hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Implementing a hardware security module (HSM) to…
A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?
⚠ Common exam trap
Many exam-takers confuse Level 3's tamper-evident requirements with Level 4's tamper-resistant automatic zeroization, leading them to select Option E instead of recognizing that Level 3 only requires tamper-evident coatings and seals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tamper-evident coatings and seals
FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-based authentication only
Why it's wrong here
Role-based is acceptable, but identity-based is more specific and required for Level 3; but the question asks for TWO features, and role-based alone is not enough.
- ✓
Tamper-evident coatings and seals
Why this is correct
Level 3 requires tamper evidence.
- ✓
Identity-based authentication for operators
Why this is correct
Level 3 requires identity-based authentication.
- ✗
Ability to export keys in plaintext
Why it's wrong here
Exporting plaintext keys would violate the security policy.
- ✗
Tamper resistance with automatic zeroization
Why it's wrong here
Tamper resistance with zeroization is a Level 4 requirement.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.