CompTIA SecurityX (CAS-005) (CAS-005) — Questions 1–75

Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Governance accountability for accepting risk beyond the approved appetite belongs to the board of directors or a delegated executive risk committee. Operational and assurance roles support risk management but do not own the decision to retain risk at the enterprise level.

A honeytoken is a piece of decoy data or a credential artifact — such as a fake database credential file, API key, or document — that has no legitimate use, so any access to it signals malicious activity and triggers an alert. Option D describes exactly this: a fake credential file that fires an alert when opened. The other options describe broader deception constructs (honeynets, honeypots, fake DNS records) rather than a discrete token of data.

The organizational security policy is the top-level governance document — it states management's intent, scope, and high-level requirements. Standards, guidelines, and procedures all derive from and must align with the policy, making it the highest document in the hierarchy.

The requirement for repeatable ciphertext that still supports equality lookups points to a deterministic authenticated encryption mode. AES-SIV derives its nonce from the plaintext and associated data, so the same input always yields the same output while still providing integrity. Randomized modes and salted hashing break the equality-search property the database design depends on.

A risk register is a foundational document in risk management that systematically catalogs identified risks along with key attributes such as impact, likelihood, risk score, and assigned owner. This structured record enables ongoing tracking, prioritization, and mitigation of risks throughout the system development lifecycle or operational environment. In the context of CAS-004, the risk register is the primary artifact used to support governance and compliance activities, ensuring that risk treatment decisions are documented and auditable.

User Behavior Analytics (UBA) uses machine learning to establish a baseline of normal user activity and detect anomalies such as unusual login times and locations. This is a core feature of advanced SIEM platforms.

The requirement is to detect tampering and respond by isolating the endpoint. Tamper protection ensures the EDR agent cannot be easily disabled, and automated response actions can isolate the host. Other options focus on detection updates, logging, or encryption, which do not provide the needed tamper detection and immediate isolation.

FIDO2 WebAuthn hardware tokens provide the strongest second factor because they use public-key cryptography to generate a unique key pair per service, with the private key stored securely on the token. This eliminates phishing, man-in-the-middle, and replay attacks, as the token signs a challenge from the relying party without ever sharing a shared secret over the network.

Privacy by design means embedding privacy into systems and processes from the outset, not retrofitting it later. An early privacy impact assessment combined with data minimization controls during design directly implements that principle. The other actions either collect excessive data, react after release, or rely on a single control that does not address purpose limitation and minimization, so they do not meet the legal team's request.

SASE converges networking and security functions into a cloud-delivered service, with zero trust network access (ZTNA) as a core pillar. Unlike traditional VPNs that grant broad network-level access after authentication, SASE enforces identity-based, context-aware access policies per application or resource. This aligns with zero trust principles: never trust, always verify, and least-privilege access.

STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence.

Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Performing regular maintenance of systems is required under the Protect function of the NIST Cybersecurity Framework (CSF) because it directly supports the 'Protective Technology' and 'Maintenance' subcategories (PR.MA). Regular patching, updates, and hardware upkeep ensure that security controls remain effective against known vulnerabilities, reducing the attack surface. This is a proactive measure to sustain the integrity and availability of systems, aligning with the CSF's focus on safeguarding critical infrastructure.

Ansible Vault encrypts sensitive variables and files so secrets are never stored in plaintext in playbooks or logs. Restricting access to the vault password file ensures only authorized administrators on the shared control node can decrypt the secrets. This satisfies the requirement that secrets not be exposed in playbooks or logs.

A policy is the management-approved, high-level statement that expresses security intent and assigns accountability without dictating products or settings. Standards enforce specific mandatory requirements, procedures describe operational steps, and guidelines offer optional advice. Because the board's document sets direction and delegates responsibility at an enterprise level while avoiding technical specificity, it is a policy sitting at the top of the governance hierarchy.

Restoring from offline immutable backups is the most effective recovery approach when production backups have been encrypted by ransomware. Immutable backups cannot be altered or deleted, even by an attacker with administrative credentials, ensuring that a clean copy of data is available for restoration. This approach minimizes downtime and avoids paying the ransom.

Microsegmentation requires policy that is based on workload identity and portable across hosts. Host-based firewall agents with identity-tag rules and an SDN overlay enforcing label-based policy both deliver explicit peer authorization and follow workloads during migration. VLAN ACLs, a single perimeter zone, and 802.1X either tie policy to topology or address admission rather than ongoing east-west control.

Code signing with a trusted certificate provides both integrity and authenticity: the firmware is hashed and signed by the vendor's private key, and the device verifies the signature using the vendor's public key. This ensures the firmware has not been tampered with and originates from a trusted source. Hash verification alone only checks integrity, not authenticity.

Ephemeral Diffie-Hellman creates a unique shared secret per session and erases the private ephemeral values, so a later compromise of the server's long-term key cannot decrypt previously captured traffic. Static RSA key transport ties the premaster secret to the long-term key, so that compromise exposes all recorded sessions. The distinguishing property is forward secrecy.

The strongest protection is to have the HSM itself generate the key as non-extractable, so the private material is created and used only within the tamper-resistant boundary. Layering M of N quorum authentication ensures that no single administrator can perform sensitive CA operations, providing the dual control the scenario requires.

PCI DSS Requirement 6.2 allows organizations to formally accept risk for low-severity vulnerabilities when patching would cause significant operational impact, provided compensating controls are implemented and documented approval is obtained from management. This balances security compliance with business continuity, as the vulnerability is low-risk and the downtime cost outweighs the immediate threat.

The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.

Immutable infrastructure ensures that once a container image is built and deployed, it is never modified in place. If a change is needed, a new image is built and deployed, replacing the old container entirely. This prevents unauthorized or unplanned modifications to running containers, which is the primary security benefit because it eliminates configuration drift and reduces the attack surface from runtime tampering.

A SOC 2 Type II report provides independent validation of control effectiveness over a period, directly addressing the need for assurance without an on-site audit. It is the standard mechanism for assessing SaaS providers' security and compliance posture.

Mitigation involves implementing controls to reduce the likelihood or impact of a risk. This is the definition of risk mitigation in risk management frameworks like NIST and ISO 31000. It is distinct from avoidance (eliminating the activity), acceptance (retaining the risk), and transfer (shifting to a third party).

Mean Time to Detect (MTTD) is the metric that specifically measures the average elapsed time between when a security incident actually occurs and when it is detected by monitoring, alerting, or analyst investigation. It is a core SOC efficiency metric used to evaluate detection capabilities.

The psxview plugin in Volatility cross-references multiple process listing sources (pslist, psscan, thrdproc, pspcid, csrss, session, deskthrd) to detect processes hidden from the standard listing. It is specifically designed to reveal rootkit-hidden processes by comparing discrepancies between these sources.

The correct design uses a jump host in a screened subnet, VPN with MFA, and RDP with session recording. This combination isolates the EHR servers, authenticates the unmanaged vendor laptops, and provides an auditable path for maintenance. The other options either place the jump host on the protected VLAN, expose RDP directly, or use a reverse proxy that does not support direct server maintenance, all of which weaken isolation or control.

DNS query logs are the least useful data source for identifying lateral movement because they primarily reveal domain name resolution activity, which may indicate command-and-control or data exfiltration but do not directly show authentication or file-share access between internal hosts. Lateral movement is best detected through authentication events (Event ID 4624), explicit credential use (Event ID 4648), and file share access (Event ID 5140).

FIPS 140-2 Level 3 validation requires tamper-evident physical mechanisms and identity-based authentication, ensuring that keys remain within a hardened hardware boundary and that only authenticated operators can access them. This matches the stated requirements of keys never leaving the module and resistance to physical tampering. Levels 1 and 2 lack these physical protections, while Level 4 adds environmental protections beyond what is needed here.

SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

AWS Direct Connect provides a dedicated, private physical network connection from an on-premises data center to AWS, bypassing the public internet entirely. It is provisioned through a Direct Connect location or partner and offers consistent latency and higher bandwidth than internet-based options. This is the only option that guarantees a private, non-internet path by design.

The best approach is to use learning mode to understand normal traffic, then enable targeted SQL injection and XSS rules along with virtual patching for known vulnerabilities. This minimizes false positives while providing strong protection. Generic blocking rules, overly broad regex, or disabling WAF rules entirely either cause operational issues or reduce defense-in-depth.

Tamper-evident archival requires cryptographic binding of entries plus signatures produced with a key the attacker cannot reach, combined with encryption whose keys the storage provider does not hold. Hash chains detect alteration, offline hardware security module signing prevents forgery of new checkpoints, and provider-inaccessible keys preserve confidentiality across the retention period.

Hardware-backed authentication and tamper-evident recording are distinct requirements that need complementary controls. FIDO2-backed sk-ssh-ed25519 keys bind administrative sessions to a physical authenticator, while remote TLS-protected logging with a hash chain ensures session recordings cannot be altered undetectably. Together they satisfy both the credential-binding and recording-integrity objectives without relying on weaker password or SMS mechanisms.

Defense in depth. This architecture implements multiple, overlapping layers of security controls: a WAF at the application layer (Layer 7) to inspect and filter HTTP/HTTPS traffic for web-specific attacks (e.g., SQL injection, XSS), and a network firewall between the web and application tiers to enforce stateful packet inspection and access control at Layers 3/4. This layered approach ensures that if one control fails or is bypassed, another control still provides protection, embodying the core principle of defense in depth.

In MITRE ATT&CK, Execution (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including T1059 Command and Scripting Interpreter. PowerShell is explicitly documented under T1059.001, so running a PowerShell script to download tools is classified as Execution. Initial Access describes how the adversary got in (the spearphishing), not what they ran afterward.

WPA3-Enterprise with 802.1X is the correct choice because it provides the strongest authentication and encryption for a high-security facility. It uses Simultaneous Authentication of Equals (SAE) for secure key exchange, mandates GCMP-256 encryption, and integrates with 802.1X/EAP for per-user, certificate-based authentication, eliminating shared passphrase vulnerabilities.

FIDO2/WebAuthn uses public-key cryptography where the private key never leaves the authenticator, and the credential is cryptographically bound to the origin (relying party ID) during registration. This origin binding means a phishing site on a different domain cannot trigger the authenticator to produce a valid assertion, because the browser enforces the RP ID match. Even if a user is tricked into visiting a lookalike site, the signature will not validate against the legitimate server's expected origin.

Even with a recent SOC 2 Type II report, the organization should still perform its own vendor risk assessment using a security questionnaire to evaluate controls specific to the engagement, scope, and data sensitivity. A SOC 2 report covers the vendor's controls but does not address the organization's specific risk tolerance, contractual requirements, or gaps not in the report's scope. This is the best next step because it validates and contextualizes the report.

CRYSTALS-Kyber is the NIST-selected post-quantum algorithm for key encapsulation (KEM), standardized as FIPS 203 (ML-KEM). It is designed to resist attacks from both classical and quantum computers, making it appropriate for long-lived classified data. CRYSTALS-Dilithium is for digital signatures, not key encapsulation, and the classical algorithms (ECDH, RSA) are vulnerable to Shor's algorithm on a sufficiently powerful quantum computer.

Centralizing logs with real-time forwarding removes the single point of failure and append-only storage with restricted access prevents tampering or deletion even if one server is fully compromised. Local encryption, retention changes, and database encryption all leave authoritative copies within reach of the compromised host.

Financial stability (B) is a critical initial vendor assessment factor because it evaluates the vendor's ability to remain solvent and support long-term contractual obligations. A financially unstable vendor poses a direct risk to service continuity and may be unable to invest in necessary security controls, leading to potential data breaches or service disruptions.

Python is the correct answer because it is a cross-platform scripting language with extensive standard libraries (e.g., `re` for regex, `json`, `csv`, `logging`) and third-party packages (e.g., `pandas`, `yara-python`, `stix2`) that simplify parsing diverse log formats and automating IOC extraction. Its portability across Windows, Linux, and macOS makes it ideal for environments with heterogeneous systems, unlike platform-specific alternatives.

Chain of custody documents every person who handled the evidence, from collection to presentation in court, ensuring that evidence has not been tampered with. This is essential for admissibility.

Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

On a live system, volatile data — RAM contents, running processes, network connections, and encryption keys — is lost the moment power is cut or the system is rebooted. Order of volatility (RFC 3227) dictates capturing RAM first using tools like LiME or fmem before touching the disk. This preserves evidence that may never exist on disk, such as in-memory malware or active sessions.

EAP-TLS is the only method that mandates client-side certificates, allowing the RADIUS server to validate them against the corporate CA. This ensures that only devices with certificates from that CA can connect. The other methods either rely on user credentials, tunneled legacy authentication, or PACs, none of which enforce device certificate validation.

XXE attacks exploit the XML parser's ability to process external entities defined in a DTD. By disabling DTD processing entirely, the parser cannot resolve or fetch external resources, which neutralizes the primary vector for XXE injection. This is a standard security hardening step for XML parsers like libxml2, Xerces, or .NET's XmlReader, often achieved by setting properties such as `LIBXML_NOENT` to false or `XmlReaderSettings.DtdProcessing` to `Prohibit`.

Write-once, read-many (WORM) storage ensures that once log data is written, it cannot be altered, overwritten, or deleted for the retention period. This immutability directly satisfies the regulatory requirement for log integrity over seven years, as it prevents both accidental modification and malicious tampering. WORM can be implemented via optical media, magnetic tape with WORM firmware, or object storage with retention policies.

Correct matches: Kerberos uses tickets and symmetric keys for authentication; SAML uses XML assertions for single sign-on; OAuth provides delegated authorization via tokens. Common confusions include mixing cryptographic methods and confusing authorization with authentication.

The MITRE ATT&CK Navigator and the official ATT&CK website are the authoritative resources for mapping adversary techniques to ATT&CK technique IDs (e.g., T1021 for Remote Services). The analyst would search the technique name or tactic (Lateral Movement) to find the corresponding ID and details.

TTP-based threat intelligence focuses on the adversary's tactics, techniques, and procedures — the behavioral patterns behind an attack — rather than volatile artifacts like subject lines or hashes. Because TTPs describe how attackers operate (e.g., MITRE ATT&CK techniques such as spearphishing attachment T1566.001), they remain relevant even when IOCs rotate. This makes them far more durable and actionable for building detections and defenses against an ongoing campaign.

AWS KMS with customer managed keys allows the architect to create a unique key for each tenant and use encryption context to enforce that only the intended tenant can decrypt its data. This centralizes key management while providing cryptographic isolation, satisfying both the per-tenant key requirement and the need for central administration.

When a patch cannot be applied, compensating controls such as network segmentation, firewall rules, or WAF can reduce risk. Network isolation is a common compensating control.

The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing personal data that is likely to result in high risk to individuals. The core requirement is to systematically assess the types of personal data being processed, the necessity and proportionality of the processing, and the risks to data subjects' rights and freedoms. This directly aligns with option A, as the DPIA must identify and mitigate privacy risks before the SaaS application goes live.

A dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provides encryption at rest and in transit, automatic rotation, fine-grained access control via IAM policies, and audit logging. This prevents secrets from being exposed in configuration files, environment dumps, or version control, which is essential for cloud-native applications that must adhere to the principle of least privilege and compliance standards like SOC 2 or PCI DSS.

Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Rate limiting is the API gateway control that caps the number of requests a client can make within a defined time window (e.g., 100 requests/minute), directly preventing abuse from excessive API calls, brute-force attempts, and denial-of-service. It is enforced at the gateway before requests reach backend microservices.