Courseiva

CompTIA SecurityX (CAS-005) (CAS-005) — Questions 151225

968 questions total · 13pages · All types, answers revealed

Page 2

Page 3 of 13

Page 4
151
Multi-Selectmedium

Which TWO of the following are key components of a risk assessment methodology?

Select 2 answers
A.Disaster recovery.
B.Threat identification.
C.Risk appetite.
D.Incident response.
E.Asset inventory.
AnswersB, E

Identifying threats is a fundamental step in risk assessment.

Why this answer

Threat identification (B) is a core component of a risk assessment methodology because it systematically catalogs potential sources of harm that could exploit vulnerabilities in the environment. Without identifying threats—such as malware, insider threats, or natural disasters—the subsequent risk analysis cannot calculate likelihood or impact. Asset inventory (E) is equally fundamental because risk is always assessed in the context of what is valuable or critical to the organization; you cannot evaluate risk to assets you do not know exist.

Exam trap

CompTIA CASP+ often tests the distinction between proactive risk assessment components (threat identification, asset inventory) and reactive operational processes (disaster recovery, incident response), expecting candidates to recognize that risk appetite is a governance policy input, not a step in the methodology.

152
MCQeasy

Which hashing algorithm is recommended for modern applications requiring high security and resistance to quantum computing threats, and offers improved performance over SHA-2?

A.SHA-3
B.RIPEMD-160
C.MD5
D.SHA-256
AnswerA

SHA-3 is the newest NIST hash, with a sponge construction and quantum resistance.

Why this answer

SHA-3 is the latest NIST-standardized hash function, designed to be resistant to quantum attacks and offers a different structure from SHA-2, with good performance.

153
Multi-Selectmedium

Which THREE of the following are common vulnerabilities found in web applications according to the OWASP Top 10 2021? (Select THREE.)

Select 3 answers
A.Cryptographic Failures
B.Broken Access Control
C.Server-Side Request Forgery (SSRF)
D.SQL Injection
E.Remote Code Execution (RCE) via buffer overflow
AnswersA, B, C

Cryptographic Failures (A02:2021) is a distinct category in the OWASP Top 10 2021, covering weak encryption, improper key management, and failure to enforce HTTPS. This is a correct answer.

Why this answer

The OWASP Top 10 2021 lists three categories that correspond directly to the options: A02:2021 Cryptographic Failures (option A), A01:2021 Broken Access Control (option B), and A10:2021 Server-Side Request Forgery (option C). Option D (SQL Injection) is not a standalone category in the 2021 list; it falls under A03:2021 Injection, which is broader and includes various injection types. Option E (Remote Code Execution via buffer overflow) is not listed as a distinct category in the OWASP Top 10 2021.

Therefore, the correct three answers are A, B, and C.

Exam trap

A common trap is assuming SQL Injection remains a separate category in the OWASP Top 10 2021; however, it was merged into the broader Injection category (A03). Additionally, SSRF was added as a new category (A10), so it is a correct answer despite being a less familiar vulnerability.

154
MCQmedium

Refer to the exhibit. A security engineer reviews the S3 bucket policy. Which of the following is the most concerning security issue?

A.The policy does not require encryption in transit
B.The policy uses the incorrect version of the policy language
C.The policy allows any user to list the objects in the bucket
D.The policy allows public read access to all objects in the bucket
AnswerD

Principal: * with s3:GetObject allows anonymous read access to all objects.

Why this answer

The S3 bucket policy explicitly grants the `s3:GetObject` action to `"Principal": "*"`, which allows any unauthenticated user (public) to read all objects in the bucket. This is a critical misconfiguration that exposes sensitive data to the internet, often leading to data breaches. The policy does not restrict access by IP, referer, or any condition, making it a direct violation of the principle of least privilege.

Exam trap

CompTIA CASP+ often tests the distinction between `s3:ListBucket` (listing object names) and `s3:GetObject` (reading object contents), tricking candidates into thinking listing is the most severe when actually public read access to object data is the critical risk.

How to eliminate wrong answers

Option A is wrong because encryption in transit (e.g., HTTPS) is enforced at the client-server level, not via S3 bucket policies; S3 supports HTTPS by default and the policy can require `aws:SecureTransport` but its absence is less concerning than public read access. Option B is wrong because the policy uses version `2012-10-17`, which is the current and correct version of the AWS IAM policy language; older versions like `2008-10-17` are deprecated but still functional, and version alone is not a security issue. Option C is wrong because while the policy allows `s3:ListBucket` to any principal, listing objects does not expose the object contents; the far greater risk is the `s3:GetObject` permission that grants direct read access to all objects.

155
Multi-Selecthard

An organization is architecting a hybrid cloud environment with AWS and on-premises resources. Which THREE considerations are essential for meeting data residency requirements? (Choose three.)

Select 3 answers
A.Selecting the correct AWS region for data storage
B.Using only on-premises storage for all data
C.Storing encryption keys in the same region as the data
D.Implementing data classification policies
E.Using a global AWS account without region constraints
AnswersA, C, D

Region selection ensures data stays within specific geographic boundaries.

Why this answer

Data residency requires control over data location. AWS region selection determines physical storage location. Data classification policies enforce where data can reside.

Encryption keys stored in a specific region ensure data remains under jurisdictional control.

156
MCQeasy

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

A.IaaS
B.FaaS
C.SaaS
D.PaaS
AnswerA

Customer responsibility is greatest in IaaS.

Why this answer

In IaaS, the customer manages the OS, applications, and data, while the provider secures the physical infrastructure. SOC 2 compliance requires customer to handle many controls.

157
MCQmedium

A company is deploying IoT sensors in a remote area with limited connectivity. The sensors must be able to securely transmit data using minimal bandwidth. Which protocol should the engineer choose?

A.SNMPv3
B.HTTPS
C.MQTT with TLS
D.SSH
AnswerC

MQTT is designed for low-bandwidth, high-latency networks and TLS provides security.

Why this answer

MQTT with TLS is the correct choice because MQTT is a lightweight publish-subscribe protocol designed for constrained devices and low-bandwidth, high-latency networks. It minimizes overhead with a small header (2 bytes minimum) and supports persistent connections, making it ideal for IoT sensors in remote areas. TLS ensures encrypted, authenticated communication without adding significant bandwidth overhead when using modern cipher suites.

Exam trap

The trap here is that candidates confuse 'secure' with 'lightweight' and choose HTTPS or SSH because they are familiar, overlooking that MQTT is specifically engineered for low-bandwidth IoT scenarios and can be secured with TLS without sacrificing efficiency.

How to eliminate wrong answers

Option A is wrong because SNMPv3, while secure, is designed for network management polling and has higher overhead due to its request-response model and larger message structures, making it unsuitable for minimal-bandwidth IoT sensor data transmission. Option B is wrong because HTTPS relies on TCP and TLS handshakes that add significant latency and bandwidth consumption per request, and its request-response model is inefficient for frequent small sensor updates. Option D is wrong because SSH is a secure remote access protocol for interactive sessions and file transfers, not designed for lightweight machine-to-machine data publishing; it requires maintaining a persistent TCP connection with higher overhead than MQTT.

158
MCQhard

During a security review, it is discovered that a critical application uses hardcoded cryptographic keys. The development team refactors the code to retrieve keys from a centralized key management system (KMS) using role-based access control. Which additional practice should be implemented to minimize the risk of key compromise?

A.Log every key access without rotation
B.Use a single, long key to reduce management overhead
C.Implement key expiration and automated rotation
D.Store keys in a hardware security module only
AnswerC

Regularly rotating keys limits the time an attacker can use a compromised key.

Why this answer

Rotation reduces the window of exposure if a key is compromised, and automating it ensures consistency.

159
MCQhard

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

A.Implement a private container registry with access controls
B.Enable content trust and require signatures on all images
C.Run vulnerability scanning on all images before deployment
D.Use an admission controller that checks image labels
AnswerB

Why this answer

Enabling content trust (e.g., Docker Content Trust or Notary) cryptographically signs container images, ensuring that only images signed by a trusted publisher can be deployed. This directly enforces integrity and authenticity in the CI/CD pipeline, preventing unauthorized or tampered images from reaching production.

Exam trap

The trap here is that candidates confuse access control (registry permissions) or vulnerability scanning with cryptographic trust, failing to recognize that only content trust provides non-repudiation and tamper-evidence for container images.

Why the other options are wrong

A

Access controls prevent unauthorized pushes but do not verify the integrity or authenticity of images.

C

Scanning identifies vulnerabilities but does not verify the publisher's identity or prevent tampering.

D

Labels are metadata and can be easily spoofed; they do not provide cryptographic proof of origin.

160
MCQhard

An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?

A.Deploy a web application firewall (WAF) to filter malicious payloads.
B.Rewrite the database query to use parameterized prepared statements.
C.Move all database queries to stored procedures.
D.Implement client-side input validation to block special characters.
AnswerB

Parameterized queries ensure user input is treated as data, not executable code, preventing SQL injection.

Why this answer

Parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.

Exam trap

CompTIA often tests the misconception that stored procedures are inherently safe against SQL injection, but the trap is that they only prevent injection if they use parameterized queries internally—otherwise, they are just as vulnerable as inline SQL.

How to eliminate wrong answers

Option A is wrong because a WAF is a reactive, signature-based or heuristic filter that can be bypassed with carefully crafted payloads (e.g., encoding, obfuscation) and does not address the root cause of the vulnerability. Option C is wrong because stored procedures alone do not prevent SQL injection if they still concatenate user input into dynamic SQL strings; the protection comes from using parameterized queries within the stored procedure, not from the stored procedure itself. Option D is wrong because client-side validation can be easily bypassed by disabling JavaScript or using tools like cURL or Burp Suite to send raw HTTP requests, and it provides no server-side defense against injection.

161
Multi-Selecthard

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?

Select 2 answers
A.Implement data mapping to track personal data across systems and jurisdictions.
B.Establish data classification policies to categorize information based on sensitivity.
C.Deploy data loss prevention (DLP) technology to monitor data exfiltration.
D.Define a data retention schedule that automatically deletes data after a set period.
E.Integrate a security information and event management (SIEM) system for log analysis.
AnswersA, B

Data mapping is a foundational governance activity required by both GDPR and CCPA.

Why this answer

Options A and B are correct. GDPR and CCPA both require understanding of personal data flows (data mapping - A) and categorizing data to apply appropriate controls (data classification - B). Data mapping is explicitly required for records of processing activities under GDPR and for consumer requests under CCPA.

Data classification helps determine which data is subject to regulations and apply necessary protections. Option C (DLP) is a technical control that supports compliance but is not a governance control. Option D (retention schedule) is important but more specific to GDPR's storage limitation and not as central for CCPA.

Option E (SIEM) is a monitoring tool, not a governance control.

162
MCQhard

During a malware analysis, an analyst runs a suspicious binary in a sandbox and observes that it attempts to communicate with a known malicious IP address, modifies registry keys, and creates a service. The analyst then extracts strings from the binary and finds references to a specific C2 server. Which analysis phase does the extraction of strings represent?

A.Dynamic analysis
B.Reverse engineering
C.Static analysis
D.Memory analysis
AnswerC

String extraction is a static analysis technique.

Why this answer

Static analysis involves examining the binary without executing it, such as extracting strings and PE headers.

163
MCQhard

A company's risk register shows a high-likelihood, high-impact risk related to ransomware. The cost to mitigate fully is $2M, while the expected annual loss is $500K. Which risk response is most appropriate?

A.Avoid the risk by discontinuing use of IT systems
B.Mitigate the risk by implementing full endpoint protection
C.Accept the risk and implement monitoring controls
D.Transfer the risk via cyber insurance
AnswerC

Cost-benefit analysis supports acceptance

Why this answer

The cost to fully mitigate the ransomware risk is $2M, which far exceeds the expected annual loss of $500K. This makes full mitigation economically unjustifiable under a cost-benefit analysis. Accepting the risk with monitoring controls allows the organization to detect ransomware early and respond, without spending more on prevention than the potential loss itself.

Exam trap

CompTIA often tests the cost-benefit analysis principle in risk response decisions, where candidates mistakenly choose 'mitigate' because they focus on the high likelihood and impact without comparing the cost of mitigation to the expected loss.

How to eliminate wrong answers

Option A is wrong because discontinuing IT systems would halt business operations entirely, which is an extreme and impractical response that ignores the organization's need to function; avoidance is only appropriate when the risk outweighs any possible benefit, not when a cost-effective alternative exists. Option B is wrong because implementing full endpoint protection at a cost of $2M is not cost-justified when the annual expected loss is only $500K; this violates the principle of risk management where the cost of mitigation should not exceed the potential loss. Option D is wrong because transferring the risk via cyber insurance does not reduce the likelihood or impact of ransomware; it only provides financial reimbursement after an incident, and the premium cost may still be high relative to the expected loss, making acceptance with monitoring a more balanced approach.

164
MCQmedium

An organization is unable to patch a critical vulnerability in a legacy application due to vendor limitations. The risk assessment indicates a high likelihood of exploitation. Which compensating control should the organization implement to reduce the risk?

A.Deploy an additional firewall in front of the application
B.Disable the application until a patch is available
C.Increase the frequency of vulnerability scanning
D.Implement network segmentation to isolate the application
AnswerD

Segmentation reduces exposure and potential lateral movement.

Why this answer

When patching is not possible, compensating controls such as network segmentation, application whitelisting, or strict access controls can mitigate the risk. Network segmentation limits the attack surface by isolating the vulnerable system.

165
MCQeasy

A security administrator needs to secure remote access for employees using personal devices. The company requires that company data be encrypted and that the device be wiped if lost. Which solution best meets these requirements?

A.Use network access control (NAC) to allow only compliant devices onto the network.
B.Deploy a mobile device management (MDM) solution that enforces device encryption and supports remote wipe.
C.Require employees to connect via a corporate VPN and use two-factor authentication.
D.Implement remote desktop protocol (RDP) gateways for all remote access.
AnswerB

MDM can enforce encryption and perform remote wipe to protect company data.

Why this answer

Mobile device management (MDM) solutions are specifically designed to enforce security policies on personal devices, including mandatory device encryption (e.g., AES-256 for data at rest) and the ability to perform a remote wipe (factory reset) to destroy company data if the device is lost or stolen. This directly addresses the requirement to protect company data on unmanaged, employee-owned devices.

Exam trap

The trap here is that candidates often confuse network-level controls (NAC, VPN) or access methods (RDP) with device-level data protection, failing to recognize that only MDM provides the required encryption enforcement and remote wipe capabilities on the endpoint itself.

How to eliminate wrong answers

Option A is wrong because network access control (NAC) checks device compliance before granting network access but does not provide device-level encryption enforcement or remote wipe capabilities; it controls admission, not data protection on the device. Option C is wrong because requiring a corporate VPN and two-factor authentication secures the communication channel and verifies identity but does not enforce encryption of data stored on the device or allow remote wiping of the device. Option D is wrong because RDP gateways provide remote access to internal desktops or applications but do not enforce encryption of local device storage or support remote wipe of the personal device.

166
MCQeasy

Based on the exhibit, which vulnerability is being exploited?

A.Cross-site request forgery (CSRF)
B.SQL injection
C.Directory traversal
D.Cross-site scripting (XSS)
AnswerC

The path contains ../ to escape web root and read system files.

Why this answer

The GET request in the exhibit uses '../' sequences to traverse directories and access the /etc/passwd file, which is characteristic of a directory traversal attack. Option A (CSRF) is wrong because CSRF attacks rely on exploiting a user's authenticated session to perform unintended actions, not directory path manipulation. Option B (SQL injection) is wrong because there is no SQL syntax or database query involved.

Option D (XSS) is wrong because no scripts or client-side code execution is present.

167
MCQhard

A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?

A.Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.
B.Deploy IPsec tunnels between each pair of services using pre-shared keys.
C.Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.
D.Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.
AnswerA

Service mesh provides automated mTLS, encryption, and mutual authentication with low operational overhead.

Why this answer

A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.

Exam trap

The trap here is that candidates may choose IPsec or VPN solutions because they are familiar with network-layer encryption, but they fail to recognize that these approaches do not scale to the dynamic, ephemeral nature of microservices and introduce prohibitive operational overhead compared to a service mesh's automated mTLS.

How to eliminate wrong answers

Option B is wrong because IPsec tunnels between each pair of services introduce significant operational overhead for key management and do not scale well in a dynamic microservices environment where service instances are ephemeral. Option C is wrong because a site-to-site VPN between the Kubernetes cluster and the legacy network secures only cross-network traffic, not internal service-to-service communication within the cluster, and routing all service traffic through the VPN adds unnecessary latency and complexity. Option D is wrong because distributing a CA certificate to all services for self-signed TLS still requires manual management of certificate distribution and does not automate certificate rotation, leading to high operational overhead and potential security gaps if certificates expire or are compromised.

168
Multi-Selectmedium

A security architect is designing a secure software development pipeline. The organization wants to ensure that code is thoroughly analyzed before deployment. Which TWO of the following should be integrated into the pipeline to identify vulnerabilities early? (Select TWO.)

Select 2 answers
A.Static application security testing (SAST)
B.Software composition analysis (SCA)
C.Fuzz testing
D.Dynamic application security testing (DAST)
E.Penetration testing
AnswersA, B

SAST analyzes source code without executing it, identifying vulnerabilities early.

Why this answer

SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code without executing it, scanning for vulnerabilities like SQL injection, buffer overflows, and insecure cryptographic functions. Integrating SAST early in the pipeline (shift-left) allows developers to fix issues before compilation, reducing remediation cost and risk. SCA (Software Composition Analysis) identifies known vulnerabilities in third-party libraries and open-source components by comparing dependency versions against databases like the National Vulnerability Database (NVD).

Both tools are non-intrusive and can be automated in CI/CD pipelines to catch flaws before deployment.

Exam trap

The CAS-004 exam often tests the distinction between static and dynamic analysis by presenting SAST and DAST as equally valid early-stage options, but the trap is that DAST requires a running application and cannot be integrated before deployment, making SAST and SCA the only correct choices for early vulnerability identification.

169
MCQeasy

Under the GDPR, which of the following is a data subject right?

A.Right to transfer data across borders without restriction
B.Right to unlimited processing
C.Right to erasure (right to be forgotten)
D.Right to sell data
AnswerC

This is a core GDPR right.

Why this answer

The GDPR grants data subjects the right to request deletion of their personal data under certain conditions.

170
MCQmedium

During a security incident, a forensic investigator needs to acquire volatile data from a compromised server. Which of the following is the correct order for collecting volatile data according to the standard digital forensics process?

A.Processes, memory, disk, network connections
B.Disk, memory, network connections, processes
C.Memory, network connections, processes, disk
D.Network connections, memory, disk, processes
AnswerC

This follows the order of volatility: memory is most volatile, then network connections, then processes, then disk.

Why this answer

The standard order of volatility (RFC 3227) recommends collecting data in order of decreasing volatility: memory (RAM) first, then network connections, then process information, then disk. This ensures that the most volatile data is preserved before it changes.

171
MCQeasy

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

A.Submit a change request to implement an email content filter.
B.Check if the host is configured as a mail server in the organization's asset database.
C.Block the outbound traffic on the firewall to prevent potential data exfiltration.
D.Run a full antivirus scan on the host to detect any malware.
AnswerB

This step quickly confirms if the traffic is expected, avoiding unnecessary escalation.

Why this answer

The first step in investigating potential data exfiltration over TCP port 25 (SMTP) is to verify whether the host is authorized to send email. If the host is a legitimate mail server, the traffic may be normal; if not, it could indicate malware or a misconfigured application exfiltrating data via SMTP. This aligns with the CAS-004 objective of validating asset roles before escalating to containment.

Exam trap

The trap here is that candidates often jump to containment (blocking traffic) or remediation (antivirus scan) without first verifying the host's authorized role, which CompTIA tests to ensure you follow a structured incident response process (identify before contain).

How to eliminate wrong answers

Option A is wrong because submitting a change request to implement an email content filter is a reactive, long-term control that does not address the immediate need to determine if the traffic is malicious; it also assumes the traffic is unauthorized without investigation. Option C is wrong because blocking outbound traffic on the firewall without first confirming the host's role could disrupt legitimate business operations (e.g., if the host is a mail server) and violates the principle of least disruption during incident response. Option D is wrong because running a full antivirus scan is a secondary step that may detect malware but does not confirm whether the host is authorized to send SMTP traffic; it also delays the critical triage step of asset verification.

172
MCQhard

An organization is migrating to an immutable infrastructure model for its containerized applications. Which practice is essential to ensure the integrity of the immutable infrastructure?

A.Regular patching of running containers
B.Image scanning and signing in the CI/CD pipeline
C.Runtime security monitoring with seccomp
D.Use of configuration management tools like Ansible
AnswerB

Scanning for vulnerabilities and signing images ensures only trusted images are deployed.

Why this answer

Immutable infrastructure means that components are replaced rather than modified. Image scanning ensures that only secure, approved images are deployed, preventing tampered or vulnerable images from running.

173
Multi-Selecteasy

A company is implementing MFA for remote access. Which TWO factors are considered possession factors?

Select 2 answers
A.A fingerprint scan
B.A hardware OTP token
C.A PIN
D.A push notification to a registered smartphone
E.A password
AnswersB, D

A tangible device the user possesses.

Why this answer

Possession factors are things the user has: a hardware token or a smartphone (for soft tokens). Biometrics and passwords are not possession factors.

174
MCQeasy

An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?

A.ISO 27001
B.PCI DSS
C.NIST SP 800-53
D.FIPS 140-2
AnswerD

FIPS 140-2 is the standard for cryptographic module validation, ensuring hardware and software meet security requirements.

Why this answer

FIPS 140-2 (Federal Information Processing Standard Publication 140-2) is the U.S. government standard for validating cryptographic modules. It specifies security requirements for hardware and software modules that perform cryptographic functions, ensuring they have been tested and validated by an accredited laboratory. For an application processing sensitive user data, deploying a FIPS 140-2 validated module guarantees that the cryptographic implementation meets rigorous security standards.

Exam trap

Candidates often mistake broad security frameworks like ISO 27001 or NIST SP 800-53 for the specific cryptographic module validation standard. For the CASP+ exam, remember that FIPS 140-2 is the dedicated standard for validated cryptographic modules used in government and sensitive data environments.

How to eliminate wrong answers

Option A is wrong because ISO 27001 is an information security management system (ISMS) standard that defines requirements for establishing, implementing, and improving an organization's security management processes; it does not validate cryptographic modules. Option B is wrong because PCI DSS (Payment Card Industry Data Security Standard) is a set of security controls for protecting cardholder data, not a cryptographic module validation standard; it may reference FIPS 140-2 but is not itself a validation standard. Option C is wrong because NIST SP 800-53 provides a catalog of security and privacy controls for federal information systems and organizations, not a standard for validating cryptographic modules.

175
MCQhard

A penetration tester is performing an assessment of a web application. During reconnaissance, the tester discovers a publicly accessible Jenkins server with default credentials. The tester gains access and finds a build job that executes arbitrary commands. What is the most effective way for the tester to escalate privileges and move laterally within the network?

A.Use Jenkins to execute a reverse shell and then perform pass-the-hash
B.Exploit a SQL injection vulnerability in the web app
C.Use a vulnerability scanner to find additional CVEs
D.Deploy a ransomware payload to encrypt files
AnswerA

Exploiting Jenkins' execution capability to gain a shell with high privileges is a direct method for lateral movement.

Why this answer

Jenkins can be configured as a Windows service, often running with high privileges (e.g., SYSTEM). Using the Jenkins script console or a build job, the tester can execute commands to extract credentials, install backdoors, or move laterally. This is a common attack path.

176
Multi-Selectmedium

A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)

Select 2 answers
A.Dropping all capabilities (CAP_DROP=ALL)
B.Enabling SELinux
C.Using host networking
D.Mounting /var/run/docker.sock
E.Setting USER to non-root in the Dockerfile
AnswersA, E

Removing capabilities eliminates potential escalation via Linux capabilities.

Why this answer

Dropping all capabilities with `CAP_DROP=ALL` removes all Linux capabilities from the container, effectively preventing any process inside from performing privileged operations such as changing user IDs, mounting filesystems, or accessing kernel features that could lead to privilege escalation. This is a fundamental container security best practice, as capabilities are the primary mechanism for granting fine-grained privileges to container processes.

Exam trap

The CAS-004 exam often tests the misconception that SELinux or AppArmor alone can prevent privilege escalation, but these tools enforce access control policies rather than removing the underlying capability to escalate; the trap is that candidates confuse mandatory access control with capability dropping, which directly removes the ability to perform privileged actions.

177
MCQeasy

A web server is configured to use TLS 1.3. Which of the following is a key security benefit of TLS 1.3 over earlier versions?

A.Removal of weak cipher suites
B.Support for 0-RTT handshake
C.Mandatory certificate pinning
D.Forward secrecy for all key exchanges
AnswerD

TLS 1.3 mandates ephemeral Diffie-Hellman key exchanges, ensuring forward secrecy.

Why this answer

TLS 1.3 provides forward secrecy by default, meaning session keys are not compromised even if the server's long-term private key is compromised. 0-RTT is a performance feature but can be vulnerable to replay. Removed cipher suites is a cleanup. Certificate pinning is not part of TLS 1.3.

178
MCQeasy

Which cryptographic best practice ensures that a private key remains protected even if the server it is stored on is compromised?

A.Storing keys in a hardware security module (HSM)
B.Encrypting keys with AES-256
C.Using short key rotation intervals
D.Using strong key derivation functions
AnswerA

Correct – HSMs protect keys in hardware.

Why this answer

Hardware Security Modules (HSMs) provide tamper-resistant hardware to protect private keys, preventing extraction even if the server is compromised.

179
MCQmedium

A company's incident response team is conducting a post-incident review. They identify that the intrusion was not detected for 72 hours due to insufficient logging on critical servers. Which phase of the incident response lifecycle should be improved to address this gap?

A.Lessons learned
B.Containment
C.Detection
D.Preparation
AnswerD

Preparation involves building detection capabilities like logging.

Why this answer

The preparation phase includes establishing logging and monitoring capabilities. Improving logging is part of preparation for future incidents.

180
Multi-Selectmedium

A DevOps team is automating the deployment of a containerized application to production. Which THREE practices are essential for maintaining security and reliability? (Select THREE.)

Select 3 answers
A.Use Helm charts to package and deploy Kubernetes applications.
B.Use Docker Compose files for production deployments.
C.Use infrastructure as code tools like Terraform to provision and manage container hosts.
D.Manually configure each environment to handle unique settings.
E.Implement continuous deployment pipelines with automated security testing.
AnswersA, C, E

Helm provides reusable, versioned deployment packages with rollback capabilities.

Why this answer

Helm charts are essential for packaging and deploying Kubernetes applications because they provide a standardized, version-controlled way to manage complex Kubernetes manifests. Helm simplifies deployment, rollback, and dependency management, which is critical for maintaining security and reliability in production environments.

Exam trap

CompTIA CASP+ often tests the distinction between development tools (like Docker Compose) and production-grade orchestration tools (like Kubernetes with Helm), so candidates mistakenly assume Docker Compose is suitable for production deployments.

181
MCQmedium

An organization is deploying hardware security modules (HSMs) to protect cryptographic keys used for digital signatures. Which attack vector is most effectively mitigated by using an HSM compared to storing keys in software?

A.Side-channel attacks on the host CPU
B.Key extraction from memory dumps
C.Man-in-the-middle attacks on cryptographic operations
D.Brute-force attacks on key strength
AnswerB

HSMs keep keys in hardware, so even if an attacker gains access to the host, keys cannot be extracted from memory.

Why this answer

HSMs are designed to store cryptographic keys in tamper-resistant hardware, preventing attackers from extracting keys via memory dumps. Unlike software-based storage, where keys reside in volatile or non-volatile memory and can be read through process memory inspection or cold boot attacks, HSMs ensure keys never leave the secure boundary in plaintext form.

Exam trap

The trap here is that candidates confuse the HSM's protection of key material at rest with protection against active attacks like side-channel or MITM, when in fact HSMs primarily defend against key extraction from memory or physical theft, not against all cryptographic attack vectors.

How to eliminate wrong answers

Option A is wrong because side-channel attacks on the host CPU (e.g., timing, power analysis, or cache attacks) can still be performed against the host system even when an HSM is used, as the HSM does not eliminate side-channel leakage from the host's cryptographic operations. Option C is wrong because man-in-the-middle attacks on cryptographic operations target the communication channel between the client and the HSM or between systems, and while HSMs can help with secure key storage, they do not inherently prevent MITM attacks on the protocol layer (e.g., TLS interception). Option D is wrong because brute-force attacks on key strength depend on the key length and algorithm (e.g., AES-256, RSA-2048), not on whether the key is stored in an HSM or software; an HSM does not increase the computational difficulty of brute-forcing the key itself.

182
MCQhard

A company's web application uses single sign-on (SSO) via SAML. Security analysts notice that attackers are able to forge SAML responses to impersonate users. Which misconfiguration is most likely causing this vulnerability?

A.SSL/TLS is not enforced for the SAML endpoint
B.SAML responses are not signed
C.The identity provider's metadata is not verified
D.Clock skew between SP and IdP exceeds the allowed tolerance
AnswerB

Unsigned responses can be intercepted and modified by an attacker.

Why this answer

SAML assertions must be cryptographically signed by the identity provider (IdP) to ensure integrity and authenticity. If SAML responses are not signed, an attacker can forge a response containing arbitrary user attributes (e.g., a privileged role) and impersonate any user because the service provider (SP) cannot verify the response's origin. This is the most direct cause of the described impersonation vulnerability.

Exam trap

The CAS-004 exam often tests the distinction between transport-layer security (TLS) and message-level security (signing); candidates mistakenly choose 'SSL/TLS not enforced' because they conflate encryption with integrity/authentication, but TLS only protects data in transit, not the authenticity of the SAML assertion itself.

How to eliminate wrong answers

Option A is wrong because failing to enforce SSL/TLS for the SAML endpoint exposes the SAML exchange to man-in-the-middle attacks (eavesdropping or tampering in transit), but it does not directly enable an attacker to forge a valid SAML response from scratch; the core issue is the lack of signature verification. Option C is wrong because not verifying the IdP's metadata (e.g., its certificate or endpoint URL) could lead to accepting responses from a rogue IdP, but the described attack involves forging responses from the legitimate IdP, not substituting the IdP itself. Option D is wrong because clock skew exceeding the allowed tolerance would cause valid SAML assertions to be rejected (due to NotBefore/NotOnOrAfter time conditions), not allow attackers to forge responses; it is a denial-of-service or interoperability issue, not a forgery vulnerability.

183
MCQmedium

A security engineer is selecting an asymmetric encryption algorithm for a system that must provide non-repudiation and long-term security (at least 20 years). The system has limited computational resources. Which of the following is the best choice?

A.RSA 4096
B.ECDSA P-384
C.Ed25519
D.DSA 3072
AnswerC

Ed25519 uses elliptic curves with 128-bit security, small keys, and fast operations, suitable for long-term security.

Why this answer

Ed25519 offers high security with small key sizes and efficient computation, and is suitable for long-term security. RSA 4096 is slower and has larger keys. ECDSA P-384 is secure but slower than Ed25519.

DSA is older and less efficient.

184
MCQmedium

A security team needs to implement a CI/CD pipeline that automatically scans container images for vulnerabilities before deployment. Which tool can be integrated into the pipeline for this purpose?

A.SonarQube
B.Prometheus
C.Trivy
D.Grafana
AnswerC

Trivy scans container images for known vulnerabilities.

Why this answer

Trivy is a comprehensive open-source vulnerability scanner specifically designed for container images, filesystems, and Git repositories. It can be integrated directly into a CI/CD pipeline to automatically scan container images for known CVEs before deployment, making it the correct choice for this use case.

Exam trap

The CAS-004 exam often tests the distinction between tools used for static code analysis (SonarQube) versus container vulnerability scanning (Trivy), leading candidates to confuse SAST tools with container security scanners.

How to eliminate wrong answers

Option A is wrong because SonarQube is a static application security testing (SAST) tool focused on source code quality and security, not container image vulnerability scanning. Option B is wrong because Prometheus is a monitoring and alerting toolkit for metrics collection, not a vulnerability scanner for container images. Option D is wrong because Grafana is a visualization and analytics platform for dashboards, not a tool for scanning container images for vulnerabilities.

185
MCQmedium

A company is migrating to AWS and needs to comply with SOC 2. Which cloud-native service would BEST help monitor and enforce security configurations across the AWS environment?

A.AWS CloudTrail
B.AWS WAF
C.AWS Config
D.AWS Shield
AnswerC

AWS Config monitors and evaluates resource configurations against compliance policies.

Why this answer

AWS Config continuously monitors and evaluates AWS resource configurations against desired policies, helping meet compliance requirements like SOC 2.

186
MCQhard

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

A.Perform separate PIAs for GDPR and CCPA requirements
B.Skip PIAs for existing processing activities
C.Conduct a single PIA that covers both regulations' requirements
D.Only perform PIAs when processing high-risk data
AnswerC

Comprehensive and efficient

Why this answer

Conducting a single PIA that addresses both GDPR and CCPA requirements is the most efficient and effective approach. GDPR requires Data Protection Impact Assessments (DPIAs) for high-risk processing, while CCPA mandates risk assessments for certain activities. A single PIA can map both regulations' requirements, identify overlapping controls, and ensure comprehensive compliance.

Option A is wrong because separate PIAs would be redundant and could lead to inconsistencies or gaps. Option B is wrong because skipping PIAs for existing processing violates both regulations' requirements to review ongoing activities. Option D is wrong because PIAs are required for any processing that poses risks to privacy, not only high-risk data, and GDPR requires DPIAs for specified high-risk processing but also recommends them for other activities; however, the best practice is to conduct PIAs broadly to demonstrate accountability.

187
MCQmedium

A company is implementing a Privileged Access Management (PAM) solution to manage admin credentials. Which feature allows administrators to request temporary elevated access for a specific task?

A.Session recording
B.Just-in-time access
C.Password vaulting
D.Break-glass accounts
AnswerB

JIT provides temporary privileged access on demand.

Why this answer

Just-in-time (JIT) access provisioning grants rights only when needed, reducing standing privileges.

188
MCQeasy

A small business wants to achieve compliance with PCI DSS. Which approach should they take to minimize the scope of the assessment?

A.Segment the cardholder data environment from the corporate network
B.Implement a tokenization service
C.Encrypt all cardholder data at rest
D.Train employees on security awareness
AnswerA

Segmentation reduces the systems that process, store, or transmit card data.

Why this answer

Segmenting the cardholder data environment (CDE) from the corporate network using firewalls or VLANs physically or logically isolates systems that store, process, or transmit cardholder data. This reduces the number of systems and network segments that fall under PCI DSS assessment scope, because only devices within the CDE segment must comply with the full set of requirements. By minimizing the attack surface and the number of controls to validate, segmentation directly lowers the cost and complexity of the assessment.

Exam trap

A common misconception is that encryption or tokenization alone reduces PCI DSS scope, but only network segmentation (or outsourcing to a validated third party) can remove systems from the assessed environment.

How to eliminate wrong answers

Option B is wrong because tokenization replaces cardholder data with a non-sensitive token, but the tokenization service itself still processes and stores the original PAN, so the service and its network remain in scope unless the tokenization is performed by a third-party provider that is PCI DSS compliant and the tokens are not reversible within the merchant environment. Option C is wrong because encrypting cardholder data at rest is a security control required by PCI DSS Requirement 3, but it does not reduce the number of systems or network segments that must be assessed; all systems that store, process, or transmit cardholder data remain in scope regardless of encryption. Option D is wrong because security awareness training is a PCI DSS Requirement 12.6 control that helps prevent data breaches, but it does not change the network architecture or reduce the number of systems subject to the assessment scope.

189
Multi-Selectmedium

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker used DNS tunneling to exfiltrate data. Which THREE network traffic indicators would support this hypothesis? (Select THREE.)

Select 3 answers
A.A sudden increase in failed login attempts
B.Large DNS response packets (greater than 512 bytes)
C.Unencrypted HTTP traffic to external IPs
D.DNS queries for domains with long subdomains and random characters
E.An unusually high number of DNS queries from a single host
AnswersB, D, E

Large packets may carry exfiltrated data.

Why this answer

DNS tunneling uses DNS queries to exfiltrate data, often characterized by high volume of queries, unusual domain names, and abnormally large DNS packets. Data sent in clear text (unencrypted) over HTTP is not typical of DNS tunneling.

190
MCQmedium

A company is implementing measured boot using TPM 2.0. What is the primary purpose of storing boot measurements in Platform Configuration Registers (PCRs)?

A.To speed up the boot process.
B.To provide a root of trust for storage (sealed storage).
C.To encrypt the bootloader.
D.To enable remote attestation of the system's boot state.
AnswerD

Attestation allows a verifier to check that the system booted with trusted software.

Why this answer

PCRs store hashes of boot components; these measurements are used for remote attestation to verify the integrity of the boot process.

191
MCQmedium

A company wants to ensure that a compromised root CA does not affect the validity of previously issued certificates. Which PKI control should be implemented?

A.Certificate pinning
B.Offline root CA and online issuing CA
C.Certificate transparency logs
D.Short-lived certificates
AnswerB

Keeping root CA offline prevents compromise of root from being used to issue new certs.

Why this answer

CRLs and OCSP allow revocation, but offline root CA and issuing CA separation ensure that compromise of root does not directly affect issued certs if root is kept offline.

192
MCQmedium

A security analyst is reviewing a suspicious executable file. The analyst performs static analysis by examining the file's strings and imports. Which of the following findings would most strongly suggest the file is packed or obfuscated?

A.The file imports many Windows API functions
B.The file has a high entropy score
C.The file contains a large number of IP addresses
D.The file has very few readable strings
AnswerD

Few strings suggest packing or obfuscation.

Why this answer

Packed executables often have very few readable strings because the original code is compressed or encrypted. A small number of strings relative to file size is a strong indicator of packing.

193
MCQhard

A multinational corporation must comply with both the EU's GDPR and the California Consumer Privacy Act (CCPA). Which of the following scenarios would cause a conflict between these regulations?

A.GDPR requires explicit consent for data processing, while CCPA allows opt-out for data sale
B.One regulation requires breach notification, the other does not
C.CCPA imposes data minimization, while GDPR does not
D.Both require data access rights for individuals
AnswerA

Consent vs opt-out can conflict.

Why this answer

GDPR mandates explicit consent for processing personal data (Article 7), while CCPA provides a right to opt out of the sale of personal information (Section 1798.120). This creates a direct conflict: a company subject to both must decide whether to obtain explicit consent (GDPR) or rely on an opt-out mechanism (CCPA) for data sales, as the two approaches are incompatible in practice.

Exam trap

The trap here is that candidates assume GDPR and CCPA are fully compatible, overlooking the fundamental difference between opt-in (GDPR) and opt-out (CCPA) consent models for data processing activities like sale or sharing.

How to eliminate wrong answers

Option B is wrong because both GDPR (Article 33) and CCPA (Section 1798.82) require breach notification, so there is no conflict. Option C is wrong because GDPR includes data minimization principles (Article 5(1)(c)), while CCPA does not explicitly impose data minimization; thus, the statement is factually incorrect. Option D is wrong because both regulations require data access rights (GDPR Article 15, CCPA Section 1798.100), so this is an area of alignment, not conflict.

194
MCQeasy

In a zero trust architecture, which concept ensures that an attacker who compromises one segment cannot move laterally to other segments?

A.Software-defined perimeter
B.Defense-in-depth layering
C.Identity-centric access
D.Micro-segmentation
AnswerD

Correct – micro-segmentation isolates workloads and limits lateral movement.

Why this answer

Micro-segmentation divides the network into small, isolated segments and enforces granular access controls, preventing lateral movement.

195
MCQeasy

Which of the following best describes the purpose of the STIX and TAXII standards in threat intelligence sharing?

A.They are tools for analyzing malware behavior in a sandbox environment
B.They are used to automatically patch vulnerabilities based on threat feeds
C.They provide a framework for conducting incident response exercises
D.They standardize the format and exchange of cyber threat intelligence
AnswerD

STIX defines the data model, TAXII defines the transport mechanism for sharing threat intelligence.

Why this answer

STIX (Structured Threat Information Expression) is a language for describing threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol for exchanging that intelligence. Together they enable automated sharing of threat data.

196
Multi-Selecthard

A security analyst is prioritizing remediation of vulnerabilities. Which three of the following factors should be considered when determining the risk level of a vulnerability? (Choose three.)

Select 3 answers
A.Availability of a public exploit
B.Vendor patch availability
C.Asset value or criticality
D.CVSS base score
E.Number of days since the vulnerability was discovered
AnswersA, C, D

Public exploits increase likelihood of attack.

Why this answer

Risk is a function of impact and likelihood. CVSS score provides severity; asset value indicates impact; exploit availability indicates likelihood of attack.

197
Multi-Selecthard

A security architect is designing a Kubernetes cluster for a government agency that requires high security and compliance with FedRAMP. The cluster will host microservices processing sensitive data. Which TWO configurations are most critical for hardening the Kubernetes environment? (Choose TWO.)

Select 2 answers
A.Deploying runtime security with seccomp and AppArmor
B.Enabling container image scanning
C.Implementing Role-Based Access Control (RBAC)
D.Using admission controllers like PodSecurityPolicy
E.Configuring network policies to restrict pod communication
AnswersC, E

RBAC ensures that only authorized users and service accounts have appropriate permissions, a fundamental security control.

Why this answer

RBAC (Role-Based Access Control) restricts user and service account permissions, enforcing least privilege. Network policies control pod-to-pod communication, enabling micro-segmentation. Pod security policies (now replaced by Pod Security Standards) are important but less critical than RBAC and network policies.

Image scanning and runtime security are important but are container security measures, not Kubernetes-specific hardening.

198
MCQhard

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

A.Use of untrusted base image
B.Privilege escalation via SUID binaries
C.Exposure of sensitive credentials in the image layers
D.Dependency confusion from unpinned packages
AnswerC

Why this answer

Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Exam trap

The CAS-004 exam often tests the misconception that deleting a file in a later Docker layer removes it from the image, when in fact the underlying layer still contains the sensitive data.

Why the other options are wrong

A

While a risk, it's not as directly exploitable as an exposed private key.

B

No indication of SUID; the main issue is secret leakage.

D

Unpinned packages are a supply chain risk but not as immediate as credential exposure.

199
MCQmedium

A healthcare organization has suffered a ransomware attack. The ransomware encrypted all files on file servers and workstations, and a ransom note demands payment in cryptocurrency. The backup systems were also encrypted because the backup service account had write access to the backup repository. The organization's cybersecurity team has activated the incident response plan. Which of the following is the BEST course of action?

A.Restore data from the encrypted backups using a third-party decryption tool.
B.Isolate all affected systems from the network immediately to prevent further encryption.
C.Begin restoring systems from any clean backups located on removable media.
D.Pay the ransom to obtain the decryption key and restore operations quickly.
AnswerB

Containment stops the spread and limits damage.

Why this answer

The BEST course of action is to isolate all affected systems (Option B). Containment is the immediate priority in incident response to prevent the ransomware from spreading to uninfected systems. Option A is incorrect because the backups are encrypted and third-party decryption tools are unreliable and may not work.

Option C is incorrect if no clean backups exist on removable media; the scenario states backup systems were encrypted. Option D is not recommended as paying the ransom encourages further attacks and does not guarantee data recovery.

200
MCQeasy

An organization wants to implement a zero-trust architecture for remote access. Which of the following is the MOST important component?

A.RAID 5
B.Syslog server
C.VPN concentrator
D.Micro-segmentation
AnswerD

Micro-segmentation enforces granular access controls and limits lateral movement, a core zero-trust concept.

Why this answer

Micro-segmentation is the most important component for zero-trust remote access because it enforces granular, identity-based access controls that limit lateral movement within the network. Unlike perimeter-based models, zero-trust assumes no implicit trust, and micro-segmentation ensures that even after authentication, each remote session is isolated to only the specific resources required, reducing the attack surface.

Exam trap

The trap here is that candidates often mistake a VPN concentrator as the core of zero-trust remote access because it provides encryption and authentication, but zero-trust requires micro-segmentation to enforce least-privilege access and prevent lateral movement, which a traditional VPN alone cannot achieve.

How to eliminate wrong answers

Option A (RAID 5) is wrong because it is a disk redundancy technology used for fault tolerance and data protection, not for access control or network segmentation, and has no role in zero-trust architecture. Option B (Syslog server) is wrong because it is a centralized logging tool for event collection and analysis, which supports monitoring but does not enforce access policies or segmentation required for zero-trust. Option C (VPN concentrator) is wrong because while it provides encrypted tunnels for remote access, it typically operates on a perimeter-based model and does not inherently enforce micro-segmentation or continuous verification, making it insufficient for a zero-trust architecture.

201
MCQmedium

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

A.Aggregate all logs from all sources and create a single correlation rule for each attack type.
B.Use the default correlation rules provided by the SIEM vendor without modification.
C.Block all traffic from external IP addresses that are not on the organization's whitelist.
D.Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.
AnswerD

Custom tuning ensures rules are relevant and accurate, reducing false positives while detecting true threats.

Why this answer

Tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.

Exam trap

The trap here is that candidates often confuse network security controls (like blocking IPs) with SIEM tuning techniques, or assume that default rules or aggregation alone can achieve optimal detection without contextual customization.

How to eliminate wrong answers

Option A is wrong because aggregating all logs from all sources into a single correlation rule for each attack type ignores the need for context-specific tuning, leading to excessive noise and false positives from irrelevant or duplicate events. Option B is wrong because using default correlation rules without modification fails to account for the organization's unique environment, resulting in either missed attacks (if rules are too narrow) or overwhelming false positives (if rules are too broad). Option C is wrong because blocking all traffic from external IPs not on a whitelist is a network access control measure, not a SIEM tuning technique, and it would disrupt legitimate business traffic while not addressing false positives in detection logic.

202
MCQmedium

A security architect is designing a new web application that must meet strict data confidentiality and integrity requirements. The application will run in a cloud environment and must support low-latency operations. The architect is considering cipher suites for TLS 1.3. Which combination of algorithms would best meet these requirements?

A.AES-128-CBC with HMAC-SHA256 and RSA-2048
B.ChaCha20-Poly1305 with static ECDH and SHA-384
C.ChaCha20-Poly1305 with ECDHE key exchange and Ed25519
D.AES-256-GCM with RSA key exchange and SHA-256
AnswerC

This combination provides authenticated encryption, forward secrecy, and efficient authentication suitable for low-latency requirements.

Why this answer

ChaCha20-Poly1305 is a symmetric cipher that offers excellent performance on mobile and low-power devices, while providing authenticated encryption. ECDHE provides forward secrecy, and Ed25519 provides efficient authentication. AES-256-GCM is also good but ChaCha20 often performs better in software.

RSA key exchange does not provide forward secrecy. SHA-256 is a hashing algorithm, not an encryption algorithm.

203
Multi-Selectmedium

Which TWO of the following are key elements of a data classification policy?

Select 2 answers
A.Handling and labeling procedures
B.Classification categories (e.g., public, internal, confidential)
C.Acceptable use guidelines for company devices
D.Backup frequency and retention periods
E.Encryption algorithms and key lengths
AnswersA, B

Procedures for handling each classification level are essential.

Why this answer

Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Exam trap

The CAS-004 exam often tests the distinction between policy elements and implementation controls, so the trap here is confusing operational procedures (handling/labeling) and classification categories (the core of a classification policy) with technical security controls like encryption algorithms or backup schedules, which belong in separate policies.

204
Multi-Selectmedium

Which TWO of the following are essential elements of an effective data governance framework?

Select 2 answers
A.Data classification policies and procedures
B.Mandatory data localization requirements
C.Assignment of data stewardship roles
D.Automated breach notification system
E.Implementation of full-disk encryption on all endpoints
AnswersA, C

Classification is foundational to governance.

Why this answer

Data classification policies and procedures (Option A) are essential for determining how data should be handled based on sensitivity, while assignment of data stewardship roles (Option C) ensures accountability and ownership. These are core governance elements. Mandatory data localization (Option B) is a regulatory requirement, not a governance framework element.

Automated breach notification (Option D) is an operational response process. Full-disk encryption (Option E) is a technical control, not governance. Therefore, the correct answers are A and C.

Exam trap

A common pitfall is confusing data governance framework elements (policies, roles) with operational or technical controls. Remember that governance establishes the rules and accountability, not the specific tools or regulations like data localization or encryption.

205
MCQmedium

You are the compliance officer for a financial institution that must adhere to the Payment Card Industry Data Security Standard (PCI DSS). During a quarterly vulnerability scan, you discover that several critical vulnerabilities in the cardholder data environment (CDE) were not remediated within the required 30-day window. Additionally, the most recent penetration test report shows that a segmentation control between the CDE and the corporate network is not functioning as intended. The next PCI DSS assessment is in two months. Which of the following remediation actions should be prioritized FIRST to maintain compliance?

A.Implement a compensating control for the segmentation failure and document it
B.Immediately patch all critical vulnerabilities in the CDE
C.Request an extension from the acquirer for the next assessment
D.Re-establish correct segmentation between CDE and corporate network
AnswerD

Segmentation is foundational to PCI DSS compliance.

Why this answer

The segmentation control failure is the most critical issue because it directly undermines the scope of the PCI DSS assessment. If the CDE is not properly isolated from the corporate network, the entire corporate network could be considered in-scope for PCI DSS, drastically increasing compliance requirements. Re-establishing correct segmentation first restores the intended security boundary and reduces the risk of a non-compliant assessment in two months.

Exam trap

Candidates often prioritize patching critical vulnerabilities (Option B) because it seems urgent, but they overlook that a segmentation failure is a scope-breaking issue that must be resolved first to keep the CDE boundary intact. This question tests understanding of PCI DSS scope and the priority of remediating segmentation failures over individual vulnerabilities.

How to eliminate wrong answers

Option A is wrong because implementing a compensating control for segmentation failure is a secondary step that should only be considered after the primary control is restored; PCI DSS requires compensating controls to be robust and approved, but they do not replace the need to fix the underlying segmentation issue. Option B is wrong because while patching critical vulnerabilities is important, the segmentation failure is a more fundamental control that, if left broken, could invalidate the entire CDE scope and make the vulnerability scan results irrelevant. Option C is wrong because requesting an extension does not address the technical non-compliance; it merely postpones the assessment without fixing the root cause, and acquirers rarely grant extensions for known control failures.

206
MCQmedium

An organization is migrating a legacy application to a containerized environment. The application requires root privileges to bind to a low port (80). What is the most secure approach to handle this requirement?

A.Map port 80 to a non-privileged port and grant CAP_NET_BIND_SERVICE capability
B.Change the application to use a high port (e.g., 8080)
C.Run the container as root and bind to port 80
D.Use host networking mode
AnswerA

Allows binding to low port without full root privileges.

Why this answer

It allows the container to bind to port 80 without running as root by mapping the container's port 80 to a non-privileged host port (e.g., 8080) and granting the CAP_NET_BIND_SERVICE capability. This capability enables the container process to bind to privileged ports (<1024) while running with a non-root user, adhering to the principle of least privilege. It avoids the security risks of full root access while satisfying the application's requirement.

Exam trap

The trap here is that candidates often assume host networking mode (Option D) is the simplest fix, but they overlook the severe security implications of bypassing network isolation, which violates the principle of least privilege emphasized in CompTIA CASP+ container security.

How to eliminate wrong answers

Option B is wrong because changing the application to use a high port (e.g., 8080) would require modifying the application code or configuration, which may not be feasible for a legacy application and does not address the root privilege requirement for binding to port 80. Option C is wrong because running the container as root and binding to port 80 violates container security best practices, as it grants the container unnecessary privileges that could lead to host compromise if the container is breached. Option D is wrong because using host networking mode bypasses container network isolation, exposing the container directly to the host network stack, which increases the attack surface and negates the security benefits of containerization.

207
MCQmedium

A SOC team is implementing a SOAR platform to automate responses to phishing emails. The team wants to create a playbook that, upon detection of a phishing email, automatically quarantines the email from all mailboxes and blocks the sender's domain. Which type of playbook action is being described?

A.Advisory action
B.Manual action
C.Semi-automated action
D.Automated action
AnswerD

The playbook performs actions automatically without human intervention.

Why this answer

Automated response actions are executed by the SOAR platform without human intervention, such as quarantining and blocking.

208
MCQmedium

A vulnerability management team is prioritizing patches for a large number of vulnerabilities discovered in a quarterly scan. A critical vulnerability in a widely used application has a CVSS base score of 9.8, but it is not currently being exploited in the wild and the application is not directly exposed to the internet. According to CVSS scoring principles, which factors should the team consider to adjust the priority?

A.The number of other vulnerabilities in the same software product
B.The age of the vulnerability since its disclosure
C.Temporal metrics including exploit code maturity and remediation level
D.Environmental metrics such as collateral damage potential and target distribution
AnswerD

Environmental metrics allow customization for the organization's environment, including asset criticality and exposure, which directly affects risk.

Why this answer

CVSS environmental metrics allow organizations to modify the base score based on the specific context, such as the asset's value and exposure. This helps prioritize vulnerabilities that pose the greatest risk to the organization.

209
MCQeasy

A security administrator needs to automate the process of revoking access for terminated employees across multiple cloud services. Which scripting approach would best minimize the risk of errors and ensure consistent execution?

A.Create a shell script that relies on environment variables containing API keys.
B.Use a configuration management tool like Ansible with a playbook that calls cloud provider modules using encrypted vault files for credentials.
C.Write a Python script using separate API calls for each service with hardcoded credentials.
D.Manually execute commands each time an employee is terminated.
AnswerB

Ansible with vault securely automates and standardizes the process.

Why this answer

Ansible playbooks with encrypted vault files provide idempotent, repeatable automation across multiple cloud services without exposing credentials in plaintext. The use of dedicated cloud provider modules (e.g., aws_iam, gcp_iam) abstracts API complexities and ensures consistent revocation logic, minimizing human error compared to ad-hoc scripting.

Exam trap

The exam often tests the misconception that any scripting approach (e.g., Python or shell) is sufficient for automation, but the trap is that they ignore the critical need for secure credential management and idempotent execution, which configuration management tools like Ansible are specifically designed to provide.

How to eliminate wrong answers

Option A is wrong because relying on environment variables for API keys introduces a security risk (e.g., accidental exposure in logs or process listings) and lacks the centralized, encrypted credential management that vault files offer. Option C is wrong because hardcoded credentials in a Python script violate security best practices and make the script brittle; any credential rotation requires code changes, increasing error risk. Option D is wrong because manual execution is not automated, introduces human error, and cannot ensure consistent, timely revocation across multiple cloud services.

210
MCQmedium

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

A.Creating a single perimeter around the entire network
B.Isolating workloads at the virtual network interface level with granular security policies
C.Using VLANs to separate departments
D.Implementing a VPN for remote access
AnswerB

This accurately defines micro-segmentation in a zero trust model.

Why this answer

Micro-segmentation creates isolated zones for each workload, enabling granular security policies that restrict lateral movement even within the same network segment.

211
MCQmedium

An organization wants to implement passwordless authentication for its employees using FIDO2/WebAuthn. What is a primary security advantage of this approach over traditional password-based MFA?

A.It is resistant to phishing attacks because credentials are bound to the origin.
B.It eliminates the need for a second factor.
C.It allows users to reuse the same credential across multiple websites.
D.It does not require any client-side hardware.
AnswerA

WebAuthn credentials are scoped to the relying party, so they cannot be used on fake sites.

Why this answer

FIDO2 uses public key cryptography; the private key never leaves the user's device, so phishing attacks cannot steal credentials. This provides strong resistance to phishing.

212
MCQmedium

A security engineer is hardening a container image. Which practice is MOST effective in reducing the attack surface?

A.Running containers as root
B.Using a minimal base image
C.Adding antivirus software
D.Using the latest version of all packages
AnswerB

A minimal image contains only the essentials, reducing the number of potential vulnerabilities.

Why this answer

Using a minimal base image (e.g., Alpine, Distroless) removes unnecessary packages and binaries, significantly reducing the attack surface. Running as root increases risk. Antivirus is not typical in containers.

Latest packages are good but do not reduce surface.

213
MCQmedium

A security team is hardening a Kubernetes cluster. Which resource should be used to define fine-grained rules for which pods can communicate with each other?

A.Admission Controller
B.PodSecurityPolicy
C.RBAC
D.NetworkPolicy
AnswerD

Correct; NetworkPolicy defines network access rules between pods.

Why this answer

Kubernetes NetworkPolicies allow ingress/egress rules controlling pod-to-pod communication.

214
MCQhard

A security analyst reviews the above Windows security events from a domain controller. What is the most likely conclusion about the activity?

A.The jsmith account is performing routine administrative tasks with standard user privileges.
B.An attacker has compromised the jsmith account and used it to perform lateral movement and access sensitive data.
C.The Administrator account is locked out due to repeated failed logon attempts.
D.A user named jsmith is attempting to reset the Administrator password via network logon.
AnswerB

The sequence matches typical PtH: failed logon as admin, then successful interactive logon with high privileges, then accessing admin share.

Why this answer

The security analyst is reviewing Windows security events on a domain controller. The most likely conclusion is that the jsmith account was compromised and used for lateral movement and access to sensitive data, while the other options describe routine administration, Administrator lockout, or a password reset attempt, which are less consistent with a suspicious account compromise scenario.

Exam trap

The CAS-004 exam often tests the distinction between logon types (e.g., Type 2 for interactive, Type 3 for network) and the specific event IDs associated with account management versus object access, leading candidates to confuse a network logon with a password reset or lockout event.

How to eliminate wrong answers

Option A is wrong because Event ID 4624 with Logon Type 3 indicates a network logon, not a local interactive session, and standard user privileges would not generate Event ID 4670 for permission changes on sensitive objects. Option C is wrong because account lockout would generate Event ID 4740, not the 4624 and 4670 events shown; the Administrator account is not referenced in the provided events. Option D is wrong because a password reset attempt would generate Event ID 4724 (password reset attempt), not a network logon (4624) followed by permission changes (4670); the events show successful authentication and subsequent object access, not a reset attempt.

215
Multi-Selectmedium

An organization is deploying a cloud workload protection platform (CWPP). Which TWO capabilities are essential for protecting workloads in a hybrid cloud?

Select 2 answers
A.Security information and event management
B.Identity and access management
C.Data loss prevention
D.Runtime protection
E.Vulnerability management
AnswersD, E

Monitors and protects workloads during execution.

Why this answer

CWPP should provide vulnerability management across different environments and runtime protection (e.g., intrusion detection) for workloads regardless of location.

216
MCQmedium

A security architect is designing a segmentation strategy for a multi-tier web application. The public-facing web servers must communicate only with application servers, and application servers must communicate only with database servers. The architect wants to use a firewall that can inspect application-layer traffic to prevent SQL injection attacks. Which firewall type should be deployed between the application tier and the database tier?

A.Packet filtering firewall
B.Next-generation firewall (NGFW) with intrusion prevention
C.Stateful firewall
D.Web application firewall (WAF)
AnswerB

NGFWs can perform deep packet inspection and use IPS signatures to detect SQL injection in database protocols.

Why this answer

A next-generation firewall (NGFW) with intrusion prevention is the correct choice because it can perform deep packet inspection (DPI) at the application layer, allowing it to detect and block SQL injection payloads within database queries. Unlike simpler firewalls, an NGFW integrates signature-based and behavioral IPS engines that can identify malicious SQL patterns (e.g., 'OR 1=1') in traffic between the application and database tiers, providing the required application-layer inspection.

Exam trap

The trap here is that candidates often confuse the WAF's ability to inspect HTTP traffic with the need for application-layer inspection between application and database tiers, forgetting that database protocols (e.g., SQL) are not HTTP-based and require a different inspection engine like an NGFW with IPS.

How to eliminate wrong answers

Option A is wrong because a packet filtering firewall operates only at Layers 3 and 4, inspecting source/destination IPs and ports without any application-layer awareness, so it cannot detect SQL injection attacks. Option C is wrong because a stateful firewall tracks connection states (e.g., TCP handshake) but still inspects only headers at Layers 3–4, not the payload content needed to identify SQL injection. Option D is wrong because a web application firewall (WAF) is designed to inspect HTTP/HTTPS traffic between clients and web servers, not the database protocol traffic (e.g., SQL queries over TCP port 1433 or 3306) between application and database servers; deploying a WAF between these tiers would not inspect the actual database protocol.

217
MCQmedium

The security engineer notices that SSH login attempts to 192.168.1.1 from the untrust zone are being blocked. Which policy misconfiguration is MOST likely causing this?

A.The application is incorrect
B.The source zone is not permitted
C.The log setting prevents connections
D.The destination address is incorrect
AnswerB

The policy only allows source zone vpn; untrust is not allowed, causing the block.

Why this answer

The security engineer observes SSH login attempts from the untrust zone to 192.168.1.1 being blocked. In a typical firewall policy, the source zone must be explicitly permitted for traffic to be allowed. If the source zone 'untrust' is not included in the policy's source zone list, the firewall will drop the traffic regardless of other correct parameters.

This is the most likely misconfiguration because SSH traffic from the untrust zone is reaching the destination but being denied at the policy level.

Exam trap

A common misconception is that a correct destination address or application is sufficient for traffic to pass, when in fact the source zone must be explicitly permitted in the firewall policy.

How to eliminate wrong answers

Option A is wrong because the application (SSH, TCP port 22) is correctly identified in the logs, indicating the firewall recognizes the traffic; an incorrect application would cause a different behavior, such as misclassification but not outright blocking. Option C is wrong because log settings only control whether events are recorded, not whether connections are permitted or denied; blocking occurs due to policy rules, not logging configuration. Option D is wrong because the destination address 192.168.1.1 is reachable and the logs show attempts reaching it; an incorrect destination address would result in traffic being routed elsewhere or dropped at a different stage, not specifically blocked by policy.

218
MCQhard

Based on the exhibit, what type of attack is most likely occurring?

A.Man-in-the-middle (MITM) attack
B.Phishing attack
C.Distributed denial-of-service (DDoS) attack
D.Brute-force attack
AnswerD

The log shows repeated failed authentication attempts, typical of brute force.

Why this answer

The exhibit shows multiple failed SSH login attempts from various IP addresses with different usernames, which is characteristic of a brute-force attack. Option D is correct. Option A (MITM) is incorrect because there is no evidence of intercepted communication.

Option B (phishing) is incorrect as it involves social engineering, not direct authentication attempts. Option C (DDoS) is incorrect because the traffic is aimed at authentication, not overwhelming the network.

219
MCQhard

During a security audit, it was discovered that an application uses RSA with 1024-bit keys for encrypting sensitive data. The organization's security policy mandates a minimum of 128-bit symmetric equivalent security. Which of the following should be recommended as a replacement?

A.RSA with 3072-bit keys
B.AES-256-GCM
C.ECDSA P-384
D.RSA with 2048-bit keys
AnswerA

RSA 3072 provides 128-bit security, meeting the requirement.

Why this answer

RSA 2048 provides approximately 112-bit security, while RSA 3072 provides 128-bit. AES-256-GCM is symmetric, not asymmetric. ECDSA is for signatures, not encryption.

So RSA 3072 is the correct choice.

220
MCQhard

An organization plans to establish a cross-forest trust between two Active Directory forests to enable resource access. The security architect is concerned about the risk of privilege escalation from a compromised domain in one forest. Which design choice best mitigates this risk?

A.Remove the trust entirely and use individual local accounts
B.Configure the trust to use forest-wide authentication instead of selective
C.Enable SID filtering on both forest trusts
D.Use selective authentication and restrict the authorized accounts
AnswerD

Selective authentication ensures only specified users can access resources in the trusting forest, limiting exposure from a compromise.

Why this answer

Using selective authentication restricts what resources users from the trusting forest can access, ensuring that only specified accounts are allowed. Forest-level authentication would allow broader access. SID filtering is enabled by default for cross-forest trusts but is not sufficient alone; selective authentication provides an additional constraint.

Disabling the trust is not practical.

221
MCQmedium

An organization discovers that a third-party vendor has a subcontractor that processes its data. The organization did not have a contract with the subcontractor. This is an example of which type of risk?

A.Residual risk
B.Third-party risk
C.Fourth-party risk
D.Supply chain risk
AnswerC

Fourth-party risk involves vendors of your vendors.

Why this answer

Fourth-party risk is the risk that arises from a vendor's use of subcontractors, which may not be directly managed by the organization.

222
MCQmedium

A security team is selecting key risk indicators (KRIs) for the organization's cybersecurity program. Which of the following is an example of a KRI that provides a leading indicator of risk?

A.Mean time to detect (MTTD) for security incidents
B.Number of security incidents reported last month
C.Percentage of systems with antivirus installed
D.Number of unpatched critical vulnerabilities
AnswerD

This is a leading indicator of potential breaches.

Why this answer

KRIs ideally should be leading indicators that predict future risk. Number of unpatched critical vulnerabilities is a leading indicator because it indicates potential for future exploitation. MTTD is lagging (measures past incidents).

Patch compliance % is a KPI, not necessarily a risk indicator. Number of incidents is lagging.

223
Multi-Selecteasy

An organization is implementing a vulnerability management program and needs to prioritize patching based on risk. The team has identified multiple vulnerabilities with different CVSS scores. Which THREE factors should be considered when prioritizing patches according to CVSS environmental metrics? (Choose THREE.)

Select 3 answers
A.Confidentiality, integrity, and availability requirements of the affected system
B.Compliance and regulatory obligations
C.Availability of a patch or workaround
D.Asset criticality and business impact
E.Exploit code maturity and remediation level
AnswersA, B, D

These are the security requirements in environmental metrics.

Why this answer

Environmental metrics in CVSS allow customization of the score based on the organization's environment. Key factors include security requirements (confidentiality, integrity, availability), which affect the overall severity. Asset criticality and compliance requirements are also considered.

Patch availability and exploit maturity are temporal metrics, not environmental.

224
Multi-Selecteasy

Which TWO of the following are best practices for securing a database server?

Select 2 answers
A.Install sample databases for testing
B.Enable remote access from any IP
C.Disable default accounts
D.Use encrypted connections
E.Use simple passwords for ease of administration
AnswersC, D

Default accounts (e.g., 'sa' in SQL Server) are often targeted; disabling them reduces risk.

Why this answer

Disabling default accounts (e.g., 'sa' in SQL Server, 'root' in MySQL) is a critical hardening step because these accounts have well-known SIDs/names and are often targeted by automated attacks. Attackers can exploit default credentials to gain administrative access, so removing or renaming them reduces the attack surface.

Exam trap

CompTIA CASP+ often tests the misconception that sample databases are harmless for testing, but in a production security context, any unnecessary software or data increases risk and should be removed.

225
MCQhard

An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?

A.Extend the session token expiration time to reduce the frequency of re-authentication
B.Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture
C.Reduce the number of authentication factors required for re-authentication
D.Implement short-lived access tokens with refresh tokens that are automatically rotated
AnswerD

Refresh tokens allow seamless renewal of access without user intervention, while maintaining short token lifetimes.

Why this answer

Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse.

Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.

Page 2

Page 3 of 13

Page 4