Courseiva

CompTIA SecurityX (CAS-005) (CAS-005) — Questions 76–150

968 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 13

Page 3
76
MCQhard

Refer to the exhibit. A system administrator creates a systemd service to run a daily patching script. Which security concern is most prevalent?

A.The service restarts on failure
B.The script location is non-standard
C.The service depends on the network
D.The script runs as root
AnswerD

Executing automation as root increases blast radius; privilege separation is recommended.

Why this answer

Running the script as root (User=root) is the most prevalent security concern because it grants the script unrestricted system access. If the patching script is compromised or contains a vulnerability, an attacker could gain full control over the host, escalate privileges, or persist across reboots. The principle of least privilege dictates that services should run with the minimum necessary permissions, typically a dedicated non-root user account.

Exam trap

CompTIA often tests the principle of least privilege by hiding the most critical security flaw (running as root) among seemingly benign configuration details like restart policies or non-standard paths, leading candidates to focus on less impactful issues.

How to eliminate wrong answers

Option A is wrong because restarting on failure (Restart=on-failure) is a standard reliability feature in systemd services and does not introduce a security vulnerability; it simply ensures the service resumes after an unexpected crash. Option B is wrong because placing the script in /usr/local/bin is a conventional, non-standard location for locally maintained scripts and does not inherently pose a security risk; the path is not world-writable by default. Option C is wrong because depending on the network (After=network-online.target) is a common dependency for services that need internet access to download patches, and while it introduces a potential attack surface, it is not the most prevalent security concern compared to running as root.

Full explanation →
77
MCQmedium

During a compliance audit, an organization discovers that its backup data for a critical database is stored in an unencrypted format on a tape that is kept offsite. The organization's data protection policy requires encryption of all data at rest. Which of the following is the BEST remediation action?

A.Change the offsite storage provider to one with better physical security
B.Implement TLS for data transmission to offsite storage
C.Re-encrypt the existing tape and implement encryption for all future backups
D.Encrypt all future backups before writing to tape
AnswerC

Remediates the non-compliance for existing and future backups.

Why this answer

The best remediation because it directly addresses the compliance violation by re-encrypting the existing unencrypted tape and ensuring all future backups are encrypted before being written to tape. This aligns with the data protection policy requiring encryption of data at rest, as the tape is a storage medium that holds data at rest. Simply encrypting future backups (Option D) would leave the existing unencrypted data in violation, while the other options do not address the at-rest encryption requirement.

Exam trap

The trap here is that candidates often confuse encryption of data in transit (TLS) with encryption of data at rest, or they choose to only encrypt future backups, overlooking the need to remediate the existing non-compliant data that is already stored unencrypted.

How to eliminate wrong answers

Option A is wrong because improving physical security does not satisfy the requirement for encryption of data at rest; the policy mandates cryptographic protection, not just access controls. Option B is wrong because TLS protects data in transit during transmission to offsite storage, but the tape itself remains unencrypted at rest, which is the core compliance issue. Option D is wrong because it only encrypts future backups, leaving the existing unencrypted tape in violation of the policy; remediation must address the current non-compliant data.

Full explanation →
78
MCQeasy

A multinational corporation that processes personal data of EU residents is required to appoint a Data Protection Officer (DPO) and implement data protection impact assessments. Which regulation primarily drives these requirements?

A.PCI DSS
B.SOX
C.GDPR
D.HIPAA
AnswerC

The GDPR is the EU regulation requiring DPOs and DPIAs.

Why this answer

The GDPR mandates DPO appointment for certain organizations and requires Data Protection Impact Assessments (DPIAs) for high-risk processing activities.

Full explanation →
79
MCQeasy

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

A.Secrets management
B.Pod Security Policies
C.Network policies
D.RBAC
AnswerB

Pod Security Policies define constraints for pod creation.

Why this answer

Pod Security Policies (or Pod Security Admission) enforce security standards for pods, such as preventing privileged containers.

Full explanation →
80
MCQmedium

A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?

A.Leverage the cloud provider's default security groups and disable encryption
B.Encrypt the data at rest and in transit, and implement IAM policies
C.Migrate the ERP without changes and apply encryption after migration
D.Use a VPN to connect on-premises and cloud while keeping data unencrypted
AnswerB

This ensures data confidentiality during migration and in the cloud.

Why this answer

Encrypting data at rest (using AES-256 or similar) and in transit (using TLS 1.2/1.3 or IPsec) ensures confidentiality during migration and after the ERP is hosted in the cloud. Implementing IAM policies with least-privilege access controls prevents unauthorized access to the sensitive financial data, addressing both data protection and access management requirements for a public cloud IaaS environment.

Exam trap

The trap here is that candidates may assume encryption after migration is sufficient, overlooking the critical need to protect data during the migration phase, or they may underestimate the importance of IAM as a complementary security control to encryption.

How to eliminate wrong answers

Option A is wrong because relying solely on the cloud provider's default security groups does not protect data at rest or in transit, and disabling encryption exposes sensitive financial data to interception and unauthorized access. Option C is wrong because migrating the ERP without changes and applying encryption after migration leaves data unencrypted during the transfer, violating confidentiality requirements and increasing risk of exposure. Option D is wrong because using a VPN to connect on-premises and cloud while keeping data unencrypted only protects the tunnel, but data remains in plaintext at rest and could be exposed if the VPN is misconfigured or compromised.

Full explanation →
81
Multi-Selecthard

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

Select 3 answers
A.Registry hives
B.Windows Event Logs
C.Master File Table (MFT)
D.Prefetch files
E.System Resource Utilization Monitor (SRUM)
AnswersB, C, D

Event logs record security and system events.

Why this answer

Timestamps from the MFT (Master File Table), prefetch files, and event logs are key to establishing a timeline. Prefetch shows program execution, MFT shows file access/modification, and event logs record system events. The registry contains configuration data but not as reliable for timeline; SRUM is for resource usage but less direct.

Full explanation →
82
MCQmedium

An organization is implementing a Windows Hello for Business deployment to enable passwordless authentication. The solution uses TPM 2.0 for key storage. Which of the following TPM features ensures that the system has not been tampered with before the user authenticates?

A.Secure boot
B.Sealed storage
C.Attestation
D.Measured boot
AnswerD

Measured boot records boot measurements in PCRs, enabling attestation to verify that the system has booted into a known trustworthy state.

Why this answer

Measured boot records measurements of boot components in PCR banks, which can be used for attestation to verify system integrity. Secure boot prevents execution of unauthorized code, but measured boot provides evidence of the boot chain. Sealed storage uses PCR values to restrict access to keys.

Attestation is the process of proving the measurements to a verifier.

Full explanation →
83
MCQeasy

A company wants to ensure that a third-party vendor allows them to perform an audit of the vendor's security controls. Which clause should be included in the contract?

A.Indemnification clause
B.Right-to-audit clause
C.Non-disclosure agreement (NDA)
D.Service level agreement (SLA)
AnswerB

Correct. This clause allows the customer to audit the vendor's controls.

Why this answer

A right-to-audit clause grants the customer the ability to audit the vendor's security controls.

Full explanation →
84
MCQhard

A SOC team uses a SOAR platform to automate incident response. They want to ensure that playbooks run with minimal human intervention but still require approval for actions that could cause service disruption. Which approach should be used?

A.Require analyst sign-off for every playbook action.
B.Use network isolation as a safety net for any action.
C.Implement conditional manual approval for destructive actions.
D.Configure the SOAR to automatically execute all playbook steps.
AnswerC

Conditional approval balances automation and safety.

Why this answer

Conditional manual approval (option C) is the correct approach because it allows the SOAR platform to automatically execute low-risk actions while requiring human approval for high-risk or destructive actions that could cause service disruption. This balances automation efficiency with necessary oversight. Option A is inefficient and defeats automation.

Option B is a technical control that does not address approval. Option D is unsafe as it removes all human checks.

Full explanation →
85
MCQmedium

An organization is evaluating risk treatment options for a critical vulnerability with a CVSS score of 9.8. The cost to remediate is $500,000, and the potential loss if exploited is estimated at $2,000,000. Which risk response is most appropriate?

A.Transfer the risk through cyber insurance
B.Accept the risk
C.Avoid the risk by decommissioning the affected system
D.Remediate the vulnerability
AnswerD

Remediation cost is lower than expected loss, making it the best option.

Why this answer

With a CVSS score of 9.8 (critical) and a potential loss of $2,000,000, the cost to remediate ($500,000) is significantly lower than the expected loss. Remediation reduces the risk to an acceptable residual level, making it the most cost-effective response. This aligns with the principle that when the cost of remediation is less than the potential loss, the organization should directly fix the vulnerability.

Exam trap

CompTIA often tests the misconception that a high CVSS score automatically justifies acceptance or transfer, but the key is comparing the cost of remediation against the potential loss to determine the most appropriate risk response.

How to eliminate wrong answers

Option A is wrong because transferring risk via cyber insurance does not reduce the likelihood or impact of exploitation; it only provides financial compensation after a breach, and insurers often exclude critical vulnerabilities or require remediation as a condition. Option B is wrong because accepting a critical vulnerability with a CVSS of 9.8 and a $2,000,000 potential loss is irresponsible when a cheaper remediation option exists; acceptance is only appropriate when the cost of mitigation exceeds the potential loss. Option C is wrong because avoiding the risk by decommissioning the affected system would eliminate the business function entirely, incurring operational and revenue losses that likely exceed the $500,000 remediation cost, making it an extreme and unnecessary response.

Full explanation →
86
MCQmedium

An organization is implementing a data classification scheme. Which data type should be given the highest protection and is typically restricted to a very small number of individuals?

A.Restricted
B.Confidential
C.Internal
D.Public
AnswerA

Restricted data is the most sensitive and requires highest protection.

Why this answer

Restricted data is the highest classification, reserved for data that could cause severe damage if disclosed, such as trade secrets or PII, and access is tightly controlled.

Full explanation →
87
Multi-Selecteasy

A company is implementing a defense-in-depth strategy for its web application. Which THREE of the following are layers that should be included? (Select THREE.)

Select 3 answers
A.Application security controls (WAF, input validation)
B.Single sign-on (SSO) without MFA
C.Data encryption at rest and in transit
D.Network firewall and IDS/IPS
E.Physical security of the data center
AnswersA, C, D

Application layer controls protect against web attacks.

Why this answer

Defense in depth uses multiple security layers: network controls, application security, and data protection are key layers.

Full explanation →
88
Multi-Selectmedium

Which TWO of the following are secure coding practices to prevent SQL injection?

Select 2 answers
A.Escaping all single quotes in user input
B.Validating input against a whitelist of allowed characters
C.Using an ORM that automatically parameterizes queries
D.Using parameterized queries with placeholders
E.Using stored procedures that accept user input directly
AnswersC, D

Modern ORMs use parameterization internally, preventing SQL injection.

Why this answer

Object-Relational Mapping (ORM) frameworks like Hibernate or Entity Framework, when configured to use parameterized queries, automatically separate SQL code from data. This prevents an attacker from injecting malicious SQL statements because user input is always treated as a parameter value, never as executable code. The ORM's internal query builder generates parameterized SQL statements under the hood, ensuring that even if input contains SQL metacharacters, they are safely escaped or bound.

Exam trap

A common misconception is that stored procedures are inherently safe against SQL injection, but if the stored procedure uses dynamic SQL with concatenated input (e.g., EXEC('SELECT * FROM Users WHERE UserName = ''''' + @Input + ''''''), it remains vulnerable.

Full explanation →
89
MCQhard

A company is conducting a vendor risk assessment and receives a SOC 2 Type II report from a cloud service provider. The report covers a 12-month period and includes an opinion on the effectiveness of controls. Which of the following is the primary benefit of using this report?

A.It guarantees the vendor is compliant with all regulations
B.It offers an independent assessment of control effectiveness over time
C.It eliminates the need for a right-to-audit clause
D.It provides real-time monitoring data from the vendor
AnswerB

Correct. SOC 2 Type II provides an independent opinion on controls over a period.

Why this answer

SOC 2 Type II reports provide an independent auditor's opinion on the effectiveness of controls over a period, which helps the company assess the vendor's security posture without conducting its own audit.

Full explanation →
90
MCQmedium

A security analyst is reviewing an AppArmor profile for an application. Based on the exhibit, which action would the application be denied?

A.Send a UDP packet to a remote server
B.Override discretionary access controls
C.Write to /var/log/app.log
D.Write to a file in /etc/config/
AnswerD

Only read is allowed on /etc/config/*; write is denied.

Why this answer

AppArmor profiles restrict applications by path and capability. The profile shown does not include any rule allowing write access to /etc/config/, so any write attempt to that directory or its files would be denied. This is because AppArmor enforces mandatory access control based on the profile's explicit allow rules.

Exam trap

CompTIA often tests the misconception that AppArmor denies all actions not explicitly allowed, but candidates may overlook that network and capability rules are separate from file path rules, leading them to incorrectly assume a default allow for network or capability operations.

How to eliminate wrong answers

Option A is wrong because the profile does not restrict network access via UDP; AppArmor uses network rules (e.g., 'network udp') to deny such traffic, and none are present. Option B is wrong because overriding discretionary access controls (DAC) is a capability (e.g., CAP_DAC_OVERRIDE) that must be explicitly granted in the profile; the profile shown does not include any capability entries, so it is not denied by default—AppArmor denies capabilities only if they are not listed. Option C is wrong because the profile includes a rule allowing write access to /var/log/app.log (e.g., '/var/log/app.log rw'), so the application can write to that file.

Full explanation →
91
MCQmedium

When conducting a vendor risk assessment, which contractual clause is most important for ensuring ongoing visibility into the vendor's security posture?

A.Indemnification clause
B.Right-to-audit clause
C.Non-disclosure agreement (NDA)
D.Service level agreement (SLA)
AnswerB

This clause enables periodic audits of the vendor's security controls.

Why this answer

A right-to-audit clause allows the organization to perform or request audits of the vendor's controls, providing ongoing assurance.

Full explanation →
92
MCQmedium

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

A.ZTNA
B.CASB
C.SWG
D.SD-WAN
AnswerC

SWG provides security inspection for web traffic.

Why this answer

SWG (Secure Web Gateway) is the SASE component that provides security inspection for all traffic, regardless of user location, by enforcing policies and protecting against web-based threats. It inspects all outbound traffic from users, whether on-premises or remote, to ensure security compliance.

Full explanation →
93
Multi-Selectmedium

A security architect is designing a secure boot chain for an IoT device. Which THREE components are essential to ensure the integrity of the firmware update process? (Select THREE.)

Select 3 answers
A.Firmware update files signed with a private key
B.A mechanism to prevent firmware rollback to older versions
C.Encryption of firmware at rest on the device
D.Secure over-the-air (OTA) update delivery mechanism (e.g., TLS)
E.A hardware root of trust (e.g., read-only memory) storing the public key
AnswersA, D, E

Signing ensures authenticity and integrity of the update.

Why this answer

A secure boot chain requires that the bootloader verifies the firmware signature using a public key stored in read-only memory. The firmware must be signed by a trusted entity, and updates must be delivered over a secure channel (e.g., TLS) to prevent tampering. Encryption of firmware at rest is not essential for integrity; integrity verification is through signatures.

Rolling back to a previous version should be prevented, but that is a separate concern.

Full explanation →
94
MCQmedium

A company is evaluating a vendor that will process sensitive customer data. The vendor's SOC 2 Type II report shows that controls were in place but had several exceptions noted. Which of the following is the BEST course of action?

A.Perform a risk assessment on the exceptions
B.Request a SOC 2 Type I report instead
C.Accept the vendor because it has a Type II report
D.Reject the vendor immediately due to exceptions
AnswerA

Risk assessment determines if exceptions are acceptable.

Why this answer

A SOC 2 Type II report with exceptions indicates that controls were tested over a period and found to have gaps. The best course is to perform a risk assessment on the exceptions to evaluate their severity, impact on confidentiality, integrity, or availability of sensitive data, and determine if compensating controls or remediation plans are acceptable. This aligns with the risk management framework required for vendor due diligence under compliance standards like GDPR or PCI DSS.

Exam trap

CompTIA often tests the misconception that any exception in a SOC 2 report automatically disqualifies a vendor, when in fact the correct approach is to perform a risk assessment to determine the materiality and acceptability of the exceptions.

How to eliminate wrong answers

Option B is wrong because a SOC 2 Type I report only evaluates control design at a single point in time, which provides less assurance than a Type II report and does not address the operational effectiveness gaps indicated by the exceptions. Option C is wrong because accepting a vendor solely because it has a Type II report ignores the significance of the exceptions, which could represent material weaknesses in data protection controls. Option D is wrong because immediate rejection without analyzing the exceptions' risk level is an overreaction; some exceptions may be low-risk or have compensating controls, and a risk-based decision is required.

Full explanation →
95
MCQhard

A company wants to protect its intellectual property stored on a file server. The security architect proposes implementing rights management services (RMS) integrated with Active Directory. Which attack is this architecture primarily designed to mitigate?

A.Unauthorized distribution of sensitive documents outside the organization
B.Phishing attacks targeting user credentials
C.Malware infection on the file server
D.Buffer overflow attack on the file server
AnswerA

RMS restricts access and usage rights even after documents leave the server.

Why this answer

Rights Management Services (RMS) integrated with Active Directory enables persistent protection of documents by encrypting them and enforcing usage policies (e.g., who can open, print, or forward) regardless of where the file resides. This architecture is specifically designed to prevent unauthorized distribution of sensitive documents outside the organization because the protection travels with the file and requires authentication to an RMS server for decryption, even if the file is copied or emailed externally.

Exam trap

The trap here is that candidates may confuse data-at-rest protection (e.g., file server encryption) with data-in-use protection (RMS), leading them to incorrectly select malware or buffer overflow options, which are server-level threats rather than content-level distribution threats.

How to eliminate wrong answers

Option B is wrong because RMS does not protect against phishing attacks targeting user credentials; phishing is a social engineering threat that RMS cannot mitigate, as it focuses on document-level access control, not authentication security. Option C is wrong because RMS does not prevent malware infection on the file server; it protects the content of files after they are created, but the server itself remains vulnerable to malware without additional security controls like antivirus or endpoint detection. Option D is wrong because RMS does not address buffer overflow attacks on the file server; buffer overflows are software vulnerabilities that require patching, input validation, or memory protection, not document-level encryption and policy enforcement.

Full explanation →
96
MCQmedium

A security architect is designing a data classification scheme. Which of the following is the highest level of sensitivity that would typically require the most stringent controls?

A.Restricted
B.Public
C.Internal
D.Confidential
AnswerA

Correct: Restricted data is the highest classification and requires the most controls.

Why this answer

Restricted data is the most sensitive and requires the highest level of protection.

Full explanation →
97
MCQeasy

A network administrator needs to establish a secure VPN tunnel between two branch offices using IPsec. The requirement is to encrypt the entire IP packet, including the original IP header. Which IPsec mode should be used?

A.AH mode
B.IKEv1
C.Tunnel mode
D.Transport mode
AnswerC

Tunnel mode encapsulates and encrypts the entire original packet.

Why this answer

Tunnel mode encrypts the entire IP packet and adds a new IP header, making it suitable for VPNs between networks.

Full explanation →
98
MCQmedium

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

A.Requests from outside 10.0.0.0/8 are allowed to read objects.
B.All requests from IPs in 10.0.0.0/8 are allowed to read objects.
C.Only anonymous requests are denied.
D.All requests to the bucket are denied regardless of source IP.
AnswerD

The Deny statement applies to all actions and all principals, so it denies everything.

Why this answer

The S3 bucket policy includes an explicit Deny statement that denies all actions (s3:*) for all principals (*), effectively blocking any request regardless of source IP. Even though there is an Allow statement permitting GetObject from the 10.0.0.0/8 range, the explicit Deny overrides it due to the policy evaluation logic where Deny takes precedence over Allow. Therefore, all requests to the bucket are denied.

Full explanation →
99
Multi-Selecthard

A security architect is evaluating a new SIEM solution for a large enterprise. Which THREE of the following capabilities are CRITICAL for effective threat detection and response? (Choose three.)

Select 3 answers
A.Real-time correlation of events from multiple sources
B.Scheduled vulnerability scanning
C.Automated patch management
D.Integration with threat intelligence feeds
E.User and entity behavior analytics (UEBA)
AnswersA, D, E

Correlation is essential for identifying patterns and threats.

Why this answer

Real-time correlation of events from multiple sources is critical because it enables the SIEM to aggregate and analyze logs from diverse systems (firewalls, endpoints, servers) simultaneously, identifying complex attack patterns like lateral movement or multi-stage exploits that would be invisible in isolated logs. This capability directly supports timely detection and automated response, which is the core function of a SIEM in a large enterprise.

Exam trap

The trap here is that candidates confuse SIEM capabilities with adjacent security tools (vulnerability scanners, patch managers), forgetting that SIEMs are primarily for detection and correlation, not active remediation or scanning.

Full explanation →
100
MCQmedium

An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?

A.ESP in tunnel mode
B.AH in tunnel mode
C.AH in transport mode
D.ESP in transport mode
AnswerB

AH provides integrity and authentication without encryption; tunnel mode is for site-to-site VPNs.

Why this answer

AH provides authentication and integrity without encryption. Transport mode is used for end-to-end communication, while tunnel mode is for gateway-to-gateway. Since this is between sites (gateways), tunnel mode is appropriate.

AH in transport mode is for host-to-host. ESP provides confidentiality. AH in tunnel mode is correct.

Full explanation →
101
MCQmedium

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

A.Disable the affected user accounts until the source IP is blocked.
B.Reset the passwords for all affected accounts.
C.Enable multi-factor authentication for all accounts.
D.Implement a rate-limiting rule on the network firewall for the source IP.
AnswerD

Rate-limiting blocks excessive traffic from the source IP, directly halting the brute-force attempt.

Why this answer

Rate-limiting the source IP at the network firewall immediately throttles the number of authentication attempts from that address, mitigating the brute-force attack without disrupting legitimate user access. This is the best immediate action as it directly blocks the attack vector at the network layer, preventing further failed logins while preserving user productivity.

Exam trap

The trap here is that candidates often confuse a long-term security control (like MFA or password resets) with an immediate mitigation technique, failing to recognize that rate-limiting the source IP is the fastest way to stop the ongoing brute-force attack at the network perimeter.

How to eliminate wrong answers

Option A is wrong because disabling affected user accounts would deny service to legitimate users and does not address the root cause—the attacking IP can still target other accounts. Option B is wrong because resetting passwords for all affected accounts is a reactive, time-consuming measure that does not stop the ongoing attack from the same IP; the attacker can simply continue with new attempts. Option C is wrong because enabling multi-factor authentication (MFA) is a strong security improvement but is not an immediate action—it requires user enrollment and configuration, and it does not stop the current burst of failed login attempts from the single IP.

Full explanation →
102
MCQhard

A security engineer is analyzing a serverless application that uses AWS Lambda. Which of the following is the most critical security concern when the function processes external input?

A.The function may be vulnerable to injection attacks if input is not sanitized
B.The function has a timeout of 5 minutes
C.The function uses environment variables for configuration
D.The function does not use a custom runtime
AnswerA

Injection attacks (e.g., command injection) are critical because they can lead to data exfiltration or code execution.

Why this answer

The most critical security concern is injection attacks (option A). In serverless applications, unsanitized external input can lead to serious vulnerabilities such as SQL injection or command injection, compromising the entire application. Option B (timeout) is a functional setting and not a security issue.

Option C (environment variables) is a standard practice and secure if handled correctly. Option D (custom runtime) is irrelevant to security; the default runtime is perfectly acceptable.

Full explanation →
103
MCQeasy

A security engineer must select a cryptographic algorithm to ensure non-repudiation for digitally signed documents. Which algorithm is most appropriate?

A.RSA with SHA-256
B.HMAC-SHA256
C.AES-256 in GCM mode
D.Elliptic Curve Diffie-Hellman (ECDH)
AnswerA

RSA is an asymmetric algorithm, and combined with SHA-256, it produces a digital signature that binds the signer's identity, providing non-repudiation.

Why this answer

RSA with SHA-256 (Option A) is the most appropriate choice because digital signatures rely on asymmetric cryptography. RSA provides the private key for signing and the public key for verification, ensuring that only the signer could have created the signature. SHA-256 provides a secure hash.

Together, they provide non-repudiation. In contrast, HMAC-SHA256 (Option B) uses a symmetric key, which does not provide non-repudiation because both parties share the key. AES-256 in GCM mode (Option C) is a symmetric encryption algorithm, not a signature algorithm.

Elliptic Curve Diffie-Hellman (ECDH) (Option D) is a key exchange protocol, not suitable for digital signatures.

Full explanation →
104
Multi-Selecthard

During a business continuity planning meeting, the team identifies several critical systems. Which THREE of the following are key components of a Business Impact Analysis (BIA)? (Select THREE.)

Select 3 answers
A.Mission-essential functions
B.Inventory of all hardware assets
C.Threat modeling of likely attack vectors
D.Recovery Time Objective (RTO)
E.Recovery Point Objective (RPO)
AnswersA, D, E

BIA identifies which functions are critical to the mission.

Why this answer

A is correct because mission-essential functions are a core component of a Business Impact Analysis (BIA). The BIA identifies and prioritizes critical business processes and the resources required to support them, directly linking to mission-essential functions to determine the impact of their disruption. This ensures continuity planning focuses on the most vital operations first.

Exam trap

CompTIA CASP+ often tests the distinction between BIA components (which focus on impact and recovery targets) and risk assessment activities (like threat modeling or asset inventory), leading candidates to confuse the two domains.

Full explanation →
105
MCQmedium

An organization is migrating sensitive customer data to a public cloud. Which of the following actions best demonstrates due diligence for compliance with GDPR?

A.Conducting a data protection impact assessment (DPIA).
B.Enabling server-side encryption on the cloud storage.
C.Obtaining explicit consent from all data subjects.
D.Signing a data processing agreement (DPA) with the cloud provider.
AnswerA

A DPIA is mandated by GDPR for high-risk processing and demonstrates thorough due diligence.

Why this answer

A Data Protection Impact Assessment (DPIA) is a mandatory requirement under GDPR Article 35 for processing activities that are likely to result in high risk to individuals' rights and freedoms, such as migrating sensitive customer data to a public cloud. Conducting a DPIA demonstrates due diligence by systematically identifying, assessing, and mitigating privacy risks before the migration begins, ensuring compliance with GDPR's accountability principle.

Exam trap

CompTIA often tests the distinction between operational security controls (like encryption) or contractual safeguards (like DPAs) and the procedural due diligence required by GDPR, leading candidates to pick a technically valid but compliance-incomplete answer.

How to eliminate wrong answers

Option B is wrong because enabling server-side encryption on cloud storage addresses data security (confidentiality) but does not fulfill the GDPR requirement to assess and mitigate privacy risks specific to the processing activity; encryption is a technical safeguard, not a due diligence process for compliance. Option C is wrong because obtaining explicit consent from all data subjects is a lawful basis for processing under GDPR Article 7, but it does not replace the need for a DPIA when processing involves high-risk activities like cloud migration of sensitive data; consent alone does not demonstrate the systematic risk assessment required by Article 35. Option D is wrong because signing a Data Processing Agreement (DPA) with the cloud provider is a contractual obligation under GDPR Article 28 to ensure the processor's compliance, but it is a downstream step that assumes the processing is lawful; a DPA does not evaluate the inherent privacy risks of the migration itself, which is the core of due diligence.

Full explanation →
106
MCQmedium

A security architect reviews the iptables firewall rules above. A new web server with IP 192.168.1.100 must be reachable from the internet on ports 80 and 443. Which of the following changes is necessary to allow inbound HTTPS while maintaining security?

A.Delete rule 3 and add a rule: ACCEPT tcp from any to 192.168.1.100 dpt 80,443
B.Change rule 3 source to 0.0.0.0/0 and restrict rule 2 to a management subnet
C.Change default INPUT policy to ACCEPT and rely on application security
D.Add a new rule before rule 5: ACCEPT tcp from any to 192.168.1.100 dpt 443
AnswerB

This allows global HTTPS and secures SSH to a trusted subnet.

Why this answer

The existing rule 3 (likely ACCEPT tcp from any to any dpt 80) would allow HTTP but not HTTPS (port 443). By changing rule 3's source to 0.0.0.0/0 and restricting rule 2 to a management subnet, you create a clean, stateful rule that permits inbound HTTPS (port 443) from any source while limiting SSH or other management access to a trusted subnet, maintaining a least-privilege posture. This avoids opening unnecessary ports or weakening the default deny policy.

Exam trap

CASP+ often tests the misconception that adding a new rule for HTTPS is sufficient, without considering the existing rule order and the need to restrict management access; candidates overlook that a preceding rule might block the new rule or that SSH should be limited to a management subnet.

How to eliminate wrong answers

Option A is wrong because deleting rule 3 and adding a rule that accepts both ports 80 and 443 from any source would still allow HTTP (port 80) from the internet, which may be unnecessary and increases attack surface; the question only requires HTTPS (port 443) to be reachable. Option C is wrong because changing the default INPUT policy to ACCEPT would bypass all firewall rules, allowing all inbound traffic and completely undermining security; application security alone cannot compensate for network-layer filtering. Option D is wrong because adding a new rule before rule 5 would still leave rule 3 (which likely only permits port 80) in place, and the order of iptables rules matters—if a preceding rule drops or limits traffic, the new rule may never be evaluated; additionally, it does not address the need to restrict management access.

Full explanation →
107
MCQmedium

A security analyst needs to write a script that detects changes to critical files across a fleet of Linux servers. Which approach is most efficient and secure?

A.Use a cron job on each server running a Python script that checks file hashes.
B.Enable Linux auditd on each server and forward logs to a SIEM for analysis.
C.Deploy a centralized log server and parse syslog for file modifications.
D.Use an agentless tool like OSSEC with a central manager to report file integrity changes.
AnswerD

OSSEC provides centralized, efficient monitoring.

Why this answer

OSSEC is a host-based intrusion detection system (HIDS) specifically designed for file integrity monitoring (FIM). Its agentless mode uses SSH to connect to remote servers, retrieve file hashes, and compare them against a known baseline stored on a central manager. This approach is both efficient (centralized reporting, no per-server cron jobs) and secure (encrypted communication, tamper-proof baseline storage).

Exam trap

CompTIA CASP+ often tests the distinction between event logging (auditd/syslog) and cryptographic integrity verification (FIM tools like OSSEC), leading candidates to choose a logging-based solution that cannot detect subtle content changes like a rootkit replacing a binary with the same size and timestamp.

How to eliminate wrong answers

Option A is wrong because running a Python script via cron on each server is inefficient (no centralized management, each server must be individually configured and maintained) and insecure (the script and its hash database are locally stored and could be tampered with if the server is compromised). Option B is wrong because Linux auditd is designed for system call auditing (e.g., tracking who accessed a file), not for efficient file integrity monitoring; it generates high-volume logs that require heavy SIEM parsing and lacks built-in baseline comparison or alerting for hash changes. Option C is wrong because parsing syslog for file modifications is unreliable (syslog is a text-based, non-tamper-proof protocol, often sent over UDP) and does not provide cryptographic hash verification; it would only detect open/write events, not actual content changes, and is easily evaded.

Full explanation →
108
MCQmedium

An organization uses a hardware security module (HSM) to protect cryptographic keys. Which aspect of key management does an HSM primarily address?

A.Key rotation
B.Key escrow
C.Secure key storage and cryptographic operations
D.Digital certificate issuance
AnswerC

HSMs are designed to protect keys and perform crypto operations in a secure environment.

Why this answer

HSMs provide tamper-resistant hardware for secure key generation, storage, and operations, ensuring that private keys are never exposed in plaintext outside the device.

Full explanation →
109
MCQmedium

Based on the iptables exhibit, a security analyst has received an alert that an external IP (203.0.113.5) is attempting to connect to TCP port 3389 on the server. Which of the following best describes the current rule set's treatment of this traffic?

A.The connection will be allowed through because there is no explicit DROP rule
B.The connection will be logged and then dropped by the default policy
C.The connection will be accepted because there is a LOG rule
D.The connection will be logged and then dropped by the LOG rule
AnswerB

LOG rule logs, then default policy (DROP) drops the packet.

Why this answer

The rule set has a LOG rule for tcp dpt:3389 from any source, which will log the packet but not explicitly accept or drop it; since the policy in the INPUT chain is DROP, the packet will be dropped after being logged. Option A is incorrect because the LOG rule does not drop, only logs. Option C is incorrect because there is no ACCEPT rule for 3389.

Option D is incorrect because the default policy is DROP.

Full explanation →
110
MCQmedium

A company is migrating its internal services to use SSH key-based authentication instead of passwords. The security policy requires using the strongest supported algorithms. The SSH server supports the following key exchange algorithms: diffie-hellman-group14-sha256, ecdh-sha2-nistp384, curve25519-sha256. Which algorithm should the administrator choose to meet the policy?

A.ecdh-sha2-nistp384
B.diffie-hellman-group14-sha256
C.All three are equally strong
D.curve25519-sha256
AnswerD

X25519 is widely recommended for its security and efficiency.

Why this answer

Curve25519 (X25519) is the recommended elliptic curve for key exchange due to its strong security and performance advantages. It is considered more secure than NIST curves and traditional Diffie-Hellman.

Full explanation →
111
MCQmedium

A security analyst is reviewing metrics for the security program. Which metric best measures the effectiveness of incident response processes?

A.Mean time to detect (MTTD)
B.Patch compliance percentage
C.Mean time to respond (MTTR)
D.Number of vulnerabilities by severity
AnswerC

Correct. MTTR measures how quickly incidents are resolved.

Why this answer

Mean time to respond (MTTR) measures the average time taken to remediate an incident, indicating response efficiency.

Full explanation →
112
MCQmedium

A security architect is designing a network segmentation strategy for a multi-tenant cloud environment. Which of the following is the MOST effective technique to isolate tenant workloads while maintaining manageability?

A.Host-based iptables
B.Stateful firewall rules
C.Virtual private clouds (VPCs) with separate subnets
D.VLAN tagging
AnswerC

VPCs provide scalable, logical isolation in cloud environments.

Why this answer

Virtual private clouds (VPCs) with separate subnets provide native, tenant-level isolation in a multi-tenant cloud environment by creating logically isolated network segments with their own IP address space, routing tables, and security policies. This approach is the most effective because it scales easily, integrates with cloud-native security controls (e.g., security groups, network ACLs), and maintains manageability through centralized orchestration without requiring per-tenant hardware or complex overlay configurations.

Exam trap

The trap here is that candidates confuse VLAN tagging (a legacy on-premises technique) with cloud-native VPCs, failing to recognize that VLANs cannot provide the scale, automation, or multi-region isolation required in a modern multi-tenant cloud environment.

How to eliminate wrong answers

Option A is wrong because host-based iptables operate at the individual VM/container level, requiring per-instance rule management that does not scale for multi-tenant isolation and lacks centralized control. Option B is wrong because stateful firewall rules, while useful for traffic inspection, are a security control applied at a network boundary and do not inherently create separate tenant network segments; they cannot prevent layer-2 or layer-3 visibility between tenants without underlying segmentation. Option D is wrong because VLAN tagging (IEEE 802.1Q) provides layer-2 segmentation but is limited to a single broadcast domain, does not extend across cloud regions or availability zones, and introduces management overhead (STP, VLAN trunking) that conflicts with cloud elasticity and multi-tenant scalability.

Full explanation →
113
MCQmedium

A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?

A.Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.
B.Schedule a weekly cron job to scan the container registry and generate reports.
C.Use Terraform to enforce that only images from a trusted registry are deployed.
D.Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.
AnswerA

Automated scanning in the pipeline catches vulnerabilities before deployment, enforcing security earlier.

Why this answer

Integrating container image scanning into the CI/CD pipeline ensures vulnerabilities are detected before deployment, reducing delays and improving security. Option A is correct because adding a stage in Jenkins to run Trivy scans before pushing images to the registry catches issues early. Option B is incorrect because weekly scans after deployment do not prevent vulnerable images from being deployed.

Option C is incorrect because Terraform can enforce registry trust but does not scan for vulnerabilities within the image. Option D is incorrect because relying on developers for local scans is inconsistent and not automated.

Full explanation →
114
MCQeasy

A security engineer needs to implement a solution that provides both confidentiality and integrity for data at rest. Which cryptographic method BEST meets these requirements?

A.AES-256-GCM
B.SHA-256
C.Diffie-Hellman
D.RSA-2048
AnswerA

AES-256-GCM provides both encryption and authentication, satisfying confidentiality and integrity requirements.

Why this answer

AES-256-GCM is correct because it provides both confidentiality (via AES encryption) and integrity (via Galois/Counter Mode authentication tag). GCM is an authenticated encryption mode that ensures data at rest remains both secret and tamper-proof, meeting the dual requirement directly.

Exam trap

Candidates often confuse integrity-only tools like SHA-256 or key exchange protocols like Diffie-Hellman with solutions that provide both confidentiality and integrity, overlooking that GCM is an authenticated encryption mode specifically designed for this dual purpose.

How to eliminate wrong answers

Option B (SHA-256) is wrong because it is a cryptographic hash function that provides only integrity verification (via message digest), not confidentiality; it cannot encrypt data. Option C (Diffie-Hellman) is wrong because it is a key exchange protocol used for establishing shared secrets over an insecure channel, not for encrypting data at rest. Option D (RSA-2048) is wrong because it is an asymmetric encryption algorithm primarily used for key exchange or digital signatures, not for bulk data encryption at rest; it lacks built-in integrity verification and is computationally inefficient for large data.

Full explanation →
115
MCQeasy

A company is evaluating its disaster recovery plan. Which metric indicates the maximum acceptable downtime?

A.Mean Time to Repair (MTTR)
B.Recovery Point Objective (RPO)
C.Recovery Time Objective (RTO)
D.Mean Time Between Failures (MTBF)
AnswerC

RTO is the maximum acceptable downtime.

Why this answer

Recovery Time Objective (RTO). RTO defines the maximum acceptable downtime for a system or application after a disaster. Option A (MTTR) measures the average time to repair a failed component.

Option B (RPO) defines the maximum acceptable data loss. Option D (MTBF) measures the average time between failures, indicating reliability.

Full explanation →
116
MCQeasy

A security engineer is reviewing firewall logs and finds multiple failed SSH attempts from an internal IP. Which control should be implemented to reduce this risk?

A.Allow SSH only from a specific management subnet
B.Implement account lockout after 5 failed attempts
C.Install a host-based IDS on the server
D.Disable SSH and use Telnet instead
AnswerB

Account lockout prevents brute-force attacks by temporarily disabling the account.

Why this answer

Implementing an account lockout policy after a defined number of failed attempts (e.g., 5) directly mitigates brute-force or password-guessing attacks against SSH. This control enforces a threshold that stops automated scripts or manual attempts from continuing, reducing the risk of unauthorized access without blocking legitimate administrative traffic.

Exam trap

The trap here is that candidates often choose a network-based control like subnet restriction (Option A) because it seems logical to limit access, but they overlook that the failed attempts are already coming from an internal IP, meaning the attacker is already inside the trusted zone and subnet filtering alone will not stop the attack.

How to eliminate wrong answers

Option A is wrong because restricting SSH to a specific management subnet reduces the attack surface but does not prevent brute-force attacks from within that subnet; an attacker who compromises a machine on that subnet could still launch unlimited attempts. Option C is wrong because a host-based IDS (HIDS) can detect and alert on failed SSH attempts but does not actively prevent them; it is a detective control, not a preventive one. Option D is wrong because disabling SSH and using Telnet would increase risk, as Telnet transmits credentials and data in cleartext, making it vulnerable to sniffing and completely unacceptable in a secure environment.

Full explanation →
117
Multi-Selectmedium

A security architect is designing a secure enclave for processing classified data. Which TWO of the following controls are essential for ensuring data confidentiality in such an enclave? (Select TWO.)

Select 2 answers
A.Data diodes for one-way data transfer from the enclave to external networks
B.Full-disk encryption on all enclave workstations
C.Physical air gap between the enclave and other networks
D.Security Content Automation Protocol (SCAP) vulnerability scanning
E.Redundant power supplies and cooling
AnswersA, B

Data diodes ensure data cannot be extracted from the enclave.

Why this answer

Full-disk encryption protects data at rest on enclave workstations, ensuring confidentiality if a device is lost or stolen. Data diodes enforce one-way data transfer, preventing unauthorized exfiltration of classified data from the enclave. Option C (air gap) is a physical security measure but not a control per se; the question asks for controls.

Option D (SCAP) is for vulnerability assessment, not directly confidentiality. Option E is about availability, not confidentiality.

Full explanation →
118
MCQeasy

A company is deploying a wireless network for guests. Which security measure is most important to prevent unauthorized users from accessing internal resources?

A.Use WPA2-Enterprise with 802.1X
B.Disable SSID broadcast
C.Implement MAC address filtering
D.Place the guest network on a separate VLAN with no access to internal subnets
AnswerD

VLAN segmentation restricts traffic between guest and internal networks.

Why this answer

Placing the guest network on a separate VLAN with no access to internal subnets provides network segmentation, which is the most effective security measure to prevent unauthorized users from reaching internal resources. This approach uses VLAN tagging (802.1Q) and access control lists (ACLs) to enforce Layer 2 and Layer 3 isolation, ensuring that guest traffic cannot traverse to internal networks even if other wireless security measures are bypassed.

Exam trap

The trap here is that candidates often focus on wireless authentication or obscurity measures (like WPA2-Enterprise or disabling SSID broadcast) instead of recognizing that network segmentation is the fundamental control for isolating guest traffic from internal resources.

How to eliminate wrong answers

Option A is wrong because WPA2-Enterprise with 802.1X is an authentication mechanism that controls who can connect to the wireless network, but it does not inherently prevent authenticated guests from accessing internal resources; it only secures the wireless link. Option B is wrong because disabling SSID broadcast is a weak security-by-obscurity measure that can be easily defeated by passive scanning tools (e.g., airodump-ng), and it does not restrict access to internal subnets once a client connects. Option C is wrong because MAC address filtering is easily spoofed using tools like macchanger, and it provides no protection against an attacker who captures a valid MAC address from the airwaves, nor does it segment traffic from internal resources.

Full explanation →
119
MCQhard

Which of the following are accurate descriptions for the given container security concepts? (Select all that apply.)

A.Container runtime security
B.Image signing
C.Secrets management
D.Orchestration security
E.Enforces system call filtering and access controls at runtime
F.Ensures container images are not tampered with using cryptographic hashes
G.Safely injects credentials into containerized applications at runtime
H.Manages network segmentation and pod security policies in clusters
AnswerE, F, G, H

Why this answer

The correct descriptions are: E (Container runtime security: enforces system call filtering and access controls at runtime using tools like AppArmor and Seccomp), F (Image signing: ensures container images are not tampered with using cryptographic hashes via signatures), G (Secrets management: safely injects credentials into containerized applications at runtime using tools like Vault), and H (Orchestration security: manages network segmentation and pod security policies in clusters as seen in Kubernetes). Options A through D name the security concepts but are not descriptions themselves.

Exam trap

Candidates may confuse 'Image signing' with 'Vulnerability scanning' because both deal with images, but signing is about integrity, not vulnerability detection.

Full explanation →
120
MCQmedium

A security operations center (SOC) analyst is investigating an alert from an EDR tool indicating that a workstation executed a suspicious PowerShell command that decoded a base64 string. The decoded string contained a command to download a file from an external IP address. Which stage of the cyber kill chain does this activity most likely represent?

A.Actions on Objectives
B.Reconnaissance
C.Weaponization
D.Exploitation
AnswerA

Correct. This activity is part of the attacker's objectives after initial access—downloading additional payloads or establishing persistence aligns with Actions on Objectives.

Why this answer

The described activity—executing a PowerShell command that decodes a base64 string and downloads a file from an external IP—occurs after the attacker has already gained initial access. This is characteristic of the Actions on Objectives stage, where the attacker performs actions to achieve their goals, such as downloading additional tools for lateral movement, data exfiltration, or persistence. It is not Exploitation, which involves triggering the initial vulnerability to gain access; here, that access has already been established and the attacker is now taking further action.

Full explanation →
121
MCQhard

A security architect is reviewing the network architecture of a financial trading system. The system uses a time-sensitive order matching engine that must process trades with minimal latency. The architect is concerned about the risk of a DDoS attack on the matching engine. Which of the following architectural changes would best mitigate DDoS risk while preserving low latency?

A.Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.
B.Deploy an intrusion prevention system (IPS) in inline mode in front of the matching engine.
C.Move the matching engine to a cloud provider with elastic scalability.
D.Implement a reverse proxy with rate limiting and IP blacklisting.
AnswerA

Scrubbing services filter attacks at the cloud edge, adding minimal latency if the provider is close to the origin; they preserve low latency for clean traffic.

Why this answer

A cloud-based DDoS scrubbing service (e.g., AWS Shield Advanced, Cloudflare Magic Transit) filters malicious traffic at the cloud edge before it reaches the on-premises matching engine. This preserves low latency because only clean, low-volume traffic is forwarded, and the scrubbing infrastructure is designed for high-throughput, low-latency processing without introducing inline inspection delays on the critical path.

Exam trap

The trap here is that candidates assume inline security controls (IPS, reverse proxy) are always appropriate, but for ultra-low-latency environments, any inline processing—even rate limiting—adds unacceptable delay, making cloud-based scrubbing the only viable option that offloads filtering without touching the critical path.

How to eliminate wrong answers

Option B is wrong because an inline IPS introduces processing latency (deep packet inspection, signature matching) that can exceed the sub-millisecond tolerance of a time-sensitive trading engine, potentially causing order timeouts. Option C is wrong because moving to a cloud provider with elastic scalability does not inherently mitigate DDoS; it only absorbs volumetric attacks by scaling out, but the matching engine itself remains a target and scaling introduces variable latency (e.g., cold starts, network jitter) unacceptable for low-latency trading. Option D is wrong because a reverse proxy with rate limiting and IP blacklisting adds a hop and processing overhead (connection termination, HTTP parsing) that increases latency, and it cannot handle large volumetric DDoS attacks without being overwhelmed itself.

Full explanation →
122
MCQeasy

A company's risk assessment identifies that employees often use weak passwords. Which control directly addresses this risk?

A.Conduct security awareness training
B.Deploy single sign-on
C.Implement multi-factor authentication
D.Enforce a strong password policy
AnswerD

A strong password policy directly addresses weak passwords.

Why this answer

Enforcing a strong password policy directly addresses the risk of weak passwords by mandating complexity, length, and expiration requirements (e.g., minimum 12 characters, mixed case, numbers, symbols). This control reduces the likelihood of successful brute-force or dictionary attacks by increasing the entropy of user credentials. Unlike other options, it specifically targets the root cause—weak password creation—rather than adding compensating controls.

Exam trap

The trap here is that candidates confuse 'addressing the risk' with 'mitigating the impact'—MFA (Option C) reduces the impact of a weak password but does not prevent the weak password itself, which is the root cause identified in the risk assessment.

How to eliminate wrong answers

Option A is wrong because security awareness training educates users but does not technically enforce password strength; users may still choose weak passwords despite training. Option B is wrong because single sign-on (SSO) centralizes authentication but does not prevent users from creating weak passwords for the SSO identity provider or downstream systems. Option C is wrong because multi-factor authentication (MFA) adds a second factor (e.g., TOTP, SMS) but does not address the weakness of the first factor (password); a weak password can still be guessed or cracked offline, bypassing MFA in some attack scenarios (e.g., pass-the-cookie).

Full explanation →
123
Multi-Selecteasy

A security analyst is reviewing a CI/CD pipeline configuration. The pipeline uses a containerized application and includes automated security scanning. Which TWO practices should be implemented to ensure container immutability and reduce the attack surface?

Select 2 answers
A.Run containers with read-only root filesystem.
B.Scan images for vulnerabilities at build time.
C.Use the same base image for all environments.
D.Run containers as root.
E.Store credentials in environment variables.
AnswersA, B

Enforces container immutability by preventing modifications at runtime.

Why this answer

Running containers with a read-only root filesystem enforces immutability, preventing any modifications at runtime. Option B is correct because scanning images for vulnerabilities at build time reduces the attack surface by catching issues before deployment. Option C is incorrect because using the same base image for all environments does not directly relate to immutability or attack surface reduction and may ignore environment-specific security needs.

Option D is incorrect because running containers as root weakens security and increases the attack surface. Option E is incorrect because storing credentials in environment variables is insecure and should be avoided.

Full explanation →
124
MCQmedium

An organization is merging with another company and needs to ensure that the combined entity's security policies are aligned. Which document type should the security team prioritize to harmonize security expectations and responsibilities?

A.Disaster Recovery Plan (DRP)
B.Non-Disclosure Agreement (NDA)
C.Acceptable Use Policy (AUP)
D.Business Continuity Plan (BCP)
AnswerC

AUP sets rules for system use and user responsibilities.

Why this answer

The Acceptable Use Policy (AUP) is the correct document to prioritize because it defines the rules and expectations for how users may access and use the organization's IT resources. During a merger, harmonizing the AUP ensures that all employees from both entities operate under a single, consistent set of security requirements, reducing the risk of policy violations and data breaches. This document directly governs user behavior, which is foundational to aligning security expectations and responsibilities across the combined workforce.

Exam trap

The trap here is that candidates often confuse operational continuity documents (DRP, BCP) with governance policies (AUP), mistakenly thinking that disaster recovery or business continuity planning is the primary tool for aligning security expectations after a merger, when in fact the AUP directly governs user behavior and responsibilities.

How to eliminate wrong answers

Option A is wrong because a Disaster Recovery Plan (DRP) focuses on restoring IT infrastructure and data after a disruptive event, not on defining day-to-day security expectations and responsibilities for users. Option B is wrong because a Non-Disclosure Agreement (NDA) is a legal contract that protects confidential information, but it does not establish the broader operational security policies or acceptable use rules needed for harmonizing security expectations across the merged entity. Option D is wrong because a Business Continuity Plan (BCP) addresses maintaining critical business functions during and after a disruption, not the alignment of user security policies and responsibilities.

Full explanation →
125
MCQeasy

A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?

A.Incorporating privacy controls during the initial system architecture
B.Encrypting data at rest only
C.Performing an annual privacy audit
D.Providing privacy training to employees
AnswerA

Correct: Privacy by design requires proactive embedding of privacy in design.

Why this answer

Privacy by design integrates privacy into the system design from the start, not as an afterthought.

Full explanation →
126
MCQeasy

A security architect is evaluating cloud security architectures. The company requires that all data at rest in a public cloud object storage bucket be encrypted with a key that is managed by the company's own hardware security module (HSM) on-premises. Which encryption approach should the architect recommend?

A.Use envelope encryption where a cloud KMS wraps a data key, and the data key is used to encrypt the data.
B.Use server-side encryption with customer-provided keys (SSE-C).
C.Use server-side encryption with cloud provider-managed keys (SSE-S3).
D.Use client-side encryption where the application encrypts data before sending it to the cloud.
AnswerD

The company controls the encryption key entirely on-premises; the cloud only stores ciphertext.

Why this answer

Client-side encryption ensures the data is encrypted by the application before it is sent to the cloud, using a key managed by the company's own on-premises HSM. This approach guarantees that the cloud provider never has access to the encryption key or the plaintext data, meeting the requirement that all data at rest in the public cloud object storage bucket be encrypted with a key managed by the company's own HSM.

Exam trap

The trap here is that candidates often confuse 'customer-provided keys' (SSE-C) with true client-side key management, but SSE-C still exposes the key to the cloud provider during the encryption/decryption process, failing the requirement for the key to be managed solely by the company's own on-premises HSM.

How to eliminate wrong answers

Option A is wrong because envelope encryption with a cloud KMS still involves the cloud provider managing the key encryption key (KEK), which violates the requirement that the key be managed by the company's own on-premises HSM. Option B is wrong because server-side encryption with customer-provided keys (SSE-C) requires the customer to provide the key with each API call, but the key is temporarily stored in the cloud provider's memory for encryption/decryption, and the provider still has access to the key during the operation, failing the 'managed by the company's own HSM' requirement. Option C is wrong because server-side encryption with cloud provider-managed keys (SSE-S3) uses keys entirely managed by the cloud provider, which directly contradicts the requirement for the company to manage the key with its own HSM.

Full explanation →
127
MCQeasy

A security analyst observes anomalous outbound network traffic from a server that normally only performs internal functions. According to the incident response plan, what should the analyst do first?

A.Follow the incident response plan
B.Contain the server by disconnecting it from the network
C.Immediately shut down the server
D.Ignore the traffic as it might be a false positive
AnswerA

The incident response plan provides procedures for initial actions, including identification and reporting.

Why this answer

The first step in incident response is to follow the established plan to ensure proper handling and minimize damage. Option B is wrong because containment should follow identification and reporting. Option C is wrong because shutting down may destroy evidence.

Option D is wrong because ignoring is risky.

Full explanation →
128
MCQeasy

A security analyst is reviewing threat intelligence feeds and notices indicators from a known APT group. Which threat intelligence sharing standard is most commonly used to structure and share such cyber threat information in a machine-readable format?

A.CybOX
B.MITRE ATT&CK
C.STIX/TAXII
D.OpenIOC
AnswerC

STIX and TAXII are the standard protocols for sharing cyber threat intelligence in a structured, machine-readable format.

Why this answer

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the standard protocols for sharing cyber threat intelligence in a structured, machine-readable format. STIX defines the data model, and TAXII defines the transport mechanism.

Full explanation →
129
Multi-Selectmedium

A security architect is evaluating cryptographic agility for a system that must be resistant to quantum computing attacks. Which TWO algorithms are part of the NIST PQC standards? (Select TWO.)

Select 2 answers
A.RSA-4096
B.CRYSTALS-Dilithium
C.AES-256
D.SHA-256
E.CRYSTALS-Kyber
AnswersB, E

Dilithium is a lattice-based signature scheme.

Why this answer

CRYSTALS-Kyber is a key encapsulation mechanism, and CRYSTALS-Dilithium is a digital signature scheme; both are NIST-selected PQC algorithms.

Full explanation →
130
Multi-Selecteasy

A security analyst is defining key risk indicators (KRIs) for the security program. Which TWO of the following are examples of KRIs? (Select TWO.)

Select 2 answers
A.Percentage of employees who completed security awareness training
B.Time to patch critical systems
C.Budget spent on security tools
D.Number of unpatched critical vulnerabilities
E.Number of security incidents reported in the last quarter
AnswersD, E

Correct. High numbers indicate increased risk.

Why this answer

KRIs are metrics that indicate risk levels. Number of unpatched critical vulnerabilities and number of security incidents are direct risk indicators.

Full explanation →
131
MCQmedium

A security engineer is evaluating the use of AES-256-GCM for encrypting sensitive data in transit. They note that the Additional Authenticated Data (AAD) field is empty. What is the security implication?

A.The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.
B.The cipher is still secure, but missing AAD offers no additional protection against man-in-the-middle attacks.
C.The encryption provides no authentication because AAD is missing.
D.The cipher becomes vulnerable to key recovery attacks because AAD is missing.
AnswerA

Without AAD, an attacker could take a valid ciphertext from one session and insert it into another, if the same key is used, leading to potential data confusion.

Why this answer

In AES-256-GCM, the Additional Authenticated Data (AAD) provides context binding, ensuring that the ciphertext is authentic only within a specific context (e.g., a particular session or transaction). When AAD is empty, an attacker who has access to multiple valid ciphertexts (each with its own context) could potentially swap them without detection, leading to a mix-and-match attack. The cipher still provides authentication (via the authentication tag) and confidentiality, but without AAD, the binding to the intended context is lost.

Option B is wrong because missing AAD does not directly affect protection against man-in-the-middle attacks; the cipher still provides integrity and authentication. Option C is wrong because AES-256-GCM provides authentication through its GMAC authentication tag, even without AAD. Option D is wrong because AAD has no impact on key recovery; GCM is secure against key recovery attacks regardless of AAD.

Full explanation →
132
MCQhard

A company deploys a microservices architecture using container orchestration. The security team wants to enforce mutual TLS between services. Which technology should be used?

A.Service mesh
B.SSH tunneling
C.API gateway
D.VPN
AnswerA

A service mesh transparently injects sidecar proxies to handle mTLS encryption and authentication between services.

Why this answer

A service mesh (e.g., Istio, Linkerd) is the correct technology because it provides a dedicated infrastructure layer for handling service-to-service communication, including automatic mutual TLS (mTLS) enforcement between microservices. It injects sidecar proxies that intercept all traffic and negotiate mTLS using X.509 certificates, ensuring both encryption and authentication without modifying application code.

Exam trap

The trap here is that candidates often confuse an API gateway's ability to terminate TLS for external traffic with the need for mTLS between internal services, leading them to incorrectly select API gateway instead of service mesh.

How to eliminate wrong answers

Option B (SSH tunneling) is wrong because SSH tunnels are designed for point-to-point encrypted connections between hosts, not for dynamic, policy-driven mTLS between many microservices in a container orchestration environment; they lack certificate-based identity and automatic rotation. Option C (API gateway) is wrong because an API gateway handles north-south traffic (external clients to services) and can terminate TLS, but it does not enforce mTLS for east-west traffic between internal microservices. Option D (VPN) is wrong because a VPN creates an encrypted network tunnel between networks or hosts, but it does not provide per-service identity or mutual authentication at the application layer; it secures the network path, not the service-to-service communication.

Full explanation →
133
Multi-Selectmedium

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

Select 3 answers
A.Lack of visibility into vendor security practices
B.Over-automation of risk scoring
C.Resource constraints for conducting assessments
D.Inconsistent assessment criteria across vendors
E.Excessive cooperation from vendors
AnswersA, C, D

Common challenge

Why this answer

A is correct because organizations often lack visibility into vendor security practices, meaning they cannot verify whether vendors comply with security policies or contractual obligations. This challenge arises when vendors do not provide access to their security controls, audit reports, or real-time monitoring data, leaving gaps in the risk assessment process.

Exam trap

The CAS-004 exam often tests the distinction between common operational challenges (like lack of visibility, resource constraints, and inconsistent criteria) versus hypothetical or reversed issues (like over-automation or excessive cooperation) that are not typical in vendor risk management programs.

Full explanation →
134
MCQeasy

A security architect is designing a web application that handles sensitive customer data. The application must ensure that if one server is compromised, the attacker cannot access the private keys used for TLS termination. Which of the following approaches best meets this requirement?

A.Store the private keys in an encrypted database on a separate database server.
B.Use a software-based key vault that runs on the same operating system as the web server.
C.Use a hardware security module (HSM) to generate and store the private keys, performing TLS termination on the HSM.
D.Store the private keys in a local file with restricted permissions on the application server.
AnswerC

HSM provides tamper-resistant storage and performs cryptographic operations without exposing keys.

Why this answer

A Hardware Security Module (HSM) provides a dedicated, tamper-resistant cryptographic processor that generates, stores, and manages private keys in hardware, never exposing them to the application server's memory or filesystem. By performing TLS termination directly on the HSM, the private keys remain isolated even if the web server is compromised, meeting the requirement for key confidentiality.

Exam trap

The trap here is that candidates often assume encrypting keys at rest (Option A) or using OS-level permissions (Option D) is sufficient, but the CAS-004 exam emphasizes that any software-based storage, even if encrypted, still exposes the key during runtime operations like TLS termination.

How to eliminate wrong answers

Option A is wrong because storing private keys in an encrypted database on a separate server still exposes the keys to the application server during decryption (the keys must be loaded into memory to terminate TLS), and a compromised server could extract them from memory or intercept the decryption process. Option B is wrong because a software-based key vault running on the same OS as the web server shares the same attack surface; if the OS is compromised, the vault's memory and files can be accessed, allowing key extraction. Option D is wrong because storing private keys in a local file with restricted permissions relies solely on OS-level access controls, which are bypassed if the attacker gains root or equivalent privileges on the compromised server.

Full explanation →
135
MCQhard

Which automation security concept coordinates the deployment, scaling, and management of containers?

A.Immutable infrastructure
B.Infrastructure as Code
C.Secret management
D.Container orchestration
AnswerD

Container orchestration coordinates the deployment, scaling, and management of containers, matching the described concept.

Why this answer

Container orchestration is the correct concept because it coordinates the deployment, scaling, and management of containers, which matches the description of coordinating container operations. Immutable infrastructure focuses on preventing drift by replacing instances rather than modifying them. Infrastructure as Code enables version-controlled provisioning and configuration of infrastructure.

Secret management secures sensitive data like passwords and API keys. None of these other options describe coordination of container operations.

Exam trap

Candidates may confuse container orchestration with other automation concepts like infrastructure as code or immutable infrastructure, but container orchestration specifically deals with managing container lifecycles and scaling.

Why the other options are wrong

A

Matched to correct description

B

Matched to correct description

C

Matched to correct description

Full explanation →
136
Multi-Selectmedium

A security administrator is implementing TPM 2.0 for secure boot and measured boot on new laptops. Which TWO capabilities does TPM 2.0 provide that are directly related to ensuring the integrity of the boot process? (Select TWO.)

Select 2 answers
A.Remote attestation to verify boot measurements
B.Platform Configuration Registers (PCRs) for storing measurements
C.UEFI secure boot enforcement
D.Sealed storage to protect encryption keys
E.Generation of RSA keys for code signing
AnswersA, B

TPM can sign PCR values to prove boot integrity to a remote party.

Why this answer

Measured boot stores measurements of boot components in PCRs, and attestation allows a remote verifier to check these measurements. Secure boot verifies signatures of bootloaders, but TPM stores measurements; secure boot is a UEFI feature, though TPM can participate. Sealed storage is for data protection, not boot integrity.

Full explanation →
137
MCQmedium

During an incident response, the team identifies that an attacker gained initial access via a phishing email containing a malicious macro. The macro downloaded a payload from a remote server. Which phase of the incident response lifecycle is currently being executed when the team identifies the phishing email as the attack vector?

A.Containment, eradication, and recovery
B.Preparation
C.Lessons learned
D.Detection and analysis
AnswerD

The team is analyzing the attack vector, which is part of detection and analysis.

Why this answer

Detection and analysis involves identifying the attack and determining its nature. The team has identified the vector, so they are in this phase.

Full explanation →
138
MCQhard

A SOC analyst is tuning a SIEM correlation rule to detect lateral movement. The rule currently triggers on a single failed authentication followed by a successful authentication from a new IP address within 5 minutes. Which improvement would best reduce false positives while maintaining detection of pass-the-hash attacks?

A.Require two failed authentications before the success
B.Increase the time window to 30 minutes
C.Add a condition that the source IP is not in the company's IP range
D.Remove the failed authentication requirement and only trigger on successful authentication from a new IP
AnswerA

Two failures reduce the chance of accidental typos, and pass-the-hash often has multiple failures before success.

Why this answer

Pass-the-hash attacks often involve a single failed authentication (due to incorrect hash) followed by a success. However, requiring two failures before the success would reduce false positives from accidental typos while still catching many pass-the-hash attempts. Adding source IP whitelisting can also cut false positives from admins.

Full explanation →
139
MCQeasy

An organization wants to implement a hardware security module (HSM) to protect cryptographic keys. Which of the following is a primary benefit of using an HSM?

A.Faster key generation than software
B.Reduced network latency for encryption
C.Automatic cloud backup of keys
D.Tamper-resistant key storage
AnswerD

HSMs are designed to protect keys from physical and logical attacks.

Why this answer

An HSM provides tamper-resistant key storage by using physical and logical safeguards, such as tamper switches, epoxy potting, and zeroization circuits, that destroy cryptographic keys if an attacker attempts to access the hardware. This ensures that private keys remain secure even if the device is compromised, which is a primary requirement for compliance with standards like FIPS 140-2 Level 3 or 4. Software-based storage cannot offer the same level of physical protection against extraction attacks.

Exam trap

The trap here is that candidates confuse the security benefit of tamper-resistant storage with performance improvements like faster key generation or reduced latency, which are not primary HSM advantages and are often worse than software alternatives.

How to eliminate wrong answers

Option A is wrong because HSMs typically have slower key generation than optimized software implementations due to hardware constraints and the overhead of tamper-proofing mechanisms; software can leverage CPU cryptographic instructions (e.g., AES-NI) for faster generation. Option B is wrong because an HSM does not reduce network latency for encryption; it may actually increase latency due to the need for network communication to the HSM (e.g., via PKCS#11 or KMIP) compared to local software encryption. Option C is wrong because automatic cloud backup of keys is not a built-in HSM feature; cloud backup would require additional configuration and introduces security risks that HSMs are designed to mitigate, and many compliance frameworks prohibit exporting keys from an HSM.

Full explanation →
140
MCQmedium

A company needs to connect its on-premises data center to a public cloud provider with low latency and high bandwidth while avoiding the public internet. Which connectivity method should be used?

A.Client VPN
B.Direct Connect
C.Site-to-site VPN
D.SD-WAN
AnswerB

Dedicated private connection for high bandwidth and low latency.

Why this answer

Direct Connect (or ExpressRoute) provides a dedicated private connection from on-premises to the cloud, bypassing the internet for better performance and security.

Full explanation →
141
Multi-Selecteasy

Which TWO of the following are key benefits of using a software-defined perimeter (SDP) in a zero trust architecture? (Select TWO.)

Select 2 answers
A.Reduces the attack surface by hiding network resources
B.Automates patch management
C.Eliminates the need for encryption
D.Provides identity-based access control
E.Simplifies network architecture by removing firewalls
AnswersA, D

SDP makes resources invisible to unauthorized users.

Why this answer

SDP hides network infrastructure and enforces identity-based access, reducing the attack surface and preventing lateral movement.

Full explanation →
142
Multi-Selecteasy

An organization is implementing a threat hunting program. The team plans to use the MITRE ATT&CK framework to structure their hunts. Which THREE of the following are core components of the ATT&CK framework? (Choose THREE.)

Select 3 answers
A.Procedures
B.Indicators of compromise (IOCs)
C.CVSS scores
D.Tactics
E.Techniques
AnswersA, D, E

Procedures are specific implementations of techniques.

Why this answer

ATT&CK includes tactics (the 'why'), techniques (the 'how'), and procedures (specific implementations). Indicators of compromise and CVSS scores are not part of the framework; they are separate concepts.

Full explanation →
143
MCQmedium

A multinational corporation is migrating its data centers to a hybrid cloud model. The security team must ensure that data sovereignty laws are respected. The company operates in the EU, US, and Asia. Which of the following is the BEST approach?

A.Require all employees to sign a data processing agreement.
B.Encrypt all data at rest and in transit using a single global encryption key.
C.Implement a virtual private network between all data centers and cloud providers.
D.Use cloud regions in each geographic area where data is stored and processed.
AnswerD

Cloud regions allow data to stay within jurisdictional boundaries.

Why this answer

Using cloud regions in each geographic area ensures data remains within the jurisdiction where it was collected, directly complying with data sovereignty laws such as the EU's GDPR, US state laws, and Asia-Pacific regulations. This approach leverages the cloud provider's regional boundaries to enforce legal data residency without relying on technical controls that can be circumvented or misconfigured.

Exam trap

The trap here is that candidates often confuse data sovereignty with data security, assuming encryption or VPNs (Options B and C) satisfy legal residency requirements, when in fact they only protect data in transit or at rest without controlling where the data physically resides.

How to eliminate wrong answers

Option A is wrong because a data processing agreement (DPA) is a contractual document that defines roles and responsibilities under regulations like GDPR, but it does not enforce technical data residency or prevent data from being stored or processed in unauthorized jurisdictions. Option B is wrong because using a single global encryption key for all data at rest and in transit violates data sovereignty by failing to segregate encryption management per region; it also introduces a single point of compromise and does not address where the data is physically stored. Option C is wrong because a VPN between data centers and cloud providers secures the communication channel but does not control or restrict the geographic location of the cloud resources or data storage, so data can still be processed in a non-compliant region.

Full explanation →
144
MCQeasy

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $50,000 and an exposure factor (EF) of 0.2. The annualized rate of occurrence (ARO) is estimated at 4. What is the ALE?

A.$10,000
B.$40,000
C.$50,000
D.$200,000
AnswerB

Correct calculation: $50,000 × 0.2 × 4 = $40,000.

Why this answer

ALE = SLE × ARO; SLE = AV × EF = $50,000 × 0.2 = $10,000; ALE = $10,000 × 4 = $40,000.

Full explanation →
145
MCQeasy

A security engineer is designing a secure communication channel between two internal systems over an untrusted network. Which protocol should be used to ensure both confidentiality and integrity of data in transit?

A.SSH
B.TLS
C.HTTPS
D.IPsec
AnswerB

TLS provides encryption (confidentiality) and MAC (integrity), suitable for any TCP-based communication.

Why this answer

TLS provides encryption for confidentiality and MAC for integrity, making it the best choice for secure communication over an untrusted network.

Full explanation →
146
MCQeasy

An organization wants to ensure that its employees understand their responsibilities regarding data protection. Which of the following is the MOST effective way to achieve this?

A.Include a clause in the employment contract
B.Post posters in common areas
C.Distribute a data protection policy annually via email
D.Conduct regular security awareness training with assessments
AnswerD

Interactive training with assessments reinforces understanding.

Why this answer

The most effective because it combines regular, recurring training with assessments that verify comprehension, ensuring employees actively engage with data protection responsibilities rather than passively receiving information. This aligns with the continuous improvement cycle required by frameworks like NIST SP 800-50 and GDPR Article 39, which mandate ongoing awareness programs and demonstrable understanding. Assessments provide measurable evidence of employee competence, which is critical for compliance audits and reducing human-error-related breaches.

Exam trap

CompTIA often tests the distinction between passive information dissemination (posters, emails, contract clauses) and active, verifiable training programs, trapping candidates who think any form of communication is sufficient for ensuring employee understanding.

How to eliminate wrong answers

Option A is wrong because an employment contract clause is a one-time legal agreement that does not ensure ongoing understanding or retention of data protection responsibilities; employees may never read or recall it after signing. Option B is wrong because posters in common areas are passive, static communications that lack interactivity, assessment, and reinforcement, making them ineffective for changing behavior or verifying comprehension. Option C is wrong because distributing a policy annually via email is a one-way, infrequent communication that does not require active engagement or confirmation of understanding, and employees often ignore or delete such emails without reading them.

Full explanation →
147
Multi-Selectmedium

A security engineer is designing a secure wireless network for a corporate office. Which TWO configurations should be implemented to maximize security?

Select 2 answers
A.WPA2-PSK
B.WPA3-Enterprise
C.MAC address filtering
D.802.1X with EAP-TLS
E.Disable SSID broadcast
AnswersB, D

WPA3-Enterprise provides stronger encryption and authentication than WPA2.

Why this answer

WPA3-Enterprise (Option B) is correct because it provides the highest level of wireless security by mandating the use of Simultaneous Authentication of Equals (SAE) for key exchange, which eliminates pre-shared key vulnerabilities and offers forward secrecy. It also supports 192-bit cryptographic strength when using CNSA Suite mode, making it resistant to offline dictionary attacks and brute-force attempts, which is essential for a corporate environment.

Exam trap

CompTIA often tests the misconception that disabling SSID broadcast or using MAC filtering provides meaningful security, when in reality these are trivial to bypass and do not address the core requirements of authentication and encryption in a corporate wireless network.

Full explanation →
148
Multi-Selectmedium

A security architect is designing a defense-in-depth strategy for a cloud-native application. Which TWO controls are most effective for protecting east-west traffic between microservices?

Select 2 answers
A.Service mesh with mutual TLS
B.Intrusion detection system (IDS) on the gateway
C.Micro-segmentation of virtual networks
D.Web application firewall (WAF)
E.Network access control lists (ACLs) at the perimeter
AnswersA, C

Correct – service mesh encrypts and authenticates service-to-service communication.

Why this answer

Micro-segmentation isolates traffic between services, and service mesh provides encrypted, authenticated communication. Both address east-west traffic.

Full explanation →
149
MCQeasy

A security analyst is investigating a malware sample found on a workstation. The analyst wants to determine the malware's capabilities without executing it. Which type of malware analysis involves examining the binary's strings, headers, and structure?

A.Static analysis
B.Dynamic analysis
C.Reverse engineering
D.Memory forensics
AnswerA

Static analysis examines the binary without execution.

Why this answer

Static analysis involves examining the malware's code and structure without running it. This includes looking at strings (e.g., IP addresses, registry keys), PE headers, and imports/exports to understand functionality.

Full explanation →
150
Multi-Selectmedium

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Select 2 answers
A.Penetration testing results
B.Employee background checks
C.List of all open-source components and their versions
D.Network flow logs
E.Dependency analysis to identify known vulnerabilities
AnswersC, E

This is the core of an SBOM.

Why this answer

An SBOM lists open-source components and their versions, enabling vulnerability tracking. Dependency analysis helps identify known vulnerabilities in those components.

Full explanation →
Page 1

Page 2 of 13

Page 3

All pages

12345678910111213

Practice CAS-005 by domain

Target a specific domain to shore up weak areas.

Security ArchitectureSecurity EngineeringSecurity OperationsGovernance, Risk, and Compliance
See all domains with question counts →