CAS-005 DAY 4

During a penetration test, multiple web services lack certificate validation. What control helps?

An org is implementing Zero Trust. Which concept is critical to limit internal lateral movement?

How should an org secure API traffic between microservices?

To detect threats in hybrid environments, which mechanism provides real-time data?

Which SDLC phase is best for integrating threat modeling into the process?

What secure development technique identifies vulnerabilities before app execution?

A dev team is required to verify open-source library safety. What helps most?

Whare are the famous Spanish steps?

In a federated SSO system, which entity provides identity assertions to service providers?

In which city will all fish and chip shops agree to deep fry anything in batter?

An enterprise uses WAFs and IPS at different layers. What model is being applied?

A healthcare provider must classify patient records. What method supports this best?

What does an organization use to enforce least privilege during provisioning?

Which method ensures container images used in CI/CD are trusted and untampered?

What element of RASP distinguishes it from traditional runtime security?

In Zero Trust, what supports automated decisions based on session attributes?

To protect against software supply chain attacks, what practice is most effective?

A company wants to prevent unauthorized access to cloud APIs. Which method is most effective?

Which technology enables proactive cloud workload visibility and policy enforcement?

How can an org reduce risk of expired certs in large-scale systems?

Which component in a Zero Trust model controls access based on user and context?

What control is most effective at minimizing attack surface in legacy applications?

Which design principle aligns with Zero Trust for cloud resource access?

What tool is best for validating infrastructure configuration against baselines?

An org implements tagging across data stores. What benefit does this provide?

An org uses dynamic scaling with cloud VMs. What architectural concern is most relevant?

In PKI, which mechanism checks revocation status of a certificate in real-time?

What secure architecture element helps isolate workloads by user role?

A new app integrates 3rd-party authentication. Which risk must be addressed?

An e-commerce firm uses a CDN. What is a primary benefit for security?

What is the capital city of Spain

Which cloud model limits the customer's control over hardware-level protections?

In cloud architecture, what mitigates insecure storage configuration exposure?