CompTIA SecurityX (CAS-005) (CAS-005) — Questions 1–75

Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

A honeytoken is a decoy object such as a fake credential, file, or database record that is used to detect unauthorized access. A fake database credential file that triggers an alert when accessed is a typical honeytoken.

In the policy hierarchy, policy is the highest-level document, setting overarching direction. Standards, guidelines, and procedures are subordinate.

An IPsec VPN tunnel creates an encrypted, site-to-site connection between the AWS VPC and the on-premises network, ensuring encryption in transit and minimizing internet exposure by using the VPN gateway as the endpoint. Option B is correct because AWS Direct Connect provides a dedicated, private network connection that bypasses the internet entirely, reducing exposure and supporting encryption via optional MACsec or IPsec, while maintaining low latency and consistent bandwidth.

Eradication removes the threat; recovery restores normal operations. The question combines both, but typically 'eradication' is the removal phase.

OSINT uses publicly available information and WHOIS queries are passive, as they do not interact with the target system directly.

A risk register is a foundational document in risk management that systematically catalogs identified risks along with key attributes such as impact, likelihood, risk score, and assigned owner. This structured record enables ongoing tracking, prioritization, and mitigation of risks throughout the system development lifecycle or operational environment. In the context of CAS-004, the risk register is the primary artifact used to support governance and compliance activities, ensuring that risk treatment decisions are documented and auditable.

User Behavior Analytics (UBA) uses machine learning to establish a baseline of normal user activity and detect anomalies such as unusual login times and locations. This is a core feature of advanced SIEM platforms.

FIDO2 WebAuthn hardware tokens provide the strongest second factor because they use public-key cryptography to generate a unique key pair per service, with the private key stored securely on the token. This eliminates phishing, man-in-the-middle, and replay attacks, as the token signs a challenge from the relying party without ever sharing a shared secret over the network.

STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence.

Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Performing regular maintenance of systems is required under the Protect function of the NIST Cybersecurity Framework (CSF) because it directly supports the 'Protective Technology' and 'Maintenance' subcategories (PR.MA). Regular patching, updates, and hardware upkeep ensure that security controls remain effective against known vulnerabilities, reducing the attack surface. This is a proactive measure to sustain the integrity and availability of systems, aligning with the CSF's focus on safeguarding critical infrastructure.

PCI DSS Requirement 6.2 allows organizations to formally accept risk for low-severity vulnerabilities when patching would cause significant operational impact, provided compensating controls are implemented and documented approval is obtained from management. This balances security compliance with business continuity, as the vulnerability is low-risk and the downtime cost outweighs the immediate threat.

The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.

Immutable infrastructure ensures that once a container image is built and deployed, it is never modified in place. If a change is needed, a new image is built and deployed, replacing the old container entirely. This prevents unauthorized or unplanned modifications to running containers, which is the primary security benefit because it eliminates configuration drift and reduces the attack surface from runtime tampering.

HMAC uses a shared secret key combined with a cryptographic hash function to produce a fixed-size authentication tag. The firmware update's integrity is verified by recomputing the HMAC on the received data and comparing it to the transmitted tag; any tampering will cause a mismatch. This ensures that the firmware has not been altered in transit, providing integrity verification.

Mitigate (or reduce) involves implementing controls to lower risk to an acceptable level.

Mean Time to Detect (MTTD) is a key metric for incident detection efficiency.

Volatility's psxview plugin uses cross-view techniques to detect hidden processes by comparing process lists from multiple sources (e.g., PsActiveProcessHead, EPROCESS pools, etc.). A process that appears in some lists but not others is likely hidden.

SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

Using well-vetted, standard cryptographic algorithms (e.g., AES, RSA, ECDSA) ensures the system benefits from years of public scrutiny, rigorous cryptanalysis, and proven security properties. Proprietary or custom algorithms often contain undiscovered vulnerabilities, making them unsuitable for secure systems.

AWS Direct Connect provides a dedicated private connection from on-premises to AWS.

GDPR grants data subjects the right to erasure (Article 17), also known as the 'right to be forgotten.' Implementing a process for customers to request deletion of their personal data is a mandatory control for GDPR compliance, directly addressing this regulatory requirement.

Setting the container filesystem as read-only (A) reduces the attack surface by preventing attackers from writing malicious files or modifying system binaries within the container, even if they gain code execution. This enforces immutability and aligns with the principle of least privilege, as most containers do not need to write to their own filesystem at runtime.

Defense in depth. This architecture implements multiple, overlapping layers of security controls: a WAF at the application layer (Layer 7) to inspect and filter HTTP/HTTPS traffic for web-specific attacks (e.g., SQL injection, XSS), and a network firewall between the web and application tiers to enforce stateful packet inspection and access control at Layers 3/4. This layered approach ensures that if one control fails or is bypassed, another control still provides protection, embodying the core principle of defense in depth.

Common data classification levels include Public (no harm if disclosed), Internal (limited internal use), Confidential (sensitive, limited access), and Restricted (highly sensitive).

Execution is the tactic that covers techniques that result in adversary-controlled code running on a system. PowerShell execution is a common technique under the Execution tactic.

WPA3-Enterprise with 802.1X is the correct choice because it provides the strongest authentication and encryption for a high-security facility. It uses Simultaneous Authentication of Equals (SAE) for secure key exchange, mandates GCMP-256 encryption, and integrates with 802.1X/EAP for per-user, certificate-based authentication, eliminating shared passphrase vulnerabilities.

A SOC 2 Type II report shows the effectiveness of controls over a period, but it is dated. The organization should supplement it with a current security questionnaire to assess changes and current posture.

CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for general encryption. CRYSTALS-Dilithium is a digital signature algorithm. RSA and ECDH are vulnerable to quantum attacks.

A unidirectional gateway (data diode) physically enforces one-way data flow, ensuring that no traffic can originate from the corporate IT network into the ICS network. This prevents unauthorized access while allowing monitoring data (e.g., syslog, SNMP traps) to be sent out from the ICS side. It is the most effective control for preventing any inbound attack vectors while preserving outbound monitoring traffic.

SQL injection and XSS are application-layer attacks that a WAF can detect and block based on signatures or heuristics. CSRF requires tokens, and session hijacking is often at the network layer.

Passive reconnaissance (OSINT) does not interact with the target and is allowed. Active reconnaissance without social engineering is also typically allowed if specified. Social engineering involves human interaction, which is prohibited.

Python is the correct answer because it is a cross-platform scripting language with extensive standard libraries (e.g., `re` for regex, `json`, `csv`, `logging`) and third-party packages (e.g., `pandas`, `yara-python`, `stix2`) that simplify parsing diverse log formats and automating IOC extraction. Its portability across Windows, Linux, and macOS makes it ideal for environments with heterogeneous systems, unlike platform-specific alternatives.

Chain of custody documents every person who handled the evidence, from collection to presentation in court, ensuring that evidence has not been tampered with. This is essential for admissibility.

Running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

According to the order of volatility, volatile data like memory should be captured first. On a running system, capturing memory preserves data that would be lost on shutdown.

XXE attacks exploit the XML parser's ability to process external entities defined in a DTD. By disabling DTD processing entirely, the parser cannot resolve or fetch external resources, which neutralizes the primary vector for XXE injection. This is a standard security hardening step for XML parsers like libxml2, Xerces, or .NET's XmlReader, often achieved by setting properties such as `LIBXML_NOENT` to false or `XmlReaderSettings.DtdProcessing` to `Prohibit`.

The IAM policy grants the Lambda execution role the `iam:*` action, which includes all IAM operations such as creating, modifying, and deleting IAM users, roles, and policies. This effectively gives the Lambda full administrative control over IAM, allowing it to escalate privileges, create backdoor access, or disrupt the entire AWS account's identity and access management. Such broad permissions violate the principle of least privilege and represent a critical security risk.

Correct matches: Kerberos uses tickets and symmetric keys for authentication; SAML uses XML assertions for single sign-on; OAuth provides delegated authorization via tokens. Common confusions include mixing cryptographic methods and confusing authorization with authentication.

STIX/TAXII is a standard for sharing threat intelligence, and ISACs are industry-specific sharing groups.

The MITRE ATT&CK framework provides a structured taxonomy of adversary behaviors, including techniques and procedures. The ATT&CK website or database allows mapping observed behaviors to specific technique IDs.

TTP-based intelligence focuses on the adversary's behavior, such as tactics, techniques, and procedures, which are more stable over time compared to fast-changing IOCs like hashes and domains. This aligns with the ATT&CK framework.

When a patch cannot be applied, compensating controls such as network segmentation, firewall rules, or WAF can reduce risk. Network isolation is a common compensating control.

The Certificate Authority (CA) is the trusted entity that issues digital certificates and maintains Certificate Revocation Lists (CRLs) or supports OCSP for revocation.

Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing personal data that is likely to result in high risk to individuals. The core requirement is to systematically assess the types of personal data being processed, the necessity and proportionality of the processing, and the risks to data subjects' rights and freedoms. This directly aligns with option A, as the DPIA must identify and mitigate privacy risks before the SaaS application goes live.

A dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provides encryption at rest and in transit, automatic rotation, fine-grained access control via IAM policies, and audit logging. This prevents secrets from being exposed in configuration files, environment dumps, or version control, which is essential for cloud-native applications that must adhere to the principle of least privilege and compliance standards like SOC 2 or PCI DSS.

Full disk encryption (FDE) encrypts the entire storage device at the block level, including the operating system, applications, and all data. If the device is physically stolen, the data remains unreadable without the decryption key or passphrase, as the encryption is transparent and covers all sectors of the drive. This directly addresses the requirement of protecting data at rest on a stolen storage device.

Rate limiting restricts the number of requests a client can make in a given period, preventing abuse.

Zero trust operates on the principle of never trust, always verify, requiring continuous authentication and authorization for every access request, regardless of location.

Before transferring sensitive customer data to a new vendor-managed SaaS platform, the CISO must first perform a third-party risk assessment to evaluate the vendor's security posture against regulatory requirements (e.g., GDPR, PCI DSS). This assessment reviews the vendor's SOC 2 reports, ISO 27001 certification, and contractual security controls, ensuring compliance before any technical testing or data transfer occurs. Without this initial risk evaluation, subsequent technical controls like penetration tests or DLP may be premature or misaligned with regulatory obligations.

Continuous compliance monitoring involves automated, ongoing checks that run frequently or in real-time. Automated daily file integrity monitoring (B) detects unauthorized changes to critical systems on a continuous basis, while real-time monitoring of firewall and intrusion detection system logs (E) provides immediate alerting of security events. In contrast, quarterly vulnerability scanning (D) is periodic, not continuous, and annual audits or manual monthly reviews (A, C) are point-in-time assessments that do not meet the continuous monitoring requirement.

Power analysis attacks exploit variations in power consumption during cryptographic operations. Constant-time algorithms ensure that execution time and power consumption are independent of secret data, making them the most effective software countermeasure against such attacks. While hardware countermeasures like power randomizers exist, among the given options, constant-time algorithms directly address the root cause of power analysis leakage.

Risk transfer shifts the financial burden to another party, e.g., purchasing cyber insurance.

Input validation and output encoding are the primary defenses against XSS because they prevent malicious scripts from being interpreted by the browser. Input validation rejects or sanitizes dangerous characters (e.g., <, >, &) at the point of entry, while output encoding (e.g., HTML entity encoding) ensures that any user-supplied data rendered in the page is treated as text, not executable code. This directly addresses the root cause of XSS—untrusted data being injected into the DOM.

The Rules of Engagement (RoE) is a formal document that outlines the scope, permissions, and constraints of a penetration test.

FIPS 140-2 Level 3 requires tamper-evident enclosures with active tamper response mechanisms (e.g., erasing keys) and identity-based authentication. Level 2 requires tamper-evident coatings or seals but not active response. Level 4 is more stringent.

Honeypots should be properly isolated to prevent them from being used as a pivot point, and they should be designed to appear realistic to attract attackers. Placing them in the same broadcast domain is not necessary and could increase risk.

CRYSTALS-Dilithium is one of the NIST-selected post-quantum digital signature algorithms, providing security against quantum attacks.

Creating allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules directly addresses the root cause: false positives from trusted entities. This approach preserves detection sensitivity for unknown or malicious sources while suppressing alerts from pre-vetted IPs, reducing alert fatigue without compromising security coverage.

Tunnel mode with ESP encrypts the entire original IP packet and adds a new IP header, which is required for gateway-to-gateway VPNs. ESP provides encryption and optional authentication.

API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Active reconnaissance on internal networks (e.g., port scanning, OS fingerprinting) is appropriate after gaining a foothold, as it provides detailed information about adjacent systems. Passive reconnaissance (like sniffing) might be stealthier but active scanning is more effective for mapping.

Kubernetes Secrets can be mounted as files into a container's filesystem, allowing applications to read sensitive data (e.g., passwords, tokens) from a file path rather than exposing them in environment variables or image layers. This approach keeps secrets out of the container image and reduces the risk of accidental exposure through logs or process listings.