CompTIA SecurityX (CAS-005) (CAS-005) — Questions 901–968

Active reconnaissance involves direct interaction with the target. Port scanning and banner grabbing are active; OSINT and WHOIS lookups are passive (no direct interaction).

Multi-factor authentication (MFA) directly mitigates the risk of password sharing by requiring a second authentication factor (e.g., a one-time passcode from a hardware token or authenticator app, or a biometric) in addition to the password. Even if employees share passwords, an attacker cannot authenticate without the second factor, which is typically not shared. This policy change addresses the root cause—unauthorized access via shared credentials—rather than trying to prevent the sharing behavior itself.

The order of volatility dictates that the most volatile data (registers, cache, memory, network connections, running processes) should be collected first. Disk data is less volatile.

Proper error handling in a RESTful API must never expose stack traces or internal implementation details to the client. Stack traces can reveal file paths, database schemas, library versions, and logic flows that attackers can exploit to craft targeted attacks. Instead, the API should return generic error messages (e.g., '500 Internal Server Error') while logging full details server-side for debugging.

A Secure Web Gateway (SWG) is a core SASE function that filters web traffic and enforces security policies like URL filtering and malware detection.

Privileged containers have almost all capabilities of the host, including access to host devices and kernel modules. This significantly increases the attack surface compared to running as root alone.

Using a base image with only the required packages directly reduces the attack surface by eliminating unnecessary binaries, libraries, and services that could contain vulnerabilities. This practice aligns with the principle of minimalism in container security, where every extra package increases the potential for exploitation. Unlike multi-stage builds or RUN command consolidation, this approach targets the root cause: the contents of the image itself.

Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. IoC-driven uses indicators of compromise, and TTP-driven focuses on tactics, techniques, and procedures.

A third-party security assessment is a mandatory due diligence step before entering into a contract with a new cloud service provider. This assessment evaluates the vendor's security controls, compliance posture, and risk profile against the organization's requirements, ensuring that the vendor meets minimum security standards before any data or systems are entrusted to them. Without this pre-contract assessment, the organization would be accepting unknown risks that could lead to data breaches or compliance violations.

The first and most critical step when merging two security programs is to establish a joint governance committee to provide oversight, direction, and decision-making authority for the integration. This ensures that strategic alignment and resource allocation are managed from the top down. Aligning policies, implementing tools, and conducting risk assessments are subsequent tactical steps that should be guided by governance.

S/MIME certificates are specifically used for secure email (encryption and signing). Client certificates can also be used for email authentication (e.g., in some setups). Code signing is for software, DV/OV/EV are for websites.

The exhibit shows a high number of failed authentication attempts (e.g., 500+ in a short window) against a single user account, which is characteristic of a brute-force attack. This attack systematically tries multiple password combinations to gain unauthorized access, often targeting a specific username or service. The log entries indicate repeated login failures without any evidence of intercepted traffic or session manipulation.

An account lockout policy is the correct control because it directly mitigates brute-force attacks by temporarily disabling the account after a predefined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents an attacker from continuously guessing passwords from a single IP address, as the account becomes unavailable for further attempts until the lockout period expires or an administrator intervenes.

Static analysis examines the file without running it. Running strings extracts readable text, which can reveal clues like IP addresses or commands.

To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

These are standard IANA port assignments for common protocols. Correct matches: Port 80=HTTP, Port 443=HTTPS, Port 22=SSH, Port 21=FTP. Common confusions involve swapping port numbers for similar protocols.

Hardware Security Modules (HSMs) are dedicated hardware that securely generate, store, and manage cryptographic keys, making them resistant to extraction even if the host is compromised.

Automated actions can have negative consequences if not validated. Incorporating user confirmation before destructive actions reduces risk, especially in cases of false positives.

In IaaS, the customer manages the guest OS, applications, and data, while the cloud provider secures the physical hosts and hypervisor.

Defense-in-depth uses multiple layers. WAF filters malicious traffic, network segmentation limits lateral movement, and RASP protects the application at runtime.

The cloud storage bucket policy shown includes a `Principal: "*"` with `Action: "PutObject"` and no `Condition` block restricting the source IP or requiring authentication. This means any unauthenticated user on the internet can upload objects to the bucket, which is a classic data ingestion vulnerability. Option C correctly identifies this as allowing anonymous PUT operations from any source.

Infrastructure as Code (IaC) tools like Terraform provide a declarative, version-controlled, and repeatable method to define and enforce security group rules across AWS, Azure, and GCP. This approach ensures that all changes are auditable through code repositories (e.g., Git), and can be automatically validated and applied via CI/CD pipelines, eliminating manual drift and providing centralized control.

Honeypots are decoy systems, and honeytokens are fake credentials or data used to trigger alerts when accessed.

Audit evidence includes system logs (factual records) and policy documentation (proof of requirements).

Using try-except blocks in Python allows the script to catch and handle exceptions (e.g., missing environment variables, API call failures) gracefully without crashing. This is a fundamental secure coding practice that prevents unhandled errors from exposing sensitive information or causing unpredictable behavior in automated compliance checks.

Pass-the-Hash uses NTLM hashes to authenticate without the plaintext password, effective when the same account hash is reused across systems.

Continuous monitoring using automated tools provides real-time visibility into vendor security posture, enabling proactive detection of policy violations, configuration drift, or emerging threats. Unlike point-in-time assessments, automated monitoring can detect changes in vendor environments (e.g., new open ports, SSL/TLS certificate expiration, or exposed credentials) as they happen, aligning with the CAS-004 emphasis on ongoing risk management rather than static compliance checks.

Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

A SOC 2 Type II report is an independent auditor's opinion on controls over a period, making it the most comprehensive.

Just-in-time (JIT) temporary privilege elevation ensures contractors only receive the minimum necessary permissions for a limited duration, reducing the attack surface and preventing standing privileges. This aligns with the principle of least privilege and zero-trust architectures, often implemented via tools like Azure AD PIM or AWS IAM Access Analyzer with time-bound policies.

FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.

Threat modeling during the design phase is the best practice for addressing security requirements early because it proactively identifies potential threats, attack vectors, and vulnerabilities in the system architecture before any code is written. By analyzing data flow, trust boundaries, and threat agents (e.g., using STRIDE or PASTA methodologies), security controls can be integrated into the design, reducing costly rework later. This aligns with the 'shift left' principle in secure SDLC, ensuring security is not an afterthought.

An API gateway can enforce rate limiting and authentication (e.g., OAuth) at the API level, while a WAF typically focuses on HTTP-layer attacks like SQLi.

Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Python is correct because it is a versatile, high-level scripting language widely used in SOC automation for tasks such as parsing logs, interacting with REST APIs, and orchestrating incident response workflows. Its extensive libraries (e.g., requests, pandas, and boto3 for AWS) and cross-platform support make it ideal for automating repetitive security operations tasks.

Digital signatures ensure authenticity and integrity; a secure boot chain verifies the signature before executing the update, preventing unauthorized firmware.

The web server (httpd_t) is denied access to the local database socket because SELinux enforces mandatory access controls. Adding an SELinux policy module that allows httpd_t to connect to unconfined_t (the domain of the database socket) grants the necessary permission without disabling security. This is the targeted fix that preserves SELinux protection while resolving the connectivity issue.

In digital forensics, the order of volatility dictates that volatile data (e.g., running processes, network connections) should be collected first because it is lost when the system is powered down. Memory capture preserves this data, including process information and active network connections.

SAST (Static Application Security Testing) analyzes source code at rest to find vulnerabilities like injection flaws, without executing the code.

IoT devices with limited processing power cannot efficiently perform asymmetric operations, so pre-provisioning keys from a cloud-based HSM during manufacturing ensures secure key generation and storage without burdening the device. The HSM provides tamper-resistant key generation and lifecycle management, and the keys are injected into the device's secure storage (e.g., eFuse or secure element) before deployment, eliminating the need for on-device asymmetric cryptography.

Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

A key management system (KMS) with automatic key rotation ensures that encryption keys are securely stored, rotated, and managed, which is essential for protecting data at rest. Without proper key management, encryption can be rendered ineffective if keys are compromised or stale. This control directly supports the confidentiality of PII stored in the cloud.

Isolating VNFs is the most important security consideration because VNFs share the same hypervisor and commodity hardware, so a compromise in one VNF could allow an attacker to move laterally to other VNFs or the underlying host. Without proper isolation (e.g., using VLANs, VXLANs, or micro-segmentation), the entire multi-tenant environment is at risk, undermining the high-availability design.

Input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.

Credential dumping, specifically from LSASS, is a technique under the Credential Access tactic in the MITRE ATT&CK framework. The tactic describes the adversary's goal of stealing credentials.

Federated identity management using SAML enables users to authenticate via external identity providers (e.g., social media platforms) while the corporate system retains control over access policies through the exchange of SAML assertions. This architecture decouples authentication from authorization, allowing the corporate service provider to enforce its own rules based on trusted identity claims.

TLS 1.3 mandates ephemeral Diffie-Hellman key exchange (ECDHE or DHE), which provides forward secrecy by generating unique session keys for each session.

Ansible is the most appropriate choice because it is agentless (no agent installation required) and uses push-based communication over SSH to enforce configurations. It uses YAML-based playbooks to define desired states, making it ideal for automating consistent configuration across multiple Linux servers with minimal overhead.

Without signing, an attacker can modify the assertion in transit, potentially impersonating a user or altering attributes, leading to unauthorized access.

Corrupted system files (A) are a strong indicator of a successful attack because many malware variants, such as ransomware or rootkits, intentionally modify or encrypt critical system files (e.g., DLLs, executables) to maintain persistence or cause damage. The incident responder would detect this via file integrity monitoring (FIM) tools like Tripwire or by comparing file hashes against known-good baselines, revealing unauthorized changes that confirm compromise.

To validate command injection without causing damage, the tester should use non-destructive commands like ping, echo, and whoami. Deleting files or performing DoS would violate rules of engagement.

Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.

Eradication involves removing the threat completely: deleting malware, revoking compromised credentials, and patching vulnerabilities.

VLANs logically segment the flat network into separate broadcast domains, and ACLs applied at the Layer 3 boundary (e.g., on the switch virtual interface or router) enforce least-privilege access by permitting only necessary traffic flows between segments. This approach meets HIPAA's technical safeguard requirements (45 CFR § 164.312(a)(1)) for access control and integrity without the operational overhead of physical separation or the security risk of a single DMZ.

Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Static application security testing (SAST) is a white-box testing method that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It is an essential component of a secure software development lifecycle (SSDLC) because it enables early detection of flaws such as SQL injection, buffer overflows, and cross-site scripting during the coding and build phases, reducing remediation cost and risk.