mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is designing a zero-trust…
A security architect is designing a zero-trust network architecture for a hybrid cloud environment. The company uses on-premises servers and AWS. Which of the following best implements the principle of least privilege for inter-component communication?
⚠ Common exam trap
The CAS-004 exam often tests the misconception that network-layer controls like ACLs or VPNs are sufficient for zero-trust least privilege, when in fact they lack the workload-level granularity and stateful enforcement required for true micro-segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.
Micro-segmentation with stateful firewalls and explicit allow rules enforces least privilege at the workload level, ensuring that only explicitly permitted inter-component traffic is allowed. This approach is fundamental to zero-trust architectures, as it reduces the attack surface by preventing lateral movement, even within the same subnet or VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy an SD-WAN with dynamic path selection and encryption for all inter-site traffic.
Why it's wrong here
SD-WAN optimizes routing but does not provide granular per-component access control.
- ✓
Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.
Why this is correct
Micro-segmentation with explicit allow rules ensures only necessary traffic is permitted, adhering to least privilege.
- ✗
Use network ACLs on the cloud VPC and on-premises routers to deny all traffic by default, then allow required ports.
Why it's wrong here
Network ACLs are stateless and less granular than stateful firewalls; they do not track connection state.
- ✗
Deploy a site-to-site VPN and route all inter-component traffic through a VPN concentrator.
Why it's wrong here
VPN concentrators create a trust boundary but do not enforce least privilege at the component level.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.