20+ practice questions focused on Security Engineering — one of the most tested topics on the CompTIA SecurityX (CAS-005) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Engineering PracticeA security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?
Explanation: FIDO2/WebAuthn uses public key cryptography and is designed to resist phishing; it supports passwordless authentication. TOTP/HOTP are time-based and can be phished. X.509 certificates are not inherently passwordless. Kerberos requires passwords or tickets.
A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?
Explanation: The best method is to use a CRL issued by the compromised CA, marking all its unexpired certificates as revoked. Revoking the CA certificate itself invalidates all certificates issued by it, including valid ones. Distributing a new CRL from the root CA would require the root to be online. Individual certificate revocation is inefficient.
A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?
Explanation: SHA-3 is built on the Keccak sponge construction, which is structurally immune to length extension attacks — unlike SHA-256, whose Merkle–Damgård construction is vulnerable when used naively as a MAC. SHA-3 also offers strong performance on modern 64-bit hardware and is the NIST-standardized successor family (FIPS 202), making it the best fit for integrity verification where length extension resistance is required.
A security analyst is configuring a TPM 2.0 for a new fleet of laptops. The requirement is to ensure that only authorized operating systems can boot and that any tampering with the boot process is detected. Which TPM feature should be used?
Explanation: Measured boot records measurements of boot components in PCRs, and attestation allows a remote verifier to check these measurements. Secure boot only verifies signatures, not measurements. Sealed storage ties data to PCR values. Key attestation is for keys.
A web server is configured to use TLS 1.3. Which of the following is a key security benefit of TLS 1.3 over earlier versions?
Explanation: TLS 1.3 provides forward secrecy by default, meaning session keys are not compromised even if the server's long-term private key is compromised. 0-RTT is a performance feature but can be vulnerable to replay. Removed cipher suites is a cleanup. Certificate pinning is not part of TLS 1.3.
+15 more Security Engineering questions available
Practice all Security Engineering questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Engineering. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Engineering questions on the CAS-005 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Engineering is tested as part of the CompTIA SecurityX (CAS-005) blueprint. Practicing with targeted Security Engineering questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CAS-005 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Engineering is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Engineering practice session with instant scoring and detailed explanations.
Start Security Engineering Practice →