CASP+ (CASP+) CAS-004 5 — Questions and Answers
Question 1: A security team discovers that an attacker maintained persistence in their environment for 9 months using a web shell. Which log source would MOST likely have revealed this activity earliest?
- Active Directory authentication logs showing failed login attempts
- Web server access logs showing unusual POST requests to the web shell path (Correct answer)
- Network flow data showing large outbound data transfers
- Endpoint antivirus logs from the web server
Correct answer: Web server access logs showing unusual POST requests to the web shell path
Web server access logs record every HTTP request including POST requests to web shells, making them the earliest and most direct indicator of web shell interaction.
Question 2: An organization uses a hybrid cloud architecture and needs to enforce consistent security policy across on-premises and cloud environments. Which solution BEST meets this requirement?
- Deploying separate SIEM instances tuned for each environment independently
- Implementing a cloud access security broker (CASB) in forward proxy mode
- Using a cloud-agnostic security policy platform with unified policy enforcement (Correct answer)
- Replicating on-premises firewall rules to cloud security groups manually
Correct answer: Using a cloud-agnostic security policy platform with unified policy enforcement
A cloud-agnostic security policy platform provides single-pane-of-glass policy management and consistent enforcement across heterogeneous on-premises and cloud environments.
Question 3: A penetration tester is assessing a target that uses certificate pinning in its mobile application. Which technique allows the tester to intercept the application's TLS traffic?
- Installing a custom CA certificate in the device's trusted store
- Performing an ARP spoofing attack on the device's network gateway
- Using Frida or similar tools to hook and bypass the pinning validation logic at runtime (Correct answer)
- Downgrading the TLS version to SSLv3 using a POODLE-style attack
Correct answer: Using Frida or similar tools to hook and bypass the pinning validation logic at runtime
Certificate pinning ignores the device's trust store, so runtime instrumentation tools like Frida must hook the validation function directly to bypass it.
Question 4: A company experiences a DDoS attack that saturates its upstream ISP link. Which mitigation technique should be engaged at the EARLIEST stage?
- Deploying a WAF in front of the web servers to filter malicious requests
- Enabling rate limiting on the perimeter firewall to throttle traffic
- Contacting the upstream ISP or a DDoS scrubbing service to filter traffic upstream (Correct answer)
- Implementing anycast routing to distribute attack traffic across multiple data centers
Correct answer: Contacting the upstream ISP or a DDoS scrubbing service to filter traffic upstream
When the upstream link is saturated, on-premises controls cannot receive traffic to filter it; upstream scrubbing or ISP null-routing must be engaged to absorb the attack before it reaches the organization.
Question 5: An organization's security policy requires that all cryptographic keys be generated using a FIPS 140-2 Level 3 validated device. What distinguishes Level 3 from Level 2 validation?
- Level 3 requires software-based key wrapping for key export operations
- Level 3 requires tamper-evident coatings and physical identity-based authentication for operators (Correct answer)
- Level 3 mandates the use of ECC keys over RSA for all cryptographic operations
- Level 3 eliminates the requirement for role-based authentication
Correct answer: Level 3 requires tamper-evident coatings and physical identity-based authentication for operators
FIPS 140-2 Level 3 adds tamper-responsive mechanisms (active zeroization on tamper detection) and identity-based authentication for operators, beyond Level 2's tamper-evident coatings.
Question 6: A security engineer is reviewing code and finds that an application logs full HTTP request bodies including authorization headers to a centralized SIEM. What is the PRIMARY security concern?
- Excessive logging creating storage costs and SIEM performance degradation
- Bearer tokens and session credentials in logs creating long-lived exposure of access material (Correct answer)
- Violation of data minimization principles under GDPR for EU user data only
- Log tampering by an insider with SIEM write access
Correct answer: Bearer tokens and session credentials in logs creating long-lived exposure of access material
Authorization headers containing bearer tokens or session credentials in logs create persistent, queryable copies of access material that outlive the intended session lifetime.
Question 7: An organization implements a bug bounty program. A researcher submits a finding demonstrating that an API endpoint returns sensitive PII of other users when the user ID parameter is manipulated. Which vulnerability class is this?
- Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (Correct answer)
- SQL injection allowing enumeration of the user database
- Mass assignment vulnerability overwriting protected user attributes
- Server-side request forgery (SSRF) accessing internal user data stores
Correct answer: Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization
Accessing another user's resources by manipulating an identifier without authorization checks is the definition of IDOR, categorized under Broken Object Level Authorization in OWASP.
CASP+ (CASP+) CAS-004 5
A security team discovers that an attacker maintained persistence in their environment for 9 months using a web shell.
Which log source would MOST likely have revealed this activity earliest?