CompTIA SecurityX (CAS-005) (CAS-005) — Questions 751–825

NIST selected CRYSTALS-Kyber as the primary standard for general encryption and key encapsulation (FIPS 203) in its post-quantum cryptography program. Kyber is a lattice-based KEM designed for efficient key establishment, making it the correct choice for general encryption.

The scenario explicitly describes unsanitized user input being used directly in an LDAP query. LDAP injection occurs when an attacker manipulates LDAP statements by injecting special characters (e.g., *, (, ), &, |, !) to alter the query logic, potentially bypassing authentication or extracting unauthorized directory information. This is a direct injection attack against the LDAP protocol (RFC 4511), not against a database or web client.

Running containers as a non-root user (option A) is a fundamental security best practice because it limits the privileges available to processes inside the container. If an attacker compromises the application, they will not have root access to the host or the container runtime, reducing the potential for privilege escalation or host-level damage. This aligns with the principle of least privilege, which is critical for container security.

Host-based microsegmentation is the only option that enforces policy based on workload identity and tags, decoupling security from IP addresses and VLANs. This allows consistent least-privilege enforcement across legacy and containerized workloads and supports policy portability across environments.

Covert channels often hide data within protocols that are typically allowed through firewalls, such as DNS and ICMP. Analyzing DNS for long, high-entropy subdomains can reveal DNS tunneling, while inspecting ICMP payloads for anomalies can detect ICMP tunneling. Both techniques focus on the content and patterns within these protocols, which is essential for identifying stealthy exfiltration.

An HSM is a dedicated hardware device designed to securely generate, store, and manage cryptographic keys, with physical and logical protections that make it tamper-resistant. Unlike software-based key storage, where keys reside in memory or on disk and can be extracted by malware or an attacker with system access, an HSM's keys never leave the device in plaintext and the device zeroizes keys if tampering is detected. This makes tamper-resistant key storage the primary advantage for high-assurance environments like payment processing.

Risk acceptance is a formal decision by management to acknowledge and accept a specific risk without implementing additional controls. This is typically documented in a risk register and signed off by senior leadership, indicating that the cost of mitigation outweighs the potential impact. Option D is correct because formally acknowledging residual risk after controls are implemented is also a form of risk acceptance, as the organization accepts the remaining risk that cannot be fully mitigated.

The core principle of Zero Trust is 'never trust, always verify,' which means that no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Every access request must be authenticated, authorized, and encrypted before access is granted. This principle eliminates implicit trust based on network location.

Federated identity lets the portal rely on each partner organization's identity provider for authentication and account lifecycle. Partners use existing credentials, and disabling an account at the home organization immediately prevents new sessions because the portal consumes assertions rather than storing passwords. This is the standard pattern for business-to-business access with external identity sources.

In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

FIDO2 security keys are phishing-resistant because they use public-key cryptography and the authentication is bound to the specific origin. Even if a user is directed to a phishing site, the key will not authenticate to the fraudulent domain. Other methods like SMS, push notifications, and TOTP are vulnerable to real-time phishing or interception, so FIDO2 is the most secure choice for this requirement.

IaaS gives the customer control over the operating system, middleware, runtime, and applications while the provider manages the physical infrastructure, hypervisor, and network fabric. Under FedRAMP, the provider's authorization covers the underlying infrastructure, but the customer retains responsibility for configuring and securing everything above the hypervisor — offering the most security configuration control among the listed models while still leveraging the provider's FedRAMP package.

A mutually authenticated API gateway with schema validation and signed messages enables selective field exchange, real-time communication, strict schema enforcement, and tamper-resistant auditing. It avoids exposing internal databases and provides the necessary security controls for partner data sharing.

CRYSTALS-Kyber is a NIST-approved post-quantum cryptographic algorithm designed for key encapsulation (KEM), selected in the NIST PQC standardization process. It is based on module learning with errors (MLWE) and provides secure key exchange resistant to quantum attacks. RSA-4096 and ECDHE are classical algorithms vulnerable to quantum computers, and CRYSTALS-Dilithium is designed for digital signatures, not key encapsulation.

STIX (Structured Threat Information eXpression) is the OASIS standard that defines the structured language and data model for representing cyber threat intelligence — indicators, malware, attack patterns, and their relationships — in a machine-readable JSON format. When an analyst needs to structure threat intelligence data (such as a suspicious file hash) for automated sharing, STIX is the correct standard because it defines the content schema itself. TAXII is the transport protocol that carries STIX, not the structuring standard.

High-impact automated actions, such as blocking a critical server or deleting user accounts, can cause significant collateral damage if triggered by a false positive. Including a manual approval step ensures a human verifies the alert before irreversible or disruptive actions are taken, aligning with the principle of least privilege and incident response best practices.

A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

NIST SP 800-53 requires that cryptographic algorithms used to protect data in transit must be FIPS 140-2 validated. A deprecated algorithm (e.g., DES, RC4, or 3DES) is no longer considered secure and must be replaced with a current, approved algorithm such as AES-256 or ChaCha20. Updating the encryption algorithm directly remediates the security finding and aligns with the risk management framework's requirement to maintain adequate security controls.

Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Risk acceptance is the conscious decision to retain an identified risk when treatment is not cost-effective or feasible, and it is legitimized through documented rationale, executive or board approval, and scheduled re-evaluation. Leadership continued the essential activity, applied no control, transferred nothing, and formally signed off with a review date. That combination distinguishes acceptance from avoidance, transference, and mitigation.

It aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Secure Web Gateway (SWG) is one of the core converged capabilities of a SASE platform, alongside CASB, ZTNA, FWaaS, and SD-WAN. SASE merges network and security functions into a cloud-delivered service, and SWG provides web filtering, malware inspection, and policy enforcement for user web traffic. It is explicitly expected in a SASE architecture.

Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.

Token binding is the only mechanism that cryptographically links the session token to the client's TLS connection, so a token stolen via XSS cannot be replayed from a different device or network. Lifetime reduction, cookie flags, and local storage encryption mitigate other risks but do not satisfy the explicit cross-device reuse requirement.

Top Secret is a standard classification level in government and defense, indicating information that would cause exceptionally grave damage to national security if disclosed without authorization. It is the highest level in the U.S. classification system, defined under Executive Order 13526, and requires the most stringent access controls and handling procedures.

A single user account authenticating from two geographically distant countries within 10 minutes is physically impossible for one person to do via normal travel, which strongly indicates the credentials have been stolen and are being reused by an attacker from a different location. This is the classic 'impossible travel' indicator of credential theft and reuse. The legitimate user and the attacker are using the same credentials from different locations, producing the anomalous login pattern.

Ansible Vault is the built-in mechanism for encrypting sensitive data such as passwords, API keys, and certificates within Ansible projects. It encrypts variables or files at rest using AES-256, and the vault password is provided at runtime (e.g., via --ask-vault-pass or a vault password file), ensuring secrets are never stored in plaintext in playbook logs or version control. This approach integrates seamlessly with Ansible's workflow without requiring external tools or compromising automation.

Client-side encryption with keys held in an on-premises HSM ensures that data is encrypted before it reaches the cloud, so the provider only stores ciphertext and never possesses the key. This architecture preserves confidentiality even if the provider's infrastructure is breached, which is essential for ePHI under strict regulatory requirements.

Mean time to respond (MTTR) measures the average time between incident detection and containment/resolution, directly reflecting how quickly the team can act once an incident is identified. It is the standard metric for response and containment speed in incident response frameworks such as NIST SP 800-61. The other options measure detection speed, vulnerability posture, or patch hygiene, not containment speed.

Infrastructure as Code (IaC) tools like Terraform use a declarative language (HCL) to define cloud resources in configuration files. This approach enables version control (e.g., Git), repeatable deployments, and consistent environments, which are the primary benefits of IaC over manual provisioning.

The code attempts to retrieve the API_KEY environment variable using `os.environ['API_KEY']`, which raises a `KeyError` if the variable is not set. This lack of a fallback or error handling can cause the application to crash at startup, making it a security issue as it could lead to denial of service or expose stack traces in production logs.

The country-based allow rule exists for legitimate business reasons, so removing it outright would break required traffic. The correct approach is to preserve the business-justified allow rule while layering a more specific deny exception for the known malicious IP, since WAF rule precedence evaluates more specific rules before broader ones. This achieves both security and business continuity without disrupting legitimate users from that country.

DNS tunneling encodes command-and-control data inside DNS queries and responses, so the authoritative or internal DNS server logs are the only data source that captures the full query strings, TXT/NULL record payloads, and response sizes needed to confirm the activity. These logs reveal anomalies such as unusually long subdomain labels, high-entropy hostnames, and excessive query volume to a single domain.

AWS Config with managed rules and custom Lambda functions enables automated enforcement of security policies across multiple AWS accounts. This approach uses code to define policies and automatically remediate violations via Lambda, meeting the requirement for automation and code-defined policies. Option A (boto3 scripts) is manual and not fully automated; Option C (GuardDuty) is reactive and focuses on threats, not policy enforcement; Option D (CSPM) is a third-party tool, not a code-defined approach within AWS.

Assessments of controlled unclassified information environments fail most often because organizations cannot produce current, boundary-specific evidence for implemented requirements. Sustaining reviewed artifacts tied to the assessed system lets assessors verify each objective directly. Plans of action, provider inheritance, and penetration tests each address only part of the picture and cannot substitute for complete implementation evidence.

Because the U.S. vendor lacks Data Privacy Framework certification, the firm must rely on an Article 46 safeguard. Standard Contractual Clauses are the European Commission's pre-approved contractual terms for such transfers, and after Schrems II they must be supplemented by a transfer impact assessment evaluating the destination's surveillance laws. This combination lawfully supports routine transfers to the analytics provider.

Terraform is a IaC tool focused on provisioning resources across cloud providers. Docker handles containers, Ansible is configuration management, and Jenkins is CI/CD.

The Environmental Score allows customization based on specific organizational context, such as modified access requirements.

SELinux in enforcing mode enforces a mandatory access control policy that restricts the web server to only the resources it needs, such as specific files and network ports. This provides strong confinement and least privilege. The other options either do not enforce restrictions, provide only partial isolation, or rely on traditional permissions that are insufficient for limiting a compromised process.

A forward proxy with SSL/TLS inspection decrypts outbound HTTPS traffic, allowing the security team to inspect the payload of connections over TCP 443. This reveals encrypted C2 traffic that would otherwise be hidden within legitimate HTTPS flows, while still permitting authorized business traffic to pass through after inspection.

Event injection via malformed input (B) is a specific serverless security concern because AWS Lambda functions are triggered by events from sources like API Gateway, S3, or DynamoDB Streams. An attacker can craft malicious input that exploits the function's event-handling logic, leading to unintended execution paths or data corruption. This differs from traditional injection attacks because the event structure itself can be manipulated to bypass validation.

An HSM is a dedicated, tamper-resistant hardware appliance that generates, stores, and uses cryptographic keys without ever exposing them to the host OS or application memory. It provides FIPS 140-2/3 validated key protection and performs crypto operations (signing, encryption, key wrapping) inside the secure boundary. For a PKI requiring secure private key storage and tamper-resistant cryptographic operations at scale, an HSM (or cloud HSM service) is the correct answer.

RadSec (RADIUS over TLS) is the standard protocol for securely encapsulating RADIUS traffic. It uses TLS to encrypt the entire RADIUS conversation, including the shared secret, protecting against eavesdropping. Other options either do not encrypt the RADIUS packet fully or are authentication methods that do not address the shared secret protection.

Predictable session IDs allow an attacker to guess or calculate a valid session identifier for an authenticated user. By obtaining or predicting the session ID, the attacker can impersonate that user and gain unauthorized access to the application, which is the essence of session hijacking. This attack directly exploits weak session ID generation or insufficient entropy in the server-side session management.

A service mesh with mTLS provides transparent encryption and mutual authentication for all service-to-service communication, using verifiable identities. Its authorization policies can enforce access based on those identities, which is essential for zero-trust microservices. The other options either lack encryption, mutual authentication, or are limited to external traffic, failing to secure east-west communication.

Zero Trust Network Access (ZTNA) is essential for enforcing security policies based on user identity and device posture in a SASE architecture. ZTNA provides secure, identity-based access to applications, ensuring that only authenticated and authorized users with compliant devices can connect, regardless of location.

Before eradication, the incident response team must determine the root cause of the incident. This is essential to ensure that all components of the threat are identified and removed, and to prevent reoccurrence. Eradication involves removing the threat, but without understanding the root cause, the team might miss additional backdoors or persistence mechanisms.

Clause 9.3 of ISO/IEC 27001 mandates that top management review the ISMS at planned intervals, considering status of actions, changes, performance feedback, and risk assessment results. Documented minutes capturing inputs, decisions, and resulting actions are the direct evidence auditors seek. Other artifacts such as internal audit reports or the Statement of Applicability may feed the review but do not demonstrate that it took place.

The requirements are perfect forward secrecy and resistance to quantum attacks. Traditional key exchanges like RSA, DHE, and ECDHE provide PFS but are vulnerable to quantum computers. Lattice-based post-quantum algorithms such as Kyber are designed to withstand quantum attacks and can be used in ephemeral modes to achieve PFS, making them the only suitable option.

An API gateway sits in front of microservices and acts as a single entry point for all client requests, making it the ideal enforcement point for cross-cutting security controls. Centralizing authentication (e.g., OAuth2/JWT validation), authorization, rate limiting, and threat protection at the gateway means individual microservices don't each need to reimplement these policies. This reduces attack surface and ensures consistent policy enforcement across the entire API estate.

The Secure Web Gateway (SWG) is the SASE component that proxies outbound user web traffic and performs full TLS inspection, URL filtering, malware scanning, and DLP on decrypted content. Because it terminates and re-originates TLS sessions, it can inspect encrypted traffic for threats. This is its core function within the SASE stack.

Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Fail2ban is a security tool that monitors log files for suspicious patterns, such as repeated failed login attempts, and dynamically updates firewall rules to block the offending IP addresses. Implementing fail2ban with a threshold of 5 attempts per minute effectively mitigates brute-force attacks by temporarily or permanently banning IPs that exceed the threshold, while allowing legitimate users to access the system. This is more effective than the other options because it actively responds to brute-force behavior.

The shared responsibility model clearly delineates which security tasks are handled by the cloud provider and which by the customer, varying by service type (IaaS, PaaS, SaaS).

High-fidelity DLP combines exact data matching, which fingerprints the organization's own sensitive records, with trainable classifiers that recognize document categories from labeled examples. Together they detect both known data and semantically sensitive content while avoiding the noise of generic regex or keyword rules. Size limits and broad patterns do not target sensitive content and increase false positives.

FIDO2/WebAuthn is a passwordless authentication protocol that uses public key cryptography and is resistant to phishing because the private key never leaves the user's device.