CompTIA · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
27% of exam · 6 sample questions below
A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?
Creating a single perimeter around the entire network
Isolating workloads at the virtual network interface level with granular security policies
This accurately defines micro-segmentation in a zero trust model.
Using VLANs to separate departments
Implementing a VPN for remote access
An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?
Zero trust
Shared responsibility model
Correctly describes the division of security responsibilities in cloud computing.
Software-defined perimeter
Defense in depth
A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?
AWS Direct Connect
Direct Connect provides a dedicated private connection meeting the requirements.
Site-to-site VPN over the internet
AWS Client VPN
AWS Transit Gateway with internet gateway
A company is deploying a cloud access security broker (CASB) to gain visibility into shadow IT. Which mode of operation would allow the CASB to inspect traffic without requiring proxy configuration on endpoints?
Reverse proxy mode
Inline mode
API-based mode
API-based mode uses cloud provider APIs for out-of-band visibility.
Forward proxy mode
A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?
Secrets management
Pod Security Policies
Pod Security Policies define constraints for pod creation.
Network policies
RBAC
An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?
RSA-4096
CRYSTALS-Kyber
Correct NIST-selected KEM.
ECDHE
CRYSTALS-Dilithium
Want more Security Architecture practice?
Practice this domain31% of exam · 6 sample questions below
A security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?
Kerberos with PKINIT
FIDO2/WebAuthn
FIDO2/WebAuthn uses device-bound keys and is phishing-resistant, enabling passwordless authentication.
TOTP/HOTP
X.509 certificates with smart cards
A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?
Re-issue all certificates from a different issuing CA without revocation
Use OCSP to individually check and revoke each certificate
Publish a CRL from the compromised CA listing all certificates it issued
Publishing a CRL from the compromised CA marks those certificates as revoked, while the CA certificate remains valid for CRL issuance.
Revoke the compromised CA certificate and issue a new CRL from the root CA
A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?
BLAKE3
SHA-256
SHA-3
SHA-3 is resistant to length extension attacks and is a NIST standard.
MD5
An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?
ESP in tunnel mode
AH in tunnel mode
AH provides integrity and authentication without encryption; tunnel mode is for site-to-site VPNs.
AH in transport mode
ESP in transport mode
A security analyst is configuring a TPM 2.0 for a new fleet of laptops. The requirement is to ensure that only authorized operating systems can boot and that any tampering with the boot process is detected. Which TPM feature should be used?
Secure boot
Measured boot with attestation
Measured boot records boot measurements in PCRs; attestation allows verification of those measurements.
Sealed storage
Key attestation
A web server is configured to use TLS 1.3. Which of the following is a key security benefit of TLS 1.3 over earlier versions?
Removal of weak cipher suites
Support for 0-RTT handshake
Mandatory certificate pinning
Forward secrecy for all key exchanges
TLS 1.3 mandates ephemeral Diffie-Hellman key exchanges, ensuring forward secrecy.
Want more Security Engineering practice?
Practice this domain22% of exam · 6 sample questions below
During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?
Export the Windows event logs related to network activity
Execute a network scan from the compromised host to identify active connections
Capture a full disk image using FTK Imager
Perform a memory capture using a tool like DumpIt or winpmem
Memory capture preserves the most volatile data, including running processes and network connections, which is critical for identifying malicious processes.
A security analyst is investigating a potential advanced persistent threat (APT) that has evaded traditional signature-based defenses. The analyst hypothesizes that the attacker is using a specific technique from the MITRE ATT&CK framework: process injection. Which threat hunting methodology is most appropriate for this scenario?
TTP-driven hunting by analyzing adversary behaviors mapped to the ATT&CK framework
Hypothesis-driven hunting based on a specific technique (process injection) and searching for evidence in memory and process activity
Hypothesis-driven hunting starts with a hypothesis about adversary behavior and proactively searches for evidence, making it ideal for detecting novel or evasive techniques.
Automated hunting using SIEM correlation rules that trigger on known malicious file hashes
IoC-driven hunting using known indicators of compromise from open-source feeds
A security operations center (SOC) is implementing a SOAR platform to automate responses to phishing incidents. The playbook will include steps to automatically quarantine suspicious emails, delete them from user mailboxes, and block the sender's domain. Which element should the SOAR playbook incorporate to ensure the automated response does not cause unintended disruption?
An automatic rollback script that restores quarantined emails after 24 hours if no user complaint
Integration with threat intelligence to verify the sender domain reputation score before blocking
A confirmation step that prompts the analyst to approve the quarantine and deletion actions
Having the analyst approve destructive actions like deletion reduces the risk of removing legitimate emails.
A manual approval step before executing any automated response
A vulnerability management team is prioritizing patches for a large number of vulnerabilities discovered in a quarterly scan. A critical vulnerability in a widely used application has a CVSS base score of 9.8, but it is not currently being exploited in the wild and the application is not directly exposed to the internet. According to CVSS scoring principles, which factors should the team consider to adjust the priority?
The number of other vulnerabilities in the same software product
The age of the vulnerability since its disclosure
Temporal metrics including exploit code maturity and remediation level
Environmental metrics such as collateral damage potential and target distribution
Environmental metrics allow customization for the organization's environment, including asset criticality and exposure, which directly affects risk.
During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which technique is most commonly used for lateral movement in a Windows environment?
SQL injection
Cross-site scripting (XSS)
Pass-the-Hash
Pass-the-Hash enables lateral movement by using harvested password hashes to authenticate to other systems.
ARP spoofing
An organization is deploying deception technology to detect lateral movement by attackers. Which of the following would be the most effective to detect an attacker who has gained access to the internal network and is attempting to move to a sensitive server?
A honeytoken in the form of a fake password file on a file server
Honeytokens like fake credentials are effective because they trigger alerts when an attacker attempts to use them for authentication.
A network-based intrusion detection system (NIDS) on the segment
A honeypot configured to mimic a high-value database server
An endpoint detection and response (EDR) agent on all workstations
Want more Security Operations practice?
Practice this domain20% of exam · 6 sample questions below
A security analyst is calculating the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $5,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?
$0
$5,200
$1,000
Correct: $5,000 × 0.2 = $1,000.
$25,000
A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?
Incorporating privacy controls during the initial system architecture
Correct: Privacy by design requires proactive embedding of privacy in design.
Encrypting data at rest only
Performing an annual privacy audit
Providing privacy training to employees
A financial institution is required to comply with SOX. Which of the following is a primary focus of this regulation?
Privacy of personal data for EU citizens
Accuracy of financial reporting and internal controls
Correct: SOX mandates controls to ensure financial reporting accuracy.
Security of health information
Protection of cardholder data
An organization has identified a vulnerability in a legacy system that cannot be patched. The system is critical for operations, and the cost of mitigating the vulnerability exceeds the potential loss. Which risk treatment option is most appropriate?
Risk acceptance
Correct: The organization accepts the residual risk because mitigation is too expensive.
Risk avoidance
Risk mitigation
Risk transfer
A security manager is evaluating two risk quantification approaches: Factor Analysis of Information Risk (FAIR) and a qualitative heat map. Which of the following is a key advantage of using FAIR over the qualitative heat map?
FAIR is the only framework recognized by NIST
FAIR is easier to communicate to non-technical stakeholders
FAIR requires less data and expertise to implement
FAIR provides a monetary value for risk, enabling ROI calculations
Correct: FAIR produces dollar figures for risk, supporting cost-benefit decisions.
During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?
The design and operating effectiveness of controls over a period of time
Correct: SOC 2 Type II assesses control effectiveness over a period.
The vendor's financial stability
The vendor's compliance with privacy laws
The vendor's penetration test results
Want more Governance, Risk, and Compliance practice?
Practice this domainThe CAS-005 exam has 90 questions and must be completed in 165 minutes. The passing score is 700/1000.
Advanced scenario questions on enterprise security architecture, cryptography, governance, risk management, and integration of security controls. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 4 domains: Security Architecture, Security Engineering, Security Operations, Governance, Risk, and Compliance. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official CompTIA CAS-005 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.