Courseiva

CompTIA SecurityX (CAS-005) (CAS-005) — Questions 751–825

968 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 10

Page 11 of 13

Page 12
751
MCQmedium

A company has implemented a hardware security module (HSM) to manage cryptographic keys for a payment processing system. Which of the following best describes an advantage of using an HSM over software-based key storage?

A.Easier key rotation
B.Tamper-resistant key storage
C.Faster cryptographic operations
D.Lower implementation cost
AnswerB

HSMs provide physical and logical protections to prevent key extraction and tampering.

Why this answer

HSMs are tamper-resistant devices that protect keys from physical and logical attacks, offering a higher level of security than software-based storage. While HSMs can be costly and may have slower key generation, their primary advantage is physical security.

Full explanation →
752
Multi-Selectmedium

A security architect is designing a risk mitigation strategy for a critical application. Which TWO of the following are examples of risk acceptance? (Select TWO.)

Select 2 answers
A.Outsourcing the application hosting to a third party.
B.Obtaining senior management sign-off to accept the risk without additional controls.
C.Purchasing cyber insurance to cover potential losses.
D.Formally acknowledging the residual risk after controls are implemented.
E.Implementing an intrusion prevention system to reduce the likelihood of attacks.
AnswersB, D

Management sign-off is a documented acceptance.

Why this answer

Risk acceptance is a formal decision by management to acknowledge and accept a specific risk without implementing additional controls. This is typically documented in a risk register and signed off by senior leadership, indicating that the cost of mitigation outweighs the potential impact. Option D is correct because formally acknowledging residual risk after controls are implemented is also a form of risk acceptance, as the organization accepts the remaining risk that cannot be fully mitigated.

Exam trap

CompTIA CASP+ often tests the distinction between risk acceptance and risk transference, where candidates mistakenly classify outsourcing or insurance as acceptance rather than transference.

Full explanation →
753
Multi-Selectmedium

A security architect is evaluating a CSPM tool for a multi-cloud environment. Which TWO capabilities should the architect consider essential for the CSPM? (Choose two.)

Select 2 answers
A.Continuous compliance monitoring against frameworks like CIS
B.Vulnerability scanning of container images
C.Configuration drift detection
D.Real-time web application firewall
E.Data loss prevention for cloud storage
AnswersA, C

Correct; CSPM monitors compliance.

Why this answer

CSPM automates security compliance and configuration monitoring across cloud environments.

Full explanation →
754
MCQmedium

An IoT device manufacturer wants to ensure that firmware updates are authentic and have not been tampered with. The device has limited computational resources. Which cryptographic primitive is most appropriate for verifying the integrity and authenticity of firmware images?

A.Digital signature using ECDSA P-384
B.SHA-256 hash only
C.Symmetric MAC using AES-256-GCM
D.HMAC-SHA256 with a device-specific key
AnswerA

Digital signatures provide non-repudiation and authenticity without shared secrets; ECDSA is efficient for constrained devices.

Why this answer

Digital signatures provide both integrity and authenticity. RSA is too computationally intensive for constrained devices; ECDSA or Ed25519 are more suitable. The question asks for the primitive, so digital signatures is the correct category.

Full explanation →
755
Multi-Selectmedium

A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)

Select 3 answers
A.Record and monitor all privileged sessions
B.Implement just-in-time (JIT) access provisioning
C.Use break-glass accounts for emergency access
D.Enforce multi-factor authentication for all users
E.Require periodic password rotation for all service accounts
AnswersA, B, C

Session recording ensures accountability and aids forensic analysis.

Why this answer

Just-in-time (JIT) access provisioning grants privileges only when needed, reducing standing privileges. Session recording and monitoring provides audit trails. Break-glass accounts provide emergency access with controls.

MFA for all users is a general practice, but for PAM, JIT, session monitoring, and break-glass are specific. Password rotation is good but not a core PAM practice compared to the others.

Full explanation →
756
MCQeasy

Which of the following is a core principle of the Zero Trust security model?

A.Perimeter-based trust
B.Never trust, always verify
C.Trust based on network location
D.Trust but verify
AnswerB

This is the key principle of Zero Trust.

Why this answer

Zero Trust assumes no implicit trust and requires verification for every access request, regardless of location.

Full explanation →
757
MCQeasy

Which security issue is addressed by this configuration?

A.Enables server-side includes
B.Prevents directory listing
C.Blocks access to all files
D.Enables CGI execution
AnswerB

`-Indexes` explicitly disables directory listing.

Why this answer

The configuration directive 'Options -Indexes' in Apache HTTP Server explicitly disables directory indexing. When a client requests a directory without an index file (e.g., index.html), the server will return a 403 Forbidden error instead of generating an HTML page listing the directory's contents. This directly prevents directory listing, a common information disclosure vulnerability.

Exam trap

The CAS-004 exam often tests the misconception that 'Options -Indexes' blocks all file access or is related to CGI or SSI, when in reality it only suppresses the automatic directory listing generated by mod_autoindex.

How to eliminate wrong answers

Option A is wrong because server-side includes (SSI) are enabled with 'Options +Includes', not by disabling directory listing. Option C is wrong because 'Options -Indexes' does not block access to all files; it only prevents the automatic listing of directory contents when no index file is present. Option D is wrong because CGI execution is enabled with 'Options +ExecCGI' or the 'ScriptAlias' directive, not by disabling directory indexing.

Full explanation →
758
MCQhard

A global e-commerce company processes payment card data and is required to comply with PCI DSS. During a quarterly vulnerability scan, the security team discovers that a web application firewall (WAF) rule is blocking legitimate traffic, causing transaction failures. The WAF is a critical compensating control for a known vulnerability in the application that cannot be patched for 90 days. The compliance officer is concerned about maintaining PCI DSS compliance while ensuring business continuity. The security team proposes temporarily disabling the WAF to restore service while they fine-tune the rules. Which of the following is the BEST action?

A.Segment the affected application from the rest of the network and remove the WAF from the data path.
B.Disable the WAF immediately to restore service and document the decision as a risk acceptance.
C.Accept the risk of transaction failures and keep the WAF in place until the rules are fully tested.
D.Temporarily modify the WAF rule set to allow legitimate traffic while maintaining security, and schedule a permanent fix within 24 hours.
AnswerD

Fine-tuning rules restores service without compromising the compensating control.

Why this answer

The best action because temporarily modifying the WAF rule set to allow legitimate traffic while maintaining security addresses both business continuity and PCI DSS compliance. The WAF serves as a critical compensating control for a known vulnerability that cannot be patched for 90 days; disabling it (as in Option B) would remove this control, likely violating PCI DSS Requirement 6.6 and increasing risk. Option A (segmentation) may not provide equivalent protection and could be impractical in the short term.

Option C (accepting transaction failures) harms business operations without a long-term benefit. Fine-tuning rules and scheduling a permanent fix within 24 hours balances security and availability, keeping the compensating control active.

Full explanation →
759
MCQhard

An organization is implementing a zero trust architecture (ZTA). The security architect proposes using a software-defined perimeter (SDP) to replace the traditional VPN for remote access. Which of the following best describes the primary security benefit of SDP over VPN in a zero trust model?

A.It provides deep packet inspection to detect malicious traffic.
B.It enforces multi-factor authentication for every session.
C.It reduces latency by establishing direct peer-to-peer connections.
D.It prevents unauthorized users from discovering the application infrastructure.
AnswerD

SDP uses a 'black cloud' approach where the application server is invisible until the user is authenticated and authorized, reducing the attack surface.

Why this answer

In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

Exam trap

The trap here is that candidates confuse the 'direct' connection behavior of some SDP implementations with a security benefit, when in fact the core advantage is hiding infrastructure from unauthorized users, not reducing latency or enabling peer-to-peer connections.

How to eliminate wrong answers

Option A is wrong because deep packet inspection is a feature of next-generation firewalls or intrusion prevention systems, not a core or defining benefit of SDP; SDP focuses on access control and visibility hiding, not traffic inspection. Option B is wrong because multi-factor authentication is a common requirement in both SDP and modern VPN solutions; it is not unique to SDP and does not represent the primary security benefit over VPN. Option C is wrong because SDP typically uses a controller to broker connections and often routes traffic through a gateway or proxy, not direct peer-to-peer connections; reducing latency is not a primary security benefit, and direct connections can actually introduce security risks in a zero trust model.

Full explanation →
760
Multi-Selecthard

Which TWO of the following are effective defenses against Server-Side Request Forgery (SSRF) attacks? (Select TWO.)

Select 2 answers
A.Whitelist allowed outbound IP addresses and domains
B.Use a web application firewall (WAF) to block SSRF signatures
C.Enforce strict referrer headers on requests
D.Disable unused URL schemes (e.g., file://, dict://)
E.Implement input validation on all user-supplied URLs
AnswersA, D

Restricting outbound connections to known safe destinations prevents the server from making requests to internal or malicious hosts.

Why this answer

Whitelisting allowed outbound IP addresses and domains is effective because it restricts the server from making requests to any destination not explicitly permitted, directly preventing SSRF attacks that rely on reaching internal or malicious external hosts. This defense operates at the network or application layer, ensuring that even if an attacker injects a URL, the request is blocked unless it matches the whitelist.

Exam trap

Many test-takers mistakenly believe that input validation alone is sufficient to prevent SSRF, but attackers can bypass validation via encoding, redirects, or protocol smuggling. Whitelisting outbound destinations and disabling unused URL schemes are the primary effective controls.

Full explanation →
761
MCQhard

An organization is migrating critical workloads to the cloud and must comply with FedRAMP. Which cloud service model provides the most customer control over security configuration while still leveraging the provider's FedRAMP authorization?

A.Software as a Service (SaaS)
B.Infrastructure as a Service (IaaS)
C.Platform as a Service (PaaS)
D.Function as a Service (FaaS)
AnswerB

Correct – IaaS offers maximum customer control over security.

Why this answer

IaaS gives the customer control over OS, applications, and security configurations, while the provider manages the physical infrastructure. FedRAMP authorization can cover the IaaS layer.

Full explanation →
762
MCQmedium

After a security incident, the IR team identifies that the attacker used a spear-phishing email with an attached malicious macro. Which log source would be MOST crucial to determine the scope of the compromise?

A.Endpoint detection and response (EDR) telemetry
B.Windows Event Logs (Event ID 4688)
C.Proxy server logs
D.Email server logs
AnswerC

Proxy server logs capture outbound HTTP/HTTPS connections, which malware commonly uses for command and control (C2) and data exfiltration, making them most crucial for scope determination.

Why this answer

Proxy logs capture all outbound HTTP/HTTPS traffic, which is critical for identifying command-and-control (C2) communications and data exfiltration by the malware. Option A (EDR telemetry) provides endpoint-level details like process execution and network connections, but not all outbound traffic if endpoints are not forwarding logs. Option B (Windows Event Logs 4688) shows process creation events, which can help identify malicious process execution but may not reveal network connections.

Option D (email server logs) is useful for tracing the initial phishing email but does not show subsequent system activity or network traffic.

Full explanation →
763
MCQmedium

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

A.RSA-4096
B.CRYSTALS-Kyber
C.ECDHE
D.CRYSTALS-Dilithium
AnswerB

Correct NIST-selected KEM.

Why this answer

CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for post-quantum cryptography.

Full explanation →
764
Multi-Selecteasy

An organization is implementing a public key infrastructure (PKI). Which THREE of the following are essential components?

Select 3 answers
A.Key escrow agent
B.Certificate authority (CA)
C.Certificate database and CRL
D.Registration authority (RA)
E.Time-stamping authority (TSA)
AnswersB, C, D

The CA signs and issues certificates.

Why this answer

The Certificate Authority (CA) is the core trust anchor in a PKI, responsible for issuing, signing, and revoking digital certificates. Without a CA, there is no mechanism to bind public keys to identities, making secure communications impossible. The CA's private key is used to sign certificates, and its public key is distributed as a trusted root.

Exam trap

CompTIA CASP+ often tests the distinction between essential PKI components (CA, RA, certificate database/CRL) and optional services (key escrow, TSA), trapping candidates who assume all listed items are mandatory for a basic PKI implementation.

Full explanation →
765
MCQeasy

An organization needs to demonstrate compliance with the General Data Protection Regulation (GDPR) for processing personal data of EU citizens. Which of the following is a mandatory requirement under GDPR?

A.Obtain explicit consent for all data processing
B.Notify supervisory authority of a breach within 24 hours
C.Implement data protection by design and default
D.Store all personal data within the EU
AnswerC

GDPR requires data protection by design and default.

Why this answer

Article 25 of the GDPR mandates data protection by design and default, requiring organizations to integrate data protection measures into processing activities and business practices from the outset. This includes pseudonymization, data minimization, and ensuring that only necessary personal data is processed by default. It is a mandatory, proactive requirement that applies to all controllers, regardless of the legal basis for processing.

Exam trap

Candidates often confuse the specific GDPR requirements, such as assuming that explicit consent is always required or that breach notification must occur within 24 hours, when in fact the correct mandatory requirement is data protection by design and default under Article 25.

How to eliminate wrong answers

Option A is wrong because explicit consent is not required for all data processing; GDPR provides several lawful bases for processing (e.g., legitimate interest, contractual necessity, legal obligation), and explicit consent is only one of them, typically required for special categories of data. Option B is wrong because the GDPR requires notification of a personal data breach to the supervisory authority within 72 hours, not 24 hours, unless the breach is unlikely to result in a risk to rights and freedoms. Option D is wrong because GDPR does not mandate that all personal data be stored within the EU; it permits transfers to third countries or international organizations provided that appropriate safeguards (e.g., Standard Contractual Clauses, Binding Corporate Rules, adequacy decisions) are in place.

Full explanation →
766
Multi-Selecthard

A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)

Select 3 answers
A.Exploit public-facing application
B.Spear-phishing attachment
C.Valid accounts
D.Remote services
E.Boot or logon autostart execution
AnswersA, B, C

Exploiting vulnerabilities in internet-facing applications is another common technique.

Why this answer

Options A, B, and C are correct. Exploiting a public-facing application (A), spear-phishing attachment (B), and valid accounts (C) are all common techniques for initial access according to the MITRE ATT&CK framework. Option D (remote services) is typically associated with lateral movement, not initial access.

Option E (boot or logon autostart execution) is a persistence technique.

Full explanation →
767
MCQmedium

During a security incident, a SOC analyst identifies a process with a suspicious hash on several endpoints. The analyst wants to determine if this hash is known to be malicious by querying internal and external threat intelligence sources. Which standard should the analyst use to structure the threat intelligence data for automated sharing?

A.TAXII
B.STIX
C.OpenIOC
D.CybOX
AnswerB

STIX is the standard structured language for describing threat intelligence.

Why this answer

STIX (Structured Threat Information Expression) is a language for describing threat intelligence, often used in conjunction with TAXII for sharing. It structures data like indicators, observables, and campaigns.

Full explanation →
768
Multi-Selecthard

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Select 2 answers
A.Execute all actions immediately to minimize damage.
B.Include a manual approval step for high-impact actions.
C.Ensure automated actions are reversible.
D.Use the same playbook for all incident types.
AnswersB, C

Why this answer

High-impact automated actions, such as blocking a critical server or deleting user accounts, can cause significant collateral damage if triggered by a false positive. Including a manual approval step ensures a human verifies the alert before irreversible or disruptive actions are taken, aligning with the principle of least privilege and incident response best practices.

Exam trap

CompTIA often tests the misconception that speed is always the priority in automation, tempting candidates to select 'execute all actions immediately' without considering the need for validation and reversibility in high-stakes environments.

Why the other options are wrong

A

Immediate execution without validation can cause collateral damage.

D

Different incidents require tailored responses; one-size-fits-all is ineffective.

Full explanation →
769
MCQeasy

A network architect is designing a DMZ for a web application. Which of the following is the MOST appropriate placement for a reverse proxy?

A.In the management network
B.In the DMZ
C.In the database tier
D.Inside the internal network
AnswerB

The DMZ is the appropriate security zone for externally facing services.

Why this answer

A reverse proxy is placed in the DMZ to act as an intermediary for client requests to the web application. It terminates external connections, inspects traffic, and forwards legitimate requests to internal web servers, thereby hiding the internal server architecture and providing an additional layer of security. This placement aligns with the principle of least exposure, as the DMZ is a semi-trusted network segment designed to host publicly accessible services.

Exam trap

Many candidates mistakenly think a reverse proxy belongs inside the internal network for better performance or easier management, but the correct placement is in the DMZ to enforce security boundaries and protect internal resources.

How to eliminate wrong answers

Option A is wrong because the management network is isolated for administrative access and should not host a reverse proxy, which must be reachable by external clients. Option C is wrong because the database tier is a highly sensitive internal network segment that should never be directly exposed to external traffic; placing a reverse proxy there would violate network segmentation and security best practices. Option D is wrong because placing a reverse proxy inside the internal network would expose internal IP addresses and architecture to external clients, defeating the purpose of traffic inspection and hiding backend servers.

Full explanation →
770
MCQmedium

A financial services company is implementing a risk management framework. The security team has identified that the current encryption algorithm for customer data in transit is deprecated. According to NIST SP 800-53, which of the following is the MOST appropriate step to address this finding?

A.Implement compensating controls such as network segmentation
B.Update the encryption algorithm to a FIPS 140-2 validated one
C.Accept the risk because the algorithm is still functional
D.Transfer the risk by purchasing cyber insurance
AnswerB

Updating aligns with NIST SP 800-53 cryptographic controls.

Why this answer

NIST SP 800-53 requires that cryptographic algorithms used to protect data in transit must be FIPS 140-2 validated. A deprecated algorithm (e.g., DES, RC4, or 3DES) is no longer considered secure and must be replaced with a current, approved algorithm such as AES-256 or ChaCha20. Updating the encryption algorithm directly remediates the security finding and aligns with the risk management framework's requirement to maintain adequate security controls.

Exam trap

The trap here is that candidates may choose compensating controls (Option A) thinking they can avoid updating the encryption algorithm, but NIST SP 800-53 explicitly requires the use of FIPS 140-2 validated cryptography for data in transit, and compensating controls are not a substitute for a deprecated algorithm.

How to eliminate wrong answers

Option A is wrong because implementing compensating controls like network segmentation does not address the root cause of a deprecated encryption algorithm; segmentation can reduce the attack surface but does not fix the cryptographic weakness in the data-in-transit channel. Option C is wrong because accepting the risk of a deprecated algorithm violates NIST SP 800-53's requirement for FIPS 140-2 validated cryptography, and the algorithm being 'still functional' does not mean it provides adequate security against modern attacks (e.g., RC4 is broken). Option D is wrong because transferring risk via cyber insurance does not remediate the technical vulnerability; insurance covers financial loss but does not satisfy the compliance requirement to use approved encryption.

Full explanation →
771
Multi-Selecthard

A DevOps team is automating server configuration using configuration management tools. Which THREE principles should be followed to ensure secure automation? (Choose three.)

Select 3 answers
A.Store secrets in encrypted variables or vaults
B.Implement least privilege for automation agents
C.Use idempotent scripts to ensure consistent state
D.Hardcode credentials in automation scripts
E.Perform unit testing on scripts
AnswersA, B, C

Encrypting secrets prevents exposure in scripts or logs.

Why this answer

Storing secrets in encrypted variables or vaults (e.g., HashiCorp Vault, Ansible Vault, or AWS Secrets Manager) ensures that sensitive data like API keys and passwords are never exposed in plaintext within scripts or version control. This prevents credential leakage during automation execution and adheres to security best practices for configuration management.

Exam trap

The CompTIA CASP+ exam often tests the distinction between security-specific practices (e.g., secret management, least privilege) and general DevOps best practices (e.g., unit testing), leading candidates to mistakenly select Option E as a security principle.

Full explanation →
772
Drag & Dropmedium

Drag and drop the steps to perform a secure code review for a web application into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Secure code review: understand code, automated scan, manual review, document, and communicate findings.

Full explanation →
773
MCQmedium

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

A.Encrypt all emails containing any sensitive data and allow delivery
B.Block both top secret and confidential content with no override
C.Block top secret content and allow confidential content with an audit log
D.Block top secret content and allow confidential content with an override requiring a business justification
AnswerD

Balances security and usability

Why this answer

It aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Exam trap

The trap here is that candidates often confuse 'allow with audit log' (passive monitoring) with 'allow with override requiring justification' (active enforcement), overlooking the specific business requirement for a justification workflow.

How to eliminate wrong answers

Option A is wrong because encrypting all emails containing sensitive data does not prevent data leakage; it only protects data in transit, and the firm requires blocking top-secret content, not just encrypting it. Option B is wrong because blocking both top-secret and confidential content with no override is too restrictive; it would prevent attorneys from sending confidential client contact info even with a legitimate business need, violating the requirement to allow such communication with justification. Option C is wrong because allowing confidential content with only an audit log provides no enforcement mechanism; the firm explicitly requires a business justification override for confidential data, not just passive logging.

Full explanation →
774
MCQhard

A security analyst reviews the syslog messages from the company's ASA firewall. Based on the exhibit, which of the following is the MOST likely cause of the denied traffic?

A.The external server is trying to initiate connections to the internal host on port 80.
B.Network address translation (NAT) is not configured correctly for the internal host.
C.The access-group "OUTSIDE_IN" is applied to the wrong interface or direction, blocking legitimate outbound traffic.
D.The internal host is attempting a port scan against the external server.
AnswerC

The access list name suggests it is meant for inbound traffic on the outside interface, but it is blocking outbound traffic, indicating a misapplication.

Why this answer

The syslog message shows traffic from the internal host (10.10.10.10) to the external server (209.165.200.225) on port 80 being denied by the access-group "OUTSIDE_IN" applied to the outside interface. Since the traffic is outbound (source inside, destination outside), an inbound access-list on the outside interface would block this legitimate outbound traffic because it evaluates packets entering the interface from the outside, not leaving it. The correct configuration would be to apply the access-group to the inside interface in the inbound direction or to the outside interface in the outbound direction.

Exam trap

CompTIA often tests the concept that an access-list applied inbound on the outside interface filters traffic entering from the outside, not traffic leaving the inside, causing candidates to mistakenly think the ACL blocks inbound traffic when it actually blocks outbound traffic.

How to eliminate wrong answers

Option A is wrong because the denied traffic is from the internal host to the external server on port 80, not the reverse; the syslog shows source 10.10.10.10 and destination 209.165.200.225, so the external server is not initiating connections. Option B is wrong because NAT misconfiguration would typically result in translation failures or asymmetric routing, not a deny by an access-list named "OUTSIDE_IN"; the syslog explicitly shows the deny is due to the access-group, not a NAT issue. Option D is wrong because there is no evidence of a port scan in the single syslog entry; a port scan would generate multiple denied packets to different ports or sequential IPs, and the log shows only a single TCP SYN to port 80, which is normal web traffic.

Full explanation →
775
MCQmedium

A security architect is evaluating a SASE solution. Which capability is expected to be part of a SASE platform?

A.Intrusion prevention system (IPS) at the data center
B.Network segmentation via VLANs
C.Secure web gateway (SWG)
D.Virtual private network (VPN) concentrator
AnswerC

SWG is a core security function in SASE for filtering web traffic.

Why this answer

SASE converges network and security services, including secure web gateway (SWG), cloud access security broker (CASB), zero trust network access (ZTNA), and firewall as a service (FWaaS). SD-WAN is the networking component.

Full explanation →
776
MCQmedium

A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?

A.Use stored procedures exclusively for database access.
B.Deploy a web application firewall (WAF) with SQL injection rules.
C.Use parameterized queries or prepared statements for all database interactions.
D.Implement client-side input validation and sanitize all user input.
AnswerC

Parameterized queries ensure data is treated as data, effectively preventing SQL injection.

Why this answer

Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.

Exam trap

The trap here is that candidates often choose stored procedures (Option A) thinking they are inherently safe, but Cisco tests the nuance that stored procedures are only safe if they use parameterized queries internally, not if they concatenate input into dynamic SQL.

How to eliminate wrong answers

Option A is wrong because stored procedures alone do not prevent SQL injection if they are called with dynamically concatenated SQL strings or if the stored procedure itself uses dynamic SQL without parameterization. Option B is wrong because a WAF is a reactive, signature-based defense that can be bypassed with encoding variations or novel attack patterns; it does not fix the underlying vulnerability in the application code. Option D is wrong because client-side validation is easily bypassed (e.g., by disabling JavaScript or using tools like Burp Suite), and server-side sanitization is error-prone and often insufficient against all injection vectors.

Full explanation →
777
Multi-Selectmedium

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

Select 2 answers
A.Enable SQL injection signature rules.
B.Enable input validation for all query parameters.
C.Enable rate limiting on login endpoints.
D.Enable IP reputation blocking.
E.Enable SSL/TLS inspection for all traffic.
AnswersA, B

Signature rules detect known SQL injection patterns.

Why this answer

Enabling SQL injection signature rules allows the WAF to inspect HTTP requests for known SQL injection patterns, such as UNION, OR 1=1, or comment sequences like '--', using a predefined rule set. Option B is correct because input validation for all query parameters ensures that user-supplied data is sanitized or rejected before reaching the application, preventing malicious SQL syntax from being interpreted by the database. Together, these controls provide both signature-based detection and behavioral prevention against SQL injection attacks.

Exam trap

The trap here is that candidates often confuse rate limiting or IP reputation as general security measures that would stop SQL injection, but these controls address different attack vectors (DoS and network-layer filtering) and do not inspect the content of requests for malicious SQL syntax.

Full explanation →
778
MCQhard

A security engineer is reviewing a PKI deployment where the root CA is kept offline. The issuing CA signs certificates for internal applications. Recently, a subordinate CA was compromised, and the engineer needs to revoke all certificates issued by that CA. Which of the following is the most efficient method to revoke these certificates?

A.Re-issue all certificates from a different issuing CA without revocation
B.Use OCSP to individually check and revoke each certificate
C.Publish a CRL from the compromised CA listing all certificates it issued
D.Revoke the compromised CA certificate and issue a new CRL from the root CA
AnswerC

Publishing a CRL from the compromised CA marks those certificates as revoked, while the CA certificate remains valid for CRL issuance.

Why this answer

The best method is to use a CRL issued by the compromised CA, marking all its unexpired certificates as revoked. Revoking the CA certificate itself invalidates all certificates issued by it, including valid ones. Distributing a new CRL from the root CA would require the root to be online.

Individual certificate revocation is inefficient.

Full explanation →
779
MCQeasy

A security analyst is reviewing a SIEM alert that indicates a user's credentials were used to log in from two different countries within a span of 10 minutes. This is likely an indicator of what type of attack?

A.Brute-force attack
B.Man-in-the-middle attack
C.Credential theft and reuse
D.Pass-the-hash attack
AnswerC

The attacker is using stolen credentials from a different location.

Why this answer

A login from two distant locations in a short time suggests credential theft and reuse, which is characteristic of a credential stuffing or account takeover attack. The attacker likely obtained the credentials and is using them from a different location.

Full explanation →
780
MCQhard

During a security assessment, a penetration tester discovers that a smart card used for authentication is vulnerable to a timing attack. The card uses a cryptographic algorithm that has data-dependent timing variations. Which of the following algorithms is MOST likely being used on the smart card?

A.ECDSA P-384
B.SHA-256
C.AES-256-CBC
D.RSA with Chinese Remainder Theorem
AnswerD

RSA-CRT implementations often have timing variations that can be exploited to recover the private key.

Why this answer

RSA decryption (using CRT) is known to be vulnerable to timing attacks if not implemented with constant-time functions. AES is typically resistant if implemented correctly. SHA-256 is a hash function, not used for signing/decryption.

ECDSA can be vulnerable to timing attacks if not constant-time, but RSA is more commonly associated with classic timing vulnerabilities.

Full explanation →
781
Multi-Selectmedium

A security architect is reviewing API security for a financial services platform that uses OAuth 2.0 for authorization and JWTs for token exchange. The platform must protect against common API threats such as token theft and injection attacks. Which TWO controls should be implemented to mitigate these specific threats? (Choose TWO.)

Select 2 answers
A.Implementing an API gateway
B.Using OAuth 2.0 scopes
C.Rate limiting on API endpoints
D.Input validation and sanitization
E.Short token expiration times
AnswersC, D

Rate limiting mitigates brute-force attacks on tokens and prevents denial of service.

Why this answer

Rate limiting helps prevent token brute-force and DoS attacks, while input validation prevents injection attacks (e.g., SQL injection, XSS) on API endpoints. OAuth 2.0 scopes define permissions but do not directly mitigate token theft. API gateways can enforce many policies but are not a specific control.

Short token lifetimes reduce the window of token theft but do not prevent injection.

Full explanation →
782
MCQmedium

A DevOps team uses Ansible to automate server configuration. They need to ensure that sensitive variables like passwords are not exposed in playbook logs or version control. What is the recommended approach?

A.Use Ansible Vault to encrypt sensitive variables
B.Use environment variables only
C.Store secrets in plain text within the playbook
D.Encrypt the entire playbook file
AnswerA

Ansible Vault encrypts specific variables or files, protecting secrets.

Why this answer

Ansible Vault is the built-in mechanism for encrypting sensitive data such as passwords, API keys, and certificates within Ansible projects. It encrypts variables or files at rest using AES-256, and the vault password is provided at runtime (e.g., via --ask-vault-pass or a vault password file), ensuring secrets are never stored in plaintext in playbook logs or version control. This approach integrates seamlessly with Ansible's workflow without requiring external tools or compromising automation.

Exam trap

The CAS-004 exam often tests the distinction between encrypting the entire playbook versus selectively encrypting sensitive variables, tempting candidates to choose 'encrypt the whole file' as a stronger security measure, but the recommended approach is to use Ansible Vault for targeted encryption to maintain readability and operational flexibility.

How to eliminate wrong answers

Option B is wrong because environment variables can still be exposed in logs, process listings, or version control if not carefully managed, and they lack the native encryption and access control that Ansible Vault provides. Option C is wrong because storing secrets in plain text within the playbook directly violates security best practices and would expose sensitive data in logs, version control history, and any system with access to the playbook files. Option D is wrong because encrypting the entire playbook file is overly restrictive, prevents easy review of non-sensitive logic, and complicates collaboration; Ansible Vault allows selective encryption of only sensitive variables while keeping the rest of the playbook readable.

Full explanation →
783
MCQmedium

A security team is measuring the effectiveness of its incident response process. Which of the following metrics would best indicate how quickly the team can contain an incident after it is detected?

A.Mean time to respond (MTTR)
B.Vulnerabilities by severity
C.Patch compliance percentage
D.Mean time to detect (MTTD)
AnswerA

Correct: MTTR measures the time to respond and contain an incident.

Why this answer

Mean time to respond (MTTR) measures the time from detection to containment, which is directly relevant to incident response effectiveness.

Full explanation →
784
MCQeasy

What is the primary benefit of using infrastructure as code (IaC) tools like Terraform for cloud resource provisioning?

A.It reduces cloud costs by optimizing resource usage.
B.It eliminates the need for manual configuration management.
C.It provides a declarative language to define resources, enabling version control and repeatability.
D.It automatically applies security patches to resources.
AnswerC

Declarative IaC ensures consistent and tracked deployments.

Why this answer

Infrastructure as Code (IaC) tools like Terraform use a declarative language (HCL) to define cloud resources in configuration files. This approach enables version control (e.g., Git), repeatable deployments, and consistent environments, which are the primary benefits of IaC over manual provisioning.

Exam trap

Common pitfall: Candidates often select a secondary benefit (like cost reduction or automated patching) instead of the primary benefit of IaC, which is declarative, version-controlled repeatability.

How to eliminate wrong answers

Option A is wrong because IaC does not directly reduce cloud costs; cost optimization requires separate practices like right-sizing, reserved instances, or auto-scaling policies. Option B is wrong because IaC does not eliminate manual configuration management entirely—it automates provisioning, but ongoing configuration management (e.g., using Ansible or Chef) may still be needed for OS-level settings. Option D is wrong because IaC does not automatically apply security patches; patch management is a separate operational process, though IaC can help ensure consistent baseline images.

Full explanation →
785
MCQeasy

Refer to the exhibit. A security review is being conducted on the Python application configuration. Which of the following security issues is present?

A.The DB_CONNECTION environment variable is missing a default value
B.The default database connection is SQLite, which is insecure for production
C.The code does not handle the case where API_KEY is not set, potentially causing an error
D.The API key is stored in an environment variable, which is insecure
AnswerC

Using os.environ with no default will raise an exception if the variable is missing, which can lead to information disclosure or denial of service.

Why this answer

The code attempts to retrieve the API_KEY environment variable using `os.environ['API_KEY']`, which raises a `KeyError` if the variable is not set. This lack of a fallback or error handling can cause the application to crash at startup, making it a security issue as it could lead to denial of service or expose stack traces in production logs.

Exam trap

CompTIA often tests the distinction between `os.environ[]` (raises error on missing key) and `os.getenv()` (returns default), leading candidates to overlook the missing default for API_KEY while focusing on the less critical DB_CONNECTION default or the storage method of the API key.

How to eliminate wrong answers

Option A is wrong because the DB_CONNECTION environment variable is accessed with `os.getenv('DB_CONNECTION', 'sqlite:///default.db')`, which provides a default value, so no issue exists. Option B is wrong because SQLite is not inherently insecure for production; the question focuses on configuration handling, not the database type, and SQLite can be secure with proper file permissions and encryption. Option D is wrong because storing an API key in an environment variable is a standard and recommended practice (e.g., 12-factor app methodology) compared to hardcoding it in source code; the insecurity here is the lack of a default or error handling, not the storage method itself.

Full explanation →
786
MCQhard

An enterprise is securing a hybrid cloud environment with on-premises and AWS workloads. They need to ensure that on-premises systems can privately access VPC resources without traversing the public internet. Which AWS service should they use?

A.AWS VPN (site-to-site)
B.AWS Transit Gateway
C.AWS PrivateLink
D.AWS Direct Connect
AnswerD

Direct Connect provides a dedicated private connection from on-premises to AWS.

Why this answer

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the internet for lower latency and increased security.

Full explanation →
787
MCQmedium

A threat hunter hypothesizes that a sophisticated attacker is using DNS tunneling for command and control. Which data source would most likely confirm this activity?

A.Network flow data (NetFlow)
B.DNS query logs from authoritative/internal DNS servers
C.Endpoint antivirus alerts
D.Web proxy logs
AnswerB

DNS logs contain query names and types; tunneling leaves unusual patterns.

Why this answer

DNS logs contain queries and responses; anomalous patterns like large TXT records or high frequency indicate tunneling. Option A is wrong because firewall logs may show traffic but not DNS content. Option C is wrong because antivirus may not detect tunneling.

Option D is wrong because web proxy logs show HTTP traffic.

Full explanation →
788
MCQhard

A security team needs to automate the enforcement of cloud security policies across multiple accounts in AWS. They want a solution that uses code to define policies and automatically remediate violations. Which approach best meets these requirements?

A.Write Python boto3 scripts that run on a schedule to check and update security groups.
B.Use AWS Config with managed rules and custom Lambda functions for auto-remediation.
C.Enable AWS GuardDuty and rely on its threat detection alerts.
D.Deploy a third-party cloud security posture management (CSPM) tool like Prisma Cloud.
AnswerB

AWS Config rules are defined in code (JSON) and remediation via Lambda automates enforcement.

Why this answer

AWS Config with managed rules and custom Lambda functions enables automated enforcement of security policies across multiple AWS accounts. This approach uses code to define policies and automatically remediate violations via Lambda, meeting the requirement for automation and code-defined policies. Option A (boto3 scripts) is manual and not fully automated; Option C (GuardDuty) is reactive and focuses on threats, not policy enforcement; Option D (CSPM) is a third-party tool, not a code-defined approach within AWS.

Full explanation →
789
MCQeasy

A company wants to automate the creation of IAM roles and policies in AWS using infrastructure as code. Which tool is specifically designed for provisioning cloud infrastructure across multiple providers?

A.Terraform
B.Jenkins
C.Docker
D.Ansible
AnswerA

Terraform is a declarative IaC tool for cloud provisioning.

Why this answer

Terraform is a IaC tool focused on provisioning resources across cloud providers. Docker handles containers, Ansible is configuration management, and Jenkins is CI/CD.

Full explanation →
790
MCQmedium

A security analyst at a large enterprise notices that several servers have missing security patches that are critical. The patch management process requires approval from the change advisory board (CAB) which meets weekly. The next meeting is in three days, but the vulnerability is being actively exploited. What should the analyst do?

A.Implement temporary compensating controls until the CAB approves.
B.Apply the patches immediately without waiting for CAB approval.
C.Notify the system owners and leave the decision to them.
D.Document the issue and wait for the CAB meeting.
AnswerA

Compensating controls mitigate risk while following the change management process.

Why this answer

When a critical vulnerability is being actively exploited, the security analyst must prioritize risk mitigation over standard change management processes. Implementing temporary compensating controls (e.g., network segmentation, host-based firewall rules, or disabling the vulnerable service) reduces the attack surface immediately while still seeking formal CAB approval for the permanent patch. This balances the need for rapid response with the enterprise's governance requirements.

Exam trap

The trap here is that candidates often assume 'patch immediately' (Option B) is always the correct security response, but the exam tests the understanding that governance processes like CAB approval must be respected unless an emergency change process is formally invoked, and compensating controls are the appropriate interim measure.

How to eliminate wrong answers

Option B is wrong because applying patches without CAB approval violates the enterprise's change management policy, which could lead to unintended service disruptions or compliance violations, and the analyst should not bypass the process without an emergency change procedure. Option C is wrong because notifying system owners and leaving the decision to them abdicates the analyst's responsibility to act on a critical security threat; system owners may lack the security context to make an informed decision quickly. Option D is wrong because documenting the issue and waiting three days for the CAB meeting ignores the active exploitation, which could result in a breach before the patch is approved.

Full explanation →
791
MCQmedium

A vulnerability has a CVSS base score of 9.8. The vulnerability is present on a server that is not exposed to the internet but is accessible to internal users with valid credentials. Which CVSS metric should be adjusted to reflect the reduced risk?

A.None, the base score should be used as-is
B.Temporal score
C.Environmental score
D.Base score
AnswerC

Environmental score adjusts for local context, such as access restrictions.

Why this answer

The Environmental Score allows customization based on specific organizational context, such as modified access requirements.

Full explanation →
792
MCQmedium

A security architect is designing a zero-trust network architecture for a hybrid cloud environment. The company uses on-premises servers and AWS. Which of the following best implements the principle of least privilege for inter-component communication?

A.Deploy an SD-WAN with dynamic path selection and encryption for all inter-site traffic.
B.Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.
C.Use network ACLs on the cloud VPC and on-premises routers to deny all traffic by default, then allow required ports.
D.Deploy a site-to-site VPN and route all inter-component traffic through a VPN concentrator.
AnswerB

Micro-segmentation with explicit allow rules ensures only necessary traffic is permitted, adhering to least privilege.

Why this answer

Micro-segmentation with stateful firewalls and explicit allow rules enforces least privilege at the workload level, ensuring that only explicitly permitted inter-component traffic is allowed. This approach is fundamental to zero-trust architectures, as it reduces the attack surface by preventing lateral movement, even within the same subnet or VPC.

Exam trap

The CAS-004 exam often tests the misconception that network-layer controls like ACLs or VPNs are sufficient for zero-trust least privilege, when in fact they lack the workload-level granularity and stateful enforcement required for true micro-segmentation.

How to eliminate wrong answers

Option A is wrong because SD-WAN with dynamic path selection and encryption focuses on optimizing and securing inter-site connectivity, not on granular per-workload access control; it does not enforce least privilege between individual components. Option C is wrong because network ACLs and on-premises routers operate at the subnet or network layer, not at the workload level, and they lack stateful inspection, making them insufficient for fine-grained, per-component allow rules required for zero-trust. Option D is wrong because a site-to-site VPN with a concentrator creates a tunnel for all inter-component traffic but does not provide per-workload segmentation or explicit allow rules; it merely encrypts traffic without controlling which specific components can communicate.

Full explanation →
793
Multi-Selectmedium

A SOC team is implementing a SOAR playbook to automate the response to phishing emails reported by users. The playbook should perform initial triage and, if the email is determined to be malicious, take containment actions. Which TWO of the following actions should be included in the playbook? (Choose TWO.)

Select 2 answers
A.Send an alert to the user's manager for approval
B.Automatically create a ticket in the service desk system
C.Automatically block the sender's email address in the email gateway
D.Initiate a full antivirus scan on the user's workstation
E.Extract embedded URLs and file hashes for threat intelligence lookup
AnswersC, E

This is a containment action to prevent further emails from that sender.

Why this answer

Common phishing response playbooks include extracting URLs and hashes for analysis and automatically blocking the sender's email address. Creating a ticket is not a containment action, and scanning the user's machine may be part of eradication but not initial containment.

Full explanation →
794
MCQeasy

A company wants to ensure that only authorized code runs on its point-of-sale (POS) terminals. Which technology should be implemented?

A.Application whitelisting
B.Code signing
C.Trusted Platform Module (TPM)
D.Secure Boot
AnswerB

Code signing digitally signs executables, and the system validates the signature before allowing execution.

Why this answer

Code signing ensures that only code digitally signed by a trusted publisher can execute on the POS terminals. By verifying the digital signature before execution, the terminal can cryptographically confirm the code's integrity and origin, preventing unauthorized or tampered code from running. This directly addresses the requirement to restrict execution to authorized code only.

Exam trap

The CAS-004 exam often tests the distinction between boot-time security (Secure Boot) and runtime code execution controls (code signing), leading candidates to choose Secure Boot because it sounds like it 'secures' the system, but it does not enforce authorization for applications launched after boot.

How to eliminate wrong answers

Option A is wrong because application whitelisting is a policy-based control that allows only pre-approved executables to run, but it does not provide cryptographic verification of the code's origin or integrity; it can be bypassed if the whitelist is misconfigured or if a malicious file is added to the allowed list. Option C is wrong because Trusted Platform Module (TPM) is a hardware security chip that stores cryptographic keys and performs attestation, but it does not directly control which code is allowed to run on the OS; it supports Secure Boot and measured boot but is not the execution enforcement mechanism itself. Option D is wrong because Secure Boot only verifies the bootloader and kernel during the boot process using UEFI signatures; it does not enforce code execution policies for applications or scripts after the OS has loaded, leaving the POS terminal vulnerable to unauthorized code at runtime.

Full explanation →
795
Multi-Selectmedium

A security analyst is investigating a potential data exfiltration incident. The analyst needs to preserve evidence for legal proceedings. Which two actions must the analyst take to maintain the chain of custody? (Select TWO).

Select 2 answers
A.Encrypt the evidence with a personal key
B.Share the evidence with all team members for analysis
C.Document every person who accesses the evidence and the time of access
D.Run antivirus scans on the evidence to ensure it is safe
E.Create a forensic image of the hard drive using a write-blocker
AnswersC, E

Chain of custody requires a record of evidence handling.

Why this answer

Documenting who handled evidence and when, and using forensic imaging with write-blockers ensures integrity and admissibility.

Full explanation →
796
MCQmedium

An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?

A.Deploy a forward proxy with SSL/TLS inspection
B.Block outbound TCP 443 and require users to use a VPN
C.Enable logging on the firewall for all outbound 443 traffic
D.Install a network-based IDS on the internal side of the firewall
AnswerA

A proxy can decrypt, inspect, and re-encrypt traffic to detect malicious payloads.

Why this answer

A forward proxy with SSL/TLS inspection decrypts outbound HTTPS traffic, allowing the security team to inspect the payload of connections over TCP 443. This reveals encrypted C2 traffic that would otherwise be hidden within legitimate HTTPS flows, while still permitting authorized business traffic to pass through after inspection.

Exam trap

The trap here is that candidates often assume a network-based IDS can detect malicious traffic in encrypted streams, but without decryption (as in a forward proxy with SSL inspection), the IDS sees only ciphertext and cannot analyze the payload.

How to eliminate wrong answers

Option B is wrong because blocking outbound TCP 443 entirely would disrupt all legitimate HTTPS traffic, causing significant business impact, and C2 traffic could simply shift to another port or use a VPN to bypass the block. Option C is wrong because merely enabling logging on the firewall for outbound 443 traffic only records metadata (source, destination, timestamps) but cannot inspect the encrypted payload, so the C2 traffic remains undetected. Option D is wrong because a network-based IDS placed on the internal side of the firewall sees only encrypted traffic on port 443 and cannot decrypt it, rendering it blind to the C2 content without SSL inspection capabilities.

Full explanation →
797
MCQhard

A large enterprise is designing a disaster recovery site that must support rapid failover with minimal data loss. The primary data center is 50 miles away. The RPO is 1 minute, and RTO is 15 minutes. Which replication strategy best meets these requirements?

A.Log shipping with a 5-minute delay.
B.Synchronous replication over dedicated low-latency fiber links.
C.Scheduled snapshot-based replication every 30 minutes.
D.Asynchronous replication with continuous data protection.
AnswerB

Synchronous replication ensures zero data loss and can meet the required RPO and RTO if latency is low enough.

Why this answer

Synchronous replication writes data to both the primary and secondary sites simultaneously before acknowledging the write to the application, ensuring zero data loss at the storage layer. With dedicated low-latency fiber links over 50 miles, the round-trip time can be kept under 1 ms, meeting the 1-minute RPO and enabling rapid failover within the 15-minute RTO. This strategy guarantees transactional consistency and immediate availability at the DR site.

Exam trap

The trap here is that candidates often choose asynchronous replication (Option D) thinking 'continuous data protection' implies zero data loss, but they overlook that asynchronous replication inherently introduces a write acknowledgment delay, which can still result in data loss during a failure, and the recovery process may not meet the aggressive RTO.

How to eliminate wrong answers

Option A is wrong because log shipping with a 5-minute delay introduces a recovery point of at least 5 minutes, exceeding the 1-minute RPO, and failover requires applying logs, which can take longer than 15 minutes. Option C is wrong because scheduled snapshot-based replication every 30 minutes creates a maximum data loss of 30 minutes, far exceeding the 1-minute RPO, and snapshots do not support rapid failover without additional recovery steps. Option D is wrong because asynchronous replication with continuous data protection (CDP) may reduce data loss to seconds but still risks some data loss due to the asynchronous write acknowledgment, and the recovery process for CDP can be complex and time-consuming, potentially exceeding the 15-minute RTO.

Full explanation →
798
MCQhard

During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?

A.The key length is insufficient against modern attacks
B.The firmware is not encrypted
C.The signature algorithm is obsolete
D.The signing key is not rotated
AnswerA

1024-bit RSA can be broken by determined attackers; NIST recommends at least 2048 bits.

Why this answer

A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.

Exam trap

In CompTIA CASP+, the key length is the primary concern; 1024-bit RSA is considered weak against modern attacks. Candidates often mistake algorithm obsolescence or lack of encryption as the issue, but the question focuses on the cryptographic strength of the key itself.

How to eliminate wrong answers

Option B is wrong because firmware encryption protects confidentiality, not integrity or authenticity; the primary concern here is the strength of the signature, not whether the firmware is encrypted. Option C is wrong because RSA itself is not obsolete; the algorithm remains secure when used with adequate key lengths (e.g., 2048-bit or higher). Option D is wrong because key rotation, while a good practice, does not directly address the fundamental weakness of an insufficient key length; even a rotated 1024-bit key remains vulnerable.

Full explanation →
799
MCQmedium

A security architect is designing a new DMZ for an e-commerce platform. The DMZ must host a web server, an API gateway, and a database server. The architect needs to minimize the attack surface while ensuring the web server can communicate with the API gateway, and the API gateway can communicate with the database. Which network segmentation approach best meets these requirements?

A.Place all three services in the same DMZ subnet and use host-based firewalls to restrict traffic.
B.Create two DMZ subnets: one for the web server and API gateway, and another for the database server.
C.Place the web server in a DMZ subnet, the API gateway in a separate DMZ subnet, and the database server on the internal network.
D.Create three separate DMZ subnets: one for the web server, one for the API gateway, and one for the database server, with firewall rules allowing only required traffic.
AnswerD

This provides defense in depth; each tier is isolated, and only specific ports/protocols are allowed between them.

Why this answer

It implements the principle of least privilege through network segmentation. By placing each service in its own DMZ subnet with firewall rules that allow only the required traffic (e.g., HTTP/HTTPS from web to API, SQL from API to database), the attack surface is minimized. This prevents lateral movement if one service is compromised, as an attacker cannot directly reach the database from the web server or the API gateway from the internet.

Exam trap

CompTIA often tests the misconception that placing the database server on the internal network (Option C) is acceptable, but in a DMZ design, any server that must be accessed from a DMZ should remain in the DMZ to avoid exposing internal network resources to potential compromise.

How to eliminate wrong answers

Option A is wrong because placing all three services in the same subnet allows unrestricted lateral movement; host-based firewalls can be bypassed if the host is compromised, and this approach does not provide network-level isolation. Option B is wrong because placing the web server and API gateway in the same subnet still exposes the API gateway to direct attack from the web server if the web server is compromised, and the database subnet is not isolated from the API gateway with sufficient granularity. Option C is wrong because placing the database server on the internal network violates the DMZ principle; the API gateway must traverse the internal firewall to reach the database, which increases the attack surface and exposes internal resources to DMZ traffic.

Full explanation →
800
Multi-Selectmedium

A company is adopting a serverless architecture using AWS Lambda. Which of the following are security concerns specific to serverless functions? (Select TWO.)

Select 2 answers
A.Insecure deserialization of function input
B.Event injection via malformed input
C.Container escape vulnerabilities
D.Overly permissive IAM roles assigned to the function
E.SQL injection in the database
AnswersB, D

Why this answer

Event injection via malformed input (B) is a specific serverless security concern because AWS Lambda functions are triggered by events from sources like API Gateway, S3, or DynamoDB Streams. An attacker can craft malicious input that exploits the function's event-handling logic, leading to unintended execution paths or data corruption. This differs from traditional injection attacks because the event structure itself can be manipulated to bypass validation.

Exam trap

CompTIA often tests the misconception that serverless functions are immune to injection attacks because they are 'stateless' or 'event-driven,' but the trap here is that event injection is a distinct attack vector where the event structure itself is the injection surface, not just the data within it.

Why the other options are wrong

A

A general web vulnerability, not specific to serverless.

C

Serverless functions run in isolated containers, but escape is more relevant to traditional containers.

E

A general web vulnerability, not specific to serverless.

Full explanation →
801
MCQmedium

The Docker container `myservice` has the mount configuration shown. What is the most significant security implication of this configuration?

A.The container can modify files on the host at /data/config.
B.The container has full access to the host's filesystem.
C.The container can read host files at /data/config, but not write.
D.The container can mount additional filesystems using the bind mount.
AnswerC

Read-only bind mount allows reading, no writing.

Why this answer

The mount configuration shown (a bind mount with read-only flag) restricts the container to read-only access to the host's /data/config directory. The container cannot write to or modify files on the host at that path, which is the most significant security implication: it prevents the container from altering host configuration or data, reducing the risk of privilege escalation or data corruption.

Exam trap

The common misconception is that any bind mount grants full host filesystem access, when in fact the scope is limited to the specific mounted directory and the read-only flag further restricts write capabilities.

How to eliminate wrong answers

Option A is wrong because the read-only flag on the bind mount explicitly prevents the container from modifying files on the host at /data/config; write operations would be denied by the kernel's mount namespace enforcement. Option B is wrong because the container only has access to the specific bind-mounted directory (/data/config), not the entire host filesystem; full host filesystem access would require a mount like '/' or using the '--privileged' flag. Option D is wrong because the bind mount configuration does not grant the container the ability to mount additional filesystems; mounting requires the 'SYS_ADMIN' capability or '--privileged' mode, which is not implied by a simple bind mount.

Full explanation →
802
MCQeasy

An organization wants to reduce the attack surface of its web servers by ensuring only necessary modules are enabled. Which practice directly supports this goal?

A.Patch management
B.Application whitelisting and module disablement
C.Regular backups
D.Multi-factor authentication
AnswerB

Whitelisting and disabling unnecessary modules reduce attack surface.

Why this answer

Application whitelisting and module disablement. This practice directly reduces the attack surface by ensuring only authorized applications and necessary modules are enabled, eliminating unnecessary services that could be exploited. Option A (Patch management) addresses vulnerabilities in existing software but does not remove unused modules.

Option C (Regular backups) focuses on data recovery, not attack surface reduction. Option D (Multi-factor authentication) strengthens access control but does not limit enabled modules or applications.

Full explanation →
803
MCQhard

A security architect is designing a PKI for a large organization. The architect wants to ensure that private keys are stored securely and that cryptographic operations are performed in a tamper-resistant environment. Which solution should be used?

A.Trusted Platform Module (TPM)
B.Hardware Security Module (HSM)
C.Software-based keystore
D.Key Management Service (KMS) in the cloud
AnswerB

HSMs are designed for secure key generation, storage, and cryptographic operations.

Why this answer

Hardware Security Modules (HSMs) provide dedicated, tamper-resistant hardware for key storage and cryptographic operations.

Full explanation →
804
MCQhard

A security architect is evaluating a web application that uses JSON Web Tokens (JWTs) for authentication. The application uses an RSA256 asymmetric signing algorithm. The architect discovers that the JWT library accepts tokens with the algorithm set to 'none' if the public key is not provided during verification. Which of the following attacks is most likely to succeed if the application does not enforce algorithm validation?

A.Algorithm confusion (key confusion) attack where the attacker uses the public key as an HMAC secret
B.Signature exclusion attack using the 'none' algorithm
C.Timing attack to brute-force the private key
D.Header injection attack to modify the JWT header
AnswerB

Why this answer

The JWT library accepts tokens with the algorithm set to 'none' when the public key is not provided during verification. This allows an attacker to forge a JWT with the 'none' algorithm, bypassing signature verification entirely. The attack succeeds because the application fails to enforce a whitelist of allowed algorithms, as recommended by RFC 7518.

Exam trap

The CAS-004 exam often tests the distinction between algorithm confusion attacks (which involve key reuse) and signature exclusion attacks (which exploit the 'none' algorithm), and the trap here is that candidates confuse the 'none' algorithm vulnerability with the more complex key confusion attack described in option A.

Why the other options are wrong

A

This attack targets libraries that use the same key for both HMAC and RSA, but the scenario describes a library that accepts 'none' algorithm, not HMAC.

C

Timing attacks target side-channel leakage, not algorithm validation bypass.

D

Header injection is about modifying headers in requests, not exploiting JWT algorithm handling.

Full explanation →
805
MCQhard

During a penetration test, a tester finds that an application uses server-side sessions with predictable session IDs. Which attack is this vulnerability most likely to facilitate?

A.Session fixation
B.Clickjacking
C.Session hijacking
D.CSRF
AnswerC

With predictable session IDs, an attacker can obtain a valid session and impersonate the user.

Why this answer

Predictable session IDs allow an attacker to guess or calculate a valid session identifier for an authenticated user. By obtaining or predicting the session ID, the attacker can impersonate that user and gain unauthorized access to the application, which is the essence of session hijacking. This attack directly exploits weak session ID generation or insufficient entropy in the server-side session management.

Exam trap

The trap here is that candidates often confuse session hijacking with session fixation, but session fixation requires the attacker to force a specific session ID onto the victim, whereas predictable session IDs enable the attacker to simply guess or calculate the victim's current session ID without any prior interaction.

How to eliminate wrong answers

Option A is wrong because session fixation requires the attacker to set a known session ID on the victim's browser (e.g., via a URL parameter or cookie injection) before the victim logs in, not simply predicting server-generated IDs. Option B is wrong because clickjacking relies on transparent overlays and UI redressing to trick users into clicking unintended elements, not on session ID predictability. Option D is wrong because CSRF (Cross-Site Request Forgery) forces an authenticated user to execute unwanted actions via crafted requests, but it does not require or exploit predictable session IDs; it typically leverages the user's existing session cookie.

Full explanation →
806
MCQeasy

An organization is developing a SOAR playbook to handle phishing emails reported by users. Which of the following actions is most appropriate to automate in the first step of the playbook?

A.Block the sender's email address at the gateway
B.Remove the email from all user mailboxes
C.Scan the attachment in a sandbox
D.Send an alert to the SOC analyst for manual analysis
AnswerB

Removing the email from mailboxes is a containment action that limits further risk.

Why this answer

The first step in a phishing response playbook should isolate the potentially malicious email to prevent further exposure. Automating the removal of the email from all user mailboxes is a common initial containment action.

Full explanation →
807
MCQhard

An organization is adopting a SASE architecture to provide secure access to cloud applications. Which component is essential for enforcing security policies based on user identity and device posture?

A.Zero Trust Network Access (ZTNA)
B.Firewall as a Service (FWaaS)
C.Secure Web Gateway (SWG)
D.Cloud Access Security Broker (CASB)
AnswerA

ZTNA enforces access based on user identity, device posture, and context, aligning with zero trust principles.

Why this answer

SASE converges networking and security functions, with the Security Service Edge (SSE) component including SWG, CASB, ZTNA, and FWaaS. While CASB focuses on data security and compliance for cloud applications, ZTNA is the component specifically designed to enforce security policies based on user identity and device posture, providing granular access control regardless of location.

Full explanation →
808
MCQhard

After containing a confirmed security incident, the incident response team must plan for eradication. What must be done before eradication begins?

A.Conduct a full forensic analysis of all systems
B.Determine the root cause of the incident
C.Begin eradication immediately to minimize dwell time
D.Notify law enforcement agencies
AnswerB

Root cause analysis ensures eradication addresses the entry point and method.

Why this answer

Before eradication can begin, the incident response team must determine the root cause of the incident. This ensures that the eradication steps are comprehensive and address the underlying vulnerability, preventing recurrence. Conducting a full forensic analysis (A) may be part of root cause determination but is not a separate prerequisite.

Beginning eradication immediately (C) without understanding the root cause risks incomplete removal. Notifying law enforcement (D) is optional and not a required step before eradication.

Full explanation →
809
MCQmedium

A security analyst is reviewing the results of a vulnerability scan and identifies a critical vulnerability in a legacy application that cannot be patched because it is no longer supported by the vendor. The application is critical for business operations. Which of the following risk treatment strategies should the organization implement?

A.Risk transfer by purchasing cyber insurance to cover potential losses.
B.Risk mitigation by applying a vendor-supplied patch.
C.Risk avoidance by decommissioning the application and migrating to a new system.
D.Risk acceptance with compensating controls such as network segmentation and strict access controls.
AnswerD

Acceptance acknowledges the residual risk, and compensating controls reduce likelihood/impact.

Why this answer

When a legacy application cannot be patched due to vendor end-of-life, the organization must accept the residual risk while implementing compensating controls. Network segmentation (e.g., VLANs, ACLs) and strict access controls (e.g., least privilege, MFA) reduce the attack surface and contain potential exploitation, aligning with the risk acceptance strategy under the NIST SP 800-37 risk management framework.

Exam trap

The trap here is that candidates often confuse risk acceptance with doing nothing, but in CAS-004, risk acceptance requires documented compensating controls to reduce residual risk to an acceptable level, not simply ignoring the vulnerability.

How to eliminate wrong answers

Option A is wrong because risk transfer via cyber insurance does not reduce the likelihood or impact of a vulnerability being exploited; it only provides financial reimbursement after a breach, leaving the technical exposure unaddressed. Option B is wrong because a vendor-supplied patch is unavailable by definition (the application is no longer supported), making risk mitigation via patching impossible. Option C is wrong because risk avoidance by decommissioning the application would halt critical business operations, which is not feasible; the question explicitly states the application is critical for business operations.

Full explanation →
810
Multi-Selecteasy

A security engineer is hardening a Linux server. Which TWO of the following are best practices for preventing privilege escalation attacks?

Select 2 answers
A.Disable all user accounts except root
B.Apply kernel hardening with sysctl
C.Enable SELinux in enforcing mode
D.Remove the SUID bit from all binaries
E.Restrict cron jobs to root only
AnswersB, C

Kernel hardening parameters (e.g., disabling IP forwarding) reduce attack surface.

Why this answer

Options B and C are correct. Kernel hardening with sysctl (B) reduces the attack surface by disabling unnecessary kernel features and enforcing security settings (e.g., restricting dmesg, kernel pointer access). SELinux in enforcing mode (C) provides mandatory access control, limiting process capabilities and confining exploits even if a service is compromised.

Option A is incorrect because disabling all non-root user accounts is impractical, violates the principle of least privilege, and does not directly prevent privilege escalation. Option D is incorrect because removing the SUID bit from all binaries is too broad; some SUID binaries are essential (e.g., sudo, passwd) and removing them breaks functionality without necessarily preventing escalation. Option E is incorrect; while restricting cron jobs to root may limit cron-based attacks, it is not a primary best practice for preventing privilege escalation and can break legitimate scheduled tasks.

Full explanation →
811
Multi-Selectmedium

An IoT device uses a Trusted Platform Module (TPM) 2.0 for secure boot and attestation. Which THREE of the following functions does the TPM provide to support these security features?

Select 3 answers
A.Accelerated symmetric encryption
B.Platform Configuration Registers (PCRs) for storing measurements
C.Hardware random number generation
D.Sealed storage that decrypts data only if PCR values match expected measurements
E.Remote attestation using TPM_Quote to sign PCR values
AnswersB, D, E

PCRs store hash measurements of boot components.

Why this answer

TPM 2.0 provides secure boot (via PCR measurement), remote attestation (via quote operation), and sealed storage (binding data to PCR values). Measured boot is a process that uses TPM to record measurements.

Full explanation →
812
MCQmedium

During a penetration test, the tester has gained initial access to a system and wants to escalate privileges. Which of the following techniques is most likely to be effective for privilege escalation on a Windows system?

A.Using Mimikatz to extract plaintext passwords from memory
B.Exploiting a local privilege escalation vulnerability like CVE-2023-xxxx
C.Scanning for open ports on the network
D.Performing a phishing attack on the domain administrator
AnswerB

Local exploits can elevate from user to admin/system.

Why this answer

Exploiting a kernel vulnerability or a misconfigured service is a common privilege escalation technique. Token manipulation and DLL hijacking are also methods, but kernel exploits are direct.

Full explanation →
813
MCQeasy

Which of the following best describes the security benefit of using an API gateway in a microservices architecture?

A.It eliminates the need for input validation in individual microservices
B.It encrypts all data between the client and server using mTLS
C.It enforces security policies such as authentication and rate limiting centrally
D.It automatically load balances traffic to ensure high availability
AnswerC

The gateway centralizes cross-cutting security concerns, providing a single enforcement point.

Why this answer

An API gateway provides a centralized point for enforcing security policies like authentication, rate limiting, and input validation. This reduces the attack surface by offloading these responsibilities from individual services. Option A is incorrect because input validation is still needed at the service level for defense-in-depth.

Option B is incorrect because encryption is typically handled by TLS, not solely the gateway. Option D is incorrect because load balancing is a traffic management function, not a direct security benefit.

Full explanation →
814
MCQmedium

A security architect is evaluating a SASE solution. Which component of SASE is primarily responsible for inspecting encrypted traffic for threats?

A.Zero Trust Network Access (ZTNA)
B.Next-generation firewall (NGFW)
C.Secure web gateway (SWG)
D.SD-WAN edge
AnswerC

Correct – SWG performs deep packet inspection on encrypted traffic.

Why this answer

SASE integrates SWG (Secure Web Gateway) for web filtering and threat inspection, including decryption and inspection of TLS traffic.

Full explanation →
815
MCQmedium

In a CI/CD pipeline, a security gate fails because a high-severity vulnerability is found in the base image of a container. The pipeline is configured to block deployment on such findings. What is the appropriate remediation step?

A.Update the base image to a patched version
B.Override the security gate and proceed with deployment
C.Rebuild the image using the same base image
D.Add the vulnerability to an exception list
AnswerA

Using a patched base image resolves the vulnerability.

Why this answer

Updating the base image to a patched version ensures the vulnerability is fixed. Overriding the gate or adding exceptions bypasses security, and rebuilding with the same base retains the issue.

Full explanation →
816
MCQhard

The engineer needs to prevent brute-force attacks while allowing legitimate access. Which security control is MOST effective?

A.Disable root login
B.Change SSH port to 2222
C.Implement fail2ban with a threshold of 5 attempts per minute
D.Implement IP whitelist for 10.0.0.0/8
AnswerC

Fail2ban automatically blocks offending IPs after exceeding the threshold, allowing legitimate traffic.

Why this answer

Fail2ban dynamically blocks IP addresses after a configurable number of failed attempts, stopping brute-force while allowing legitimate users (e.g., 10.0.0.50) to connect. Disabling root login only prevents root access but not attacks on other users. Changing the SSH port is security by obscurity.

IP whitelisting for 10.0.0.0/8 would block all other legitimate users and is not flexible.

Full explanation →
817
MCQmedium

A company is migrating its workloads to a public cloud and wants to ensure it understands the division of security responsibilities. Which model defines the demarcation of security controls between the cloud provider and the customer?

A.Cloud Security Posture Management (CSPM)
B.Zero trust architecture
C.Cloud Access Security Broker (CASB)
D.Shared responsibility model
AnswerD

This model defines security responsibilities between provider and customer.

Why this answer

The shared responsibility model clearly delineates which security tasks are handled by the cloud provider and which by the customer, varying by service type (IaaS, PaaS, SaaS).

Full explanation →
818
Multi-Selecthard

During a penetration test, the tester has gained initial access to a web server and wants to perform lateral movement to reach a database server. The tester enumerates the network and finds that the web server has two network interfaces: one connected to a DMZ and one to an internal network. The database server is on the internal network. Which TWO techniques could the tester use to pivot from the web server to the database server? (Choose TWO.)

Select 2 answers
A.Use SSH tunneling to create a local forward to the database server's port
B.Perform a SQL injection attack against the database server
C.Deploy a reverse shell from the web server to the tester's machine
D.Install a keylogger on the web server to capture database credentials
E.Use Metasploit's route add command to add a route to the internal subnet through the web server
AnswersA, E

SSH tunneling can forward local ports to internal services.

Why this answer

Pivoting techniques include using the compromised host as a proxy to route traffic and port forwarding to tunnel to internal systems. SSH tunneling and Metasploit's pivot module are common. A reverse shell is for initial access, not pivoting.

SQL injection is for initial compromise, not lateral movement.

Full explanation →
819
MCQmedium

A security architect is designing a new authentication system for a cloud-based application that requires strong multi-factor authentication. The solution must be resistant to phishing attacks and not rely on shared secrets. Which of the following is the BEST choice?

A.HOTP with a hardware token
B.FIDO2/WebAuthn
C.TOTP via a mobile authenticator app
D.SMS one-time passcodes
AnswerB

FIDO2/WebAuthn provides phishing-resistant, passwordless authentication using public key cryptography.

Why this answer

FIDO2/WebAuthn is a passwordless authentication protocol that uses public key cryptography and is resistant to phishing because the private key never leaves the user's device.

Full explanation →
820
MCQeasy

A security architect reviews this Cisco router ACL configuration. The web server at 192.168.1.100 is accessible from the internet. What additional security measure should be implemented to protect the internal network (10.0.0.0/24)?

A.Remove the log statement from the deny rules to improve performance
B.Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web ports only
C.Replace the ACLs with a stateful firewall that inspects connection states
D.Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound
AnswerC

A stateful firewall provides deeper inspection and can prevent various attacks.

Why this answer

A stateful firewall (option C) tracks the state of active connections and dynamically permits return traffic for legitimate sessions, whereas a stateless ACL only filters based on static 5-tuple criteria. In this scenario, the ACL on the outside interface allows inbound web traffic to 192.168.1.100 but does not inspect session state, leaving the internal network (10.0.0.0/24) vulnerable to spoofed or unsolicited inbound packets that match permit rules. A stateful firewall would enforce that only packets belonging to established sessions initiated from the internal network are allowed back in, providing defense against IP spoofing and session-hijacking attacks.

Exam trap

A common misconception is that adding more ACL rules or applying them on additional interfaces is sufficient for security, when the real gap is the lack of stateful inspection that a firewall provides.

How to eliminate wrong answers

Option A is wrong because removing the log statement from deny rules does not improve security; it only reduces logging overhead, and the question asks for an additional security measure, not a performance optimization. Option B is wrong because limiting outbound traffic on GigabitEthernet0/1 to web ports only would restrict internal users from accessing legitimate non-web services (e.g., SSH, DNS) and does not address the core issue of stateless filtering on the inbound path. Option D is wrong because applying the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound would block all inbound traffic on the internal interface, including legitimate return traffic for outbound connections, effectively breaking internal-to-external communication.

Full explanation →
821
MCQmedium

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

A.The certificate uses the SHA-1 hash algorithm
B.The RSA key length is 2048 bits
C.The certificate is self-signed
D.The validity period is only one year
AnswerA

SHA-1 is considered broken and should not be used for digital signatures.

Why this answer

The certificate uses the SHA-1 hash algorithm, which is cryptographically broken and vulnerable to collision attacks. SHA-1 is deprecated by major browsers and the CA/Browser Forum, and its use in TLS certificates poses a significant security risk because an attacker could forge a certificate with the same hash.

Exam trap

In the CASP+ exam, candidates may mistakenly think that a 2048-bit RSA key is weak or that a one-year validity period is a vulnerability, but the deprecated SHA-1 hash algorithm is the critical security issue.

How to eliminate wrong answers

Option B is wrong because an RSA key length of 2048 bits is currently considered secure and is the minimum recommended by NIST and the CA/Browser Forum; it does not represent a security concern. Option C is wrong because the exhibit does not indicate the certificate is self-signed; even if it were, self-signed certificates are not inherently a security concern in all contexts (e.g., internal testing) and are not the primary issue here. Option D is wrong because a one-year validity period is actually a best practice for reducing exposure to compromised keys; longer validity periods (e.g., 2–3 years) are more concerning.

Full explanation →
822
MCQhard

An OpenVPN configuration file is shown. A security auditor recommends replacing the cipher and auth directives. Which of the following is the BEST replacement pair from a security engineering perspective?

A.cipher AES-256-GCM and auth SHA256
B.cipher AES-128-GCM and auth SHA384
C.cipher 3DES-168 and auth MD5
D.cipher Blowfish-128 and auth SHA1
AnswerA

AES-256-GCM is an AEAD cipher that includes authentication, so the auth directive becomes unnecessary; however, OpenVPN allows both. This is a secure modern combination.

Why this answer

Cipher AES-256-GCM and auth SHA256, is the best replacement pair. AES-256-GCM is an AEAD cipher that provides both confidentiality and integrity, making the auth directive redundant but still compatible with SHA256. AES-256-GCM is considered strong and current.

Option B uses AES-128-GCM with SHA384; while still secure, AES-256 is generally preferred for higher security margins. Option C uses 3DES-168 and MD5, both of which are weak and deprecated. Option D uses Blowfish-128 and SHA1, where Blowfish is outdated and SHA1 is considered weak.

Full explanation →
823
MCQhard

A company's security team is reviewing the integration of a legacy application that only supports NTLM authentication. The infrastructure must be updated to meet modern security standards. Which of the following is the BEST approach to mitigate the risk of using NTLM?

A.Place the application on an isolated network segment and restrict access with IP whitelisting.
B.Deploy an authentication federation service that translates modern Kerberos/SAML to NTLM for the legacy application.
C.Apply vendor patches to upgrade NTLM to NTLMv2 and enable extended protection for authentication.
D.Disable NTLM and force the application to use Kerberos directly.
AnswerB

A federation service (e.g., ADFS with NTLM fallback) allows the application to use modern authentication while the broker handles the legacy protocol, reducing risk.

Why this answer

Deploying an authentication federation service (such as ADFS or a SAML proxy) allows the legacy application to continue using NTLM internally while presenting a modern authentication interface (e.g., Kerberos or SAML) to clients. This mitigates the risk of exposing NTLM to the network and allows integration with modern identity providers without modifying the legacy application. Option A is incorrect because network isolation and IP whitelisting do not address the inherent vulnerabilities of the NTLM protocol itself.

Option C is incorrect because upgrading to NTLMv2 still leaves the protocol susceptible to relay attacks and other weaknesses, and vendor patches may not be available or feasible. Option D is incorrect because disabling NTLM would break the application if it does not support Kerberos directly.

Full explanation →
824
Multi-Selecteasy

Which TWO of the following are examples of compensating controls for a security control deficiency?

Select 2 answers
A.Increasing logging and monitoring.
B.Implementing stricter access controls.
C.Accepting the risk.
D.Purchasing cyber insurance.
E.Re-architecting the network.
AnswersA, B

Enhanced monitoring can detect unauthorized activities that a deficient control might not prevent.

Why this answer

Increasing logging and monitoring (A) is a compensating control because it does not prevent the security deficiency itself but instead provides enhanced visibility and detection capabilities to identify and respond to incidents that exploit the deficiency. For example, if a legacy system cannot support multifactor authentication, enabling verbose logging of authentication attempts and real-time alerting via a SIEM (e.g., Splunk or ELK) allows the security team to detect brute-force attacks or unauthorized access attempts, thereby compensating for the missing control. This aligns with the NIST SP 800-53 definition of compensating controls as alternative measures that reduce risk to an acceptable level without directly fixing the underlying flaw.

Exam trap

CompTIA often tests the distinction between compensating controls and risk acceptance or risk transfer, where candidates mistakenly select 'accepting the risk' or 'purchasing cyber insurance' as valid compensating controls because they confuse risk treatment strategies with alternative security measures.

Full explanation →
825
MCQmedium

A company runs a containerized application in a Kubernetes cluster. After a penetration test, the security team found that several containers are running with root privileges and have unnecessary packages installed. To reduce the attack surface, the team wants to enforce least privilege and minimize the software footprint. Which action should be taken first to address these findings?

A.Apply SELinux labels to restrict container capabilities
B.Rebuild the container images using minimal base images and remove unnecessary packages
C.Configure the containers to run as non-root user and use read-only filesystems
D.Implement network policies to limit lateral movement between pods
AnswerB

Minimal images reduce attack surface by eliminating unnecessary components.

Why this answer

The first step to reduce the attack surface is to rebuild the container images using minimal base images (e.g., Alpine or distroless) and remove unnecessary packages. This directly addresses the findings of unnecessary packages and reduces the software footprint. While running containers as non-root and using read-only filesystems (Option C) improves security, it does not eliminate unnecessary packages.

SELinux labels (Option A) and network policies (Option D) are additional hardening measures but do not address the core issue of container image bloat and privileged containers. Therefore, rebuilding images is the foundational action.

Full explanation →
Page 10

Page 11 of 13

Page 12

All pages

12345678910111213

Practice CAS-005 by domain

Target a specific domain to shore up weak areas.

Security ArchitectureSecurity EngineeringSecurity OperationsGovernance, Risk, and Compliance
See all domains with question counts →