CompTIA SecurityX (CAS-005) (CAS-005) — Questions 676–750

The firewall rule allows SSH (TCP port 22) from any source, which exposes the border firewall to brute-force attacks, unauthorized access, and potential credential harvesting. SSH should be restricted to specific trusted IP addresses or management networks to reduce the attack surface. An implicit deny rule exists by default at the end of most firewall rule sets, but the explicit permissive SSH rule overrides it, creating a critical security gap.

KRIs provide early warning of increasing risk. Percentage of systems with critical vulnerabilities indicates exposure; number of security incidents indicates threat activity.

Chain hashing (also known as hash chaining or blockchain-style linking) ensures tamper-proof logs by including the cryptographic hash of the previous log entry in the current entry. This creates an immutable chain: any modification to a prior entry changes its hash, breaking the chain for all subsequent entries, making tampering immediately detectable. Unlike simple hashing of individual entries, chain hashing ties the entire log sequence together, providing integrity and non-repudiation of the log's chronological order.

The pslist plugin lists processes from the doubly linked list, while psscan uses pool tag scanning to find hidden processes that are not in the linked list.

FIDO2 uses public key cryptography, so private keys never leave the device, preventing credential theft.

The first step in a vendor risk assessment is to identify the vendor and the type of data it will handle. This foundational step determines the scope and criticality of the assessment, as the data classification (e.g., PII, PHI, PCI-DSS) directly dictates the required security controls and regulatory compliance obligations. Without this identification, subsequent steps like audits or contract reviews lack context and may miss key risk areas.

Implementing additional controls to reduce risk is an example of risk mitigation. Residual risk is the risk remaining after controls are applied; if it still exceeds appetite, further mitigation is needed.

The typical hierarchy is: policy (high-level, mandatory), standard (specific requirements), guideline (recommendations), procedure (step-by-step instructions).

Incident response follows NIST framework: isolate, identify, contain, eradicate, recover.

ESP in tunnel mode with null encryption provides authentication and integrity via HMAC (e.g., HMAC-SHA256) while omitting encryption (ESP_NULL, RFC 2410). This satisfies the requirement for strong authentication and integrity without confidentiality for non-sensitive traffic, as the payload is authenticated but not encrypted.

Rules of engagement should include scope (IP ranges, systems), limitations (what is off-limits), and authorization. Testing credentials and vulnerability details are not part of ROE.

Setting `privileged: true` and `runAsUser: 0` (root) in a pod's securityContext grants the container unrestricted access to the host's kernel capabilities. This effectively disables all container isolation, allowing the container to perform privileged operations such as loading kernel modules, accessing raw block devices, and using `nsenter` or `chroot` to escape the container and gain root-level access to the underlying node. This is the most critical risk because it directly compromises the host and potentially the entire cluster.

The order of volatility dictates that memory (RAM) is the most volatile and must be captured before any other evidence.

Preserving the chain of custody ensures that evidence is not tampered with and maintains its integrity for legal proceedings.

HIPAA requires encryption of ePHI both at rest and in transit as an addressable implementation specification to ensure confidentiality.

BYOK with keys stored in a customer-controlled external KMS ensures the organization retains full control over encryption keys, enabling immediate revocation of access to data at rest if the SaaS provider is compromised. This aligns with the shared responsibility model where the customer manages keys, and external KMS decouples key management from the provider's infrastructure, preventing the provider from accessing data after key revocation.

VLANs (IEEE 802.1Q) provide Layer 2 isolation between security zones by segmenting broadcast domains, preventing traffic from crossing zone boundaries without a Layer 3 device (router/firewall). This reduces the attack surface by containing lateral movement within a single VLAN and enforcing access control at the gateway.

Mutual TLS (mTLS) with certificate authentication is the recommended approach for secure service-to-service communication in a microservices architecture because it provides both encryption and bidirectional authentication. Each service presents a unique X.509 certificate to verify its identity, preventing unauthorized access and man-in-the-middle attacks. This aligns with the principle of zero-trust networking, where no implicit trust is granted based on network location.

IPsec tunnel mode with ESP encrypts and authenticates the entire IP packet, providing confidentiality and integrity. Transport mode only encrypts the payload, and AH provides integrity without encryption.

Cloud-native applications should rely on a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) that encrypts secrets at rest and in transit, enforces fine-grained access policies via IAM, and supports automatic rotation. This approach decouples secrets from code and infrastructure, eliminating the risks of exposure through version control, logs, or misconfigured permissions.

The exhibit shows a firewall rule that explicitly drops TCP port 22 traffic, which is the default port for SSH. Since HTTP (port 80) and HTTPS (port 443) are unaffected, the issue is isolated to SSH. This rule is the most direct cause of the connection failures, as it blocks all SSH traffic regardless of source or destination.

Zero trust is built on the principle of 'never trust, always verify.' This means every device and user must be authenticated and authorized for each resource access, regardless of network location, and all communication should be encrypted to protect data in transit. This eliminates implicit trust based on network perimeter and enforces least-privilege access.

A SOC 2 Type II report provides assurance over controls in place during a historical period (the previous year), but it does not guarantee that those controls remain effective today. Requesting a current-year penetration test report (Option C) gives the company direct, timely evidence of the provider's security posture, including any vulnerabilities that may have emerged since the SOC 2 audit period ended.

Direct Connect (or AWS Direct Connect, Azure ExpressRoute) provides a dedicated private network connection from on-premises to the cloud, bypassing the internet for lower latency and increased security.

It addresses both root causes: restricting registry write access to only the CI/CD service account prevents developers from bypassing the pipeline, and enabling image signature verification via an admission controller (e.g., using Kubernetes ImagePolicyWebhook or a tool like Cosign with OCI signatures) ensures that only signed and scanned images are allowed to run in the cluster. This combination enforces the security policy at both the registry and the cluster level, closing the gaps identified in the scenario.

The condition in the policy requires the request to originate from a specified network endpoint, enforcing a network-level constraint.

AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.

Privacy by design is a proactive approach that integrates privacy into the system development lifecycle, not just a one-time assessment.

Both companies use the same RFC 1918 address space (10.0.0.0/8), which would cause routing conflicts if directly connected. Deploying NAT on the border routers translates one company's overlapping addresses to a unique range (e.g., 172.16.0.0/12 or a public IP block), eliminating IP collisions while maintaining security through stateful inspection or ACLs. This allows the merged networks to communicate without renumbering either company's internal infrastructure.

CRYSTALS-Dilithium is a NIST PQC standard for digital signatures.

The ACME account private key is a highly sensitive cryptographic credential used to authenticate against the ACME server (RFC 8555). Storing it in the OS keychain or a Hardware Security Module (HSM) provides encryption at rest, access control via OS-level permissions, and protection against accidental exposure. This aligns with the principle of least privilege and secure key management required for automation scripts handling certificate revocation.

Restricted data is typically the highest level, where unauthorized disclosure could cause severe harm. Confidential is often a lower level.

Deploying identical application stacks in two AWS regions with Route 53 weighted routing distributes traffic evenly across both regions, and DynamoDB global tables provide multi-region, multi-master replication with eventual consistency, ensuring the application remains fully active and available even if an entire AWS region fails. This architecture meets the active-active and region-failure requirement without relying on failover or single-region dependencies.

Zero-trust architecture (ZTA) explicitly mandates default-deny access policies based on least privilege. This means no user or device is trusted by default, regardless of network location; access is granted only after verifying identity, device health, and context, and is limited to the minimum necessary resources.

Automated security scanning in the pipeline with fail-fast is the most effective approach because it integrates security checks (e.g., SAST, DAST, dependency scanning) directly into the CI/CD workflow, enabling immediate detection and blocking of vulnerabilities before they reach production. This aligns with DevSecOps principles by shifting security left, reducing remediation costs, and ensuring that insecure code fails the build automatically, preventing deployment of vulnerable artifacts.

The policy allows any principal ('*') to perform s3:GetObject on the bucket, making the bucket publicly readable. This exposes objects to anyone on the internet. No encryption, logging, or versioning issues are indicated by this JSON snippet.

Defense-in-depth layers multiple controls. Input validation prevents malicious input from reaching the application, while parameterized queries ensure that SQL statements are safe even if validation fails. WAFs can detect and block injection attempts at the network layer.

Hypothesis-driven hunting starts with a specific hypothesis based on threat intelligence or a known TTP, such as process injection. This approach is proactive and focuses on detecting behaviors consistent with the hypothesis, unlike IoC-driven hunting which relies on known indicators.

SAST (Static Application Security Testing) identifies vulnerabilities in source code early, DAST (Dynamic Application Security Testing) tests running applications for runtime vulnerabilities, and IAST (Interactive Application Security Testing) combines aspects of both for real-time analysis. RASP is a runtime protection tool, not a testing technique. Threat modeling is a design-phase activity, not a testing technique.

Identifying gaps in security controls and recommending improvements is a core component of the lessons learned phase. This step ensures that the root cause of the exfiltration is addressed by analyzing which controls failed (e.g., missing DLP rules, inadequate network segmentation) and proposing concrete enhancements to prevent recurrence.

The best approach is to use multi-stage builds: build the application in one stage, then copy only the artifact to a final, clean image. This avoids including build-time secrets in the final image. Additionally, using Docker BuildKit's --secret flag can inject secrets without persisting them.

A Cloud Security Posture Management (CSPM) tool provides visibility and policy enforcement across multiple cloud providers, helping to ensure compliance with security best practices.

An exception management process is typically defined within the security policy or a related standard, outlining how to request, approve, and track exceptions.

In SOAR, an action step performs a specific operation like blocking a domain or deleting emails. Conditional steps would check conditions, but the playbook already determined the email is malicious, so an action is needed.

The contract requires the vendor to follow industry best practices, and outdated encryption algorithms (e.g., DES, RC4, or 3DES) are no longer considered secure or compliant with standards like NIST SP 800-131A or PCI DSS. The best response is to formally request the vendor to upgrade to current, approved algorithms such as AES-256 or ChaCha20, as this directly addresses the non-compliance with the contractual requirement. This action aligns with the governance and risk management process of enforcing contractual security obligations.

GDPR requires a PIA when processing is likely to result in high risk to individuals, and the PIA must describe the processing and assess necessity and proportionality.

CreateRemoteThread and WriteProcessMemory are commonly used for process injection, allowing code execution in another process's address space.

ESP provides both encryption and optional authentication, while AH only provides authentication without encryption.

A unified policy that meets the most stringent requirements of GDPR, CCPA, and LGPD ensures baseline compliance across all jurisdictions without violating any regulation. This approach minimizes conflicts by harmonizing data classification rules, such as consent management and data subject rights, under the highest common denominator, which is GDPR for most provisions like explicit consent and 72-hour breach notification.

The policy hierarchy typically follows: Policy (high-level, mandatory) -> Standard (specific requirements) -> Guideline (recommendations) -> Procedure (step-by-step instructions).

Zero trust architecture is built on the principle of 'never trust, always verify,' which explicitly requires that every access request—regardless of origin—be authenticated, authorized, and continuously validated. Option B ('Assume breach and verify every request') captures this core tenet, as it mandates that no implicit trust is granted based on network location or device status, and every request must be treated as potentially malicious until proven otherwise.

FAIR provides a more rigorous, quantitative analysis that enables cost-benefit analysis, unlike qualitative methods.

DAST (Dynamic Application Security Testing) tests running applications from the outside, simulating attacks to find vulnerabilities in runtime behavior.

Power analysis attacks exploit variations in power consumption; constant-time algorithms and power smoothing hardware help mitigate this.

Direct Connect provides a dedicated, private, high-bandwidth connection between on-premises and cloud, bypassing the internet.

A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

RBAC controls access, network policies segment traffic, and admission controllers enforce policies before pods are created.

Port scanning, SQL injection testing, and directory brute-forcing are common penetration testing activities that do not inherently cause DoS. DoS attacks and social engineering without approval are typically out of scope.

Detective controls identify and record security events after they occur; an IDS monitors traffic for suspicious activity.

Common HTTP status codes: 200 OK, 403 Forbidden, 404 Not Found, and 500 Internal Server Error. Distractors swap codes with similar meanings or misinterpretations.

NIST selected CRYSTALS-Kyber for key encapsulation (encryption) and CRYSTALS-Dilithium for digital signatures.

The scenario explicitly describes unsanitized user input being used directly in an LDAP query. LDAP injection occurs when an attacker manipulates LDAP statements by injecting special characters (e.g., *, (, ), &, |, !) to alter the query logic, potentially bypassing authentication or extracting unauthorized directory information. This is a direct injection attack against the LDAP protocol (RFC 4511), not against a database or web client.

Running containers as a non-root user (option A) is a fundamental security best practice because it limits the privileges available to processes inside the container. If an attacker compromises the application, they will not have root access to the host or the container runtime, reducing the potential for privilege escalation or host-level damage. This aligns with the principle of least privilege, which is critical for container security.

API-based CASB connects directly to the cloud app's API to monitor and control data, without requiring client software.

UBA establishes a baseline of user behavior and flags deviations, reducing false positives from legitimate multiple failed logins (e.g., forgotten passwords) while still detecting anomalous patterns.

STIX/TAXII enables sharing of structured threat intelligence in a standardized format, allowing for automated consumption and immediate updates.

A honeytoken (e.g., a fake credential file or a service account password) planted on a system can trigger an alert when an adversary attempts to use it. A fake domain controller honeypot is also effective but may require more resources. However, a honeytoken is specifically designed to be used by attackers and is simple to deploy.