Free CAS-005 Practice Test

The core issue is password fatigue, where users must manage too many credentials, leading them to engage in insecure practices like writing passwords down. A Single Sign-On (SSO) solution directly addresses this root cause. By implementing SSO, users authenticate once to a central service and are then granted access to multiple integrated applications without re-entering credentials. This drastically reduces the number of passwords a user needs to remember, eliminating the primary motivation for writing them down. SSO also enhances security by providing a single, centrally managed, and auditable point of authentication that can be more robustly protected.

A. Increasing password complexity to require at least 16 characters: This would worsen the problem by making passwords even harder to remember, increasing the likelihood that users will write them down.
C. Requiring users to use an open-source password manager: While a password manager helps, SSO is a superior enterprise solution as it offers centralized control, policy enforcement, and auditing, rather than relying on individual user adoption and management.
D. Implementing an MFA solution to avoid reliance only on passwords: MFA mitigates the risk of a compromised password but does not solve the underlying issue of password fatigue that is causing the insecure behavior. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-63C

Digital Identity Guidelines: Federation and Assertions.

Reference: Section 5.1.1

"Benefits to the RP".

Content: This document explicitly states a key benefit of federation (the technology behind SSO) is the "Reduced need for the subscriber to remember a different username and password for each RP [Relying Party/application]." This directly supports SSO as the solution to the problem of managing too many passwords.

2. Carnegie Mellon University

CyLab

A Large-Scale Study of Password-Policy-Related Frustration and Issues.

Reference: Section 6

"Discussion".

Content: This academic study highlights that a high number of accounts and restrictive password policies lead to user frustration and coping mechanisms like writing passwords down. It suggests that solutions like SSO can alleviate this burden. (DOI: https://doi.org/10.1145/3460120.3484559)

3. University of California

Berkeley

Information Security Office

Single Sign-On (SSO).

Reference: "What are the benefits of SSO?" section.

Content: This university resource explains that a primary benefit of SSO is that it "eliminates the need for users to remember multiple sets of usernames and passwords

" which improves user experience and security by reducing password proliferation.

Local caching is the most effective solution for this scenario. A local caching server, often part of a proxy or WAN optimization controller, stores frequently accessed content within the satellite office's network. When a user requests this content again, it is delivered from the local cache at LAN speed, rather than being re-fetched over the constrained WAN link. This directly addresses the core requirements by preserving bandwidth and increasing speed for both internal and external resources. Modern caching proxies can also function as secure web gateways, inspecting traffic for threats and thus maintaining security visibility.

A. Distributed connection allocation primarily involves load balancing traffic across multiple servers or links, which does not inherently reduce bandwidth consumption for repeated content access.
C. A content delivery network (CDN) is a service used by content providers to distribute their data closer to end-users; it is not an architecture implemented by a consumer to optimize all inbound traffic.
D. SD-WAN optimizes traffic routing over various WAN links. While some solutions include caching, "local caching" is the specific technique that solves the problem, and "vertical heterogeneity" is not a standard SD-WAN term. ---

1. Internet Engineering Task Force (IETF). RFC 7234: Hypertext Transfer Protocol (HTTP/1.1): Caching.

Section 2

"Overview of Caching

" Paragraph 1: "The goal of caching in HTTP is to reduce request latency and network overhead... By reusing a prior response

a cache can reduce the amount of network traffic necessary to satisfy a request

which can be a significant cost savings for both the client and the service." This directly supports caching as a method to preserve bandwidth ("reduce network overhead") and increase speed ("reduce request latency").

2. Hari Balakrishnan

et al. 6.829 Computer Networks

Lecture 19: Web

Caching

CDNs. MIT OpenCourseWare

Fall 2002.

Slide 10

"Proxy Caching": The lecture notes describe proxy caching as a solution deployed "on behalf of a set of clients (e.g.

an enterprise)." It explicitly lists the benefits as "Reduces access latency" and "Reduces bandwidth on access link

" which aligns perfectly with the requirements of the satellite office.

3. Kaur

M.

& Singh

S. (2014). A Survey of WAN Optimization Techniques. International Journal of Computer Applications

99(12)

32-36. DOI: 10.5120/17430-8001

Section 3

"WAN Optimization Techniques

" Subsection "Caching/Proxy": "Caching is the most common technique used for WAN optimization. It works by storing frequently accessed data on a local device... This reduces the amount of data that needs to be transmitted over the WAN

which can improve performance and reduce bandwidth costs." This academic survey confirms that caching is a primary and direct method for solving the problem described.

Key stretching is a cryptographic technique specifically designed to enhance the security of password-based systems. It increases the computational work required to verify a password by repeatedly applying a cryptographic hash function to the password and a salt. This process, implemented by algorithms like PBKDF2, bcrypt, and scrypt, makes brute-force and dictionary attacks significantly slower and more resource-intensive for an attacker. This directly addresses the developer's need to improve the cryptographic strength of the password-storage component without replacing the entire crypto-module, as it builds upon existing hash functions.

A. Key splitting: A key management technique for availability and security by distributing parts of a key, not for strengthening password hashing.
B. Key escrow: A key recovery mechanism involving a trusted third party, which does not enhance the cryptographic strength of password storage.
C. Key rotation: A best practice for periodically changing encryption keys to limit the impact of a key compromise; it is not a technique applied to strengthen individual password hashes.
D. Key encryption: The practice of encrypting a key with another key (key wrapping), used for protecting keys at rest, not for strengthening the password hashing process itself. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-132

Recommendation for Password-Based Key Derivation.

Section 2

Introduction: This document states

"A password-based key derivation function (PBKDF) is used to derive a key from a password or passphrase. It is intended to be computationally intensive in order to discourage brute-force attacks on the password." This computational intensity is the core principle of key stretching.

2. National Institute of Standards and Technology (NIST) Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management.

Section 5.1.1.2

Memorized Secret Verifiers: This section mandates that password verifiers (hashes) "SHALL be derived from the memorized secret using a key derivation function (KDF)

such as PBKDF2... The KDF SHALL include a salt and an iteration count." The iteration count is the mechanism for key stretching.

3. Boneh

D. (2020). CS 255: Introduction to Cryptography

Lecture 10 Notes. Stanford University.

Section on "Slowing down the attacker": The lecture notes explain that to defend against offline dictionary attacks

a slow hash function is needed. It introduces PBKDF2 as a standard that "stretches a short key" by applying a pseudorandom function (like HMAC-SHA256) a configurable number of times (e.g.

c=100

000).

4. Provos

N.

& Mazières

D. (1999). A Future-Adaptable Password Scheme. Proceedings of the 1999 USENIX Annual Technical Conference.

Section 2

"Design Goals": This seminal paper

which introduces the bcrypt algorithm

explicitly states a design goal is to make the hashing process slow and computationally expensive. It notes

"The time to check a password on a fast machine should be non-trivial... making a brute-force attack more difficult." This is the foundational concept of key stretching for password security.

Prompt injection is an attack technique that involves crafting malicious inputs to manipulate a Large Language Model (LLM) into performing unintended actions, such as ignoring previous instructions or revealing sensitive information. This attack fundamentally exploits the model's input processing channel. Input sanitation, a security control that involves filtering, validating, and cleaning user-provided data before it is processed, is a direct and primary countermeasure. By sanitizing the prompt, a system can attempt to remove or neutralize the malicious instructions, thereby mitigating the risk of the model being compromised by the injected content.

A. Model inversion: This is a privacy attack that reconstructs sensitive training data by repeatedly querying a model. It is mitigated by techniques like differential privacy, not primarily by input sanitation.
C. Data poisoning: This attack corrupts the model's training dataset to compromise its integrity. It occurs during the training phase, whereas input sanitation is applied during the inference (user interaction) phase.
D. Non-explainable model: This refers to the "black box" nature of complex AI, where it is difficult to understand its decision-making process. This is an inherent characteristic, addressed by Explainable AI (XAI) methods, not input controls. ---

1. OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications. LLM01: Prompt Injection. This document identifies prompt injection as the top vulnerability for LLMs and lists "input validation and sanitization" as a key mitigation strategy. It states, "Implement robust input validation and sanitization to limit adversarial input."

2. NIST. (2023). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST Special Publication 800-218A (Draft). This publication categorizes prompt injection as a type of evasion attack that manipulates inputs at inference time. Section 4 discusses defenses, including input sanitization, as a method to defend against such input-based attacks.

3. Parno, B., et al. (2023). Living with the Trickster: A Foundational Perspective on AI/ML Trust and Safety. Stanford University, Center for Research on Foundation Models (CRFM). The paper discusses LLM vulnerabilities, including prompt injection, framing it as an input-based security problem where the model is tricked by crafted prompts, reinforcing that input control is the relevant defense domain.

The SIEM data displays events routed through two distinct directory/authorization servers: LDAP-US and LDAP-EU. While LDAP-US correctly parses authentication status (Success/Failure) and risk levels (Low/High), every event processed by LDAP-EU reports both Status and Risk as Unknown. A fundamental requirement for effective security monitoring and threat detection is log source integrity and visibility. Before analysts can accurately investigate potential threats, establish baselines, or implement automated controls, logging coverage gaps must be resolved. Therefore, correcting the logging and audit configuration on the LDAP-EU directory server is the most appropriate and immediate action.

B. A single failed login on the ADMIN account does not indicate successful credential stuffing, nor does forced password rotation solve broader monitoring failures.

C. SALES1 successfully accessing payroll might reflect legitimate role overlap, and blocking access outright without verification disrupts standard business operations unnecessarily.

D. Automated account lockout based on single high-risk failures risks widespread denial of service (DoS) and does not fix underlying logging visibility blind spots.

NIST Special Publication 800-92: Guide to Computer Security Log Management, Section 2.1 ("Need for Log Management") and Section 3.2 ("Configuring Log Sources and Ensuring Log Completeness").

NIST Special Publication 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, Section 3.2 ("Analyze Data and Report Findings").

CIS Critical Security Controls (v8): Control 8: Audit Log Management, Safeguard 8.2 ("Collect Audit Logs") and Safeguard 8.5 ("Detailed Audit Logs").

ISO/IEC 27002:2022: Information security, cybersecurity and privacy protection — Information security controls, Control 8.15 ("Logging") and Control 8.16 ("Monitoring activities").

The most appropriate and robust solution to ensure logs are properly retained in an enterprise environment is to use a Security Information and Event Management (SIEM) system. A SIEM is specifically designed to collect, aggregate, normalize, and securely store logs from disparate sources, including legacy platforms. By forwarding the logs from the legacy system to the SIEM, the organization centralizes log management, overcomes the local storage limitations of the legacy platform, and ensures compliance with long-term retention policies mandated by the audit. This approach provides a scalable, secure, and searchable archive for forensic analysis and compliance reporting.

A. A scheduled task is a brittle, localized solution that lacks the centralized management, security, and analytical capabilities inherent in a proper log management infrastructure.
B. Event-based triggers are designed for alerting on specific conditions, not for comprehensive log collection, and would result in incomplete data retention for audit purposes.
D. Building a custom script and database is inefficient, costly to maintain, and less secure than using a dedicated, industry-standard SIEM platform designed for this purpose. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-92

Guide to Computer Security Log Management.

Section 3.1.3

"Log Storage and Retention

" states: "Organizations should also consider using a dedicated log server for centralized log storage... Centralized log storage facilitates long-term log retention and reduces the risk of logs on individual hosts being lost..." A SIEM is a primary example of a system providing this centralized function.

2. Carnegie Mellon University

Software Engineering Institute

"Common Sense Guide to Mitigating Insider Threats

5th Edition."

Practice 17: Deploy a Log Management System

Page 111

recommends organizations to "Aggregate and centrally store logs from all relevant sources (e.g.

network devices

servers

databases

applications)." This directly supports using a central system like a SIEM to solve the problem described.

3. Al-Abassi

A.

Karim

A.

& Al-Ogaili

A. (2017). A Survey of SIEM Tools. In Proceedings of the International Conference on Big Data and Internet of Things (BDIoT’17). ACM

New York

NY

USA

Article 29

pp. 1–6.

Section 2

"SIEM Architecture

" describes the fundamental components of a SIEM

highlighting the "Log collection" and "Log storage" functions. The text explains that a core purpose of a SIEM is to gather logs from various sources (agents or collectors) and store them in a central repository (database or file system) for analysis and retention.

DOI: https://doi.org/10.1145/3175828.3175857

The provided incident response table indicates that the phone system possesses the highest criticality rating ("Critical") and the highest alert severity ("Critical"). According to standard incident handling frameworks, response efforts and automation should be prioritized based on the functional impact and business criticality of the affected systems. To best support rapid incident response, systems designated with critical alert severity require immediate, active notifications to the response team (IT support) to minimize downtime. Automating alerts for the phone system ensures swift action for the organization's most crucial communication asset, directly aligning with its critical risk profile.

B. Dashboards provide passive monitoring. Rapid incident response for critical systems requires active, automated alerting rather than relying on personnel to constantly monitor a dashboard.

C. The public website has low criticality and low alert severity. Generating emails for every failed login would cause alert fatigue and misallocate critical response resources.

D. Human resources systems have only medium criticality. Automated isolation is a drastic containment measure that could unnecessarily disrupt business operations for a non-critical system.

National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61, Revision 2). Section 3.2.6: Prioritizing Incidents, pp. 32-33.

National Institute of Standards and Technology (NIST). (2011). Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations (NIST Special Publication 800-137). Section 3.3: Analyze and Report Findings (Automated Alerting), pp. 45-46.

The problem describes emails being sent to spam, which is a common symptom of email authentication failure. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are the three primary DNS-based technologies used to authenticate email and prevent spoofing. SPF is a TXT record that lists authorized mail servers for a domain. DKIM uses a public key published in a DNS TXT record to verify a digital signature on the email. A reissued certificate often involves new cryptographic keys, requiring an update to the DKIM record. DMARC is a TXT record that defines the policy for handling emails that fail SPF or DKIM checks. Updating these three records ensures that the sender's identity is properly authenticated by receiving mail servers, which resolves the issue of legitimate emails being marked as spam.

D. DNSSEC: Secures DNS records from tampering but does not directly authenticate the email sender's identity to prevent spam classification.
E. SASC: Not a standard DNS record type or a recognized acronym related to email security or DNS.
F. SAN: A field within a digital certificate specifying additional hostnames, not a type of DNS record to be updated.
G. SOA: Contains administrative zone data; updating it is a procedural step but does not fix the underlying email authentication failure.
H. MX: Directs email traffic to the correct mail server but does not authenticate the messages, which is the root cause of the spam issue. ---

1. Internet Engineering Task Force (IETF) RFC 7489, "Domain-based Message Authentication, Reporting, and Conformance (DMARC)": Section 3, "How DMARC Works," explicitly states that DMARC is a mechanism that "uses the results of SPF and DKIM" to determine the authenticity of an email message and provides instructions to receiving mail servers on how to handle authentication failures. This establishes the interconnectedness of all three records.

2. Internet Engineering Task Force (IETF) RFC 6376, "DomainKeys Identified Mail (DKIM) Signatures": Section 3.6.2, "The TXT Resource Record," details how the public key used to verify the email's signature is stored in a DNS TXT record. A change in the server's keys, which can occur during a certificate reissue, would necessitate updating this DNS record.

3. Internet Engineering Task Force (IETF) RFC 7208, "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email": Section 3.1, "Publication," specifies that the SPF policy for a domain is published as a TXT record in the DNS, which is used by receivers to verify the sending mail server's IP address.

4. MIT Information Systems and Technology (IS&T) Knowledge Base, "What are SPF, DKIM, and DMARC?": This university resource explains, "SPF, DKIM, and DMARC are three email authentication methods that help prevent spammers from sending messages on behalf of your domain... When properly configured, these records also help legitimate messages from being marked as spam." This directly links the three records to solving the problem described in the scenario.

5. Google Workspace Admin Help, "Ensure mail delivery & prevent spoofing (SPF, DKIM, DMARC)": This official vendor documentation states, "We strongly recommend you always set up these email authentication methods for Gmail: SPF, DKIM, DMARC... [They] help protect your domain against spoofing, and help prevent your outgoing messages from being marked as spam." This confirms that all three are required to fix deliverability issues.

The authentication log demonstrates that conditional access policies require a user's physical source location to match their assigned location (France). Users SALES1 and ACCT1 connecting from public IP address 8.11.4.16 are blocked because the authentication server resolves their source location to Germany, despite MFA being satisfied. In contrast, user SALES2 connecting from 8.11.4.20—an adjacent host within the exact same /24 network block—is mapped to France and successfully permitted. IP geolocation databases periodically contain localized mapping errors or outdated table assignments for specific address ranges. Because the authentication server erroneously resolves 8.11.4.16 to Germany, legitimate sign-ins fail the location-boundary compliance check.

A: While private IP 192.168.4.18 bypasses MFA internally, this reflects an intentional intranet policy and does not cause external access from 8.11.4.16 to be blocked.

C: Neither SALES1 nor ACCT1 are administrator accounts, and the access failure is triggered by a geographic boundary mismatch rather than role-based privileged access policies.

D: The log explicitly shows MFA status as "Yes" for all blocked events, proving that multi-factor authentication was successfully completed and OTP configuration is not the issue.

IETF: Kline, E., & Duleba, K. (2020). A Format for Self-Published IP Geolocation Feeds. RFC 8805, RFC Editor. Section 1 ("Motivation") and Section 3.3 ("Verification of Accuracy").

NIST: Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. National Institute of Standards and Technology (NIST) Special Publication 800-207. Section 3.1 ("Threats Associated with Zero Trust Architecture: Context and Location Evaluation").

NIST: Grassi, P. A., Fenton, J. L., et al. (2020). Digital Identity Guidelines: Authentication and Lifecycle Management. National Institute of Standards and Technology (NIST) Special Publication 800-63B. Section 5.3 ("Risk-Based Authentication and Anomaly Detection").

Peer-Reviewed Journal: Komosny, D. (2023). "Evidential value of country location evidence obtained from IP address geolocation." PeerJ Computer Science, 9, e1305. https://doi.org/10.7717/peerj-cs.1305

Vendor Documentation: Microsoft Corporation. (2024). Conditional Access: Conditions – Location. Microsoft Learn. Section: "Location evaluation and IP address geolocation databases." Document ID: entra-id/conditional-access/concept-conditional-access-conditions#locations.

The log snippet indicates a successful DNS zone transfer (qrytype: AXFR) was executed from an external IP address (19.27.214.22). This type of query allows an attacker to download the entire DNS zone file, revealing the internal network topology, hostnames, and IP addresses of sensitive servers (e.g., directoryserver1, msn-crit-apcs). This information is invaluable for reconnaissance and subsequent lateral movement. The most direct and effective mitigation is to configure the DNS server to disable or strictly control zone transfers, permitting them only from the IP addresses of authorized secondary DNS servers and denying all others.

B. Restricting DNS traffic to UDP/53: This is incorrect because while most standard queries use UDP, zone transfers and large responses legitimately require TCP. Blocking TCP/53 entirely would break necessary DNS functions.
C. Implementing DNS masking on internal servers: This is incorrect because while split-horizon DNS is a good practice, it does not prevent the zone transfer itself. A misconfigured server could still allow the transfer of the internal zone view.
D. Permitting only clients from internal networks to query DNS: This is incorrect as it would block all legitimate external queries for public resources (e.g., the company website), rendering public-facing services inaccessible to the internet. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-81-2

Secure Domain Name System (DNS) Deployment Guide. Section 3.3.1

"Restrict Zone Transfers

" states

"Zone transfers should be restricted to prevent unauthorized users from obtaining a copy of a zone’s contents... DNS servers should be configured to allow zone transfers only to explicitly authorized servers." This directly supports disabling open zone transfers. (Page 16).

2. Internet Systems Consortium (ISC)

BIND 9.18.24 Administrator Reference Manual. The documentation for the allow-transfer option specifies its use for creating an access control list (ACL) of hosts permitted to receive zone transfers. The default is to allow transfers to all hosts

which is insecure. The manual guides administrators to restrict this to only known

trusted secondary servers. (Section: "The allow-transfer option").

3. University of California

Berkeley. CS 161: Computer Security

Lecture 18: Network Security II. Course materials discuss DNS security vulnerabilities

explicitly identifying zone transfers (AXFR) as a method for attackers to map an entire internal network. The recommended countermeasure is to configure DNS servers to restrict zone transfers to only authorized secondary name servers.