mediumMultiple Choice
CAS-004 Practice Question: A financial institution needs to ensure that…
A financial institution needs to ensure that transaction logs are tamper-proof after creation. Which solution should be implemented?
⚠ Common exam trap
CompTIA CASP+ often tests the distinction between integrity (hash chaining) and non-repudiation (digital signatures), leading candidates to choose digital signatures because they associate them with 'proof'—but signatures alone do not enforce sequential ordering or detect reordering/deletion, which is the core requirement for tamper-proof logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cryptographic hashing with chain hashing
Chain hashing (also known as hash chaining or blockchain-style linking) ensures tamper-proof logs by including the cryptographic hash of the previous log entry in the current entry. This creates an immutable chain: any modification to a prior entry changes its hash, breaking the chain for all subsequent entries, making tampering immediately detectable. Unlike simple hashing of individual entries, chain hashing ties the entire log sequence together, providing integrity and non-repudiation of the log's chronological order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cryptographic hashing with chain hashing
Why this is correct
Chain hashing links each log entry's cryptographic hash to the previous entry, so altering any record invalidates all subsequent hashes. This satisfies the stem's tamper-proof requirement, since retrospective modification becomes detectable without needing to trust the storage layer itself.
- ✗
Access control lists
Why it's wrong here
ACLs only govern who may read or modify logs; a privileged account can still alter entries, leaving no cryptographic evidence of tampering. They are tempting because restricting access is a standard hardening step, and ACLs would be correct where the requirement is to limit which identities can reach the log store at all.
- ✗
Encryption with AES
Why it's wrong here
AES encryption protects confidentiality, not integrity; anyone holding the key can re-encrypt altered logs, so tampering remains undetectable. It is tempting because encryption is a core security control, and it would be correct where the requirement is to prevent unauthorised disclosure of log contents rather than to prove they were unchanged.
- ✗
Digital signatures on each log entry
Why it's wrong here
Digital signatures verify the integrity and authenticity of individual log entries, detecting if an entry has been altered *after* it was signed. However, they do not inherently link entries into an immutable, tamper-proof chain or prevent the deletion or reordering of logs, which is crucial for ensuring continuous tamper-proofing. This option is tempting because digital signatures are excellent for providing non-repudiation and verifying the integrity of standalone documents or messages, proving they originated from a specific source and remain unaltered.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.