easyMultiple Choice
CAS-004 Practice Question: A cloud-based application uses serverless…
A cloud-based application uses serverless functions to process user uploads. Which of the following is the most effective way to limit the attack surface of the function?
⚠ Common exam trap
CompTIA often tests the misconception that perimeter defenses like WAFs or encryption are the primary way to secure serverless functions, when in fact the shared responsibility model places code-level attack surface reduction as the most effective control for serverless compute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Minimize the function's dependencies and reduce its code footprint
Minimizing the function's dependencies and reducing its code footprint directly shrinks the attack surface by eliminating unnecessary libraries, packages, and code paths that could contain vulnerabilities. In serverless architectures, the function's runtime environment is ephemeral and stateless, so every added dependency increases the risk of supply-chain attacks or unpatched flaws. This aligns with the principle of least functionality, which is more effective than perimeter controls for serverless compute.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all data at rest using KMS
Why it's wrong here
KMS encryption at rest protects stored data if the underlying storage is compromised, but it does nothing to reduce the code paths an attacker can reach through the function's event triggers and dependencies. It is tempting because encryption is a common compliance control, yet it would be correct for meeting data-confidentiality requirements, not for shrinking attack surface.
- ✗
Enable detailed logging and monitoring
Why it's wrong here
Logging and monitoring provide detection and forensic visibility after an event, but they do not remove any exploitable entry point from the function itself. It is tempting because observability underpins incident response, yet it would be correct when the goal is auditing or threat detection rather than reducing the attack surface.
- ✗
Place a web application firewall (WAF) in front of the function
Why it's wrong here
A WAF filters HTTP traffic to web endpoints, but serverless functions are invoked through event sources such as S3 or SQS that bypass HTTP inspection entirely. It is tempting because WAFs block injection and bot traffic, yet it would be correct for a public web application, not for limiting a function's invocation paths.
- ✓
Minimize the function's dependencies and reduce its code footprint
Why this is correct
Fewer dependencies and less code shrink the vulnerable surface available to attackers, since each library and line is potential exploit material. This directly limits the attack surface of the serverless function, satisfying the stem's constraint without relying on runtime controls.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.