20+ practice questions focused on Security Engineering and Cryptography — one of the most tested topics on the CompTIA SecurityX CAS-004 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Engineering and Cryptography PracticeA security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?
Explanation: FIDO2/WebAuthn uses public key cryptography and is designed to resist phishing; it supports passwordless authentication. TOTP/HOTP are time-based and can be phished. X.509 certificates are not inherently passwordless. Kerberos requires passwords or tickets.
A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?
Explanation: The best method is to use a CRL issued by the compromised CA, marking all its unexpired certificates as revoked. Revoking the CA certificate itself invalidates all certificates issued by it, including valid ones. Distributing a new CRL from the root CA would require the root to be online. Individual certificate revocation is inefficient.
A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?
Explanation: SHA-3 is not vulnerable to length extension attacks and offers good performance. SHA-256 is vulnerable to length extension. BLAKE3 is fast but less standardized. MD5 is broken and insecure.
An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?
Explanation: AH provides authentication and integrity without encryption. Transport mode is used for end-to-end communication, while tunnel mode is for gateway-to-gateway. Since this is between sites (gateways), tunnel mode is appropriate. AH in transport mode is for host-to-host. ESP provides confidentiality. AH in tunnel mode is correct.
A security analyst is configuring a TPM 2.0 for a new fleet of laptops. The requirement is to ensure that only authorized operating systems can boot and that any tampering with the boot process is detected. Which TPM feature should be used?
Explanation: Measured boot records measurements of boot components in PCRs, and attestation allows a remote verifier to check these measurements. Secure boot only verifies signatures, not measurements. Sealed storage ties data to PCR values. Key attestation is for keys.
+15 more Security Engineering and Cryptography questions available
Practice all Security Engineering and Cryptography questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Engineering and Cryptography. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Engineering and Cryptography questions on the CAS-004 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Engineering and Cryptography is tested as part of the CompTIA SecurityX CAS-004 blueprint. Practicing with targeted Security Engineering and Cryptography questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CAS-004 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Engineering and Cryptography is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Engineering and Cryptography practice session with instant scoring and detailed explanations.
Start Security Engineering and Cryptography Practice →