CompTIA SecurityX (CAS-005) (CAS-005) — Questions 826–900

A data classification policy must define handling requirements for each classification level, specifying how data should be stored, transmitted, and accessed. This ensures consistent protection controls are applied based on sensitivity, which is a core governance principle. Without these requirements, data may be mishandled, leading to compliance violations or data breaches.

Identity and Access Management (IAM) is a fundamental cloud service for managing users, roles, and permissions.

GDPR requires that personal data of EU residents be stored within the EEA or in jurisdictions with an adequacy decision, making geographical storage restrictions a direct residency measure. Option C is also correct because data loss prevention (DLP) policies can monitor and block unauthorized data transfers out of approved regions, enforcing compliance with data residency requirements. Option D is incorrect; while encryption is a security measure required under GDPR Article 32, it does not ensure that data stays within approved geographical boundaries.

The environmental score allows customization based on the organization's environment, including compensating controls.

Compliance focuses on meeting minimum legal or regulatory requirements, while security aims for best practices to protect assets beyond what is required.

UEBA detects deviations from normal behavior. A user logging in at unusual hours and accessing large volumes of data are common anomalies. Running scheduled antivirus scans and normal VPN access are expected behaviors.

Disabling SSID broadcast (option C) is correct because it prevents the access point from advertising the network name in beacon frames, making the network less visible to casual scanning tools. While not a strong security control on its own (since the SSID is still discoverable via passive monitoring of probe responses and association frames), it adds a layer of obscurity that can deter low-skill attackers and is often required in government environments as part of a defense-in-depth strategy.

ChaCha20-Poly1305 is a stream cipher that is fast in software, especially on devices without AES hardware acceleration, and provides authenticated encryption with low overhead.

Image scanning verifies signatures and checks for vulnerabilities; however, to enforce only signed images, the registry must require signature verification.

The firewall rule permits 'any' as the service, meaning all TCP/UDP ports and protocols are allowed through. This is overly permissive because it bypasses the principle of least privilege, exposing the internal network to unnecessary traffic and potential attacks. A proper rule should specify only required services (e.g., TCP/443 for HTTPS) to minimize the attack surface.

The exhibit shows a high number of failed authentication attempts (e.g., Event ID 4625) from a single source IP against multiple user accounts over a short period. This pattern is characteristic of a brute force password guessing attack, where an attacker systematically tries common passwords against many accounts to gain unauthorized access. The absence of successful logins or account lockouts further supports this conclusion.

Options B and E are correct. Maintaining situational awareness of the security posture (B) and detecting security incidents in near real-time (E) are primary goals of security operations monitoring. Automating patch deployment (A) is an operational task, not a monitoring goal; conducting vulnerability scans (C) is a separate proactive security activity; ensuring compliance (D) is a secondary benefit derived from monitoring, not a primary goal.

The best practice for protecting sensitive user data at rest on a mobile device is to use the device's keychain/keystore with encryption. The keychain (iOS) or keystore (Android) provides hardware-backed secure storage that encrypts data using platform-specific cryptographic APIs, ensuring that even if the device is compromised, the data remains confidential. This aligns with the principle of defense-in-depth for mobile application security.

The policy statement includes an `Effect: Allow` with a `Principal: "*"` and an action of `s3:GetObject`, which grants public read access to all objects in the bucket. This is the most evident security concern because it allows any anonymous user on the internet to read data from the bucket, potentially exposing sensitive information.

SOX focuses on financial reporting accuracy and internal controls over financial reporting.

A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.

The false positive is caused by a specific SQL injection signature that matches the string 'OR' within legitimate credit card numbers. Disabling only that signature preserves the WAF's protection against actual SQL injection and XSS attacks while eliminating the false positive. The server-side input validation and HTTPS provide additional layers of defense, so removing the entire rule or switching to detection mode would unnecessarily weaken security.

Options A, C, and E are correct because SIEM for correlation, incident response team, and playbooks are core. Option B is a security control but not a SOC component. Option D is network infrastructure.

The General Data Protection Regulation (GDPR) explicitly requires that data controllers (the organization) ensure that data processors (the cloud service provider) implement appropriate technical and organizational measures to protect personal data. This is mandated under Article 28 of the GDPR, which governs the relationship between controllers and processors, including contractual obligations for security measures. The regulation applies to any organization handling personal data of EU residents, regardless of where the cloud provider is located.

Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Volatile data includes memory contents, network connections, and running processes. Memory is the most volatile and should be captured first.

OCSP stapling is not supported; traditional OCSP requests add latency. A locally hosted OCSP responder reduces network round trips compared to relying on external CAs.

The vulnerability being remediated is likely the use of outdated TLS 1.0, which is deprecated by PCI DSS and has known weaknesses (e.g., POODLE, BEAST). Disabling TLS 1.0 and enabling only TLS 1.2 directly addresses the cryptographic protocol weakness, ensuring compliance with PCI DSS requirement 4.1 (use of strong cryptography). This is the most appropriate action because it removes the insecure protocol entirely rather than isolating or compensating for it.

RBAC (Role-Based Access Control) in Kubernetes controls access to API resources, including pod creation, based on roles and bindings.

Sanitizing log input and using safe parsing functions like `json.loads()` prevents injection attacks (e.g., command injection, code injection) that can occur when untrusted log data is processed. `json.loads()` strictly parses JSON according to RFC 7159, rejecting malformed or malicious payloads, whereas unsanitized input could contain escape sequences or embedded scripts that compromise the script's execution context.

SOAR platforms ingest alerts from various sources (including EDR) and use playbooks to automate incident response actions, such as isolating a host or blocking an IP. This reduces manual effort and alert fatigue.

The root of trust (RoT) is the immutable hardware or firmware component that anchors the secure boot chain. It is the first code executed on power-on and is responsible for verifying the digital signature of the bootloader before allowing it to run. Without a trusted RoT, the entire boot process lacks a cryptographically verifiable starting point.

Creating a scheduled task that executes a backdoor is a common persistence mechanism. It can be disguised and runs at system startup or on a schedule, making it harder to detect.

KRIs measure risk levels and can indicate changes. Unpatched critical vulnerabilities, number of failed login attempts, and percentage of users with privileged access are direct indicators of risk.

Quantitative risk assessment (QRA) uses asset value (AV) and single loss expectancy (SLE) or annualized loss expectancy (ALE) to compute risk in monetary terms, directly aligning remediation priority with potential business impact. This approach ensures that vulnerabilities affecting high-value assets with significant loss expectancy are addressed first, which is the core principle of risk-based vulnerability management in the CAS-004 Governance, Risk and Compliance domain.

CRYSTALS-Kyber is a key encapsulation mechanism (KEM), and CRYSTALS-Dilithium is a digital signature algorithm. Both are NIST PQC standards for post-quantum security. RSA and ECDSA are not quantum-resistant, and AES-256 is symmetric but does not provide key encapsulation or digital signatures.

The root CA should be kept offline to prevent compromise, and its private key should be stored in an HSM. The issuing CA handles day-to-day operations.

An exception process should include documented justification, expiration date, and formal approval by management. Policy hierarchy documentation is separate; automated enforcement may not be required.

Unusual volumes of traffic to a single external IP, especially during off-hours, can indicate data exfiltration. Repeated connections to an external host using non-standard ports, even if encrypted, are suspicious because they may bypass security controls. DNS tunneling is detectable by high volumes of DNS queries to a single domain, but that is separate.

Lateral movement occurs after initial access is gained, which is the defining characteristic of the post-exploitation phase. In the penetration testing lifecycle, post-exploitation encompasses activities such as lateral movement, privilege escalation, and data exfiltration, whereas exploitation focuses on gaining the initial foothold through vulnerabilities.

Regulatory fines can be substantial and are directly tied to compliance requirements, making it the most significant risk.

Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. The analyst is hypothesizing that PowerShell was abused.

JWT (JSON Web Token) is a compact, self-contained token that includes claims and a digital signature to verify integrity and authenticity.

Multiple redundant IPsec VPN tunnels provide both encryption and resilience. IPsec encrypts all traffic between the on-premises data center and AWS VPC, and having multiple tunnels (e.g., over the internet or different Direct Connect virtual interfaces) ensures high availability if one tunnel fails. This meets the requirements for encrypted data transmission and resilient connectivity.

The added capability of `CAP_SYS_MODULE` (or the equivalent `privileged: true` setting) allows the container to load and unload kernel modules. This directly increases the attack surface by enabling a container to modify the host kernel, potentially installing malicious modules that can bypass security controls, escalate privileges, or access sensitive kernel memory. Option D is correct because kernel module manipulation is a well-known path to host compromise in containerized environments.

Client-side validation can be easily bypassed by disabling JavaScript or sending crafted HTTP requests. Without server-side validation, attackers can submit malicious payloads, leading to injection attacks. XSS and IDOR are separate issues; weak session management is unrelated to input validation.

The principle of least privilege (C) ensures that users and roles are granted only the permissions necessary to perform their job functions, reducing the attack surface and limiting potential damage from compromised accounts. Enabling multi-factor authentication (D) for administrative accounts adds a critical layer of security beyond passwords, mitigating risks from credential theft or brute-force attacks. Both are foundational controls in cloud IAM frameworks like AWS IAM, Azure AD, or GCP IAM.

Encrypting data at rest using AES-256 ensures that even if the underlying storage media is compromised, the PII remains unreadable without the decryption key. AES-256 is a symmetric encryption standard approved by NIST for protecting sensitive data, providing a strong cryptographic barrier against unauthorized access.

The clause in the exhibit mandates a data processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization and encryption of personal data. This is a direct requirement of GDPR Article 32, which specifically addresses the security of processing personal data and is distinct from sector-specific or framework-based standards.

IPsec VPN configuration follows a logical order: first define IKE policy, then IPsec policy, create tunnel, permit traffic, and finally apply crypto map.

The bootloader should verify a digital signature on the kernel image using a public key embedded in the boot ROM or bootloader. This ensures both integrity and authenticity of the kernel.

PCI DSS Requirement 3 mandates that stored PAN must be rendered unreadable via encryption, truncation, hashing, or tokenization.

The presence of a subcontractor introduces fourth-party risk. The company should assess the subcontractor's security through a right-to-audit clause or request equivalent evidence, as the primary provider's controls may not cover the subcontractor.

TLS 1.3 ensures data integrity during transmission by providing transport-layer encryption with authenticated encryption (AEAD), which guarantees that any tampering with the ciphertext will be detected upon decryption. For a RESTful API handling sensitive financial data, TLS 1.3 is the correct choice because it protects the entire HTTP payload in transit, preventing man-in-the-middle attacks from modifying or replaying data.

Network segmentation with strict firewall rules isolating the legacy application limits the attack surface and prevents lateral movement from compromised hosts. This is an effective compensating control when patching is not possible.

Microsegmentation using a next-generation firewall (NGFW) is the correct approach because it enforces granular, per-application-tier security policies that inspect and log all traffic regardless of source location. NGFWs provide deep packet inspection (DPI), application-level visibility, and logging capabilities, which are essential for zero-trust architecture where no implicit trust is granted to any network segment.

RBAC controls API access, Pod Security Standards (or admission controllers) enforce pod security, and Network Policies restrict pod communication. All three are Kubernetes-native controls for cluster hardening.

FIDO2/WebAuthn uses public-key cryptography and hardware authenticators to provide phishing-resistant, passwordless authentication. TOTP is not passwordless and can be phished.

Admission controllers intercept requests to the Kubernetes API server before object persistence, allowing policy enforcement such as ensuring images come from a trusted registry. Pod Security Policies are deprecated; Pod Security Admission or custom admission controllers are current.

HSMs are dedicated hardware appliances that offload cryptographic operations from the main CPU, providing hardware acceleration for algorithms such as AES, RSA, and ECC. This acceleration is critical for high-throughput environments like TLS termination or code signing, where software-based cryptography would create a performance bottleneck.

Cloud-based backup services with hourly incremental backups can meet a 4-hour RPO by capturing changes every hour, and the RTO of 24 hours is achievable through rapid restoration from the cloud. This eliminates the human error of forgetting to change tapes and provides automated, off-site data protection against hardware failure.

If signature verification is missing, an attacker can forge a JWT with arbitrary payload (e.g., admin role).

Honeypots are decoy systems designed to lure attackers and detect unauthorized activity.

The 'clipboard' plugin in Volatility extracts the contents of the Windows clipboard, which can contain copied text, including passwords or sensitive data.

Parameterized inputs (also known as prepared statements or parameterized queries) separate SQL or shell command logic from user-supplied data, ensuring that input is treated strictly as data, not executable code. This prevents injection attacks such as SQL injection or command injection, which occur when untrusted input is concatenated directly into a command string. In scripting languages like Python, using `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))` instead of string formatting eliminates the risk of an attacker breaking out of the intended syntax.