CompTIA SecurityX (CAS-005) (CAS-005) — Questions 151–225

Remote attestation lets the TPM sign a quote over selected PCR values, allowing a remote verifier to confirm the boot chain matched expected measurements. This satisfies the integrity-verification requirement by detecting tampering with firmware or boot components before trust is granted.

NetworkPolicy is the native Kubernetes mechanism to enforce pod-level segmentation. A default-deny ingress policy blocks all traffic not explicitly allowed, satisfying least privilege and stopping lateral movement. Explicit allow rules then permit only the required database access from the front end. This directly addresses the scenario's requirement to block unauthorized east-west traffic without adding external components.

Deception fidelity depends on distinguishing authorized tooling from adversary behavior. By fingerprinting the deterministic traffic patterns and source addresses of sanctioned scanners and backup agents and suppressing only those events, the team removes expected noise without blinding the environment to novel or anomalous connections. All other honeypot interactions remain high-signal indicators worth forwarding to the SIEM for correlation and triage.

Identifying the phishing email as the initial access vector is analysis of collected evidence to determine how the intrusion occurred, which falls within detection and analysis. This phase scopes the incident and informs later containment and eradication decisions.

An HSM physically protects keys within a tamper-resistant boundary that zeroises them if intrusion is detected, so keys never exist in plaintext on the host. This directly satisfies the requirement to protect cryptographic keys, unlike software keystores that rely solely on file permissions.

A cloud identity provider with conditional access evaluates real-time signals such as device compliance and on-premises risk before issuing short-lived tokens. Because token issuance happens in the cloud and does not trust on-premises domain controllers to sign tokens, a compromised domain controller cannot forge cloud access, satisfying both requirements.

SDP uses a deny-by-default model with single-packet authorisation, keeping resources invisible to unauthenticated users. Attackers cannot scan or target what they cannot see, so the exploitable attack surface shrinks — the specific benefit the zero trust scenario requires.

Regional cloud deployments keep data stored and processed inside each jurisdiction, so EU, US and Asian data remain subject to their own sovereignty laws. This satisfies the legal constraint without relying on contractual or encryption-based transfers.

Multiplying asset value by exposure factor gives the single-loss expectancy: $50,000 × 0.2 = $10,000. Annualising by the ARO of 4 yields $40,000, satisfying the stem's requirement to compute ALE from AV, EF and ARO. The $40,000 figure therefore matches the correct calculation.

Regular security awareness training with assessments repeatedly educates employees on data protection duties and verifies comprehension through testing, directly building the understanding the organisation requires. One-off communications or policy documents alone cannot confirm that responsibilities are understood.

Mutual TLS in a service mesh authenticates and encrypts every service-to-service call, giving cryptographic workload identity rather than relying on network location. This directly protects east-west traffic inside the cluster, where perimeter controls cannot inspect lateral microservice communication.

Static analysis examines the binary's strings, headers and structure without running it, directly satisfying the stem's constraint of determining capabilities without execution. Dynamic or behavioural analysis would require detonating the sample in a sandbox, which the analyst explicitly wants to avoid.

An SBOM must enumerate every open-source library and its exact version, because version data is what lets you map components to advisories and licences. Without this inventory, the supply chain constraint of knowing what ships inside your software cannot be met.

The GDPR right to data portability requires that data subjects can receive their personal data in a structured, commonly used, and machine-readable format. An API endpoint that returns data in JSON or CSV satisfies this requirement and provides a scalable, automated way to fulfill data subject requests. This is the most direct technical control for the requirement.

Threat identification enumerates the threat sources and events capable of exploiting vulnerabilities, forming the basis for estimating likelihood. It satisfies the methodology's requirement to establish what could cause harm before assessing impact and risk levels.

MAB authenticates devices based on their MAC address, which is easily spoofable. An attacker with physical port access can configure a device with a permitted MAC address and gain network access without valid 802.1X credentials. This directly undermines the requirement that unauthorized devices cannot communicate, making MAB a significant weakness in this scenario.

Cryptographic Failures ranks second in the OWASP Top 10 2021, covering exposure of sensitive data through weak encryption, poor key management or plaintext transmission. It satisfies the stem's requirement for a genuine 2021 category, having replaced the earlier Sensitive Data Exposure entry.

Data residency requires that stored data physically remains within a permitted jurisdiction. Choosing the correct AWS region determines the physical location of the data at rest, directly satisfying the legal constraint that data must not leave the approved territory.

GDPR is generally the most stringent regime the retailer faces, so using it as the baseline and layering stricter state-specific duties (for example, opt-out of sale or targeted advertising) onto that control set produces one harmonized framework that satisfies every jurisdiction without duplicating effort.

IaaS leaves the customer responsible for the guest OS, runtime, middleware, applications and data, whereas PaaS and SaaS shift those layers to the provider. This maximal customer ownership of the stack is precisely what satisfies the stem's requirement for the model placing the most security responsibility on the customer.

Signed commits prove the author's identity and, combined with mandatory peer review and branch protection, ensure only reviewed code reaches the build. Verifying dependency signatures against a trusted allowlist detects tampered or substituted packages before they enter the artifact. Together these controls directly address both code provenance and dependency integrity in the pipeline.

MQTT with TLS suits constrained IoT links: its publish/subscribe design uses a compact fixed header and persistent sessions, so sensors transmit small payloads over intermittent connections without HTTP's per-request overhead. TLS provides encryption and server authentication, satisfying the stem's secure-transmission and minimal-bandwidth constraints simultaneously.

Content trust enforces cryptographic signing, so the container runtime verifies each image's signature against trusted publishers before deployment. Unsigned or tampered images are rejected at pull time, directly satisfying the pipeline's requirement that only signed, trusted images reach production.

BCRs are approved by the competent supervisory authority and serve as a documented, enforceable framework for intra-group transfers and accountability. They demonstrate GDPR compliance without needing case-by-case authorization for each transfer, making them suitable for a multinational expanding into the EU. They are specifically designed for corporate groups with multiple entities, providing a transparent and legally binding mechanism.

Parameterised prepared statements separate SQL code from user-supplied data, so the search field's input is bound as a value rather than parsed as executable SQL. This neutralises injection at the query layer while preserving the search functionality, satisfying the requirement to mitigate without significantly impacting functionality.

Data mapping records where personal data flows across systems and jurisdictions, establishing the visibility GDPR and CCPA both demand for subject access, deletion and transfer requests. Without this inventory, the architect cannot demonstrate lawful processing or respond to cross-border data obligations.

Extracting strings examines the binary's raw bytes without executing it, revealing embedded artefacts such as the C2 server address. That places it firmly in static analysis, which inspects code and metadata at rest, distinct from the dynamic sandbox observation already performed.

Network segmentation places the unpatched legacy application in an isolated segment with restricted inbound and outbound traffic, limiting lateral movement and reducing exploitability. This compensates for the vendor-imposed inability to patch while addressing the high likelihood of exploitation.

MDM enforces encryption at the device level and provides remote wipe, satisfying both stated requirements for personal devices. Unlike app-level controls, it manages the whole device, ensuring company data is encrypted and can be erased if lost. This directly meets the encryption and wipe constraints in the scenario.

A software-defined perimeter authenticates and authorizes endpoints before any network access is granted, creating identity-based, need-to-know connectivity between workloads. This directly limits lateral movement because unauthenticated workloads cannot reach protected segments, and it supports policy based on workload identity rather than static IP addresses.

Directory traversal exploits insufficient path validation, letting an attacker supply sequences like ../ to escape the intended web root and read arbitrary files. The exhibit shows a manipulated file-path parameter returning files outside the web directory, confirming traversal rather than injection or misconfiguration.

A service mesh with mTLS encrypts all service-to-service traffic and authenticates both endpoints via certificates, satisfying the mutual authentication requirement. Its control plane automates certificate issuance and rotation across Kubernetes pods, delivering this with minimal operational overhead compared with manually managing certificates per service.

A DPIA is a GDPR requirement for processing that likely results in high risk to data subjects. It identifies and mitigates privacy risks early in the design phase, directly implementing privacy by design. By conducting it before development, the architect ensures controls are built in, not bolted on, and addresses multiple regulatory requirements proactively.

SAST analyzes source code without executing it, identifying vulnerabilities early.

The right to erasure, also called the right to be forgotten, lets a data subject require an organisation to delete personal data without undue delay. It is one of the GDPR's enumerated data subject rights, satisfying the stem's question.

This approach uses a customer-managed VPN gateway and HSMs to store keys, ensuring that the cloud provider does not have access to the encryption keys. IPsec with customer-managed certificates provides strong encryption and authentication. This meets the requirements for data confidentiality against the provider and compliance with strict key management controls.

When remediation is not feasible, applying compensating controls can reduce residual risk to an acceptable level. Network segmentation limits lateral movement, and enhanced monitoring improves detection. This approach aligns with the organization's risk appetite by addressing the risk without incurring the full cost of replacing the legacy application, and it demonstrates due diligence in managing accepted risks.

Scanning detects vulnerabilities and embedded secrets, while signing produces a cryptographic attestation of image provenance. Enforcing signature verification at deploy time ensures only unaltered, approved images run, directly preserving the integrity guarantee that immutable infrastructure depends on.

A hardware OTP token is a possession factor because authentication requires something the user physically holds, satisfying the MFA requirement for a possession-based credential. The device generates time-synchronised one-time codes, so access depends on possessing the hardware itself rather than knowledge or biometrics.

FIPS 140-2 is the NIST validation standard for cryptographic modules, specifying security requirements across eleven areas including key management and physical tampering. Compliance certifies the module has been independently tested, satisfying the demand for a validated cryptographic module.

Removing capabilities eliminates potential escalation via Linux capabilities.

An HSM performs cryptographic operations internally, so the private key never leaves the tamper-resistant hardware. Compromising the host server yields no usable key material, satisfying the requirement that the key stay protected despite server compromise.

TLS 1.3 mandates forward secrecy by design, using ephemeral Diffie-Hellman key exchange for all cipher suites. Each session generates a unique ephemeral key pair that is discarded after the handshake, so compromise of the server's long-term private key cannot decrypt recorded past sessions. This directly satisfies the requirement and aligns with PCI DSS guidance for strong cryptography.

Preparation covers establishing logging, monitoring and detection capabilities before incidents occur. Insufficient logging on critical servers is a preparation gap, so strengthening log collection and alerting in this phase directly addresses the 72-hour detection failure identified in the review.

Helm provides reusable, versioned deployment packages with rollback capabilities.

HSMs keep private keys inside tamper-resistant hardware and perform signing operations internally, so keys never exist in host RAM. This directly defeats memory-dump extraction, the stated attack vector, unlike software keystores where keys are loaded into process memory and can be captured by a privileged attacker.

Running SAST on every commit embeds automated security checks directly into the CI pipeline, satisfying the DevSecOps requirement for continuous, shift-left testing. Unlike periodic manual reviews or pre-deployment gates, this scans source code at the earliest stage, catching vulnerabilities before they merge and giving developers immediate feedback.

Trivy scans container images for known vulnerabilities.

AWS Config continuously records resource configurations and evaluates them against rules, flagging non-compliant changes across the account. This satisfies the SOC 2 monitoring and enforcement constraint by providing auditable configuration history and automated remediation triggers.

WPA3-Enterprise uses 802.1X with EAP to authenticate each user or device against a RADIUS server, eliminating the shared-secret weakness of pre-shared keys. It also mandates stronger cryptographic protections, including protected management frames and, in WPA3-Enterprise 192-bit mode, GCMP-256 and SHA-384. This directly satisfies the requirement for strong encryption without a pre-shared key.

A single consolidated PIA mapping overlapping GDPR and CCPA requirements avoids duplicated assessments, since both regimes share core principles around data processing, individual rights and risk. One assessment covering the stricter obligation of each area satisfies both regulators efficiently.

Just-in-time access grants elevated privileges only when requested and approved for a defined window, then automatically revokes them. This matches the stem's requirement for temporary elevated access for a specific task, rather than standing permanent admin rights.

Event ID 4769 logs Kerberos service ticket requests, showing which services the account accessed. Since service accounts often use Kerberos, this can reveal lateral movement to servers. Correlating with logon events provides a comprehensive view of accessed systems.

Kubernetes Network Policies are the native mechanism to control pod-to-pod traffic at Layer 3 and Layer 4. By applying a default-deny policy for both ingress and egress in a namespace, all traffic is blocked unless explicitly allowed by a subsequent policy. This enforces least privilege and prevents lateral movement between microservices. It works with a CNI plugin that supports network policies, such as Calico or Cilium, and is the standard way to achieve microsegmentation in Kubernetes.

Segmentation reduces the systems that process, store, or transmit card data.

DNS tunnelling encodes exfiltrated data into DNS records, inflating responses well beyond the 512-byte UDP limit and often forcing TCP fallback. Large response packets therefore satisfy the stem's requirement for network indicators supporting the DNS tunnelling hypothesis.

PCRs hold cumulative hashes of boot components, and their values can be signed by the TPM's attestation key. A remote verifier compares these quotes against known-good values, confirming the system booted untampered — the core mechanism enabling remote attestation of boot state.

Non-extractable keys that never leave the HSM boundary ensure the private key cannot be copied or exfiltrated, satisfying the key-protection requirement. Because signing happens inside the module, the plaintext key is never exposed to the host OS or application memory, which is exactly the property needed for a code-signing root of trust.

Micro-segmentation applies granular, workload-level security controls and policies between individual segments, so a compromised host cannot reach neighbouring workloads. This directly satisfies the zero trust requirement that no implicit trust exists between network segments, blocking lateral movement even after one segment falls.

STIX defines a structured language for describing threat indicators, actors and campaigns, while TAXII specifies the transport protocol for exchanging that content between systems. Together they give vendors and sharing communities a common format and delivery mechanism for cyber threat intelligence.

A publicly available exploit raises the likelihood of active attacks, since attackers can readily obtain working code. This directly increases the vulnerability's risk level when prioritising remediation, alongside impact factors such as asset criticality and exposure.

Micro-segmentation enforces zero trust by dividing the network into isolated zones with granular, workload-level policies, so lateral movement after compromise is contained. For remote access, it satisfies the requirement that no user or device is implicitly trusted once inside the perimeter.

Correlation rules tuned against asset inventory, network architecture and threat intelligence align detection logic with what is genuinely anomalous for this environment. This satisfies the balance constraint by suppressing benign activity specific to the organisation while preserving detection of real attacks.

Data classification policies and procedures satisfy the framework's need to categorise information by sensitivity, enabling controls such as encryption, access restrictions and retention to be applied proportionately. Without classification, Microsoft Entra ID access policies and DLP rules cannot distinguish confidential data from public, so governance decisions lack the risk context they require.

The failed segmentation control means the corporate network can reach the cardholder data environment, so cardholder data is exposed to systems outside PCI DSS scope. Restoring that boundary first re-establishes the scope-defining control the assessor will test, whereas patching overdue vulnerabilities leaves the CDE still reachable.

System call auditing logs, such as those generated by auditd on Linux, record detailed information about system calls, including process execution, file access, and network activity. They provide a comprehensive and tamper-resistant record of the attacker's actions after initial access. This is the most direct evidence for forensic analysis.

Automated actions execute without analyst intervention, which satisfies the stem's requirement that quarantine and domain blocking occur automatically upon detection. Unlike manual or semi-automated playbooks, this removes human approval from the response path, enabling immediate containment. Microsoft Entra ID and email security controls are invoked programmatically by the SOAR platform.

Ansible playbooks execute idempotently across cloud modules, so revocations run consistently regardless of prior state, while encrypted vault files keep credentials out of plaintext. This minimises manual error and satisfies the consistent, secure execution requirement.

Micro-segmentation creates granular, workload-level security policies enforced at each virtual network interface, so lateral movement between workloads is blocked regardless of subnet boundaries. This satisfies zero trust's requirement to isolate individual workloads rather than trusting the network perimeter.

EAP-TTLS and PEAP create an encrypted TLS tunnel using the server certificate, and the actual user identity and credentials are exchanged inside that tunnel. This protects the supplicant identity from passive eavesdroppers and prevents credential theft. A method that sends identity in the clear before the tunnel, such as EAP-MD5, does not meet the requirement.

FIDO2/WebAuthn credentials are cryptographically bound to the relying party's origin, so a credential registered for the genuine sign-in endpoint cannot be replayed against a look-alike phishing domain. This origin binding satisfies the stem's passwordless requirement while eliminating credential theft via reverse-proxy phishing kits such as Evilginx, which defeat OTP-based MFA.

A hierarchical key management system uses unique data encryption keys (DEKs) for each data object or session, and wraps them with key encryption keys (KEKs). Compromise of one DEK exposes only the data it protects, not the entire dataset. This minimizes risk and meets the requirement that a single compromised key does not expose all data.

A minimal base image ships fewer packages, libraries and services, so fewer vulnerabilities and binaries are present for an attacker to exploit. This directly shrinks the attack surface, satisfying the hardening constraint more effectively than scanning or runtime monitoring alone.

NetworkPolicy objects select pods via label selectors and enforce ingress and egress rules at layer 3/4, restricting traffic to explicitly permitted pod, namespace, or CIDR combinations. This satisfies the stem's requirement for fine-grained pod-to-pod communication control, which Kubernetes denies by default until a policy selects the pod.