective?

Accepted Answer

cipher AES-256-GCM and auth SHA256. Option C is correct because AES-256-GCM is an AEAD cipher that provides both encryption and authentication, and TLS 1.3 uses AEAD. Option A is wrong because the configuration already uses SHA256 for auth; adding HMAC is redundant but not best. Option B is wrong because Blowfish is outdated and DES is weak. Option D is wrong because 3DES is weak and MD5 is deprecated.

Answer

cipher AES-128-GCM and auth SHA384

Answer

cipher 3DES-168 and auth MD5

Answer

cipher Blowfish-128 and auth SHA1

Question 3

A security engineer is designing a secure communication channel between two internal systems over an untrusted network. Which protocol should be used to ensure both confidentiality and integrity of data in transit?

Accepted Answer

TLS. TLS provides encryption for confidentiality and MAC for integrity, making it the best choice for secure communication over an untrusted network.

Answer

SSH

Answer

HTTPS

Answer

IPsec

Question 4

An organization is deploying hardware security modules (HSMs) to protect cryptographic keys used for digital signatures. Which attack vector is most effectively mitigated by using an HSM compared to storing keys in software?

Accepted Answer

Key extraction from memory dumps. HSMs protect keys from extraction even if the host system is compromised, making them resistant to key extraction attacks.

Answer

Side-channel attacks on the host CPU

Answer

Man-in-the-middle attacks on cryptographic operations

Answer

Brute-force attacks on key strength

Question 5

A company is implementing single sign-on using SAML 2.0. A security architect is reviewing the authentication flow and notices that the identity provider (IdP) does not digitally sign the SAML assertions. Which of the following is the most significant security risk?

Accepted Answer

The assertion could be modified in transit. Without signing, an attacker can modify the assertion in transit, potentially impersonating a user or altering attributes, leading to unauthorized access.

Answer

The assertion could be intercepted and read

Answer

The IdP could be spoofed

Answer

The assertion could be replayed

Question 6

A network administrator is configuring a firewall to allow only necessary traffic to a web server. The server should be accessible from the internet on port 443 and from a management subnet on port 22. Which firewall rule ensures least privilege?

Accepted Answer

Allow traffic from any to port 443, and from management subnet to port 22; deny all else. Allow only specific ports from specific sources, and block all other traffic.

Answer

Allow traffic from management subnet to port 443 and any to port 22

Answer

Allow traffic from any source to ports 443 and 22

Answer

Allow all traffic to the server, then block specific ports

Question 7

A data loss prevention (DLP) solution is being implemented to prevent sensitive data from leaving the corporate network. Which of the following is the most effective approach for detecting structured data like credit card numbers in outbound traffic?

Accepted Answer

Regular expression matching. Regular expressions can match patterns like credit card numbers, while other methods are less precise or suited for different data types.

Answer

Keyword matching

Answer

Machine learning classification

Answer

Exact file hash matching

Question 8

During a security review, it is discovered that a critical application uses hardcoded cryptographic keys. The development team refactors the code to retrieve keys from a centralized key management system (KMS) using role-based access control. Which additional practice should be implemented to minimize the risk of key compromise?

Accepted Answer

Implement key expiration and automated rotation. Rotation reduces the window of exposure if a key is compromised, and automating it ensures consistency.

Answer

Log every key access without rotation

Answer

Use a single, long key to reduce management overhead

Answer

Store keys in a hardware security module only

Question 9

A company is deploying a wireless network for guests. Which security measure is most important to prevent unauthorized users from accessing internal resources?

Accepted Answer

Place the guest network on a separate VLAN with no access to internal subnets. Network segmentation ensures guests cannot reach internal systems even if they are on the same physical infrastructure.

Answer

Use WPA2-Enterprise with 802.1X

Answer

Disable SSID broadcast

Answer

Implement MAC address filtering

Question 10

A virtualization administrator needs to ensure that virtual machines (VMs) from different customers cannot communicate with each other unless explicitly allowed. Which network security control should be implemented on the hypervisor?

Accepted Answer

Use a virtual firewall to create per-VM security groups. Micro-segmentation (e.g., NSX) allows fine-grained control over VM-to-VM traffic at the virtual switch level.

Answer

Patch the hypervisor regularly

Answer

Assign each VM to a different physical server

Answer

Enable hypervisor memory overcommitment

Question 11

A security architect is evaluating web application firewall (WAF) features to protect against common attacks. Which TWO of the following attacks can a WAF most effectively prevent?

Accepted Answer

Cross-site scripting (XSS). SQL injection and XSS are application-layer attacks that a WAF can detect and block based on signatures or heuristics. CSRF requires tokens, and session hijacking is often at the network layer.

Answer

Session hijacking

Answer

Distributed denial-of-service (DDoS)

Answer

Cross-site request forgery (CSRF)

Question 12

A company is implementing a zero-trust network architecture. Which THREE of the following are critical components of this approach?

Accepted Answer

Default-deny access policies (least privilege). Zero-trust requires that no entity is trusted by default, even inside the network. Micro-segmentation, continuous authentication, and least privilege are core principles.

Answer

VPN for all remote access

Answer

A single perimeter firewall

Question 13

An organization is implementing a public key infrastructure (PKI). Which THREE of the following are essential components?

Accepted Answer

Certificate authority (CA). A CA issues certificates, a RA verifies identity before certificate issuance, and the certificate database stores issued certificates and CRLs.

Answer

Key escrow agent

Answer

Time-stamping authority (TSA)

Question 14

A large enterprise recently migrated its critical applications to a hybrid cloud environment. The security team is concerned about the risk of privileged account abuse. They have implemented a privileged access management (PAM) solution that rotates passwords for service accounts after each use. However, during a incident response drill, the team discovers that an attacker who compromised a jump server was able to access multiple administrative consoles without re-authentication. Investigation reveals that the PAM solution uses session recording but does not enforce session termination; instead, it relies on the lifecycle of the token issued during initial authentication. The attacker captured a valid token and reused it from a different machine. Which of the following is the most effective remediation?

Accepted Answer

Implement token-binding by including the client's TLS certificate in the token. Token-binding ties the token to the client device, preventing its reuse from other machines. Option B only addresses after compromise, not prevention. Option C breaks functionality. Option D doesn't address token theft.

Answer

Require multi-factor authentication at each console access

Answer

Shorten the token lifetime to 30 seconds

Answer

Deploy a host-based intrusion detection system on the jump server

Question 15

A financial institution is required to comply with PCI DSS and uses a mix of legacy and modern applications. The security architect proposes to segment the network so that the cardholder data environment (CDE) is isolated. However, a legacy application in a non-CDE segment must send data to a database in the CDE. The legacy application cannot be modified and communicates via clear-text protocols. Which of the following is the most secure solution that maintains compliance?

Accepted Answer

Use a bastion host to terminate TLS on behalf of the legacy application and forward via a one-way replication. A bastion host with TLS termination can wrap clear-text traffic in encryption, and strict firewall rules prevent direct access.

Answer

Replace the legacy application immediately

Answer

Place the legacy application in the CDE and isolate it with a firewall

Answer

Install a network-based DLP sensor to monitor traffic

CAS-004 Security Engineering Practice Test 6 — 15 Questions

Exhibit

CAS-004 Security Engineering Practice Test 6 — 15 Questions

Exhibit