CompTIA SecurityX (CAS-005) (CAS-005) — Questions 226–300

Runtime protection continuously monitors executing workloads for malicious behaviour such as process injection or fileless attacks, then blocks or alerts in real time. This satisfies the hybrid cloud constraint because on-premises and cloud workloads share the same runtime threat surface, which static scanning alone cannot address.

Just-in-time access provisioning grants privileged accounts only for an approved, time-bound window, and credential rotation replaces the password after each session. Together these satisfy both stated requirements: temporary access on request and automatic rotation following use.

Security policy evaluates traffic by source and destination zone pair. If the untrust zone is absent from the permitted source zones on the rule matching 192.168.1.1, SSH traffic is dropped before any service or application check occurs.

Fourth-party risk arises when a subcontractor, contracted by your direct vendor, handles your data without privity of contract with you. The stem's defining constraint — no contract exists between the organisation and the subcontractor — matches this exactly, since the exposure flows through the third party rather than directly.

Default and sample accounts often ship with well-known credentials or excessive privileges, giving attackers an easy entry point. Disabling or removing them eliminates that unnecessary attack surface before any other database hardening measure is applied.

Short-lived access tokens with rotated refresh tokens preserve zero-trust verification without forcing repeated interactive sign-ins. The refresh token silently renews access after idle periods, so the short idle timeout no longer triggers full re-authentication. This satisfies the stem's constraint of maintaining zero-trust principles while reducing workflow interruptions for the mobile workforce.

COSO ERM emphasizes that risk management must be integrated with strategy-setting and performance, not treated as a separate compliance exercise. Embedding risk into strategic planning ensures objectives are pursued within the organization's risk appetite. This integration is a defining core component of ERM.

When a risk owner fails to act, the security team's role is to escalate through governance channels so that accountable leadership can make a decision. Providing the risk committee with the current status, potential impact, and lack of progress ensures the risk remains visible and that a timely treatment decision is made. This preserves accountability and aligns with risk management practices that require escalation when treatment deadlines are missed.

Behavioural analysis continuously baselines normal endpoint activity and flags deviations, catching fileless malware and living-off-the-land techniques that signature matching misses. This satisfies the SOC's need for detection beyond known indicators, enabling EDR to surface novel threats in real time rather than waiting for updated signatures.

IPsec operates at the network layer and can be implemented in hardware for high throughput. IKEv2 supports perfect forward secrecy through Diffie-Hellman key exchange, ensuring that compromise of long-term keys does not compromise past session keys. This combination provides confidentiality and high availability for data in transit between data centers.

Dependency and flow mapping establishes which systems genuinely need to communicate, which is the prerequisite for writing allow-list policy that does not break production. Without this baseline, microsegmentation rules either block required traffic or remain so permissive that lateral movement is still possible.

A service mesh with mutual TLS authenticates both ends of every service connection using cryptographic identities and enforces authorization policies for which services may call which endpoints. This directly limits east-west movement between containerized tiers and provides visibility into service dependencies, complementing host-based controls for workloads that sit outside the mesh.

ZTNA typically uses outbound-only connections from the application to the trust broker, which hides the application from the internet and prevents inbound exposure. This design ensures that users connect through the broker and that the application remains protected behind the broker's policy enforcement.

Blocking malicious IP addresses at the firewall satisfies the containment constraint by severing the network path attackers use for command-and-control and lateral movement. Perimeter filtering stops inbound exploitation attempts and outbound callbacks immediately, limiting blast radius while forensic investigation continues. This is a standard, reversible containment action that preserves evidence on affected hosts.

Decoding the base64 string reveals the actual PowerShell commands, allowing the analyst to understand the script's intent without execution. This is a safe, static analysis step that can quickly expose malicious actions like downloading payloads or establishing persistence. It is the logical first step before any dynamic analysis or containment.

A CASB sits between users and multiple cloud providers, delivering the required visibility into sanctioned and unsanctioned application usage, policy enforcement, and data protection such as DLP and encryption. This directly satisfies the multi-cloud visibility and policy constraint in the stem.

Sensitivity labels persist with the data and provide consistent classification across Microsoft 365, endpoints, and integrated applications. Unified DLP policies using exact data match and trainable classifiers reduce false positives by matching actual regulated records and learning business context, and they enforce policy at egress points across all three channels.

A web application firewall inspects HTTP/S traffic, filtering SQL injection and cross-site scripting that a network firewall and IDS cannot parse at layer 7. This directly protects the credit card transaction data the e-commerce site handles, satisfying the stem's requirement for a complementary control at the application layer.

NtQueryInformationProcess with ProcessDebugPort (0x07) returns a non-zero port when a debugger is present. Malware uses this to detect debugging. Bypassing can be done by patching the API to always return zero or using a plugin that hides the debug port. This is a known anti-debugging technique, and the described bypass is effective in many cases.

OCSP stapling lets the server fetch a signed, timestamped revocation response and present it during the TLS handshake, so clients avoid downloading the full CRL or contacting the OCSP responder directly. This satisfies the stem's constraint of efficient revocation checking without full CRL downloads, while reducing latency and privacy leakage.

A unidirectional gateway physically or logically enforces one-way traffic, so controllers can emit telemetry toward the historian while no path exists for inbound connections from the business network. This directly satisfies the requirement to block workstation-initiated access to unpatched controllers. It is purpose-built for this exact industrial constraint, where endpoints cannot defend themselves.

TDE encrypts the database files at rest, and storing the encryption keys in an HSM ensures that the keys are protected and never exposed in software. Without the HSM, the stolen files cannot be decrypted, meeting the requirement. This approach provides strong protection for data at rest with hardware-based key management.

Fewer dependencies and less code shrink the vulnerable surface available to attackers, since each library and line is potential exploit material. This directly limits the attack surface of the serverless function, satisfying the stem's constraint without relying on runtime controls.

Threat modelling produces structured diagrams of systems, data flows and trust boundaries, then enumerates potential attack vectors against them. Conducted during design, it shifts security left, satisfying the DevSecOps goal of integrating security early in the development lifecycle.

SBOM generation plus dependency analysis inventories every open-source component and its transitive dependencies, then cross-references them against vulnerability databases to flag known CVEs. This directly satisfies the stem's constraint: identifying vulnerabilities in open-source libraries, which static code scanning or container hardening would not target at the dependency layer.

A FIPS 140-3 Level 3 validated HSM provides tamper-responsive physical security, detects and responds to tampering by zeroizing keys, and performs cryptographic operations internally. It meets the requirements for protecting long-term private keys against extraction and ensures operations occur in a secure environment, making it the most appropriate solution.

With SSLVerifyClient require, the server must validate the client's chain against a configured trust anchor; without a correct SSLCACertificateFile (or SSLCACertificatePath) the handshake aborts because the presented certificate cannot be chained to a trusted root. Pointing this directive at the internal CA resolves the failure, which makes it the most likely cause here.

SAQ A is designed for merchants that fully outsource all cardholder data functions to PCI DSS validated third parties and do not store, process, or transmit cardholder data electronically. The retailer's use of a validated third-party payment page matches this profile exactly. Completing SAQ A is the correct and least burdensome validation path here.

CloudHSM provides dedicated, single-tenant hardware security modules where the organisation retains sole control of key material; AWS cannot access the keys. This satisfies the stem's requirement to maintain control over encryption keys for data at rest, unlike KMS, where AWS manages the underlying key infrastructure.

Pass-the-Hash reuses captured NTLM password hashes to authenticate to remote Windows systems without cracking the plaintext password, enabling lateral movement between hosts. This satisfies the scenario's Windows lateral-movement requirement by leveraging credential material already obtained during initial access.

Signature-based detection uses predefined patterns to identify known attack payloads for SQL injection and XSS. It is effective for common attacks and is a standard WAF feature. Enabling this helps block well-known malicious requests based on their structure and content.

Because the dominant residual exposure is time-to-recover against a hard 15-minute threshold, additional mitigation through automated failover and validated recovery exercises directly reduces the likelihood and impact of missing that objective. This aligns treatment with the actual risk driver, complements the existing backup controls, and gives the board measurable evidence that the residual risk now sits within appetite.

Mapping data types to regulatory categories directly satisfies the alignment constraint, while enforcement through technical controls ensures the policy is operational rather than aspirational. Governance therefore spans both definition and enforcement, covering classification, handling and accountability for customer financial information as the stem requires.

Constant-time implementations execute identical instruction sequences and memory access patterns regardless of key or plaintext values, eliminating the timing variance the analyst observed. This removes the correlation between execution duration and secret data that enables timing attacks.

Failover is the mechanism that actually restores service when a primary system fails, so it must be exercised regularly to confirm recovery time and data integrity targets hold. Untested failover leaves the continuity plan's core assumption unverified.

Compensating controls address the legacy system's missing encryption, RBAC and plaintext credentials without disrupting patient care during the 18-month transition. Network segmentation, storage-level encryption and access monitoring reduce HIPAA and breach-notification exposure while the system remains operational.

JIT provisioning grants privileged rights only for the approved duration, then revokes them automatically. This directly shrinks the attack surface created by standing accounts, whose credentials remain valid indefinitely. The reduced exposure window satisfies the scenario's core requirement: limiting how long compromised or misused privileged credentials stay exploitable.

Immutable infrastructure replaces servers rather than modifying them in place, so every deployment starts from an identical known image. Because running instances are never patched or hand-edited, configuration drift between environments is eliminated, which is the stated benefit.

Network segmentation restricts lateral movement by dividing the network into isolated zones with enforced access rules, blocking traffic before it reaches targets. This preventive, network-layer control satisfies the defense-in-depth requirement by stopping intrusion attempts rather than merely detecting them.

File integrity monitoring continuously hashes critical files and compares results against a known-good baseline, generating alerts the moment content changes. This directly satisfies the stem's requirement to detect unauthorised modification, unlike access logging, which records who touched a file but not whether its contents were altered.

A protocol-aware inspection device parses Modbus/TCP function codes and can permit read or polling functions while dropping write functions from engineering workstations. This directly constrains what a compromised workstation can do to the controllers without blocking legitimate polling. Because it operates at the application layer of the industrial protocol, it addresses the specific unauthorized write risk.

Rate limiting policies at the API gateway cap the number of requests a client may make within a defined window, throttling or blocking excessive calls. This directly mitigates the identified API abuse risk arising from absent rate limiting.

Regular expressions match the fixed numeric patterns of credit card numbers, such as 16-digit groupings with valid prefixes, in outbound traffic. This pattern-based detection suits structured data, unlike keyword or document-fingerprint methods aimed at unstructured content.

Micro-segmentation enforces granular, workload-level policies on east-west traffic, isolating application tiers across subnets within a virtual network. Unlike perimeter controls, it inspects inter-VM flows directly, satisfying the requirement to limit lateral movement between tiers at the virtual network level.

This is the standard hybrid encryption pattern: AES-GCM provides confidentiality and integrity for the message, RSA-OAEP key wrapping delivers the unique symmetric key only to the recipient, and a sender signature provides authentication and non-repudiation. Because the symmetric key is random per message, compromise of one key does not affect other messages, and the server never sees the plaintext key.

Identity-based access policies evaluate each request against user identity and context rather than network location, which is what enables micro-segmentation to be enforced per identity across multiple clouds. Network-centric controls alone cannot deliver identity-centric segmentation in a multi-cloud estate.

CSPM continuously monitors multi-cloud infrastructure for misconfigurations and automatically remediates drift, satisfying the requirement to enforce consistent policy across AWS, Azure and GCP. Unlike native tools that operate within a single provider, CSPM normalises posture assessment across heterogeneous environments, directly addressing the cross-provider constraint in the stem.

OCSP returns a signed, per-certificate revocation status from a responder, so clients query one certificate rather than downloading and parsing an entire CRL. This satisfies the requirement for fast revocation checking without transferring a large list.

Under the shared responsibility model, the provider secures the cloud infrastructure, but customers configure their own network access controls, security groups and firewall rules. This makes network access control configuration a customer responsibility, matching the stem's question.

ZTNA brokers access per application based on continuous evaluation of user identity and device posture, and it issues context-bound tokens that are validated for each session. This prevents session hijacking because tokens are tied to the session context and cannot be replayed from a different device or location, meeting both requirements.

HIPAA requires a Business Associate Agreement before a third party creates, receives or stores PHI, contractually binding the cloud provider to safeguards, breach notification and use restrictions. This satisfies the stem's requirement for the most critical compliance step preceding contract signature.

Administrative control

The encryption mandate exists as a stated policy, but no implementing procedures exist for mobile devices. The gap therefore lies between policy and procedures, since the documented requirement lacks the operational steps needed to enact it on that platform.

bcrypt applies an adaptive, deliberately slow key-derivation function with a tunable cost factor, and the per-user salt ensures identical passwords yield distinct digests, defeating rainbow-table and precomputation attacks. This directly satisfies the stem's requirement for secure password storage, unlike fast general-purpose hashes such as SHA-256.

Contracting a validated service provider to handle card processing moves operational responsibility and much of the associated risk to that vendor. This is transference or sharing, since the provider assumes defined obligations and liabilities through the agreement, though the organization retains oversight and compliance accountability.

A secrets management service stores credentials outside the application configuration and injects them at runtime, directly eliminating the hardcoded values the auditor flagged. Its built-in rotation engine can automatically cycle database admin passwords on a schedule, satisfying the automatic rotation requirement without code changes or redeployment.

The RoPA is the Article 30 accountability artifact that catalogues each processing activity, its purposes, data categories, recipients, retention periods, and security measures. It directly answers the regulator's need for a living register documenting what is processed and for how long. Because the retailer processes data at scale, maintaining this register is mandatory and serves as the documentary backbone for demonstrating GDPR accountability.

A keyed hash is deterministic for a given input and key, so identical values produce identical digests and the database can index and match them for equality searches. Because the key lives outside the database, administrators and backup thieves see only digests they cannot reverse or verify without the key, meeting both the confidentiality and lookup requirements.

Reduces risk immediately.

OAuth 2.0 with JWT bearer tokens authenticates each API call and enforces authorisation through scoped permissions carried in the token. This satisfies the requirement to authenticate and authorise every REST call at the application layer, providing defence in depth beyond network controls.

Disabling password authentication removes the credential-guessing vector entirely, forcing key-based access that resists brute force. Restricting key exchange to curve25519-sha256 enforces ephemeral elliptic-curve Diffie-Hellman, delivering forward secrecy so compromised long-term keys cannot decrypt past sessions. Together these satisfy both the brute-force and forward-secrecy constraints in the stem.

Policies gain authority only when senior leadership formally approves them, which signals organizational commitment and provides the mandate for enforcement. Approval by executive management and the relevant governance body also ensures the policy aligns with business objectives and legal obligations, and it establishes accountability if disciplinary action is later required for violations, making this the essential step before publication.

DLP with device control blocks or audits USB mass-storage use, while content inspection identifies sensitive data being copied, catching exfiltration attempts regardless of user intent. This combination directly addresses unauthorised USB data movement, which endpoint logging alone cannot prevent.

Honeytokens are decoy credentials, files or records that have no legitimate use, so any access or use signals an attacker already inside the network. This matches the requirement to detect breached attackers, unlike honeypots, which are decoy systems rather than planted data artefacts.

mTLS ensures that both the client and server authenticate each other using certificates. Short-lived certificates limit the window of compromise and force frequent re-authentication, aligning with zero trust principles. This mechanism provides strong identity verification for each API request, and when combined with a policy engine, enables continuous authorization decisions based on certificate attributes.

Privacy as the default setting requires that systems automatically apply the strictest privacy protections without user intervention, so personal data is protected unless the individual opts otherwise. This directly satisfies the requirement that controls be integrated into default settings.

ISAC membership gives sector-specific sharing between peers facing comparable threats, so members receive timely, relevant threat data — indicators and tactics — far faster than public feeds, directly satisfying the requirement to collect intelligence from multiple industry-relevant centres.

Risk transference shifts the financial impact of a risk to a third party, typically through insurance or contracts. By purchasing cyber insurance, the organization transfers the potential financial losses from a breach to the insurer. This is a classic example of risk transference. The risk itself remains, but the financial burden is shared or shifted. This aligns with the scenario.

Public-key authentication replaces reusable passwords with a private key the client holds, so there is no shared secret to brute-force or steal through phishing. Disabling password authentication removes that credential path entirely, directly shrinking the attack surface.

CSPM continuously assesses configurations against benchmarks and compliance frameworks across AWS, Azure and GCP through native APIs, satisfying the single-tool, multi-cloud monitoring and enforcement constraint. It detects misconfigurations such as public storage buckets and overly permissive IAM policies, unlike single-cloud native tooling.

A CASB enforces data-security policy between users and cloud services, delivering the threat protection, data-loss prevention and visibility SASE requires for cloud-bound traffic. It satisfies the stem's SASE component requirement because SASE converges networking with exactly these cloud-security functions, alongside SWG, ZTNA and FWaaS, rather than relying on on-premises appliances.

Blocking outbound traffic to known malicious IPs and domains via firewall or DNS sinkhole rules halts command-and-control communication and data exfiltration, directly satisfying the containment requirement while leaving internal business services untouched. This limits ransomware spread without disrupting legitimate user access, unlike broad network isolation.

Expiration dates enforce time-bound risk acceptance, ensuring exceptions are reviewed and renewed rather than persisting indefinitely. This directly satisfies the process requirement for periodic reassessment, preventing stale waivers from silently accumulating. Without expiry, exceptions become permanent policy bypasses, undermining governance and auditability across Microsoft Entra ID and other controlled environments.