CASP+ (CASP+) CAS-004 2 — Questions and Answers
Question 1: A security architect is designing a zero-trust network for a financial institution. Which control BEST enforces the 'never trust, always verify' principle for internal east-west traffic?
- Perimeter firewall with deep packet inspection
- Microsegmentation with continuous identity verification per session (Correct answer)
- VLAN-based network segregation with ACLs
- IDS sensors deployed at each subnet boundary
Correct answer: Microsegmentation with continuous identity verification per session
Microsegmentation combined with continuous per-session identity verification directly enforces zero-trust by treating every lateral connection as untrusted.
Question 2: During a threat hunt, an analyst discovers beaconing traffic to an external IP at regular 60-second intervals using HTTPS. The process responsible is svchost.exe. What is the MOST likely threat?
- Legitimate Windows Update service communicating with Microsoft
- A rootkit disguising itself as a kernel driver
- Command-and-control communication from malware using process hollowing (Correct answer)
- DNS tunneling exfiltrating data over HTTPS
Correct answer: Command-and-control communication from malware using process hollowing
Regular beaconing from svchost.exe over HTTPS is a hallmark of process hollowing where malware injects into a legitimate process to establish C2 communication.
Question 3: A company must comply with both GDPR and CCPA. Their cloud provider stores data in the US and EU. Which data governance control addresses both regulations' residency and subject rights requirements?
- Encrypt all data with AES-256 and store encryption keys on-premises
- Implement data classification with geo-tagged metadata and automated deletion workflows (Correct answer)
- Use a CDN to serve data from the nearest region to reduce latency
- Deploy a CASB to monitor all cloud access and generate compliance reports
Correct answer: Implement data classification with geo-tagged metadata and automated deletion workflows
Data classification with geo-tagged metadata enables both residency enforcement and automated workflows for subject rights like deletion under GDPR/CCPA.
Question 4: An organization's PKI root CA must be taken offline after initial setup. What is the PRIMARY security reason for this practice?
- To reduce the computational load on the network infrastructure
- To prevent the root CA private key from being compromised via network-based attacks (Correct answer)
- To allow the CRL to be updated only during scheduled maintenance windows
- To comply with FIPS 140-2 Level 1 requirements for key storage
Correct answer: To prevent the root CA private key from being compromised via network-based attacks
Keeping the root CA offline eliminates its attack surface, protecting the root private key that underpins the entire PKI trust chain.
Question 5: A penetration tester successfully performs a SQL injection attack but the application returns only true/false responses with no error messages. Which SQL injection technique applies?
- Union-based SQL injection
- Error-based SQL injection
- Blind boolean-based SQL injection (Correct answer)
- Out-of-band SQL injection
Correct answer: Blind boolean-based SQL injection
Blind boolean-based SQL injection infers database information from the application's true/false behavioral responses when no data is directly returned.
Question 6: An enterprise wants to implement deception technology to detect lateral movement. Which solution BEST fits this goal?
- Deploying a DMZ with a bastion host to attract external attackers
- Placing honeytokens and honeypots throughout internal network segments (Correct answer)
- Installing a UEBA solution to baseline and alert on user behavior anomalies
- Enabling enhanced audit logging on all Active Directory domain controllers
Correct answer: Placing honeytokens and honeypots throughout internal network segments
Honeytokens and honeypots distributed across internal segments attract and detect attackers engaged in lateral movement without alerting legitimate users.
Question 7: A CISO needs to communicate cybersecurity risk to the board of directors. Which metric is MOST meaningful to a non-technical executive audience?
- Mean time to detect (MTTD) measured in hours
- Number of critical CVEs patched in the last quarter
- Annualized Loss Expectancy (ALE) expressed in dollars (Correct answer)
- Percentage of endpoints with EDR agents installed
Correct answer: Annualized Loss Expectancy (ALE) expressed in dollars
ALE translates cybersecurity risk into financial terms, making it directly relevant and understandable to executives focused on business impact.
CASP+ (CASP+) CAS-004 2
A security architect is designing a zero-trust network for a financial institution.
Which control BEST enforces the 'never trust, always verify' principle for internal east-west traffic?