CAS-004 — CASP+ Study Guide

A security architect is designing a cloud infrastructure for a financial services organization. The organization requires strict control over data residency due to regulatory compliance. Which approach best addresses this requirement while maintaining scalability?

• A Rely on the cloud provider's default data center assignments
• B Store all data on-premises and avoid cloud services entirely
• C Use multiple cloud providers to distribute risk without considering data location
• D Implement geo-fencing policies and data residency controls within the cloud provider's infrastructure ✓ Correct

During a security assessment, you discover that a critical application uses hardcoded API keys in source code repositories. What is the most effective remediation strategy?

• A Move the source code to a private server
• B Restrict repository access to senior developers only
• C Immediately rotate all credentials and implement a secrets management solution with automated key rotation policies ✓ Correct
• D Change the API keys monthly and document them in a shared wiki

An organization implements a zero-trust architecture across its network. Which of the following is NOT a core principle of zero-trust security?

• A Assume breach and verify every access request
• B Continuously validate device and user trustworthiness
• C Trust the perimeter and focus security controls at network edges ✓ Correct
• D Implement least privilege access controls

A security team is evaluating third-party software components for a mission-critical application. They discover that a widely-used library has a known vulnerability affecting versions prior to 5.0. The application currently uses version 4.2. What should be the immediate action?

• A Replace the library entirely with an alternative solution
• B Apply a patch directly to the application code to work around the vulnerability
• C Continue using version 4.2 and monitor for exploitation attempts
• D Update to version 5.0 or later after testing compatibility in a staging environment ✓ Correct

An organization is implementing container orchestration across multiple cloud providers. Security requirements include strong isolation between workloads and compliance with data sovereignty laws. Which capability is most critical for this hybrid environment?

• A Increased container image sizes to include all security tools
• B Reliance on each cloud provider's native security controls without standardization
• C Manual security reviews of each deployed container
• D Pod security policies and network policies that enforce isolation regardless of underlying cloud provider ✓ Correct

A compliance audit reveals that your organization's incident response plan has not been tested in 18 months. What is the primary risk of this gap?

• A Auditors will require additional documentation explaining each control
• B The plan may not reflect current infrastructure, personnel, or procedures, reducing effectiveness during an actual incident ✓ Correct
• C Employees will lose the ability to perform their regular job duties
• D The organization will face immediate fines from regulatory bodies

An organization experiences a supply chain attack where malicious code is injected into a software library before distribution. Which security practice would have most effectively prevented or detected this attack?

• A Increasing the frequency of security awareness training
• B Using only open-source software libraries
• C Implementing stricter password policies for developers
• D Software Bill of Materials (SBOM) generation combined with integrity verification and vendor security assessments ✓ Correct

A security architect must design authentication for a distributed microservices environment where services need to communicate securely without user interaction. Which approach best balances security and operational efficiency?

• A Use mutual TLS (mTLS) certificates with automated certificate lifecycle management and a service mesh implementation ✓ Correct
• B Share a single API key among all microservices
• C Implement username and password authentication for each service-to-service call
• D Use unencrypted HTTP with IP-based access controls

During a risk assessment, you identify that legacy systems cannot be updated or patched. What is the most appropriate risk management strategy for these systems?

• A Ignore the vulnerability since the systems cannot be patched
• B Purchase cyber insurance to cover potential breaches
• C Accept the risk and monitor continuously while implementing compensating controls and network segmentation ✓ Correct
• D Immediately decommission all legacy systems

An organization implements a Data Loss Prevention (DLP) solution across endpoints. Employees begin circumventing the controls by uploading files through personal cloud accounts. What is the root cause of this control failure?

• A The DLP solution is not sophisticated enough to detect all data transfers
• B Cloud accounts automatically bypass DLP controls
• C Insufficient user training and lack of business justification for the DLP policies ✓ Correct
• D Employees are inherently malicious and cannot be trusted

A cloud migration project must comply with standards requiring encryption of data in transit and at rest. The organization uses multiple cloud providers with different encryption capabilities. How should encryption be approached?

• A Implement encryption only for publicly accessible data
• B Implement application-level encryption that is provider-agnostic, ensuring consistent protection across all platforms ✓ Correct
• C Only encrypt data at rest, as in-transit encryption is handled automatically
• D Use each provider's native encryption without additional layers

An organization detects suspicious lateral movement within its network. Which security control should have been implemented to prevent this activity?

• A Network segmentation with micro-segmentation policies and continuous monitoring of internal traffic flows ✓ Correct
• B More restrictive password policies
• C Increased physical security controls
• D Stronger perimeter firewalls

A security team implements multi-factor authentication (MFA) but observes that adoption among remote employees is significantly lower than office-based employees. What is the most likely reason?

• A MFA is only effective for office networks
• B Remote workers face additional usability friction from slower internet and authentication method compatibility issues ✓ Correct
• C Remote workers are less security-conscious than office employees
• D The MFA solution is inherently insecure for remote users

An organization discovers that its infrastructure-as-code (IaC) templates contain hardcoded secrets and misconfigurations that create security vulnerabilities. What is the best remediation process?

• A Accept the risk since IaC provides efficiency benefits
• B Implement IaC scanning tools in the CI/CD pipeline, establish secure secret management, and conduct code reviews before deployment ✓ Correct
• C Manually review all IaC files quarterly
• D Avoid using IaC and return to manual infrastructure provisioning

A security architect is designing a privileged access management (PAM) solution for an organization with thousands of system accounts. Which approach best reduces the attack surface while maintaining operational efficiency?

• A Require all privileged actions to be approved by manual ticket systems without time limits
• B Create one master account to be shared among all administrators
• C Implement just-in-time (JIT) access provisioning with automatic revocation, comprehensive audit logging, and risk-based access decisions ✓ Correct
• D Eliminate privileged accounts entirely by making all users standard users

An organization's threat intelligence indicates that its industry is being targeted by a specific Advanced Persistent Threat (APT) group known for exploiting unpatched vulnerabilities. What is the appropriate immediate response?

• A Assume the organization will not be targeted and maintain current practices
• B Increase security awareness training alone without technical changes
• C Wait for more definitive intelligence before taking action
• D Prioritize patching known vulnerabilities associated with this threat actor and implement detection signatures for their known tactics ✓ Correct

A vulnerability scanner identifies a critical flaw in a production system that cannot be patched due to vendor support limitations. The system is isolated to a single business function with limited users. Which risk response is most appropriate?

• A Request the vendor to develop a custom patch, regardless of cost
• B Document the vulnerability and accept unlimited risk exposure
• C Implement compensating controls such as enhanced monitoring, network isolation, and access restrictions specific to this system ✓ Correct
• D Immediately shut down the system and halt the business function

An organization implements a Security Information and Event Management (SIEM) system but struggles with alert fatigue from thousands of daily alerts. What is the most effective solution?

• A Implement advanced correlation rules, baseline normal behavior, and tune alerts based on actual threat relevance and organizational risk ✓ Correct
• B Manually review every alert without automated filtering
• C Increase the SIEM's sensitivity to catch more potential incidents
• D Ignore all alerts since there are too many to investigate

A security team is evaluating whether to adopt a Software-as-a-Service (SaaS) solution for sensitive business functions. What critical security consideration should drive this decision?

• A Assume the SaaS provider handles all security responsibilities
• B Select only on-premises solutions to maintain complete control
• C Choose based solely on cost and feature availability
• D Evaluate vendor security certifications, data residency controls, encryption capabilities, incident response procedures, and contractual security obligations ✓ Correct

An organization discovers that several employees have been using personal devices to access sensitive corporate data without proper security controls. What is the primary risk of this practice?

• A Employees will be more satisfied with their work experience
• B Loss of control over security configurations, potential data exfiltration, and inability to enforce protective measures on personal devices ✓ Correct
• C Increased productivity since employees work more efficiently
• D Reduced IT department workload due to fewer devices to support

A penetration test reveals that an organization's web application is vulnerable to SQL injection attacks. The security team must prioritize remediation. What is the most effective fix?

• A Instruct users not to input special characters
• B Disable database error messages from appearing in web responses
• C Implement a Web Application Firewall (WAF) and consider the issue resolved
• D Use parameterized queries and prepared statements throughout the application, combined with input validation and least privilege database accounts ✓ Correct

An organization operates critical infrastructure that must maintain 99.99% availability while protecting against DDoS attacks. Which architectural approach best addresses both requirements?

• A Deploy geographically distributed infrastructure with DDoS mitigation services, load balancing, and automated failover capabilities across multiple providers ✓ Correct
• B Maintaining a single, heavily protected data center
• C Isolating systems completely from the internet to prevent DDoS attacks
• D Oversizing all infrastructure to absorb any DDoS attack

A security audit identifies that the organization lacks formal change management procedures for security controls. What is the likely impact of this gap?

• A Reduced need for security monitoring
• B Improved security through rapid, unrestricted changes
• C Faster incident response procedures
• D Unintended security degradation, difficulty tracking changes, inability to maintain compliance, and increased risk of misconfigurations ✓ Correct

An organization implements a bring-your-own-device (BYOD) policy. Which control is essential to protect corporate data on personal devices?

• A Mobile Device Management (MDM) with remote wipe capabilities, encryption enforcement, and containerization of corporate data ✓ Correct
• B Allowing employees full administrative control of their devices
• C Monitoring all personal activities on the device
• D Requiring employees to sign additional liability waivers

A security architect must design a backup and disaster recovery strategy for an organization's critical data. The organization requires rapid recovery and geographic redundancy. Which approach best balances protection and operational requirements?

• A Maintain a single backup on-site only
• B Rely entirely on cloud provider snapshots without independent backups
• C Perform backups annually to minimize storage costs
• D Implement multiple backup copies across geographically diverse locations with regular recovery testing and documented Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) ✓ Correct

An organization's security assessment reveals excessive privilege usage among system administrators. What governance approach best addresses this issue?

• A Implement role-based access control (RBAC) with the principle of least privilege, requiring justification for elevated permissions and regular privilege reviews ✓ Correct
• B Remove all administrator accounts and restrict all system changes
• C Trust administrators to self-regulate their privilege usage based on their judgment
• D Audit logs only, without implementing access restrictions

An organization is implementing a zero-trust architecture across its enterprise network. Which of the following best describes the primary principle that should guide this implementation?

• A Establish perimeter-based security controls and allow unrestricted internal access
• B Never trust, always verify—authenticate and authorize every access request regardless of location ✓ Correct
• C Trust all internal traffic and verify only external connections
• D Implement network segmentation to reduce the number of verification checkpoints

During a security assessment, you discover that the organization's cryptographic key management system lacks automated key rotation. What is the primary risk this creates?

• A Increased administrative overhead in manual key management procedures
• B Reduced performance of encrypted systems due to key age
• C Extended exposure window if a key is compromised, and potential compliance violations ✓ Correct
• D Keys become predictable and easier to brute-force attack

A company wants to assess third-party cloud vendor security posture. Which of the following methods provides the most comprehensive evaluation?

• A Conduct a SOC 2 Type II audit and perform penetration testing with vendor authorization ✓ Correct
• B Ask the vendor to complete a detailed questionnaire about their security practices
• C Request a copy of the vendor's source code for internal code review
• D Review the vendor's public security certifications and published whitepapers

Which of the following represents the greatest risk when implementing a bring-your-own-device (BYOD) policy without proper controls?

• A Difficulty in tracking device inventory and asset management procedures
• B Reduced employee productivity from device compatibility issues
• C Increased hardware costs due to device diversity
• D Loss of organizational control over data and endpoints, combined with exposure to personal device vulnerabilities ✓ Correct

An organization experiences a sophisticated supply chain attack affecting multiple vendors simultaneously. What defensive strategy would MOST effectively mitigate similar future attacks?

• A Implement more stringent vendor selection criteria based solely on company size and reputation
• B Establish a vendor risk management program with continuous monitoring, security requirements, and incident response coordination ✓ Correct
• C Reduce the number of vendors to consolidate supply chain complexity
• D Require all vendors to implement identical security controls to organizational standards

During incident response, you need to preserve evidence from a Linux system without contaminating it. Which approach best follows forensic best practices?

• A Copy files to an external USB drive using standard file operations and document timestamps
• B Access the system remotely via SSH to minimize physical contact and preserve the live state
• C Take screenshots of important files and back them up to cloud storage immediately
• D Create a disk image using dd and store it on a separate encrypted drive with documented hash verification ✓ Correct

A security architect must choose between implementing network segmentation using VLANs or microsegmentation. Which statement best describes when microsegmentation would be preferred?

• A When the organization has limited budget and needs to minimize operational complexity
• B When network infrastructure lacks advanced switching capabilities and simplicity is prioritized
• C When legacy systems require broad network access to function properly
• D When granular, application-level access control is required and lateral movement must be prevented across the network ✓ Correct

Which of the following best represents a limitation of relying solely on signature-based antivirus detection?

• A It requires too much memory and processing resources on endpoints
• B It cannot detect zero-day malware or polymorphic variants that have not yet been catalogued ✓ Correct
• C It detects threats too quickly and generates excessive false positives
• D It is incompatible with modern operating systems and cloud environments

An organization implements a Data Loss Prevention (DLP) system that blocks all encrypted communications. What unintended consequence is most likely to occur?

• A System performance will improve due to reduced encrypted traffic overhead
• B Employees will use approved encryption methods more consistently
• C The organization will achieve complete visibility into all data transfers
• D Users may circumvent the DLP system by using unauthorized shadow IT solutions and unsanctioned communication channels ✓ Correct

When conducting threat modeling using the STRIDE methodology, which threat category best describes an attacker modifying data in transit to change a transaction amount?

• A Tampering ✓ Correct
• B Denial of Service
• C Repudiation
• D Spoofing

A company wants to implement continuous compliance monitoring. Which technology combination would BEST support this objective?

• A Configuration management database (CMDB) integrated with security information and event management (SIEM) ✓ Correct
• B Network monitoring tools with basic logging capabilities
• C Annual third-party assessments and periodic vulnerability scanning
• D Manual quarterly audits combined with employee training programs

During a security assessment, you identify that the organization stores encryption keys in the same location as encrypted data. What attack scenario is this configuration vulnerable to?

• A Social engineering attacks targeting encryption key personnel
• B Attackers obtaining both the encrypted data and keys, defeating encryption protections entirely ✓ Correct
• C Denial-of-service attacks that consume key generation resources
• D Brute-force attacks against the encryption algorithm itself

Which of the following represents the primary challenge in implementing effective security metrics and key performance indicators (KPIs)?

• A Complying with regulatory requirements that mandate specific metric formats
• B Selecting the most expensive monitoring tools available to guarantee comprehensive coverage
• C Determining which metrics actually correlate with reduced business risk rather than measuring activities that don't improve security ✓ Correct
• D Ensuring all employees understand complex security terminology and reporting structures

An organization is designing a disaster recovery strategy for a critical application. The business requires Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour. Which solution best meets these requirements?

• A Hourly incremental backups with automated failover to a hot standby system in another region ✓ Correct
• B Weekly incremental backups stored on network-attached storage (NAS) in the same data center
• C Real-time replication to a backup site with quarterly disaster recovery testing
• D Daily full backups to an offsite location with manual restore procedures

During a security code review, you discover that an application uses MD5 hashing to store user passwords. What is the primary security concern with this approach?

• A MD5 is cryptographically broken and vulnerable to collision attacks; password hashing requires algorithms like bcrypt or Argon2 ✓ Correct
• B MD5 is too slow and causes performance degradation in authentication systems
• C MD5 requires too much storage space compared to modern hashing algorithms
• D MD5 cannot be used with salting techniques for password protection

An organization wants to implement passwordless authentication for its workforce. Which implementation would provide the strongest security posture?

• A PIN-based authentication using numeric codes sent via SMS
• B Security questions and knowledge-based authentication factors
• C Email-based magic links with token expiration
• D Biometric authentication combined with hardware security keys and multi-factor verification ✓ Correct

When evaluating cloud service provider (CSP) security, which documentation provides the most reliable evidence of ongoing security controls and testing?

• A Public blog posts and security whitepapers authored by CSP security staff
• B Marketing materials and feature comparisons provided by the CSP sales team
• C SOC 2 Type II report completed by independent auditors covering control effectiveness over time ✓ Correct
• D Security checklists completed by the CSP's internal security team without external verification

A penetration tester discovers that the organization's network allows unrestricted outbound connections to the internet. What is the primary risk this creates?

• A The organization's internet bandwidth will be consumed entirely by employee personal usage
• B Compromised systems can communicate with command-and-control servers, exfiltrate data, and spread laterally without detection ✓ Correct
• C Increased latency and degraded performance for legitimate business applications
• D Users will download and install unauthorized software, violating software licensing agreements

Which of the following best represents a secure design principle that reduces the attack surface of a system?

• A Use open-source components exclusively to ensure transparency and community review
• B Implement defense in depth with multiple overlapping security controls at each layer
• C Implement comprehensive logging of all system activities to improve troubleshooting
• D Apply the principle of least privilege, disabling unnecessary services and limiting user permissions to minimum required functionality ✓ Correct

An organization experiences a breach where attackers exfiltrated credentials stored in plain text in configuration files. What architectural pattern would BEST prevent this vulnerability?

• A Implementing a secrets management system that stores credentials encrypted and provides API-based access with audit logging ✓ Correct
• B Having developers memorize credentials and manually enter them during deployment
• C Storing all credentials in a central database encrypted with the application's encryption key
• D Using environment variables without encryption but restricted to authorized personnel access

During a risk assessment, an organization identifies a high-impact, low-probability threat. Which risk response strategy should be prioritized?

• A Immediately accept the risk and allocate resources to other priorities
• B Avoid all activities that could trigger this threat, regardless of business impact
• C Escalate the threat to maximum alert status across the entire organization
• D Mitigate the risk through controls, or transfer it via insurance, depending on cost-benefit analysis ✓ Correct

Which approach would MOST effectively address insider threats while maintaining employee privacy and trust?

• A Conduct surprise searches of employee workspaces and personal devices during business hours
• B Require employees to disclose all personal communications and financial information annually
• C Implement user behavior analytics with clear organizational policies, proportionate monitoring, and transparent privacy practices ✓ Correct
• D Install keystroke loggers and screen capture software on all employee devices without notification

An organization implements a Security Operations Center (SOC) and needs to prioritize alert investigation. Which methodology would be MOST effective for reducing false positives while ensuring critical threats are addressed?

• A Ignore all alerts below a manually set threshold to reduce workload and false positives
• B Use threat intelligence, asset criticality, and behavioral baselines to score and prioritize alerts based on actual risk ✓ Correct
• C Randomly sample 10% of alerts daily to reduce investigation costs
• D Investigate all alerts in chronological order without prioritization or filtering

What is the primary advantage of implementing a Hardware Security Module (HSM) for key management compared to software-based key storage?

• A HSMs are immune to all forms of cyberattacks and completely eliminate risk
• B HSMs provide hardware-level protection, tamper detection, and cryptographic operations without exposing keys to the operating system ✓ Correct
• C HSMs automatically patch all security vulnerabilities without requiring manual intervention
• D HSMs are more affordable and easier to deploy than software solutions

An organization is evaluating a new SaaS application for use by 5,000 employees. Which factor represents the GREATEST security concern in a shared multi-tenant environment?

• A Potential data isolation failures that could expose tenant data to other customers or the vendor ✓ Correct
• B The difficulty of ensuring application feature parity with legacy on-premises solutions
• C Increased licensing costs compared to perpetual software licenses
• D The requirement to update all employees' devices to access cloud-based applications

An organization is implementing a zero-trust architecture across its cloud infrastructure. Which of the following should be the PRIMARY focus when designing the network segmentation policy?

• A Verifying and validating every access request regardless of source or location, combined with microsegmentation ✓ Correct
• B Creating separate VLANs for each department to isolate user groups
• C Implementing perimeter firewalls to block all external traffic by default
• D Deploying intrusion detection systems at all network boundaries to monitor traffic patterns

A security architect discovers that legacy applications running on the company's network cannot support modern encryption standards. What is the BEST approach to address this compliance gap while maintaining operational continuity?

• A Conduct a risk assessment, isolate the applications in a segregated network segment, implement compensating controls, and develop a remediation timeline ✓ Correct
• B Disable encryption requirements for legacy applications only and implement enhanced logging to compensate
• C Immediately discontinue use of the legacy applications and replace them with modern alternatives within 30 days
• D Request a formal compliance waiver from all regulatory bodies before taking any action

During a penetration test, the tester obtains valid Active Directory credentials from a compromised workstation. The tester is able to move laterally across the network without triggering any alerts. Which security control is MOST lacking in this environment?

• A Data loss prevention tools monitoring outbound traffic
• B Firewall rules preventing lateral movement between subnets
• C Network access control and endpoint detection and response capabilities ✓ Correct
• D Vulnerability scanning to identify and patch weak systems

A company is evaluating cloud service providers for hosting sensitive customer data. Which of the following factors should MOST influence the security decision?

• A The provider that offers the widest range of cloud services regardless of security posture
• B The provider's ability to encrypt data at rest and in transit, their compliance certifications, and their incident response procedures ✓ Correct
• C The provider with the largest number of data center locations worldwide
• D The lowest cost option that meets minimum regulatory requirements

An organization uses containerized applications deployed across multiple cloud providers. The security team needs to ensure consistent security policies are enforced across all container environments. What is the MOST appropriate solution?

• A Deploy firewalls at the edge of each cloud environment to monitor container traffic
• B Configure security groups and network policies individually on each cloud provider's platform
• C Use separate security teams for each cloud provider to maintain platform-specific expertise
• D Implement a container orchestration platform with built-in policy engines and container image scanning at the source ✓ Correct

A security analyst observes unusual API calls to a cloud data storage service originating from a service account during off-business hours. What is the FIRST action the analyst should take?

• A Isolate the affected system from the network to prevent further data exfiltration
• B Immediately revoke all permissions for the service account and re-provision it
• C Investigate the context by reviewing logs, confirming if this is scheduled activity, checking for unauthorized credential exposure, and assessing the scope of access ✓ Correct
• D Update the service account password and enable multi-factor authentication

An organization implements a secure software development lifecycle (SSDLC) but fails to achieve the expected reduction in vulnerabilities in production. Which factor is MOST likely responsible?

• A Threat modeling was performed but security testing was not consistently enforced throughout all phases or properly integrated into the build pipeline ✓ Correct
• B The SSDLC framework chosen was not comprehensive enough
• C Third-party libraries and dependencies were not evaluated during the requirements phase
• D The organization did not hire enough security personnel

A company's incident response plan requires notification of affected individuals within 72 hours of discovering a data breach. However, the investigation is still ongoing after 72 hours with no confirmation of actual data exfiltration. What should the organization do?

• A Wait until the investigation is complete before sending any notifications to individuals
• B Send preliminary notifications within the regulatory timeframe indicating a potential breach, and provide updates as the investigation progresses ✓ Correct
• C Notify only a small subset of individuals as a test to avoid unnecessary panic
• D Request an official extension from regulators before the 72-hour deadline expires

During a security architecture review, an assessor identifies that a critical application accepts user input without proper validation before processing database queries. The development team claims that parameterized queries are implemented. What is the MOST appropriate next step?

• A Accept the team's statement and document that SQL injection risks are mitigated
• B Request code review evidence and conduct dynamic testing to confirm parameterized queries are correctly implemented throughout the application ✓ Correct
• C Recommend implementing a Web Application Firewall (WAF) as a compensating control without further investigation
• D Schedule the application for replacement in the next development cycle due to improper input handling

An organization is designing a security operations center (SOC) to handle security alerts from multiple data sources including endpoints, networks, and applications. Which architectural consideration is MOST critical for effective threat detection?

• A Deploying separate analysis teams for each data source type to ensure specialized expertise
• B Implementing alert correlation and enrichment to reduce noise and prioritize high-fidelity alerts that warrant investigation ✓ Correct
• C Using the highest volume alert threshold to reduce false positives and analyst burnout
• D Implementing alerts from every possible security tool to maximize detection coverage