hardMultiple SelectObjective-mapped
CAS-004 Practice Question: A DevOps team is automating server configuration…
A DevOps team is automating server configuration using configuration management tools. Which THREE principles should be followed to ensure secure automation? (Choose three.)
⚠ Common exam trap
The CompTIA CASP+ exam often tests the distinction between security-specific practices (e.g., secret management, least privilege) and general DevOps best practices (e.g., unit testing), leading candidates to mistakenly select Option E as a security principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets in encrypted variables or vaults
Storing secrets in encrypted variables or vaults (e.g., HashiCorp Vault, Ansible Vault, or AWS Secrets Manager) ensures that sensitive data like API keys and passwords are never exposed in plaintext within scripts or version control. This prevents credential leakage during automation execution and adheres to security best practices for configuration management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store secrets in encrypted variables or vaults
Why this is correct
Encrypting secrets prevents exposure in scripts or logs.
- ✓
Implement least privilege for automation agents
Why this is correct
Least privilege limits the impact of a compromised automation agent.
- ✓
Use idempotent scripts to ensure consistent state
Why this is correct
Idempotent scripts reduce risk of unexpected changes and configuration drift.
- ✗
Hardcode credentials in automation scripts
Why it's wrong here
Hardcoding exposes credentials to anyone with script access.
- ✗
Perform unit testing on scripts
Why it's wrong here
Unit testing improves reliability but is not a direct security principle.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.