hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Refer to the exhibit
Exhibit
# nginx.conf
server {
listen 443 ssl;
ssl_certificate /etc/ssl/certs/server.crt;
ssl_certificate_key /etc/ssl/private/server.key;
location /admin {
proxy_pass http://internal-admin:8080;
allow 192.168.1.0/24;
deny all;
}
location /api {
proxy_pass http://internal-api:8080;
}
}Refer to the exhibit. A security analyst is reviewing the Nginx configuration. Which of the following is the most critical security flaw?
⚠ Common exam trap
The CAS-004 exam often tests the distinction between a misconfiguration that is serious but mitigable (like readable SSL keys or internal HTTP) versus a direct exposure of an unprotected endpoint, which is immediately exploitable and thus the most critical flaw.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The /api location does not have any access restrictions, exposing internal API
The /api location block lacks any authentication or authorization directives, such as `allow/deny` or `auth_basic`, leaving the internal API endpoint exposed to any client that can reach the Nginx server. In a typical deployment, this would allow unauthenticated access to sensitive backend services, which is a critical security flaw. The absence of access controls on /api directly violates the principle of least privilege and can lead to data exfiltration or unauthorized operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL certificate key file is readable by all users (assuming default permissions)
Why it's wrong here
While important, the configuration does not show file permissions; it is not directly a flaw in the config.
- ✗
The proxy_pass uses HTTP internally, which is not encrypted
Why it's wrong here
Internal communication over HTTP is common and not a critical flaw; attackers already need access to the internal network.
- ✓
The /api location does not have any access restrictions, exposing internal API
Why this is correct
Without any allow/deny directives, the /api endpoint is accessible to anyone who can reach the server, which could include external attackers.
- ✗
The /admin location restricts access by IP only, which can be bypassed by IP spoofing
Why it's wrong here
IP-based restriction is a valid layer; spoofing is possible but less likely in internal networks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.