(CASP+) CAS-004 Flashcards

A security architect is designing a zero-trust network for a financial institution. Which control BEST enforces the 'never trust, always verify' principle for internal east-west traffic?

Answer: Microsegmentation with continuous identity verification per session

Microsegmentation combined with continuous per-session identity verification directly enforces zero-trust by treating every lateral connection as untrusted.

During a threat hunt, an analyst discovers beaconing traffic to an external IP at regular 60-second intervals using HTTPS. The process responsible is svchost.exe. What is the MOST likely threat?

Answer: Command-and-control communication from malware using process hollowing

Regular beaconing from svchost.exe over HTTPS is a hallmark of process hollowing where malware injects into a legitimate process to establish C2 communication.

A company must comply with both GDPR and CCPA. Their cloud provider stores data in the US and EU. Which data governance control addresses both regulations' residency and subject rights requirements?

Answer: Implement data classification with geo-tagged metadata and automated deletion workflows

Data classification with geo-tagged metadata enables both residency enforcement and automated workflows for subject rights like deletion under GDPR/CCPA.

An organization's PKI root CA must be taken offline after initial setup. What is the PRIMARY security reason for this practice?

Answer: To prevent the root CA private key from being compromised via network-based attacks

Keeping the root CA offline eliminates its attack surface, protecting the root private key that underpins the entire PKI trust chain.

A penetration tester successfully performs a SQL injection attack but the application returns only true/false responses with no error messages. Which SQL injection technique applies?

Answer: Blind boolean-based SQL injection

Blind boolean-based SQL injection infers database information from the application's true/false behavioral responses when no data is directly returned.

An enterprise wants to implement deception technology to detect lateral movement. Which solution BEST fits this goal?

Answer: Placing honeytokens and honeypots throughout internal network segments

Honeytokens and honeypots distributed across internal segments attract and detect attackers engaged in lateral movement without alerting legitimate users.

A CISO needs to communicate cybersecurity risk to the board of directors. Which metric is MOST meaningful to a non-technical executive audience?

Answer: Annualized Loss Expectancy (ALE) expressed in dollars

ALE translates cybersecurity risk into financial terms, making it directly relevant and understandable to executives focused on business impact.