CompTIA SecurityX (CAS-005) (CAS-005) — Questions 301–375

In a hierarchical PKI, the root CA is offline and issues certificates to intermediate CAs. The root CA can revoke the intermediate CA's certificate without being compromised itself.

It implements a classic three-tier DMZ architecture: web servers in a DMZ (publicly accessible), application servers in an internal network (accessible only from the DMZ), and database servers in a restricted backend network (accessible only from the application tier). This layered segmentation enforces the principle of least privilege and uses firewall rules to control traffic between each tier, ensuring that internet-facing components cannot directly reach sensitive data stores.

Implementing the most stringent requirements across all regions ensures compliance with the strictest data protection law (e.g., GDPR's Article 3 territorial scope, LGPD, or CCPA) without needing to track per-region variations. This approach reduces legal risk and operational complexity by applying a single, high-standard baseline that satisfies all applicable regulations, such as requiring explicit consent for data processing and 72-hour breach notification timelines.

Common security KPIs include mean time to detect (MTTD), mean time to respond (MTTR), and patch compliance percentage. Vulnerability by severity is typically a Key Risk Indicator (KRI). Number of firewalls is a configuration metric, not a KPI.

SAST scans source code early, SCA identifies open-source vulnerabilities, and IAST combines static and dynamic analysis within the CI/CD pipeline. DAST and RASP are typically run later or in production.

The primary concern with a custom encryption algorithm is the lack of peer review and cryptanalysis. Without rigorous public scrutiny by the cryptographic community, hidden vulnerabilities or backdoors may remain undetected, violating the secure engineering principle of using well-vetted, standard cryptographic primitives. This is a foundational principle in security engineering, as custom algorithms often fail to withstand known attack vectors like differential or linear cryptanalysis.

A full offline scan using Microsoft Defender Offline boots the server from a clean environment, bypassing the running operating system where malware can hide or resist detection. This approach directly addresses the suspected malware without relying on the compromised OS, minimizes downtime by avoiding unnecessary restoration or network changes, and uses the only security tool available (Windows Defender) effectively.

The NIST incident response lifecycle includes Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (lessons learned). After eradication, recovery follows.

Deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.

Pinning the public key rather than the entire certificate allows for certificate renewal without invalidating the pin.

Code signing ensures the integrity and authenticity of build artifacts, preventing tampering or injection of malicious code during the CI/CD pipeline. This practice verifies that artifacts originate from a trusted source and have not been altered, which is critical for secure software supply chain management.

Regenerating the session ID upon successful login (option A) is a critical defense against session fixation attacks, where an attacker forces a known session ID on a user before authentication. By issuing a new, server-generated session ID after login, the application ensures that any pre-authentication session ID controlled by an attacker becomes invalid. This practice is recommended by OWASP and aligns with RFC 6265 session management guidelines.

TLS 1.3 includes a 0-RTT (zero round-trip time) feature that allows a client to send data immediately with the first message to a server it has previously connected to, reducing latency.

Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

In NIST RMF, Step 2 (Select) and Step 3 (Implement) involve selecting controls from NIST SP 800-53 and implementing them. This aligns with governance through the risk executive function.

Certificate pinning involves pinning the public key of the server's certificate or the certificate itself. Pinning the public key allows for certificate renewal without updating the app.

Hardcoded credentials (Option B) are a common IoT vulnerability because manufacturers often embed default usernames and passwords (e.g., 'admin/admin') into device firmware for ease of deployment. Attackers can exploit these static credentials via SSH, Telnet, or web interfaces to gain unauthorized access, as seen in Mirai botnet attacks. This violates the principle of least privilege and secure credential management.

The database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Using minimal base images like Alpine Linux reduces the number of installed packages, libraries, and utilities, which directly shrinks the attack surface by eliminating unnecessary components that could contain vulnerabilities. This practice aligns with the principle of least functionality, ensuring only essential binaries are present in the container image.

Active reconnaissance involves directly interacting with the target, such as probing subdomains or services. Discovering a subdomain by scanning or querying DNS is active, as it sends traffic to the target's infrastructure.

Integrating a vulnerability scanner into the CI/CD pipeline and failing the build on critical findings directly reduces the attack surface by preventing deployment of images with known exploitable vulnerabilities. This aligns with the principle of secure software supply chain management, where automated security gates are essential for containerized environments.

The private SSL key must be protected from unauthorized access because it is used to decrypt traffic and establish trust. Setting permissions to 600 (owner read/write only) ensures that only the root or the application user who owns the key can read it, preventing other users or processes from extracting the key material.

SOC 2 Type II reports on the effectiveness of controls over a period of time.

ChaCha20-Poly1305 is a stream cipher (ChaCha20) combined with a MAC (Poly1305). It is an AEAD cipher. It is not a block cipher, and it does not require padding.

API-based mode uses cloud provider APIs to access logs and metadata, providing visibility without inline traffic interception or endpoint changes.

TLS 1.3 requires forward secrecy and uses AEAD ciphers. AES-256-GCM is a recommended AEAD cipher with strong security and performance.

Network segmentation and strict ACLs limit access to the vulnerable application, reducing the attack surface without patching.

GDPR Article 17 gives individuals the right to erasure ('right to be forgotten').

Automation is the ability to execute predefined actions without human intervention, as in automatically quarantining and blocking.

The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.

The JWT header specifies `"alg":"none"`, which instructs the server to accept a token without any cryptographic signature. This is a critical vulnerability because an attacker can forge arbitrary tokens by setting the algorithm to `none`, bypassing signature verification entirely. The correct answer is B because this directly creates an algorithm confusion attack surface, where the server may be tricked into accepting unsigned tokens.

FIPS 140-2 Level 3 requires tamper-evident coatings and tamper response mechanisms that zeroize keys upon tampering. Level 2 requires tamper-evident coatings but no response, Level 4 is for extreme environments.

Using a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) retrieves credentials at runtime via secure APIs, avoiding hardcoded secrets in scripts. This practice ensures credentials are encrypted at rest and in transit, and supports rotation without modifying the script. It aligns with the principle of least privilege and reduces the risk of credential exposure in version control or logs.

Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Disabling password authentication and using only key-based authentication eliminates the risk of password brute force and credential theft. Listening on a non-standard port provides security through obscurity, which is not a strong control.

SBOMs list all components and their versions; dependency analysis identifies vulnerabilities in those components.

Constant-time algorithms ensure that the execution time of cryptographic operations does not depend on secret data, such as keys. By avoiding conditional branches or variable-time instructions (e.g., multiplication or memory accesses) that vary with input, these algorithms prevent attackers from inferring secrets through timing measurements. This is a fundamental mitigation against timing side-channel attacks, as specified in standards like FIPS 140-3 and NIST SP 800-56B.

COBIT 2019 is specifically designed to align IT governance and security controls with business objectives by providing a comprehensive framework that links business goals to IT goals and enablers. It focuses on governance of enterprise IT (GEIT), ensuring that security investments and controls directly support strategic business outcomes, unlike other frameworks that are more operational or compliance-focused.

SDP hides infrastructure, requires authentication before connectivity, and creates per-session encrypted tunnels.

Zero trust assumes no implicit trust; every access request must be verified regardless of origin.

SeImpersonatePrivilege allows a process to impersonate a user token. Tools like JuicyPotato exploit this privilege to impersonate SYSTEM by forcing a higher-privileged process to authenticate and then stealing its token. This is a common technique for local privilege escalation on Windows.

Terraform is an infrastructure-as-code tool that uses provider plugins to interact with the APIs of AWS, Azure, GCP, and hundreds of other services. This allows a single declarative configuration language (HCL) to manage resources consistently across all three cloud providers, making it the most appropriate choice for multi-cloud infrastructure management.

A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model and inspects HTTP/HTTPS traffic for malicious payloads. It uses a combination of signature-based detection, behavioral analysis, and rule sets (e.g., OWASP ModSecurity Core Rule Set) to filter out common web exploits such as SQL injection, cross-site scripting (XSS), and path traversal. By intercepting and blocking malicious requests before they reach the web application, a WAF provides a critical layer of defense without requiring changes to the application code.

Honeypots and honeytokens are classic deception technologies. Honeypots mimic real systems, and honeytokens are fake data objects.

UBA establishes baselines of normal user behavior and alerts on deviations, which is an anomaly-based detection method.

HTTPS uses TCP port 443, and the rule set correctly allows inbound TCP 443 to the web server at 10.1.1.10, permits the server's outbound responses (stateful or explicit), and then denies all other inbound traffic. This matches the requirement to allow only HTTPS traffic from the internet while blocking everything else.

CRL, OCSP, and OCSP stapling are all standard revocation checking mechanisms; OCSP stapling improves performance by having the server present the OCSP response.

Forensic acquisition requires write-blocking first, then using FTK Imager to create a forensic image, ensuring integrity with hash verification.

The rule set includes an explicit permit rule for HTTP traffic from any source, which overrides the default deny policy. Since the default input policy is set to DROP (or DENY), only traffic matching a permit rule is allowed; HTTP is explicitly permitted, making option A correct.

ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) provides PFS as session keys are ephemeral.

With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

The order of volatility dictates that the most volatile data (memory, network connections) should be collected first. The standard order: registers/cache, routing table, ARP cache, process table, kernel statistics, memory, temporary file systems, disk.

Storing API keys in a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) prevents hardcoding credentials in the script, which is a critical security practice for automation. Even with least privilege, if the API key is exposed in plaintext (e.g., in source code or logs), an attacker can reuse it across services. Secrets management also enables rotation, auditing, and dynamic access control, directly addressing the risk of credential compromise in multi-cloud revocation scripts.

Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated, reflecting process efficiency.

The NIST Cybersecurity Framework (CSF) is specifically designed to provide a structured, risk-based approach to managing cybersecurity risks, offering core functions (Identify, Protect, Detect, Respond, Recover) and implementation tiers that align with an organization's risk appetite. It is the best fit because it directly addresses cyber risk management through a flexible, outcome-driven framework, unlike other frameworks that focus on IT governance, information security management systems, or service management.

FIDO2/WebAuthn uses origin-bound keys, and hardware tokens (e.g., YubiKey) generate one-time passwords or use challenge-response resistant to phishing.

FAIR decomposes risk into loss event frequency and loss magnitude. These are core components used to calculate risk.

A core principle of Software-Defined Perimeter (SDP) is to make the infrastructure invisible to unauthorized users. This is achieved by deploying SDP controllers and gateways that hide network components (e.g., servers, IP addresses) from unauthenticated clients, effectively creating a 'black cloud' that only reveals resources after successful authentication and authorization.

Data encryption at rest and in transit is a fundamental security requirement for protecting sensitive data in a SaaS environment. Encryption at rest (e.g., AES-256) ensures data stored on the provider's servers is unreadable if physically compromised, while encryption in transit (e.g., TLS 1.2/1.3) protects data as it moves between the client and the SaaS platform. This directly addresses secure data handling, which is the core concern of the question.

An HSM provides tamper-resistant physical protection for cryptographic keys, ensuring that even if an attacker gains physical access to the device, the keys cannot be extracted or modified. This is a primary benefit over software-based key storage, which stores keys in memory or disk and is vulnerable to OS-level attacks, memory dumps, or file system breaches. The HSM's hardware root of trust and physical security mechanisms (e.g., tamper switches, zeroization) make it the gold standard for key protection in compliance-heavy environments like FIPS 140-2 Level 3 or PCI DSS.