CompTIA SecurityX (CAS-005) (CAS-005) — Questions 301–375

A shared symmetric key means any compromised service can forge valid tokens for every other service, breaking per-service authentication boundaries. Asymmetric signing with per-service keys, or centralised issuance, would contain the blast radius of a single compromised credential.

Envelope encryption keeps bulk data encrypted under a data key, while the HSM holds the master key that wraps it. The backup application can copy ciphertext freely, but unwrapping the data key happens only inside the HSM under its usage policy, so the plaintext key never leaves the module. This satisfies both the at-rest protection and HSM-enforced control requirements.

SAST analyses source code without executing it, so running it during the build phase immediately after commit catches flaws before they propagate into later artefacts. This satisfies the constraint of minimising rework, since defects are cheapest to fix at the earliest pipeline stage.

Privacy by design embeds data minimisation and access controls into the CRM architecture from inception, rather than retrofitting them later. This satisfies GDPR's requirement that protection be built into processing systems and default settings before personal data is collected.

The analyst forms a specific proposition about adversary behaviour, PowerShell execution, then hunts for evidence supporting or refuting it. This structured, hypothesis-first method is hypothesis-driven hunting, matching the stem's constraint of starting from a stated theory rather than an indicator or alert.

Federating AD DS with SAML 2.0 allows the on-premises domain to act as the identity provider, so employees use their existing AD credentials and the SaaS application receives assertions about group membership and account status. This avoids separate passwords and enforces on-premises account state in real time because the identity provider evaluates the account at each authentication. It is the standard approach for hybrid identity with SaaS.

A CASB sits inline or via APIs between users and cloud services, enforcing policy at that boundary. This directly satisfies the stem's requirement for a primary function: it governs access and data flows to sanctioned and unsanctioned cloud applications, providing visibility and control.

dm-verity is a device-mapper target that stores a hash tree and verifies each block as it is read, with the root hash protected by a signature. If an attacker alters data offline, the recomputed hash will not match the tree and reads fail. This provides detection of at-rest tampering even when the disk is modified outside the running system, exactly matching the requirement.

Ed25519 signatures verify firmware authenticity with minimal computation, satisfying the constrained processor and memory requirement. Its compact 64-byte signatures and 32-byte keys reduce storage and transmission overhead, while verification is far faster than RSA at equivalent security. This makes it ideal for OTA updates on resource-limited IoT devices.

TLS 1.3 cuts the handshake to a single round trip by combining key exchange and authentication, and supports zero round-trip resumption for repeat connections. This directly satisfies the question's comparison against earlier versions, which required two round trips, thereby reducing latency.

Tuning the rule to understand the application's expected input, such as allowing single quotes in search parameters but still detecting SQL injection patterns like ' OR '1'='1', reduces false positives while maintaining protection. This contextual approach is a best practice for WAF tuning, balancing security and usability.

Mandatory access control enforces access decisions by comparing the subject's clearance level with the object's classification label, and the labels are managed by the system rather than by users. This directly satisfies the requirement to consider clearance and classification together and prevents users from changing their own labels. It is the standard model for need-to-know enforcement in government and defense environments handling sensitive data.

FedRAMP requires an independent assessment by a Third-Party Assessment Organization accredited under the programme, which validates the cloud service's security controls against NIST baselines before an agency can grant authorisation. This external evaluation is the key requirement the stem asks for.

Encrypting at the application layer with keys resident in an HSM means the ciphertext stored on the shared array is useless without the HSM, and role separation prevents the storage administrator from accessing key material. This directly satisfies both the confidentiality requirement for copied volumes and the key-access restriction.

Public denotes information approved for unrestricted disclosure, carrying no confidentiality requirement. It satisfies the stem's requirement for a common classification level, forming the lowest tier of enterprise schemes and letting architects label marketing material, published policies and open datasets without unnecessary controls.

Full-disk encryption protects data only when the system is powered off or the volume is locked. Once the OS is running and the volume is decrypted, any process or remote attacker with sufficient privileges can read the data. The TPM unseals the key during boot, so the disk remains transparently accessible. This limitation means additional controls like file-level encryption or access controls are needed for runtime protection.

The condition compares the request's source IP against defined ranges, permitting access only when the origin falls within them. This satisfies the policy's constraint of scoping permissions geographically or to trusted networks, rejecting requests from any other address.

A retention and residency matrix ties each data category to the specific retention period and storage location mandated by every applicable jurisdiction, making conflicts explicit and resolvable. This is exactly the governance artifact needed when a single global schedule cannot satisfy GDPR and local residency law, because it allows differentiated handling per jurisdiction while preserving an auditable rationale.

Placing each tier in its own segment with firewall rules permitting only required flows enforces least-privilege segmentation. Internet-facing web servers sit in the DMZ, while application and database servers remain unreachable from the internet, satisfying the stated access constraints.

Patch compliance percentage directly measures the proportion of assets carrying current security updates, giving the board a quantifiable view of vulnerability exposure reduction. It is a standard operational KPI because it tracks remediation effectiveness over time against a defined baseline, satisfying the stem's requirement for board-level security programme metrics.

Mutual TLS with certificates bound to a Kubernetes service account gives each service a cryptographic identity that cannot be transferred to another service without its private key. A service mesh certificate authority can issue short-lived certificates and rotate them automatically, and the service account binding ensures a compromised pod cannot claim a different service identity. This satisfies authentication, non-impersonation, and automated rotation in one design.

SAST analyses source code without executing it, detecting vulnerabilities during development and satisfying shift-left by finding flaws before deployment. It integrates into CI pipelines and IDEs, unlike DAST, which requires a running application and therefore tests later in the lifecycle.

Custom algorithms bypass public scrutiny, so undiscovered weaknesses persist. Without peer review and cryptanalysis, flaws such as biased output, weak key scheduling or predictable IVs remain unproven, making the scheme untrustworthy regardless of its apparent complexity.

Pinning the public key rather than the full certificate lets the app continue trusting the server after certificate renewal, provided the key pair is reused. This maintains man-in-the-middle protection while avoiding outages from routine certificate rotation.

Volatility reconstructs kernel structures from the raw memory image on a trusted, isolated workstation, so the rootkit's own hooks and hidden process lists cannot conceal themselves. This satisfies the constraint of detecting kernel-mode compromise without relying on the compromised operating system's APIs.

Static code analysis examines the script's source code without executing it. The analyst can read the PowerShell commands, identify obfuscation, and understand the script's intent. Tools like PowerShell's AST parser or manual review can be used. This directly fulfills the requirement to analyze without execution, making it the correct choice.

0-RTT allows a returning client to send application data in the first flight using a previously established pre-shared key, eliminating a round trip. This satisfies the reduced-latency requirement unique to TLS 1.3, though it carries replay risk that deployments must mitigate.

The shared responsibility model defines the security boundary between provider and customer, satisfying the cloud-first scenario's need to clarify who secures what. The provider secures the cloud infrastructure, while the customer secures data, identities, and access in the cloud. This division varies by service model (IaaS, PaaS, SaaS), directly answering the stem's requirement.

Within the NIST RMF, Step 2 (Select) chooses controls from the risk assessment, and Step 3 (Implement) deploys them into the system. This mapping satisfies the stem's requirement to tie control selection and implementation to the organisation's governance structure.

Pinning the server's public key, rather than the whole certificate, survives certificate renewal because the key pair persists across reissues. This satisfies the mobile app's requirement to block man-in-the-middle attacks without breaking connectivity each time the certificate rotates.

Hardcoded credentials ship identical usernames and passwords across every unit, so attackers who extract them from firmware or documentation gain access to the whole fleet. This satisfies the stem's requirement to identify a common IoT vulnerability.

The TLS 1.3 key schedule uses HKDF to derive secrets from the shared ECDHE value and the handshake transcript hash, producing traffic keys for each direction. Those derived keys are what the AEAD ciphers use, so the key schedule underpins confidentiality and integrity by ensuring unique, context-bound keys per session and epoch.

Micro-segmentation enforces least privilege by permitting only explicitly authorised flows between individual workloads, satisfying NIST SP 800-53 access control and separation-of-duties controls. Continuous verification re-evaluates every request against identity and device posture, so a compromised tier cannot pivot laterally into adjacent data tiers.

Reviewing file access logs confirms whether the directory traversal attempts actually reached /etc/shadow or /etc/passwd, distinguishing reconnaissance from compromise. This satisfies the immediate response requirement to establish exploitation status before containment, since the URL patterns alone only evidence attempted traversal, not successful reads of those credential files.

Smaller images have fewer packages and vulnerabilities.

Event ID 4104 is generated when PowerShell logs a script block, capturing the actual code being executed. This is crucial for detecting fileless malware because the malicious script may never touch disk. Monitoring this event allows the team to see the script content and identify malicious patterns, even if the script is obfuscated or executed in memory.

Unanswered SYNs indicate the handshake never completes because the SYN never reaches the host. A firewall silently dropping those packets before delivery produces exactly this capture pattern, distinguishing it from a host actively refusing connections with RST responses.

Distributed firewalls in an SDN fabric enforce policy at the hypervisor level using workload identity tags rather than IP addresses. This allows rules to follow the workload as it migrates between hosts, maintaining least-privilege east-west controls. It directly satisfies the requirements of identity-based enforcement and mobility without rule changes, making it the correct architectural choice.

An external key store lets the cloud KMS delegate cryptographic operations to key material held in the organization's own HSM, so plaintext keys never enter the provider's infrastructure. The provider still performs server-side encryption using the externally held key, satisfying both the residency mandate and the server-side encryption requirement. This is the designed pattern for exactly this regulatory scenario.

Automating a vulnerability scanner that fails the build on critical findings prevents images containing known exploitable packages from progressing through the pipeline. This directly minimises attack surface by blocking vulnerable base-image layers before deployment, rather than relying on manual review or post-deployment detection.

Federation through SAML or OIDC centralizes authentication with the identity provider, while conditional access policies evaluate device posture and other signals. Just-in-time elevation issues short-lived credentials, eliminating long-lived secrets in the cloud. Together, these satisfy all three architectural requirements.

Permission 600 grants read and write to the owner only, denying all access to group and others. This satisfies the stem's requirement for a private SSL key, since any broader permission such as 644 would expose the key material to other local users.

SOC 2 Type II evaluates control design and operating effectiveness across a defined audit period, unlike Type I which reports design at a single point in time. This satisfies the vendor assessment requirement for sustained control performance evidence.

ChaCha20 is a stream cipher, generating a keystream from a 256-bit key and nonce that is XORed with plaintext. This distinguishes it from block ciphers such as AES, and explains its efficiency in software without dedicated hardware acceleration.

Running Trivy scans inside Jenkins and failing the pipeline when vulnerabilities exceed a threshold enforces the constraint that only scanned, compliant images reach production, replacing inconsistent manual base-image updates with automated gatekeeping before the registry push.

TLS_AES_256_GCM_SHA384 uses ephemeral Diffie-Hellman key exchange, which is mandatory in TLS 1.3, delivering the required forward secrecy. AES-256-GCM provides authenticated encryption with hardware-accelerated performance, while SHA-384 strengthens the handshake. It satisfies both the forward secrecy and high-performance constraints.

Microsegmentation with identity-based policies enforces least-privilege access between workloads and applications by using identity and context rather than IP addresses. It supports continuous verification and limits lateral movement, aligning with Zero Trust. This mechanism is essential for dynamically controlling access based on device health and user identity.

Segmentation with strict ACLs restricts reachability to the vulnerable legacy application, shrinking the attack surface while it stays available to authorised internal users. Since patching is impossible, this compensating control limits lateral movement and exploitation attempts, satisfying the availability constraint better than disabling the service.

Restricting network access to authorised applications only shrinks the attack surface without touching the database, so it can be applied immediately while patching waits three months. It directly mitigates exposure of plaintext data by preventing unauthorised hosts from reaching the database.

The right to erasure, or right to be forgotten, lets a data subject demand deletion of personal data where no overriding legal ground for retention applies. This directly satisfies the GDPR requirement for an individual to request erasure of their data.

The playbook executes quarantine, sender blocking and ticket creation without human intervention, which is machine-driven execution of a predefined workflow. That distinguishes automation from orchestration, which coordinates multiple tools, and from case management or threat intelligence enrichment.

Admission controllers intercept API requests before pods are created, rejecting unsigned or unapproved images, while PodSecurityPolicy restricts privileged escalation and capability use. Together they enforce image provenance and prevent privilege escalation, matching both stem constraints.

Automated scanning in CI satisfies the security team's pre-deployment scanning mandate while the hardened base image standard reduces the container knowledge gap for an unfamiliar operations team, establishing a repeatable, secure foundation before any workload reaches the registry.

Each boot stage must be digitally signed by a trusted authority, and the signature must be verified before execution. This ensures that only authorized code runs. Without verification, an attacker could replace a boot stage with malicious code. The verification uses the public key from the root of trust or a chain of trust.

Allowing only ports 80 and 443 from any source restricts inbound access to the web services, which is exactly what the public web application requires. Dropping all other inbound traffic reduces the attack surface by preventing access to other services. This is a fundamental host-based firewall hardening step that directly addresses the requirement.

Key-based authentication removes password brute-forcing and credential-replay vectors entirely, since possession of the private key is required. This directly reduces the attack surface on the jump host, satisfying the stem's requirement to restrict authentication to the most secure method.

An SBOM enumerates every component and version in the product, giving the inventory needed to trace third-party dependencies. Combined with provenance attestation, it lets the architect verify what was supplied and detect tampering or unexpected inclusions, satisfying the integrity and provenance requirement.

Constant-time algorithms execute identical instruction sequences and memory accesses regardless of secret values, removing the timing and cache-usage variations that side-channel attackers measure. This directly satisfies the stem's mitigation requirement by eliminating the data-dependent execution path that leaks key material.

COBIT 2019 is a governance framework that explicitly separates governance from management and maps IT objectives to enterprise goals, satisfying the stem's requirement to align security controls with business objectives. Other frameworks address control implementation or risk, not enterprise-wide IT governance alignment.

SDP employs a deny-by-default model where the controller authenticates and authorises both endpoints before any connection is brokered, so applications never respond to unauthenticated probes. This satisfies the zero trust requirement that resources remain hidden from unauthorised users, mitigating scanning and reconnaissance.

Sysmon provides detailed process creation events including command-line arguments, parent process, and hashes, which are critical for detecting suspicious LOLBin execution and fileless techniques. Network connection events from Sysmon also help identify command-and-control traffic. This data source is essential for advanced threat detection because it captures rich context that native Windows event logs may lack.

Never trust, always verify requires every access request to be authenticated and authorised explicitly, regardless of network location, replacing implicit trust with continuous verification. This is the foundational tenet from which all other zero trust controls derive.

PCI DSS Requirement 3 requires that stored cardholder data be rendered unreadable through encryption, truncation, tokenization, or hashing. This addresses data at rest and is essential for protecting stored PAN. The architect must ensure that any storage of cardholder data complies with this requirement to reduce the risk of compromise.

Docker Content Trust uses Notary to sign image tags, and the Docker client verifies those signatures before pull or run. Enforcing it in the build-and-push script blocks unsigned or tampered images from the private registry, directly satisfying the integrity requirement.

JuicyPotato exploits the SeImpersonatePrivilege token by coercing a privileged service into authenticating, then impersonating its token via COM server abuse. Since the stem confirms the service account holds SeImpersonatePrivilege, this satisfies the exact prerequisite, enabling escalation to SYSTEM or root without needing kernel exploits.

Terraform's provider plugins translate a single declarative configuration into each cloud's native API calls, so one workflow and state file manage AWS, Azure and GCP resources. That satisfies the requirement for consistent multi-provider infrastructure management without separate tooling per cloud.

A WAF inspects inbound HTTP traffic against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting and similar exploits before they reach the application. This filtering at layer 7 satisfies the requirement to stop common web attacks rather than merely logging them.

SIEM with behaviour analytics correlates logs across sources and baselines normal activity, surfacing anomalies that indicate compromise faster than signature-only tooling. This directly reduces mean time to detect, the metric the company wants to improve.

Honeytokens are decoy credentials, files or records seeded across systems; any access triggers an alert, since legitimate users have no reason to touch them. This satisfies the stem's detection requirement, giving high-fidelity, low-false-positive signals of attacker reconnaissance or lateral movement without delaying normal business activity.

Anomaly-based correlation baselines normal behaviour and alerts on statistically significant deviations, rather than matching fixed signatures or thresholds. Accessing sensitive data at unusual hours deviates from the established behavioural baseline, which is precisely what this rule type detects.

Event ID 4769 logs a Kerberos service ticket request. The encryption type 0x17 corresponds to RC4-HMAC, which is weaker and faster to crack than AES. Attackers performing Kerberoasting often request RC4-encrypted tickets for service accounts with SPNs, then extract and crack them offline. Thus, seeing RC4 where AES is expected is a strong indicator of Kerberoasting.

Stateful inspection matches the outbound TCP reply to the existing inbound session, so permitting outbound TCP from 10.1.1.10 lets the web server respond. The explicit deny all inbound then blocks every other unsolicited inbound connection.