CompTIA SecurityX (CAS-005) (CAS-005) — Questions 76–150

The zero trust model enforces authentication and authorisation at every access request, regardless of network location, by requiring continuous verification of identity, device health, and session context before granting resource access. This satisfies the stem’s requirement for a foundational principle, as it directly opposes the traditional perimeter-based trust model. In Microsoft Entra ID, conditional access policies implement this by evaluating real-time signals for each request.

A third-party risk assessment evaluates the vendor's security controls, compliance posture and data handling against regulatory requirements before any data is transferred. It identifies gaps and informs contractual safeguards, making it the necessary first step prior to onboarding the SaaS platform.

Disassembly with IDA Pro reveals anti-debugging checks, encrypted string routines and dynamic API resolution logic in the code itself, without executing the sample. This exposes the obfuscation and evasion mechanisms the malware uses, which behavioural observation alone cannot fully map.

DNS tunneling often encodes data in subdomains, resulting in long, random-looking strings. Reviewing DNS logs for such patterns from a single host can quickly validate the alert. This is a direct and efficient first step because it uses existing log data without disrupting operations, and it can confirm whether the traffic is anomalous.

Automated daily file integrity monitoring directly satisfies PCI DSS continuous monitoring by detecting unauthorised changes to critical system files between point-in-time assessments. Unlike periodic manual reviews, it provides the ongoing, evidence-generating oversight the stem demands, flagging tampering or drift promptly so remediation occurs before the next audit cycle.

DSPM discovers and classifies sensitive data across on-premises and multi-cloud environments, then applies consistent protection policies. With centralized key management, it can enforce encryption and access controls regardless of where the data resides, meeting the cross-provider, data-centric requirement without vendor lock-in.

Transfer shifts the financial consequences of a risk to a third party, typically an insurer, while the risk itself remains. Insurance is the classic example, matching the stem's requirement to move financial impact rather than avoid, reduce or accept the risk.

The Rules of Engagement document is the formal agreement that scopes a penetration test, listing authorised targets, permitted techniques, timing windows and prohibited actions. It satisfies the stem's requirement for a document defining scope, rules and restrictions, protecting both tester and client legally.

Honeypots only detect lateral movement if attackers believe they are genuine targets. Populating them with realistic services, banners, credentials and data sustains attacker engagement long enough to record techniques and tooling, directly satisfying the stem's requirement that the deployment attract and deceive intruders effectively.

Allowlisting known partner IP ranges and internal scanners suppresses alerts generated by legitimate crawling and scanning, cutting false positives without disabling detection logic for genuine threats. It targets the specific noise source rather than broadly weakening correlation rules.

Tunnel mode encapsulates the entire original IP packet, including its header, inside a new IP packet, whereas transport mode protects only the payload. ESP supplies the encryption, so tunnel mode with ESP encrypts the whole packet as the stem requires.

Nmap scanning from the compromised host enumerates live neighbours, open ports and services across internal subnets, directly satisfying the requirement to find lateral-movement targets. External reconnaissance cannot reach internal-only systems, and passive sniffing reveals only traffic already traversing the segment.

Mounting Kubernetes Secrets as files injects sensitive data through the container's filesystem, avoiding environment variables that leak into logs, process listings, and crash dumps. This satisfies the recommendation for secure secret delivery without exposing credentials in container metadata.

Envelope encryption satisfies the per-tenant uniqueness and rotation constraints: each tenant gets a distinct DEK, while only the KEK in the HSM needs rewrapping during rotation, avoiding bulk data re-encryption. Storing the wrapped DEK alongside the ciphertext keeps key retrieval local, so rotation incurs minimal performance overhead.

The GDPR mandates appointing a Data Protection Officer for large-scale monitoring or special-category processing, and requires data protection impact assessments for high-risk processing. These obligations are explicit GDPR articles, matching the stem's EU personal-data scenario rather than CCPA, HIPAA or SOX.

IaaS leaves the guest OS, application and data under customer control, so the shared responsibility model places encryption of data at rest and in transit plus identity and access management policies firmly with the company. This preserves confidentiality of financial data throughout and after migration.

A right-to-audit clause contractually grants the company permission to examine the vendor's security controls, evidence and records. It directly satisfies the requirement to perform an audit, giving enforceable access rather than relying on the vendor's voluntary cooperation.

Mutual TLS with short-lived certificates provides strong authentication and encryption for inter-service communication. Short-lived certificates reduce the risk of key compromise and enable automatic rotation. This ensures that only authenticated services can communicate, and all traffic is encrypted, meeting the requirements for secure service-to-service communication.

Conditional manual approval satisfies the minimal-intervention constraint by automating routine playbook steps while pausing only before destructive actions, such as resource deletion or service restarts. This gates high-impact operations behind human authorisation, preventing service disruption without imposing blanket approval that would defeat the automation's efficiency.

Remediation costs $500,000 against a potential $2,000,000 loss, so the control is economically justified and eliminates the critical 9.8 vulnerability. This satisfies the stem's cost-benefit constraint, unlike acceptance, which retains unacceptable exposure, or transfer, which rarely covers exploited vulnerabilities.

Restricted data demands the highest protection level, typically limited to a very small number of authorised individuals with strict need-to-know. It sits above confidential, internal and public classifications, matching the scenario's requirement for the most tightly controlled category.

Host-based enforcement keyed to workload labels decouples policy from IP addresses and network topology. Because the agent travels with the workload, rules continue to apply correctly after automated redeployments change IP addresses, and policy can be expressed in terms of workload identity such as application tier or environment, satisfying both stated requirements.

A SOC 2 Type II report tests controls across a defined audit period rather than a single point in time, so the auditor's opinion addresses whether controls operated effectively throughout those 12 months. This satisfies the vendor risk assessment's need for evidence of sustained control performance.

Regulatory breach-notification regimes impose fixed deadlines measured from awareness, and contracts with partners often impose separate, sometimes tighter deadlines. Notifying regulators, affected individuals, and contractually entitled parties within each applicable window satisfies the full set of obligations. This parallel approach respects that different recipients have different triggers and timelines, which is exactly what the incident lead must coordinate.

A right-to-audit clause contractually grants the organisation the ability to inspect the vendor's controls, records and security practises on an ongoing basis. This directly satisfies the requirement for continuing visibility into the vendor's security posture, unlike one-off certifications or SLAs, which only report point-in-time or service-level assurances.

Signed firmware images let the device verify authenticity and integrity before flashing, using the vendor’s public key to validate the private-key signature. This directly satisfies the stem’s requirement for a trustworthy update process, preventing tampered or malicious firmware from being installed on the IoT device.

SOC 2 Type II exceptions indicate control failures during the audit period, so their impact on the specific data being processed must be evaluated. A risk assessment determines the severity, likelihood and appropriate mitigation or acceptance before contracting, rather than relying on the report alone.

Rights management encrypts documents and binds access permissions to Active Directory identities, so files remain protected even after leaving the network perimeter. This directly mitigates unauthorised distribution, since recipients outside the organisation cannot decrypt or open the protected intellectual property.

This sequence is the classic remote process injection pattern: OpenProcess obtains a handle to the target process, VirtualAllocEx allocates memory in its address space, WriteProcessMemory writes the payload, and CreateRemoteThread starts execution. Monitoring these API calls in sequence is a reliable indicator of remote thread injection, commonly used by malware to execute code in another process.

A high-assurance guard combines a formally verified security kernel with content filtering and a controlled release process, which is exactly what is needed to enforce a non-bypassable information-flow policy while permitting approved structured data to cross. The formal verification provides the assurance evidence that the policy cannot be bypassed, and the filtering performs the necessary sanitization.

Restricted data demands the strictest controls because it covers information whose exposure causes severe harm, such as trade secrets or regulated personal data. It sits above Confidential, Internal and Public in the classification hierarchy, satisfying the stem's requirement for the highest sensitivity tier needing the most stringent protection.

Tunnel mode encapsulates the complete original IP packet inside a new IP packet, encrypting payload and original header together. Transport mode encrypts only the payload and leaves the original header intact, so tunnel mode is required to meet the stated requirement of encrypting the entire packet.

Correlation is essential for identifying patterns and threats.

Validating partner-issued JWTs against their published JSON Web Key Sets lets the gateway verify authenticity using public keys, so no shared secret is exchanged. Claims such as issuer, audience, scope, and subject can then drive authorization decisions and per-partner throttling policies at the gateway.

MAM applies policy to specific apps rather than the whole device, allowing personal use while preventing data leakage. App-level encryption and containerization keep patient data within the managed app and block copy/paste or local storage to unauthorized apps. This matches the requirement to avoid full device management.

Regular outbound connections to multiple external IPs on port 443 with small data transfers are characteristic of C2 beaconing. Malware often uses HTTPS to blend in with normal traffic. The periodic nature and multiple destinations suggest a compromised host attempting to communicate with its controller, possibly using domain generation algorithms (DGAs) or fast-flux.

Event ID 4625 is generated whenever a logon attempt fails, such as due to a bad password or unknown username. A high volume of 4625 events from a single source or against a single account within a short time frame is a classic indicator of a brute-force or password-spraying attack. Monitoring and alerting on this event is essential for early detection of credential attacks against local accounts.

AH provides data integrity and origin authentication through its ICV, but performs no encryption, matching the stated indifference to confidentiality. Tunnel mode encapsulates the entire original IP packet, protecting traffic between the two site gateways rather than just host-to-host flows.

GDPR Article 35 requires a DPIA when processing is likely to result in a high risk to data subjects, especially when using new technologies and processing special categories of data on a large scale. Clinical trials involving genetic and health data on a large scale clearly meet this threshold. Genetic data and health data are special categories under Article 9, and large-scale processing triggers the DPIA requirement.

Rate-limiting the offending source IP on the network firewall throttles or blocks the repeated authentication attempts immediately, disrupting the brute-force pattern while legitimate traffic from other sources continues unaffected, and requires no account or application changes.

Lambda functions that process external input pass untrusted data into downstream queries or commands, so unsanitised input enables injection attacks; this is the most critical concern because it can compromise data and execution context directly.

RekeyLimit specifies the maximum amount of data and/or time before the session key is renegotiated. Setting it to 1G 1h forces a new key exchange after 1 gigabyte of data or one hour, whichever comes first, thereby rotating session keys and limiting exposure if a key is compromised. This directly satisfies the requirement.

RSA signatures with SHA-256 provide non-repudiation because only the holder of the private key can produce a signature that the corresponding public key verifies. This asymmetric property binds the signer to the document, unlike symmetric MACs where both parties share the secret.

EAP-TLS uses mutual certificate-based authentication, where both the supplicant and the authentication server present certificates. This ensures the server validates the supplicant's identity and vice versa, meeting the requirement. It is widely supported in WPA3-Enterprise and provides strong security without passwords, making it ideal for environments requiring robust mutual authentication.

Separating the wrapping key into a distinct HSM under dual control enforces separation of duties and prevents a single compromised HSM from exposing backed-up keys. Logging wrapping operations provides the required auditability. This design ensures that even if the primary HSM is compromised, the attacker cannot unwrap exported blobs without also compromising the second HSM.

NAC with posture assessment checks the health of devices, such as ensuring antivirus is up-to-date and patches are installed, before allowing network access. When integrated with VPN, it can enforce health policies for remote workers. This directly meets the requirement for strong authentication and device health validation.

BIA identifies which functions are critical to the mission.

A DPIA directly satisfies GDPR Article 35, which mandates assessing high-risk processing before migrating sensitive customer data. It systematically identifies privacy risks, documents lawful basis and mitigation, and evidences accountability to supervisory authorities. This proactive, documented evaluation demonstrates due diligence more concretely than reactive or purely contractual measures.

OSSEC provides centralized, efficient monitoring.

An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys internally, so keys never exist in plaintext outside the module. This directly addresses secure key storage and cryptographic operations, unlike software keystores where keys reside in memory or on disk.

Compensating controls reduce risk without patching, satisfying the end-of-life constraint. Because the vendor no longer supplies fixes, mitigation through network segmentation, strict access control or virtual patching limits exploitability while the critical system continues operating.

Automated discovery that assigns classification labels at the point of creation enforces the labeling objective at the earliest possible moment and removes reliance on users to remember the scheme. It directly operationalizes the classification standard by ensuring every artifact carries its sensitivity marking, which downstream controls such as encryption and access rules can then act upon consistently.

Real-time forwarding removes logs from the source host before an attacker can tamper with them, and append-only storage with hash chaining makes any later modification detectable because each entry's hash depends on the previous one. An attacker with server administrative rights cannot rewrite records already transmitted to the hardened collector. This directly provides tamper evidence and verifiability.

MTTR directly quantifies how quickly the team contains and resolves incidents, making it the clearest indicator of response-process effectiveness. It captures elapsed time from detection to resolution, exposing bottlenecks in triage, escalation and containment that other metrics, such as incident counts, cannot reveal.

VPCs provide network-level isolation between tenants, while separate subnets within each VPC segment workloads by tier or function. Security groups and network ACLs then enforce traffic rules, delivering strong tenant separation without the operational overhead of per-tenant accounts or dedicated hardware.

Trivy scanning as a pre-push Jenkins stage shifts detection left, failing the build before vulnerable images reach the registry. This satisfies the stem's automation and delay constraints, replacing manual post-deployment scanning with a gate that blocks flawed artefacts early.

AES-256-GCM provides confidentiality through symmetric encryption and integrity via its built-in GHASH authentication tag, detecting tampering without a separate MAC. This single-pass AEAD construction satisfies the stem's dual requirement for data at rest, unlike plain AES-CBC, which encrypts but leaves integrity unverified.

Recovery Time Objective (RTO) defines the maximum tolerable duration of service interruption after a disruption, directly answering the downtime constraint in the stem. Unlike Recovery Point Objective, which measures acceptable data loss in time, RTO targets restoration speed, making it the metric that specifies how long an outage may last before unacceptable impact occurs.

A separate VLAN isolates guest traffic at layer 2, so guest devices cannot route to internal subnets without an explicit gateway or ACL permitting it. This directly satisfies the requirement to prevent unauthorised users reaching internal resources, unlike encryption or captive portals, which authenticate guests but do not segment them.

Weak passwords stem from user behaviour, so a preventive administrative control is needed. Enforcing a strong password policy sets complexity, length and expiry requirements at authentication, directly removing the weak-credential risk rather than detecting it afterwards.

Host-based firewalls with identity labels enforce policy at the workload level regardless of host or IP changes, and a central controller distributes consistent rules. This allows only required east-west flows and follows workloads across migrations, directly satisfying the microsegmentation requirement in a dynamic data center.

WPA2-Personal with a strong PSK accommodates legacy devices that cannot use 802.1X. A WIPS monitors the airwaves for rogue access points and can detect and mitigate unauthorized devices. This combination meets the requirements without requiring device upgrades, balancing compatibility and security.

Embedding privacy controls at the initial system architecture stage satisfies privacy by design, which requires data protection to be built into systems from the outset rather than bolted on after deployment. Retrofitting later cannot match this preventative, architecture-level alignment.

A playbook is a predefined, automated workflow that executes a series of actions based on triggers and conditions. Here, the trigger is a reported phishing email, and the actions include URL extraction, threat intelligence lookup, and conditional quarantine. This directly matches the requirement to define a sequence of automated actions.

The incident response plan defines the agreed sequence of actions for exactly this anomaly, so following it first ensures containment, evidence handling and escalation occur consistently. Deviating risks destroying forensic data or breaching organisational procedure before the plan's steps are applied.

SSH provides strong encryption, integrity, and authentication for remote administration. It protects the session against eavesdropping and tampering. It is the standard protocol for secure command-line management. Using SSH meets the requirement for confidentiality and integrity of the management session.

STIX provides a structured, machine-readable schema for describing indicators, threat actors and relationships, while TAXII defines the transport protocol for exchanging that content between servers and clients. Together they satisfy the stem's requirement for a standardised, automated format for sharing APT indicators, unlike document-centric or proprietary feed formats.

CRYSTALS-Dilithium is a lattice-based digital signature scheme selected by NIST for post-quantum cryptography standardisation, providing quantum-resistant authentication. It satisfies the stem's requirement for cryptographic agility against quantum attacks, unlike RSA or ECDSA, whose security collapses under Shor's algorithm. Its selection as a NIST PQC standard confirms its suitability.

A site-to-site VPN with a customer gateway on-premises and a virtual private gateway in the cloud encrypts traffic via IPsec, and advertising only the database subnet CIDR in the static route confines reachable destinations to that network. This meets both the encryption requirement and the least-privilege routing constraint without exposing other on-premises ranges.

A BCP focuses on maintaining the delivery of critical business functions at acceptable levels during and after a disruption. It prioritises operational resilience of essential processes, distinguishing it from disaster recovery, which restores IT infrastructure, and from incident response, which contains the immediate threat.

A service mesh injects sidecar proxies that terminate and originate mTLS on behalf of each workload, issuing and rotating certificates automatically. This enforces mutual TLS between services without modifying application code, which container orchestration alone does not provide.

Common challenge

HSM provides tamper-resistant storage and performs cryptographic operations without exposing keys.

Container orchestration platforms schedule containers across hosts, scale replicas up or down, and manage lifecycle and networking automatically. This coordination of deployment, scaling and management is precisely the automation security concept the question describes, distinguishing it from image scanning or secrets management.