CASP+ (CASP+) CAS-004 3 — Questions and Answers
Question 1: A cloud-native application uses microservices that communicate via an internal API gateway. Which authentication mechanism is MOST appropriate for service-to-service communication in this environment?
- Username and password credentials stored in environment variables
- Mutual TLS (mTLS) with short-lived certificates issued by a service mesh (Correct answer)
- OAuth 2.0 authorization code flow with user consent
- Kerberos tickets issued by an on-premises Active Directory domain controller
Correct answer: Mutual TLS (mTLS) with short-lived certificates issued by a service mesh
mTLS with short-lived certificates in a service mesh provides strong mutual authentication and encryption for service-to-service communication without human credentials.
Question 2: A security engineer is analyzing a firmware image for an embedded IoT device. They suspect a hardcoded backdoor exists. Which analysis technique is MOST efficient for finding hardcoded credentials?
- Dynamic analysis by running the firmware in a production device
- Fuzzing the device's network interface with malformed packets
- Static binary analysis using entropy analysis and string extraction (Correct answer)
- Reviewing the manufacturer's published CVE disclosures
Correct answer: Static binary analysis using entropy analysis and string extraction
Static binary analysis with string extraction and entropy analysis efficiently surfaces hardcoded credentials and cryptographic material without executing the firmware.
Question 3: An organization implements a SOAR platform. A playbook automatically blocks IP addresses flagged by threat intelligence feeds. What risk does this automation introduce?
- Increased mean time to respond due to playbook execution overhead
- False positive blocking of legitimate IP addresses causing service disruption (Correct answer)
- Bypassing of the SOAR platform by sophisticated attackers using dynamic IPs
- Inability to correlate events across multiple security tools
Correct answer: False positive blocking of legitimate IP addresses causing service disruption
Automated blocking based on threat intelligence without human review risks false positives that can block legitimate business traffic and cause service outages.
Question 4: A security architect must select an encryption mode for a database that stores fixed-length credit card numbers. Which mode is MOST appropriate considering the data characteristics?
- AES-ECB because identical inputs produce identical outputs enabling fast lookups
- AES-CBC with a random IV for each record to prevent pattern analysis
- AES-GCM to provide authenticated encryption with integrity verification (Correct answer)
- AES-CTR to enable random access without decrypting the entire dataset
Correct answer: AES-GCM to provide authenticated encryption with integrity verification
AES-GCM provides both confidentiality and integrity verification, and with a unique nonce per record, prevents the pattern leakage that makes ECB insecure for structured data.
Question 5: An attacker uses a supply chain attack to insert malicious code into a widely used open-source library. What defensive control BEST detects this before the code reaches production?
- Subscribing to the library vendor's security mailing list
- Implementing a software composition analysis (SCA) tool in the CI/CD pipeline (Correct answer)
- Manually reviewing all third-party library changelogs before updates
- Blocking all outbound internet access from production build servers
Correct answer: Implementing a software composition analysis (SCA) tool in the CI/CD pipeline
SCA tools integrated into CI/CD pipelines scan dependencies for known vulnerabilities and unexpected changes, detecting supply chain compromises before deployment.
Question 6: A company's incident response team is handling a ransomware attack. Encrypted files have been confirmed on three servers. What should be the FIRST containment action?
- Pay the ransom to obtain the decryption key and minimize downtime
- Restore the affected servers from the most recent backup immediately
- Isolate the affected systems from the network to prevent further spread (Correct answer)
- Perform forensic imaging of all affected systems before taking any action
Correct answer: Isolate the affected systems from the network to prevent further spread
Network isolation is the first containment priority to stop ransomware propagation before it encrypts additional systems across the environment.
Question 7: A red team successfully exfiltrates data by encoding it within DNS TXT record queries. Which security control would have BEST prevented this?
- Blocking all outbound UDP port 53 traffic at the perimeter firewall
- Deploying a DNS firewall with DNS query rate limiting and anomaly detection (Correct answer)
- Requiring all DNS queries to use DNSSEC for record validation
- Implementing split-horizon DNS to separate internal and external name resolution
Correct answer: Deploying a DNS firewall with DNS query rate limiting and anomaly detection
A DNS firewall with query rate limiting and anomaly detection identifies unusual TXT record query volumes and patterns characteristic of DNS tunneling exfiltration.
CASP+ (CASP+) CAS-004 3
A cloud-native application uses microservices that communicate via an internal API gateway.
Which authentication mechanism is MOST appropriate for service-to-service communication in this environment?