CASP+ (CASP+) CAS-004 4 — Questions and Answers
Question 1: An organization is evaluating cryptographic algorithms for a system that must remain secure for 30+ years. Which algorithm and key length combination provides the BEST long-term security?
- RSA-2048 due to its widespread adoption and hardware support
- AES-128 because symmetric encryption is inherently quantum-resistant
- ECDSA with P-256 for efficiency with adequate security margin
- AES-256 combined with CRYSTALS-Kyber for quantum-resistant key exchange (Correct answer)
Correct answer: AES-256 combined with CRYSTALS-Kyber for quantum-resistant key exchange
AES-256 combined with a NIST-approved post-quantum key encapsulation mechanism like CRYSTALS-Kyber provides security against both classical and quantum adversaries over decades.
Question 2: A security engineer reviewing cloud infrastructure finds that developer IAM roles have 'AdministratorAccess' attached to enable rapid development. What risk does this MOST directly represent?
- Violation of the principle of least privilege increasing blast radius of a compromise (Correct answer)
- Non-compliance with HIPAA due to excessive PHI access permissions
- Increased cloud costs from unrestricted resource provisioning by developers
- Inability to audit developer actions due to overly broad permission sets
Correct answer: Violation of the principle of least privilege increasing blast radius of a compromise
Overly permissive IAM roles violate least privilege, meaning a compromised developer credential grants an attacker full administrative control over the cloud environment.
Question 3: During a purple team exercise, defenders fail to detect a pass-the-hash attack that successfully authenticated to a domain controller. Which control would MOST effectively prevent this?
- Enforcing complex password policies with minimum 16-character requirements
- Enabling Protected Users Security Group and disabling NTLM authentication (Correct answer)
- Deploying a PAM solution to manage privileged account passwords
- Implementing multi-factor authentication for all domain user accounts
Correct answer: Enabling Protected Users Security Group and disabling NTLM authentication
The Protected Users Security Group prevents NTLM authentication and disabling NTLM eliminates the hash reuse attack vector that pass-the-hash exploits.
Question 4: An organization acquires a company and must assess the security posture of the acquired entity's systems before integrating them into the corporate network. What is the BEST first step?
- Immediately connecting acquired systems to the corporate network with firewall rules controlling access
- Deploying corporate endpoint protection software on all acquired systems
- Conducting an independent security assessment of the acquired environment before integration (Correct answer)
- Requiring the acquired company to pass a SOC 2 Type II audit within 90 days
Correct answer: Conducting an independent security assessment of the acquired environment before integration
An independent security assessment of the acquired environment identifies unknown vulnerabilities and risks before integration, preventing the introduction of compromised systems into the corporate network.
Question 5: A web application undergoes a security review and is found to serialize user-supplied objects without validation. Which vulnerability class does this MOST likely introduce?
- Cross-site request forgery (CSRF) allowing unauthorized state changes
- Insecure deserialization enabling remote code execution (Correct answer)
- XML external entity (XXE) injection extracting server files
- Server-side request forgery (SSRF) accessing internal services
Correct answer: Insecure deserialization enabling remote code execution
Deserializing untrusted user-supplied objects without validation is the definition of insecure deserialization, which can lead to remote code execution when gadget chains exist.
Question 6: A CISO is implementing a vendor risk management program. A critical SaaS vendor refuses to allow third-party security audits. What is the MOST appropriate response?
- Accept the risk if the vendor provides a completed security questionnaire
- Require the vendor to provide SOC 2 Type II reports and contractual security commitments (Correct answer)
- Immediately terminate the vendor relationship due to non-compliance
- Perform a remote vulnerability scan of the vendor's externally facing infrastructure
Correct answer: Require the vendor to provide SOC 2 Type II reports and contractual security commitments
SOC 2 Type II reports provide third-party validated evidence of security controls, and contractual commitments provide legal recourse, offering reasonable assurance when direct audits are refused.
Question 7: A security architect is designing controls for a multi-tenant cloud platform. Which approach BEST ensures cryptographic isolation between tenants?
- Using separate VLANs for each tenant with inter-VLAN routing disabled
- Assigning each tenant a unique encryption key managed in a dedicated HSM partition (Correct answer)
- Enforcing tenant-specific IAM policies that restrict cross-tenant resource access
- Deploying separate virtual machines for each tenant workload
Correct answer: Assigning each tenant a unique encryption key managed in a dedicated HSM partition
Tenant-unique encryption keys stored in dedicated HSM partitions ensure that even if one tenant's data is accessed, it cannot be decrypted using another tenant's key material.
CASP+ (CASP+) CAS-004 4
An organization is evaluating cryptographic algorithms for a system that must remain secure for 30+ years.
Which algorithm and key length combination provides the BEST long-term security?