CAS-005 Practice Questions

Question 1

Which TWO of the following are key elements of a data classification policy?

Accepted Answer

Handling and labeling procedures. Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Answer

Acceptable use guidelines for company devices

Answer

Backup frequency and retention periods

Answer

Encryption algorithms and key lengths

Question 2

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 3

A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?

Accepted Answer

SHA-3. SHA-3 is not vulnerable to length extension attacks and offers good performance. SHA-256 is vulnerable to length extension. BLAKE3 is fast but less standardized. MD5 is broken and insecure.

Answer

BLAKE3

Answer

SHA-256

Answer

MD5

Question 4

Which of the following is a primary function of a Cloud Access Security Broker (CASB)?

Accepted Answer

Enforce security policies between users and cloud applications. A CASB acts as an intermediary between users and cloud services, enforcing security policies such as access control, data loss prevention, and visibility into cloud application usage.

Answer

Scan container images for vulnerabilities

Answer

Provide IAM for cloud infrastructure

Answer

Monitor network traffic at the packet level

Question 5

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 6

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 7

An analyst wants to automate incident response tasks in a SOC environment. Which THREE scripting languages are commonly used for automation? (Choose three.)

Accepted Answer

Python. Python is correct because it is a versatile, high-level scripting language widely used in SOC automation for tasks such as parsing logs, interacting with REST APIs, and orchestrating incident response workflows. Its extensive libraries (e.g., requests, pandas, and boto3 for AWS) and cross-platform support make it ideal for automating repetitive security operations tasks.

Answer

Java

Answer

COBOL

Question 8

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 9

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Accepted Answer

OAuth 2.0 tokens. OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

Answer

LDAP binds

Answer

SAML assertions

Answer

Kerberos tickets

Question 10

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Accepted Answer

Add an SELinux policy module to allow httpd_t to connectto unconfined_t. The web server (httpd_t) is denied access to the local database socket because SELinux enforces mandatory access controls. Adding an SELinux policy module that allows httpd_t to connect to unconfined_t (the domain of the database socket) grants the necessary permission without disabling security. This is the targeted fix that preserves SELinux protection while resolving the connectivity issue.

Answer

Disable SELinux entirely

Answer

Restart the httpd service

Answer

Change the SELinux enforcing mode to permissive

Question 11

During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?

Accepted Answer

Perform a memory capture using a tool like DumpIt or winpmem. In digital forensics, the order of volatility dictates that volatile data (e.g., running processes, network connections) should be collected first because it is lost when the system is powered down. Memory capture preserves this data, including process information and active network connections.

Answer

Export the Windows event logs related to network activity

Answer

Execute a network scan from the compromised host to identify active connections

Answer

Capture a full disk image using FTK Imager

Question 12

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

Accepted Answer

Use selective authentication and restrict the authorized accounts. Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint. Disabling the trust is not practical.

Answer

Remove the trust entirely and use individual local accounts

Answer

Configure the trust to use forest-wide authentication instead of selective

Answer

Enable SID filtering on both forest trusts

Question 13

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Question 14

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 15

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

CompTIA SecurityX (CAS-005) CAS-005 practice test

Three ways to study

Study CAS-005 by domain

Study CAS-005 by topic

Security Architecture practice questions

Security Engineering practice questions

Security Operations practice questions

Governance, Risk, and Compliance practice questions

CAS-005 fundamentals practice questions

CAS-005 scenario practice questions

CAS-005 troubleshooting practice questions

Top CAS-005 questions

CompTIA SecurityX (CAS-005) practice questions

How to use these CAS-005 questions

Quick answer