CompTIA SecurityX (CAS-005) (CAS-005) — Questions 376–450

Restricting HMAC to SHA-2 or stronger removes MD5 and SHA-1 message authentication codes, which are collision-prone and deprecated. This directly satisfies the policy's requirement to disable legacy algorithms, since SSH MAC negotiation would otherwise still permit these weak integrity checks.

A bucket policy granting public read access exposes every object to anonymous retrieval, so anyone with the URL can download customer data. This is the setting most likely to cause a breach, unlike encryption or versioning misconfigurations.

ECDHE generates an ephemeral key pair per session, then discards the private key, so compromising the long-term certificate key cannot decrypt past sessions — satisfying TLS 1.3's PFS requirement. TLS 1.3 mandates ephemeral Diffie-Hellman, and ECDHE is its recommended elliptic-curve instantiation, unlike static RSA key transport.

Eliminates risk directly

Entra ID Conditional Access can require that a device be marked compliant by Intune before granting access to Microsoft 365. Intune enforces device configuration and compliance on Android and iOS without requiring on-premises infrastructure or VPN, directly meeting the requirement to restrict access to compliant devices.

Fail2ban parses auth.log and dynamically inserts firewall rules to drop the source IP once failed authentication attempts cross a threshold, immediately throttling the brute-force source while legitimate users retain access, and it is reversible once the attack subsides.

MTTR measures elapsed time from incident detection to containment or resolution, directly reflecting how quickly the response process actually works. It satisfies the stem's requirement for a KPI gauging incident response effectiveness, unlike volume or cost metrics.

The NIST Cybersecurity Framework supplies a structured, voluntary approach organised around Identify, Protect, Detect, Respond and Recover, giving organisations a repeatable way to manage cyber risk. Its risk-based core functions directly match the stem's requirement for structured cyber risk management.

Order of volatility dictates that the most perishable evidence, such as RAM contents and active network connections, must be collected before anything else because it is lost on shutdown or even over time. Capturing memory and live connections first preserves artifacts that no disk image can recover.

FIDO2/WebAuthn binds credentials to the origin's domain via public-key cryptography, so a phishing site on a different domain cannot trigger or replay the authentication. This origin-binding satisfies the phishing-resistance requirement, unlike OTP or push methods vulnerable to real-time relay.

Loss event frequency and loss magnitude form FAIR's two top-level factors, splitting risk into how often a threat event occurs and how much it costs. This taxonomy directly satisfies the stem's quantification requirement, letting analysts model frequency and magnitude separately rather than relying on qualitative ratings.

SDP uses a black cloud model, hiding assets until authentication.

Mandating encryption at rest and in transit in the SaaS contract ensures the provider applies cryptographic controls to stored data and network traffic, directly satisfying the secure data handling requirement that the migration imposes on the outsourced service.

Tamper-resistant physical protection directly satisfies the stem's hardware-versus-software constraint: keys reside inside a validated cryptographic boundary that zeroises on intrusion, so extraction attempts destroy the material. Software-based storage exposes keys to memory scraping and host compromise, whereas an HSM's physical shielding enforces confidentiality independently of the operating system.

RADIUS traditionally uses UDP ports 1812 (authentication) and 1813 (accounting). These are the official IANA-assigned ports. While some legacy implementations use 1645 and 1646, the standard ports are 1812 and 1813. This is a correct statement about RADIUS.

Running the container as a non-root user removes the ability to perform privileged operations inside the container. If the application is compromised, the attacker gains only the limited permissions of that unprivileged account, reducing the attack surface.

Drops all capabilities, enforces non-root, and read-only filesystem – defense in depth against escapes.

A signed, cacheable status list lets resource servers reject tokens that the authorization server (or a recovery process) marks as invalid without a per-request call to the issuer. Because the list is signed and versioned, resource servers can refresh it on a schedule and honor the most recent revocation state, bounding the acceptance window after a compromise while keeping request-path latency low.

Content inspection with pattern matching and classifiers is the foundation of any DLP program because it identifies regulated data such as card numbers and PII within files, messages, and uploads. Without accurate classification, neither discovery at rest nor prevention in motion can distinguish sensitive content from ordinary business data, so this capability is essential to meet both stated requirements.

SOX mandates accurate, reliable financial reporting and internal controls over financial disclosure, directly satisfying the stem's regulatory constraint for a financial institution. Unlike frameworks centred on data privacy or payment card handling, SOX specifically governs the integrity of financial statements and the controls assuring their accuracy.

This is correct because comsvcs.dll MiniDump is a known LOLBin technique to dump LSASS memory using rundll32.exe, a signed Microsoft binary. It avoids dropping custom tools and can bypass some application whitelisting. The command-line arguments are a strong indicator of credential dumping, aligning with MITRE ATT&CK T1003.001.

An HSM is tamper-resistant hardware that generates and stores the root CA private key internally, performing signing operations without exposing the key to software or memory. This provides the physical protection and non-exportability that high-assurance root key custody demands.

Tactics represent the adversary's tactical goal — the 'why' behind an action — with entries such as Initial Access, Execution and Credential Access. Techniques, by contrast, describe the 'how'. The stem asks which component categorises the 'why', so Tactics is the matching category.

Running the sample inside an isolated virtual machine with network monitoring captures real behavioural indicators — process creation, registry writes, file drops and command-and-control traffic — without risking the production host. This satisfies the stem's safe-environment constraint, since the VM can be snapshotted and reverted after execution.

Correlating the source IP against authentication, firewall and endpoint logs distinguishes a genuine password-spraying or brute-force attempt from a misconfigured service account or scanner, establishing scope and intent before escalation or blocking. Verification precedes containment actions such as blocking the address.

Quarterly scanning satisfies PCI DSS Requirement 11.3.2 by identifying exploitable weaknesses in external and internal networks before attackers do, enabling remediation within the mandated timeframe. Continuous detection keeps the cardholder data environment compliant between annual penetration tests, directly addressing the standard's timely-remediation constraint.

A LOLBin such as schtasks.exe creates the scheduled task using a signed Microsoft binary, so the registry run key is never touched. This satisfies evading the EDR's registry-change monitoring while still achieving persistence through Task Scheduler.

Loss Magnitude quantifies the financial impact of a single loss event across primary and secondary forms. It is a primary FAIR factor, paired with Loss Event Frequency to derive annualised risk exposure in the model.

Access control mechanisms are a core control area verified under right-to-audit clauses, confirming that only authorised identities reach vendor systems and data. Auditors examine authentication, authorisation and privileged access management to validate the vendor's safeguards against unauthorised entry.

Wireshark provides deep packet inspection with protocol dissectors, allowing the analyst to view application-layer payloads, reassemble TCP streams, and analyze session flow. It supports custom protocol analysis through user-defined dissectors and is the most appropriate tool for this scenario.

ALE is calculated by multiplying single loss expectancy by annualised rate of occurrence: $50,000 × 0.2 = $10,000. This quantifies the expected annual loss from the risk, matching the stem's supplied SLE and ARO values.

Kubernetes network policies act as pod-level firewalls, selecting pods by label and permitting only declared ingress and egress flows. This segments pod-to-pod traffic, blocking lateral movement between compromised containers that would otherwise communicate freely on the flat cluster network.

ForceCommand internal-sftp makes the server run the built-in SFTP subsystem for every matched session regardless of what the client requests, so no shell is ever spawned, and ChrootDirectory confines each partner to their own directory tree with the path token expanded per account. This pairing delivers file transfer without interactive shell access.

Immutable infrastructure replaces rather than patches instances, so every deployment derives from one hardened image. Drift and configuration creep disappear, and no lingering services or stale packages accumulate, which is precisely the consistent-configuration reduction of attack surface the stem asks for.

Impossible travel is the classic UBA signal: the same credentials authenticating from two distant locations faster than physical travel allows. This pattern indicates the account's credentials have been compromised and reused by an attacker, directly matching the impossible-login constraint described in the stem.

Host-based firewalls with tag-based rules enforce policy at the workload level, so protections move with the VM even if it is migrated. This restricts lateral movement because only explicitly allowed traffic can reach the workload, regardless of network topology or host compromise.

The Authorize step is where a senior official reviews the security assessment results, the plan of action and milestones, and the continuous monitoring strategy, then formally accepts the residual risk and grants an authorization to operate. This directly satisfies the Chief Risk Officer's requirement that risk decisions be authorized before production changes are made, because the authorization decision is documented and tied to explicit risk acceptance.

The HIPAA Security Rule requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. Documented system inventories and periodic risk analysis results are core administrative safeguards and provide direct audit evidence. This activity demonstrates that the hospital has identified where ePHI resides and has evaluated risks, which is exactly what an auditor expects to see.

Honeypots and deception technology present fake assets with no legitimate traffic, so any interaction is inherently suspicious. This exposes APT reconnaissance and lateral movement that signature-based tools miss, satisfying the stem's requirement to detect evasive threats.

Resource-based policies with an explicit deny for public access override any bucket or object ACL that would otherwise grant anonymous read, directly preventing accidental exposure. This control enforces the restriction at the resource itself, satisfying the requirement to block public access reliably.

Direct Connect provisions a dedicated private circuit between the on-premises data centre and the cloud provider, bypassing the public internet entirely. This satisfies all three stated constraints simultaneously: low latency, high bandwidth, and no internet traversal, which VPN or internet-based alternatives cannot guarantee.

Hypothesis-driven hunting starts from an informed theory about attacker tactics, techniques or targets, then queries telemetry for evidence confirming or refuting it. This differs from indicator-led hunting, which searches for known IoCs rather than testing a reasoned proposition about adversary behaviour.

FedRAMP authorisation directly evaluates the cloud service provider's implementation of NIST SP 800-53 security controls, satisfying the stem's compliance constraint. Assessment covers the provider's control environment, not customer-side configurations or data classification. This makes the CSP's security controls the object of FedRAMP review under Microsoft Entra ID-governed environments.

Intel SGX creates hardware-isolated enclaves within the CPU, encrypting code and data in memory so even the operating system or hypervisor cannot read them. This directly satisfies the stem's requirement for hardware-enforced isolation of sensitive computations, providing stronger protection than virtualisation or process-level sandboxing alone.

A software-defined perimeter creates identity-based, need-to-know network segments, so access to resources is granted per user and device rather than by network location. This enforces identity-centric control, satisfying zero trust's requirement that trust be continuously verified before any connection is established.

A software-defined perimeter hides internal applications behind an identity-based, need-to-know broker, granting per-session access only after device and user verification. This directly enforces least-privilege access to internal apps, unlike network-centric controls that expose services broadly.

Disabling PasswordAuthentication enforces key-only access, satisfying the key-based constraint, while explicitly restricting Ciphers and MACs to strong algorithms removes weak cryptographic suites. Together these directives harden the SSH daemon against both password brute force and downgrade attacks on the jump host.

Input validation ensures that user-supplied data conforms to expected formats, while output encoding (e.g., HTML entity encoding) ensures that any data rendered in the browser is treated as data, not executable code. Together, they prevent XSS by stopping malicious scripts from being injected and executed. This is a fundamental and effective mitigation for XSS.

TPM 2.0 provides the hardware root of trust: it stores boot measurements in Platform Configuration Registers and holds the attestation key used for remote attestation. PCRs reside in shielded TPM memory, so software cannot rewrite them, satisfying the tamper-resistant integrity measurement constraint.

Modified Attack Vector (MAV) is a valid CVSS environmental metric that adjusts the base Attack Vector to reflect how the vulnerability is actually exploitable in the organisation's environment, directly satisfying the stem's requirement to tailor the 7.5 base score.

Software-defined networking policies centralise control and enforce per-workload rules through a programmable controller, segmenting traffic independently of physical topology. This satisfies micro-segmentation's requirement for granular, identity- and workload-based east-west controls, unlike VLANs or subnet ACLs, which segment only at coarser network boundaries and cannot isolate individual workloads dynamically.

With ssl_verify_client optional, nginx requests a certificate but accepts connections lacking one, so the client certificate is never enforced as an authentication factor. Any client can complete the handshake without proving identity, satisfying the stem's concern that certificates are not required.

Accepting the risk means the risk owner acknowledges the legacy application's exposure and proceeds without encryption, absorbing potential loss. This matches risk acceptance rather than mitigation, transfer or avoidance, satisfying the stem's decision to tolerate the identified risk.

Retention schedules per classification level directly satisfy PCI DSS's requirement to define and enforce how long cardholder data is kept. Mapping each classification to a defined retention period ensures data is disposed of once its purpose expires, preventing the indefinite storage the audit identified.

Mean time to patch measures the average elapsed duration between patch release and deployment across systems, directly quantifying remediation speed. It isolates the time dimension of the patching programme, unlike coverage or count metrics, which describe breadth rather than how quickly critical patches are applied.

The secure web gateway is the SASE component that inspects and filters web traffic, enforcing acceptable-use and malware policies. Converging it into SASE delivers SWG filtering from the cloud edge, satisfying the requirement to combine network and security functions in one architecture.

A SOC 2 Type II report covers the design and operating effectiveness of controls over a review period, giving evidence that the provider's control environment actually functioned. Type I only assesses design at a point in time, so it cannot demonstrate sustained SOC 2 compliance during due diligence.

MDM with containerisation creates an encrypted work container separating corporate apps and data from personal content. IT can selectively wipe only that container remotely, leaving the employee's personal data and applications untouched on the BYOD device.

Encrypts memory for VMs, supports attestation.

A right-to-audit clause contractually grants the organisation the ability to inspect a critical vendor's security controls and evidence on demand, satisfying the requirement for ongoing visibility into their security posture rather than relying on one-off assurances.

Curve25519-sha256 and its libssh.org alias implement X25519, an elliptic-curve Diffie-Hellman exchange that does not use finite-field modular exponentiation and provides strong forward secrecy. Restricting KexAlgorithms to these two entries removes all classic DH group1/group14-sha1 and ECDH NIST-curve options, satisfying the requirement to avoid finite-field DH based key exchange.

INetSim simulates common internet services, allowing malware to receive responses as if it were communicating with real servers. This can trick the malware into revealing its C2 behavior, such as HTTP requests or DNS queries. It is a safe way to observe network activity without allowing actual external connections, which is essential in a sandbox environment.

Standing admin rights violate zero trust's assume-breach stance. Just-in-time privilege elevation grants access only when needed, then revokes it, shrinking the blast radius of compromised accounts. This directly satisfies the identity-centric requirement that entitlements are scoped and time-bound rather than permanent.

Just-in-time access issues credentials only for a bounded period, so stolen or misused sessions expire quickly. This shrinks the window attackers have to pivot between systems, directly delivering the reduced lateral-movement risk the stem asks for.

Phishing remains the primary initial access vector for ransomware, so training employees to recognise and report suspicious messages directly reduces the likelihood of successful compromise. This satisfies the preparation phase's requirement to build preventive human controls before an incident occurs, complementing technical safeguards such as email filtering and endpoint detection.

Keeping raw payment records local satisfies data residency, while forwarding normalized telemetry such as authentication events, network flows, and alerts gives the central SIEM the visibility needed for global threat detection. The telemetry is stripped of payment data, so no regulated records cross borders, and correlation across regions remains possible for detecting coordinated attacks.

The HIPAA Security Rule names the security management process as a required administrative safeguard. It obliges covered entities to conduct risk analysis, risk management, sanction policy and information system activity review, forming the governance foundation the rule mandates.

Failing to validate the 'alg' header lets attackers forge tokens by switching to 'none' or downgrading RS256 to HS256, signing with the public key as an HMAC secret. This directly satisfies the stem's authentication-integrity constraint, since unverified algorithm choice undermines every downstream authorisation decision in the microservices chain.

Digitally signing firmware with a private key lets devices verify the signature using the corresponding public key before installation, so any tampered or forged image fails validation. This cryptographically ensures only vendor-authorised firmware is accepted.

UEBA baselines each user's and entity's normal activity, then flags statistical deviations such as logons outside business hours and anomalous data volumes. Unlike static correlation rules, it detects subtle, gradual changes in behaviour, directly satisfying the requirement to identify off-hours access and unusual transfer patterns.

ChaCha20-Poly1305 relies solely on ARX operations, which execute efficiently in software on CPUs lacking AES-NI hardware acceleration. AES-256-GCM depends on dedicated AES instructions for competitive throughput, so on such constrained devices ChaCha20-Poly1305 delivers markedly faster encryption, directly satisfying the stem's "certain environments" constraint.

Authentication logs from Microsoft Entra ID or Active Directory record who logged on, when, from where and whether attempts failed. These identity events form the core behavioural baseline UBA needs to flag anomalous insider sign-in patterns, such as impossible travel or off-hours access, satisfying the stem's requirement for normal user behaviour data.

ISO 22301 requires documented scope and policy as the foundation of the BCMS, defining which parts of the organisation, locations and services the plan covers and the top-management commitment governing it. This satisfies the stem's requirement for a mandatory BCP component under the standard.

Direct Connect and ExpressRoute provide dedicated private circuits from on-premises into the cloud provider's network, so traffic never traverses the public internet. This satisfies the low-latency, private connectivity constraint, unlike site-to-site VPNs, which still ride the internet.

Health-checked global server load balancing continuously probes each regional API endpoint and withdraws a failed region from DNS answers, so existing clients resolve to a healthy region on their next lookup without any client-side change. This directly addresses regional failover for API consumers while preserving a single stable hostname.