Free SecurityX Security Architecture Practice Questions | CAS-005

This domain represents 27% of CAS-005 and covers enterprise architecture, zero trust, cloud and hybrid design, trust boundaries, data flows, resilience, and secure integration.

Sample Question 1 — Security Architecture

A water utility wants to detect malicious commands on the network link between its SCADA servers and field controllers. Engineers insist that no security device may drop, delay, or alter traffic on this link, because a false positive could disrupt water treatment. Which of the following designs best meets these requirements?

  1. A. A next-generation firewall placed between servers and controllers
  2. B. A passive IDS that receives a copy of traffic from a network tap (Correct answer)
  3. C. A web application firewall in front of the SCADA servers
  4. D. An inline IPS configured to block known malicious commands

Correct answer: B

Explanation: B is correct because a network tap copies traffic to a passive IDS out of band, so threats are detected without any device sitting inline where it could block or delay control traffic. A is incorrect because an inline firewall can block or delay traffic and does not satisfy the requirement. C is incorrect because a WAF inspects HTTP traffic to web applications and sits inline, so it fits neither the protocol nor the requirement. D is incorrect because an inline IPS can drop legitimate traffic after a false positive, which the engineers have ruled out.

Sample Question 2 — Security Architecture

A company's perimeter firewall allows HTTPS to web servers in its screened subnet. Attackers continue to exploit known vulnerabilities in the servers' software through these allowed connections. The company wants to automatically block such exploit attempts in real time. Where should an IPS be placed?

  1. A. Inline between the perimeter firewall and the screened subnet (Correct answer)
  2. B. Outside the perimeter firewall, before any traffic filtering occurs
  3. C. On a SPAN port of the core switch in the internal network
  4. D. On each employee workstation as a host-based agent

Correct answer: A

Explanation: A is correct because placing an IPS inline on the path to the web servers lets it inspect permitted traffic and block exploit attempts before they reach the servers. B is incorrect because outside the firewall, the IPS would spend resources on traffic the firewall would drop anyway, and the placement is not required to protect the servers. C is incorrect because a device on a SPAN port receives only copies of traffic and cannot block attacks, and the core switch is not on the path to the screened subnet. D is incorrect because workstation agents do not inspect traffic headed to servers in the screened subnet.

Sample Question 3 — Security Architecture

A security team needs a full-fidelity copy of all traffic on a 10 Gbps data center link for forensic packet capture. Previous captures from a switch SPAN port dropped packets during busy periods and omitted malformed frames. Which of the following should the team deploy?

  1. A. A NetFlow collector attached to the core router
  2. B. A forward proxy that logs all outbound connections
  3. C. A passive network tap on the link (Correct answer)
  4. D. An additional SPAN session on a second switch

Correct answer: C

Explanation: C is correct because a network tap copies every frame at the physical layer, including errors, without depending on switch resources, so it provides complete captures even under heavy load. A is incorrect because NetFlow records traffic metadata only and does not capture full packets. B is incorrect because a proxy logs application-layer requests it handles and does not capture all link traffic. D is incorrect because a second SPAN session is still processed by the switch and can drop packets and filter malformed frames.

Sample Question 4 — Security Architecture

A retailer operates 300 stores, each with a small bandwidth-limited connection. Sending raw logs from every store device directly to the central SIEM saturates the links, and logs are lost when a link goes down. Which of the following is the best design?

  1. A. Disable logging on store devices except for point-of-sale terminals
  2. B. Configure every store device to send logs over UDP syslog to the SIEM
  3. C. Reduce log retention at the central SIEM from one year to 90 days
  4. D. Deploy a local log collector at each store to buffer and forward logs (Correct answer)

Correct answer: D

Explanation: D is correct because local collectors aggregate logs near the source, reduce bandwidth through filtering and compression, and buffer data during outages so logs are not lost. A is incorrect because disabling logging creates visibility gaps and may violate compliance requirements. B is incorrect because UDP syslog is connectionless and loses messages during congestion or outages. C is incorrect because retention affects storage at the SIEM, not bandwidth usage or losses at the stores.

Sample Question 5 — Security Architecture

A company's only vulnerability scanner sits in the screened subnet. Scans of internal server segments are incomplete because internal firewalls block most scanner traffic, and opening broad firewall rules is not allowed. Which of the following is the best solution?

  1. A. Deploying scan engines inside each internal segment that report to a central console (Correct answer)
  2. B. Opening all TCP and UDP ports from the scanner to every internal subnet
  3. C. Scanning internal segments only from the internet using an external scanning service
  4. D. Replacing active scanning with a quarterly manual review of server configurations

Correct answer: A

Explanation: A is correct because distributed scan engines placed within each segment can scan local systems fully without broad firewall exceptions, while a central console consolidates results. B is incorrect because broad firewall rules are not allowed and would weaken segmentation. C is incorrect because external scans see only what is exposed to the internet and cannot assess internal servers. D is incorrect because infrequent manual reviews miss vulnerabilities and do not scale.

Sample Question 6 — Security Architecture

Visitors in a company's conference rooms have plugged personal laptops into wall network ports and gained access to internal systems. The company wants only managed, compliant devices to join the corporate network, while other devices are placed on a restricted network. Which of the following should the company implement?

  1. A. A forward proxy that filters outbound internet traffic
  2. B. A web application firewall in front of internal applications
  3. C. Network access control using 802.1X with posture assessment (Correct answer)
  4. D. An IDS that monitors traffic from conference room ports

Correct answer: C

Explanation: C is correct because NAC authenticates devices with 802.1X, checks posture such as patch and EDR status, and places non-compliant or unknown devices on a quarantine or guest VLAN. A is incorrect because a forward proxy controls web access, not whether a device may join the internal network. B is incorrect because a WAF protects web applications but does not control which devices connect to the network. D is incorrect because an IDS can detect suspicious traffic but does not prevent unauthorized devices from connecting.

Sample Question 7 — Security Architecture

A company wants to protect a customer-facing web application from SQL injection and cross-site scripting. All traffic is encrypted with TLS, and the load balancer terminates TLS before forwarding requests to the web servers. Where should a web application firewall be placed so it can inspect requests effectively?

  1. A. On a SPAN port that receives a copy of encrypted internet traffic
  2. B. Between the web servers and the database servers on the internal network
  3. C. In front of the load balancer without access to the TLS private keys
  4. D. Between the load balancer and the web servers, where traffic is already decrypted (Correct answer)

Correct answer: D

Explanation: D is correct because a WAF must see decrypted HTTP requests to detect injection and XSS payloads, so placing it after TLS termination, or integrating it with the load balancer, allows effective inspection. A is incorrect because a passive copy of encrypted traffic can be neither inspected nor blocked. B is incorrect because at that point, traffic is database protocol, not HTTP, so the WAF cannot evaluate web requests. C is incorrect because without decryption, the WAF cannot inspect HTTP payloads for injection or XSS.

Sample Question 8 — Security Architecture

A company wants to control which websites employees can reach, block malware download categories, and keep a log of each user's outbound web requests for investigations. Which of the following components best meets these requirements?

  1. A. A reverse proxy in front of internal web servers
  2. B. A content delivery network for the corporate website
  3. C. A load balancer for the company's web applications
  4. D. A forward proxy that authenticates users (Correct answer)

Correct answer: D

Explanation: D is correct because a forward proxy mediates outbound web requests on behalf of users, enforces category filtering, and logs requests tied to authenticated identities. A is incorrect because a reverse proxy handles inbound requests to internal servers, not employees' outbound browsing. B is incorrect because a CDN caches and serves the company's content to outside visitors, not employee web access. C is incorrect because a load balancer distributes inbound traffic among servers and does not filter outbound browsing.

Sample Question 9 — Security Architecture

A company hosts five internal web applications that it wants to publish to the internet. It wants a single public entry point, TLS termination in one place, and no direct exposure of the applications' servers or internal IP addresses. Which of the following should the company deploy?

  1. A. A site-to-site VPN
  2. B. A forward proxy
  3. C. A network tap
  4. D. A reverse proxy (Correct answer)

Correct answer: D

Explanation: D is correct because a reverse proxy accepts client requests on behalf of back-end servers, terminates TLS, routes requests to the correct application, and hides internal server details. A is incorrect because a site-to-site VPN connects networks privately and does not publish applications to the public. B is incorrect because a forward proxy handles outbound requests from internal users, not inbound requests from the internet. C is incorrect because a network tap passively copies traffic for monitoring and does not publish applications.

Sample Question 10 — Security Architecture

A media company serves large static files, such as images and videos, to users worldwide. Users in distant regions report slow load times, and the company has been hit by volumetric DDoS attacks against its origin servers. Which of the following best addresses both issues?

  1. A. Adding a forward proxy for users in each region
  2. B. Deploying an IDS in front of the origin servers
  3. C. Scaling the origin servers vertically with more CPU and memory
  4. D. Placing a content delivery network in front of the origin servers (Correct answer)

Correct answer: D

Explanation: D is correct because a CDN caches content at edge locations close to users, reducing latency, and its distributed capacity absorbs volumetric attacks before they reach the origin. A is incorrect because the company cannot install proxies for its worldwide users, and forward proxies do not protect origin servers. B is incorrect because an IDS detects malicious traffic but neither blocks floods nor improves latency. C is incorrect because larger servers in one location do not reduce distance-based latency and can still be overwhelmed by volumetric attacks.

SecurityX practice-test hub · Mixed quick-start test