CAS-004 Security Engineering Practice Question
A security engineer is implementing a hardware security module (HSM) to protect cryptographic keys used by a certificate authority (CA). The engineer must ensure that the HSM provides strong protections against key extraction and unauthorized use. Which of the following are security properties that the HSM should provide? (Choose two.)
⚠ Common exam trap
The trap here is assuming that any FIPS validation or key export capability is sufficient for an HSM, when higher-level physical protections and strict access controls are required for CA key security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tamper-responsive mechanisms that zeroize keys upon physical intrusion.
Tamper-responsive mechanisms and role-based access control with separation of duties are essential security properties for an HSM protecting CA keys. Tamper responsiveness prevents physical key extraction, while RBAC with separation of duties prevents unauthorized logical access. The other options either provide insufficient protection or weaken security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tamper-responsive mechanisms that zeroize keys upon physical intrusion.
Why this is correct
Tamper-responsive mechanisms detect physical intrusion attempts (e.g., drilling, voltage tampering) and automatically erase sensitive key material. This prevents attackers from extracting keys even if they gain physical access to the HSM. It is a critical security property for HSMs used in CAs, as it ensures that keys cannot be recovered from a compromised device.
- ✗
FIPS 140-2 Level 1 validation for the cryptographic module.
Why it's wrong here
FIPS 140-2 Level 1 provides basic security requirements, including tested cryptographic algorithms, but it does not require physical tamper-resistance or key zeroization. For an HSM protecting CA keys, a higher level (Level 3 or 4) is typically required to ensure strong physical protections. Level 1 alone is insufficient for this scenario.
- ✗
Support for exporting private keys in plaintext for backup purposes.
Why it's wrong here
Exporting private keys in plaintext would completely undermine the purpose of an HSM. Keys should never leave the HSM in an unencrypted form. Secure backup mechanisms typically involve wrapping keys under a secure key or using key splitting, but plaintext export is a critical vulnerability and not a security property.
- ✓
Role-based access control with separation of duties for key management operations.
Why this is correct
Role-based access control (RBAC) with separation of duties ensures that no single individual can perform sensitive key management operations alone. This prevents insider threats and unauthorized use of keys. HSMs used in CAs must enforce strong authentication and authorization, often requiring multiple administrators to approve critical actions, which is a key security property.
- ✗
The ability to run arbitrary code within the HSM to extend functionality.
Why it's wrong here
Allowing arbitrary code execution within an HSM introduces significant security risks, as it could be exploited to extract keys or bypass protections. HSMs are designed to be closed systems with tightly controlled functionality. While some HSMs support secure firmware updates, they do not permit arbitrary code execution as a security property.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.