Courseiva

CompTIA SecurityX (CAS-005) (CAS-005) — Questions 376–450

968 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 13

Page 7
376
MCQhard

A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?

A.Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].
B.Set runAsNonRoot: false and readOnlyRootFilesystem: true.
C.Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].
D.Set privileged: true and readOnlyRootFilesystem: false.
AnswerA

Drops all capabilities, enforces non-root, and read-only filesystem – defense in depth against escapes.

Why this answer

Setting `runAsNonRoot: true` prevents the container from running as the root user, `readOnlyRootFilesystem: true` prevents writes to the container's root filesystem, and dropping all Linux capabilities with `drop: ['ALL']` removes all kernel privileges. Together, these three settings at the pod security context level drastically reduce the attack surface for container escape attacks by eliminating common privilege escalation vectors.

Exam trap

The CAS-004 exam often tests the misconception that setting a specific `runAsUser` (like 1000) is equivalent to enforcing non-root execution, when in fact `runAsNonRoot: true` is the explicit directive that prevents root UID (0) from being used, regardless of the numeric UID set.

How to eliminate wrong answers

Option B is wrong because `runAsNonRoot: false` allows the container to run as root, which is a primary vector for container escape; even with a read-only root filesystem, a root process can still use capabilities or syscalls to break out. Option C is wrong because setting `runAsUser: 1000` does not prevent running as root (it only sets a specific UID but does not enforce non-root), and adding `NET_ADMIN` capability grants network administration privileges that can be abused for escape, increasing risk rather than reducing it. Option D is wrong because `privileged: true` disables all security isolation, effectively giving the container host-level access, and `readOnlyRootFilesystem: false` allows writes to the root filesystem, making container escape trivial.

Full explanation →
377
MCQeasy

A mid-sized healthcare organization processes protected health information (PHI) and must comply with HIPAA and the GDPR for its EU patients. The organization uses a hybrid cloud environment with on-premises servers and AWS. Recently, an employee's laptop was stolen containing unencrypted PHI. The incident response team was activated. The security architect must determine the best course of action to address compliance obligations. The organization has a data classification policy, but it is not consistently enforced. A business continuity plan exists but has not been tested in two years. The CEO is concerned about reputational damage and legal liability. Which of the following should the security architect recommend FIRST?

A.Purchase cyber liability insurance to cover potential fines and legal costs
B.Notify affected patients and relevant regulatory authorities per breach notification rules
C.Implement full-disk encryption on all laptops and mobile devices immediately
D.Update the data classification policy to require encryption of all PHI on endpoints
AnswerB

Both HIPAA and GDPR require timely notification of data breaches; this is the first step in incident response compliance.

Why this answer

Under both HIPAA and GDPR, the primary immediate obligation after a data breach involving PHI is to notify affected individuals and relevant authorities within prescribed timeframes (72 hours for GDPR, and within 60 days for HIPAA). This demonstrates compliance and mitigates legal and reputational risk. Option A is wrong because purchasing cyber liability insurance is a financial risk transfer mechanism that does not satisfy the legal requirement to notify; it addresses potential costs but not the immediate compliance obligation.

Option C is wrong while full-disk encryption is a preventive control that should be implemented, it does not address the current breach; notification must come first. Option D is wrong because updating the data classification policy is a long-term improvement, but the immediate priority is fulfilling breach notification requirements.

Full explanation →
378
MCQeasy

A financial institution must comply with the Sarbanes-Oxley Act (SOX). Which of the following is a primary focus of SOX compliance?

A.Security of credit card transactions
B.Privacy of health information
C.Protection of personally identifiable information (PII)
D.Accuracy and reliability of financial reporting
AnswerD

SOX is about financial integrity and internal controls.

Why this answer

SOX focuses on internal controls over financial reporting (ICFR) and requires management to assess and report on the effectiveness of these controls, which includes IT controls that impact financial data.

Full explanation →
379
MCQhard

A company is deploying a containerized application on Kubernetes. The security team requires that only signed images from a private registry be used and that containers run without privileged mode. Which Kubernetes admission controller should be configured to enforce both requirements?

A.NodeRestriction
B.PodSecurity
C.ImagePolicyWebhook
D.AlwaysPullImages
AnswerB

PodSecurity (or Pod Security Admission) with a restricted profile disallows privileged containers and can be extended with external webhooks for image signing.

Why this answer

PodSecurity is the correct admission controller because it enforces Pod Security Standards (PSS) that can restrict containers from running in privileged mode (via the `privileged` policy) and can be combined with other mechanisms (e.g., image verification) to ensure only signed images are used. While PodSecurity itself does not directly verify image signatures, it can be paired with a separate admission controller like ImagePolicyWebhook or a mutating webhook to enforce signed images, and the question's phrasing implies a single controller that addresses both requirements—PodSecurity is the only option that natively handles the privileged mode restriction and can integrate with signature enforcement. The other options either lack the ability to enforce both conditions or address only one aspect.

Exam trap

CompTIA often tests the misconception that ImagePolicyWebhook alone can enforce both image signing and security contexts, but it only handles image validation and has no capability to restrict privileged containers.

How to eliminate wrong answers

Option A (NodeRestriction) is wrong because it only limits the kubelet's ability to modify node and pod objects, not enforce image signing or privileged mode restrictions. Option C (ImagePolicyWebhook) is wrong because it only validates image signatures via an external webhook but does not enforce privileged mode restrictions on containers. Option D (AlwaysPullImages) is wrong because it only ensures images are pulled every time a pod starts, which does not enforce image signing or prevent privileged mode.

Full explanation →
380
MCQmedium

A security architect is designing a PKI for an organization that requires high assurance certificates. The architect needs to protect the root CA private key. Which solution provides the highest level of security for the root CA key?

A.Store the key in an encrypted file on a secure server
B.Generate the key on a dedicated virtual machine
C.Use a Hardware Security Module (HSM) for key management
D.Keep the key on a smart card stored in a safe
AnswerC

HSMs provide physical tamper protection and dedicated cryptographic processing, meeting high assurance requirements.

Why this answer

Hardware Security Modules (HSMs) provide tamper-resistant, dedicated hardware for key generation and storage, offering the highest security for root CA keys. Smart cards are less secure for large-scale root CA operations. Encrypted files on a server are vulnerable.

A dedicated VM provides software-based isolation but is less secure than HSM.

Full explanation →
381
MCQeasy

Which component of the MITRE ATT&CK framework categorizes the 'why' of an adversary's action, such as initial access or credential access?

A.Tactics
B.Mitigations
C.Procedures
D.Techniques
AnswerA

Tactics represent the adversarial goal or 'why'.

Why this answer

Tactics represent the adversary's goal or reason for performing an action, such as gaining initial access.

Full explanation →
382
MCQhard

An organization is migrating to a hybrid cloud model. The security policy mandates that all keys used for data encryption must be managed on-premises. Which key management solution should be used?

A.Cloud KMS with BYOK
B.HSM on-premises with key escrow
C.Software-based key store on-premises
D.Cloud HSM
AnswerB

On-premises HSM keeps keys locally, satisfying the policy; key escrow provides backup.

Why this answer

An on-premises Hardware Security Module (HSM) with key escrow satisfies the mandate that all encryption keys must be managed on-premises. HSMs provide tamper-resistant, FIPS 140-2 Level 3/4 validated hardware for key generation, storage, and cryptographic operations, while key escrow ensures keys can be recovered by authorized personnel. This combination meets the hybrid cloud requirement of keeping key management entirely within the organization's physical control.

Exam trap

CompTIA often tests the distinction between 'key material location' and 'key management control'—candidates mistakenly think BYOK (Option A) keeps keys on-premises, but BYOK only imports the key once, after which the cloud provider manages the key lifecycle, failing the 'managed on-premises' requirement.

How to eliminate wrong answers

Option A is wrong because Cloud KMS with BYOK still stores the key material in the cloud provider's HSM, and the key management lifecycle (rotation, deletion, access policies) is partially controlled by the cloud provider, violating the 'managed on-premises' mandate. Option C is wrong because a software-based key store on-premises lacks the tamper-proof hardware protection required for enterprise-grade key management; it is vulnerable to OS-level attacks and does not meet compliance standards like FIPS 140-2. Option D is wrong because Cloud HSM is a fully managed cloud service where the HSM is physically located in the cloud provider's data center, meaning key management is not on-premises.

Full explanation →
383
MCQhard

An incident responder is analyzing a malware sample obtained from an infected host. The responder wants to perform dynamic analysis to observe the malware's behavior in a safe environment. Which of the following is the best approach?

A.Check the PE header for imported functions
B.Disassemble the malware using IDA Pro
C.Run strings on the malware binary
D.Execute the malware in a virtual machine with network monitoring tools
AnswerD

This allows observing behavior safely.

Why this answer

Dynamic analysis involves running the malware in a controlled environment like a sandbox to observe its behavior, including network traffic, file system changes, and registry modifications.

Full explanation →
384
MCQmedium

A security analyst is reviewing alerts from a SIEM and notices multiple failed login attempts from a single IP address to different user accounts over a 5-minute window. What should the analyst do FIRST?

A.Block the IP address at the firewall.
B.Isolate all endpoints that received the login attempts.
C.Check the source IP and correlate with other logs to confirm suspicious activity.
D.Reset all user accounts that were targeted.
AnswerC

Verification is the first step before taking action.

Why this answer

In incident response, the first step is to verify the alert before taking any action. The analyst should check the source IP and correlate the failed login attempts with other logs (e.g., VPN logs, IDS alerts, or previous successful logins) to determine if this is a brute-force attack, a misconfigured application, or a false positive. Prematurely blocking the IP (option A) could disrupt legitimate traffic if the IP is a shared proxy or NAT.

Isolating endpoints (option B) is excessive without confirmation that the attempts were successful or that the endpoints are compromised. Resetting all targeted accounts (option D) is disruptive and unnecessary without evidence of compromise. Therefore, the correct first step is to verify and correlate the alert (option C).

Full explanation →
385
MCQmedium

A company is required to comply with PCI DSS. What is the primary purpose of conducting quarterly network vulnerability scans?

A.To ensure firewall rules are correctly configured
B.To verify encryption strength
C.To detect and remediate vulnerabilities in a timely manner
D.To monitor user access logs
AnswerC

Quarterly scans help maintain security by finding vulnerabilities regularly.

Why this answer

PCI DSS Requirement 11.2 mandates quarterly external and internal vulnerability scans to identify and address vulnerabilities.

Full explanation →
386
MCQhard

During a red team exercise, the team gains access to a workstation and needs to maintain persistence. They modify a registry run key to execute a payload. However, the organization uses EDR that monitors registry changes. Which technique could the red team use to avoid detection?

A.Delete the registry key after execution
B.Change the registry key to a less suspicious name
C.Encrypt the registry key value
D.Use a LOLBin to execute the payload via a scheduled task
AnswerD

LOLBins are less likely to be flagged as malicious by EDR.

Why this answer

Living-off-the-land binaries (LOLBins) use legitimate system tools to execute code, which can blend in with normal activity and avoid EDR detection.

Full explanation →
387
Multi-Selectmedium

A risk manager is applying the FAIR model to quantify a risk. Which TWO of the following are primary components used in FAIR analysis? (Select TWO.)

Select 2 answers
A.Loss Magnitude (LM)
B.Single Loss Expectancy (SLE)
C.Annual Loss Expectancy (ALE)
D.Loss Event Frequency (LEF)
E.Annualized Rate of Occurrence (ARO)
AnswersA, D

The probable magnitude of a loss event.

Why this answer

FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO) are used in quantitative risk analysis (e.g., ALE), but not primary FAIR components. Exposure Factor (EF) is part of SLE calculation.

Annual Loss Expectancy (ALE) is a result, not a component.

Full explanation →
388
Multi-Selecthard

An organization is implementing a vendor risk management program and is reviewing a contract that includes a right-to-audit clause. Which THREE of the following are common elements that should be verified during such an audit? (Select THREE.)

Select 3 answers
A.Employee satisfaction surveys
B.Vendor's financial stability
C.Access control mechanisms
D.Incident response procedures
E.Data encryption practices
AnswersC, D, E

Access controls are critical to protect data.

Why this answer

Right-to-audit allows the customer to verify vendor compliance. Common audit areas include security controls, data handling, incident response, and access controls.

Full explanation →
389
MCQhard

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

A.The policy restricts access to specific resources
B.The policy does not enable logging
C.The policy violates the principle of least privilege
D.The policy does not allow any actions
AnswerC

Granting all actions on all resources is excessive and violates least privilege.

Why this answer

The IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Exam trap

The CAS-004 exam often tests the principle of least privilege by presenting a policy that appears functional (allows actions) but is overly permissive, tricking candidates into focusing on whether the policy 'works' rather than whether it complies with security best practices.

How to eliminate wrong answers

Option A is wrong because the policy does not restrict access to specific resources; it uses 'Resource': '*' to allow access to all resources, which is the opposite of restriction. Option B is wrong because IAM policies themselves do not enable or disable logging; logging is configured separately via services like AWS CloudTrail or Azure Monitor, and the absence of logging is not a compliance issue inherent to the policy statement. Option D is wrong because the policy explicitly allows all actions via 'Action': '*', so it does allow actions; the problem is that it allows too many actions, not none.

Full explanation →
390
MCQhard

A security analyst calculates the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

A.$50,200
B.$2,500
C.$10,000
D.$250,000
AnswerC

Correct calculation: $50,000 × 0.2 = $10,000.

Why this answer

ALE = SLE × ARO = $50,000 × 0.2 = $10,000.

Full explanation →
391
MCQeasy

An organization uses Kubernetes to orchestrate containers. Which practice enhances the security of pod-to-pod communication?

A.Implement network policies that restrict ingress and egress traffic based on labels.
B.Expose all pods via NodePort services.
C.Use ClusterIP services for all internal traffic.
D.Rely on the default Kubernetes network configuration.
AnswerA

Network policies enforce least-privilege communication.

Why this answer

Network policies in Kubernetes act as a firewall for pods, allowing you to define ingress and egress rules based on labels, namespaces, or IP blocks. By default, all pod-to-pod traffic is allowed; implementing network policies restricts this traffic to only what is explicitly permitted, thereby enhancing security by enforcing the principle of least privilege.

Exam trap

A common misconception is that ClusterIP services inherently secure pod-to-pod communication, but ClusterIP only provides service discovery and load balancing, not traffic filtering or segmentation.

How to eliminate wrong answers

Option B is wrong because exposing all pods via NodePort services opens them to external network access on every node's IP, which increases the attack surface and bypasses pod-level segmentation. Option C is wrong because ClusterIP services only provide a stable internal IP for load balancing traffic to pods; they do not restrict or filter traffic between pods themselves. Option D is wrong because the default Kubernetes network configuration allows all pod-to-pod traffic with no restrictions, which is insecure and does not enforce any segmentation or access control.

Full explanation →
392
MCQmedium

An organization wants to implement infrastructure as code (IaC) with immutable infrastructure. Which security benefit does immutable infrastructure provide?

A.Better performance through caching
B.Reduced attack surface due to consistent configurations
C.Simpler network segmentation
D.Easier patch management
AnswerB

Immutable infrastructure ensures consistent, known-good configurations, reducing drift and vulnerabilities.

Why this answer

Immutable infrastructure enforces that servers are never modified after deployment; updates are made by replacing the entire server, reducing configuration drift and vulnerabilities.

Full explanation →
393
MCQhard

A security analyst reviews logs from a web application firewall (WAF) and notices that an attacker is bypassing the WAF by encoding malicious payloads using base64 and then sending them in HTTP headers. Which WAF configuration change would BEST detect and block such attacks?

A.Enable geoblocking to restrict traffic from the attacker's country
B.Implement strict HTTP protocol validation to reject malformed requests
C.Add custom signatures to detect base64-encoded patterns in headers
D.Increase the rate limiting threshold to allow more requests per second
AnswerC

Custom signatures can identify known encoded attack patterns.

Why this answer

Base64-encoded payloads in HTTP headers are a known evasion technique that bypasses signature-based WAF rules designed for plaintext attacks. By adding custom signatures that specifically match base64-encoded patterns (e.g., detecting long strings of base64 characters or known malicious base64 strings), the WAF can decode and inspect the payload before applying detection logic. This directly addresses the attacker's encoding method without relying on generic protocol or rate controls.

Exam trap

The trap here is that candidates confuse protocol-level validation (Option B) with content inspection, assuming strict RFC compliance would catch encoded payloads, but base64 is perfectly valid HTTP header content and requires application-layer decoding logic to detect.

How to eliminate wrong answers

Option A is wrong because geoblocking restricts traffic based on source IP country, which does not detect or block the encoded payload itself; the attacker can use proxies or VPNs to bypass geolocation filters. Option B is wrong because strict HTTP protocol validation (RFC 7230) rejects malformed requests (e.g., invalid headers or method), but base64-encoded payloads in headers are syntactically valid HTTP; the WAF would not reject them based on protocol alone. Option D is wrong because increasing the rate limiting threshold allows more requests per second, which does not inspect or block the malicious content; it only prevents volumetric attacks, not payload-level evasion.

Full explanation →
394
MCQhard

A security analyst is reviewing logs from a SIEM and notices that a user account has been successfully authenticated from two different geographic locations within a short time span, which is impossible. The SIEM uses user behavior analytics (UBA). What type of anomaly is this most likely to detect?

A.A credential theft and reuse incident
B.A misconfigured VPN that routes traffic through multiple gateways
C.A brute-force attack on the user account
D.A man-in-the-middle attack intercepting the authentication
AnswerA

Impossible travel indicates the credentials may have been stolen and used by an attacker from a different location.

Why this answer

UBA establishes a baseline of normal user behavior, such as typical login locations and times. An impossible travel event (e.g., logging in from two distant locations within minutes) is a common anomaly that triggers an alert.

Full explanation →
395
Multi-Selectmedium

A SOC wants to improve detection of advanced persistent threats (APTs) that evade traditional signature-based tools. Which TWO approaches are most effective? (Select exactly 2.)

Select 2 answers
A.Reduce the false positive rate of the SIEM
B.Increase log retention period to 12 months
C.Hire additional security analysts
D.Deploy honeypots and deception technology
E.Integrate external threat intelligence feeds into the SIEM
AnswersD, E

Honeypots lure attackers and reveal their presence.

Why this answer

Options D and E are correct. Deploying honeypots and deception technology (D) helps detect APTs by luring attackers into revealing themselves, while integrating external threat intelligence feeds (E) enables the SIEM to detect known indicators of compromise that may evade traditional signatures. Option A reduces false positives but does not directly improve APT detection.

Option B increases log retention but does not enhance detection capability. Option C adds analysts, which is not a technology-based approach and less effective for detecting APTs that bypass signatures.

Full explanation →
396
MCQeasy

A company wants to protect sensitive data stored in a public cloud bucket. Which of the following is the MOST effective control to prevent accidental public exposure?

A.Enable bucket logging
B.Implement lifecycle policies
C.Use server-side encryption
D.Apply resource-based policies with explicit deny for public access
AnswerD

Explicit deny prevents any public access, even if other permissions accidentally allow it.

Why this answer

Resource-based policies with an explicit deny for public access are the most effective control because they override any allow statements that might inadvertently grant public access. In cloud providers like AWS, an explicit deny in a bucket policy takes precedence over all other permissions, ensuring that even if other settings (like ACLs) allow public access, the deny blocks it. This directly prevents accidental exposure by enforcing a strict boundary on who can access the bucket.

Exam trap

The trap here is that candidates often confuse encryption (Option C) with access control, mistakenly thinking encrypting data prevents unauthorized reading, but encryption only protects the data's confidentiality if the key is managed separately—it does not block public read requests to the bucket.

How to eliminate wrong answers

Option A is wrong because bucket logging records access requests but does not prevent public exposure; it only provides audit trails after the fact. Option B is wrong because lifecycle policies manage object transitions or deletions based on age, not access permissions, so they have no effect on public exposure. Option C is wrong because server-side encryption protects data at rest from unauthorized decryption but does not control who can read the bucket or its objects; a publicly accessible bucket with encryption is still publicly readable.

Full explanation →
397
MCQhard

A security architect is designing a secure connectivity solution between an on-premises data center and a public cloud provider. The solution must provide low latency, high bandwidth, and avoid traversing the public internet. Which approach BEST meets these requirements?

A.SSL VPN
B.SD-WAN over internet
C.Direct Connect
D.Site-to-site VPN over internet
AnswerC

Direct Connect is a dedicated private connection that avoids the internet.

Why this answer

Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the internet for low latency and high bandwidth.

Full explanation →
398
MCQmedium

An organization is implementing a threat hunting program. The team decides to use a hypothesis-driven approach. Which of the following best describes this methodology?

A.Developing a theory about potential adversary behavior and actively looking for signs
B.Searching for known indicators of compromise from threat feeds
C.Automated scanning of all systems for vulnerabilities
D.Analyzing historical alerts for patterns
AnswerA

This describes hypothesis-driven hunting.

Why this answer

Hypothesis-driven threat hunting starts with a hypothesis based on threat intelligence or risk assessments, then searches for evidence of that hypothesis in the environment.

Full explanation →
399
MCQhard

An organization must comply with FedRAMP requirements for a cloud service. Which aspect of cloud security is most directly assessed under FedRAMP?

A.Data residency compliance
B.Cost optimization of cloud resources
C.Security controls of the cloud service provider
D.Performance SLA
AnswerC

FedRAMP evaluates the effectiveness of security controls per NIST SP 800-53.

Why this answer

FedRAMP is a US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services, focusing on the security controls implemented by the cloud service provider.

Full explanation →
400
MCQhard

A security architect is designing a system that requires hardware-enforced isolation for sensitive computations. Which technology provides the strongest isolation by running code in a protected environment within the CPU?

A.HSM
B.TPM 2.0
C.Intel SGX
D.ARM TrustZone
AnswerC

SGX creates enclaves that protect code and data from privileged software.

Why this answer

Intel SGX provides enclaves that isolate code and data even from the operating system, offering strong hardware isolation.

Full explanation →
401
MCQmedium

A security architect is designing a zero trust architecture for a financial services company. Which component is MOST critical to enforce identity-centric access control in a zero trust model?

A.Network firewall
B.Intrusion prevention system
C.Software-defined perimeter
D.VPN concentrator
AnswerC

SDP creates identity-based, micro-segmented access.

Why this answer

In zero trust, every access request is authenticated, authorized, and encrypted. A software-defined perimeter (SDP) provides identity-centric, micro-segmented access that hides network resources and enforces least privilege.

Full explanation →
402
MCQmedium

A financial institution is required to comply with PCI DSS and uses a mix of legacy and modern applications. The security architect proposes to segment the network so that the cardholder data environment (CDE) is isolated. However, a legacy application in a non-CDE segment must send data to a database in the CDE. The legacy application cannot be modified and communicates via clear-text protocols. Which of the following is the most secure solution that maintains compliance?

A.Replace the legacy application immediately
B.Use a bastion host to terminate TLS on behalf of the legacy application and forward via a one-way replication
C.Place the legacy application in the CDE and isolate it with a firewall
D.Install a network-based DLP sensor to monitor traffic
AnswerB

Encrypts traffic and limits the legacy application's direct access.

Why this answer

A bastion host with TLS termination can wrap clear-text traffic in encryption, and strict firewall rules prevent direct access.

Full explanation →
403
MCQhard

An organization wants to implement a zero-trust architecture for remote access. Which component is most critical for enforcing least-privilege access to internal applications?

A.Virtual private network (VPN) concentrator
B.Software-defined perimeter (SDP)
C.Next-generation firewall (NGFW)
D.Intrusion detection system (IDS)
AnswerB

SDP creates a micro-perimeter around each application, authenticating and authorizing per session.

Why this answer

A software-defined perimeter (SDP) uses a controller to authenticate users and devices before granting access to specific applications, hiding the network from unauthorized users. VPNs extend network access, IDS only detects, and firewalls enforce network-level rules but not user/device granularity.

Full explanation →
404
MCQmedium

A security administrator is hardening SSH access to a jump host. The requirement is to allow only key-based authentication and restrict the use of weak cryptographic algorithms. Which of the following configurations accomplishes this?

A.Set PermitRootLogin prohibit-password and PasswordAuthentication yes
B.Set PubkeyAuthentication yes, PasswordAuthentication no, and configure Ciphers and MACs to strong algorithms only
C.Set PasswordAuthentication yes and use a strong password policy
D.Set AuthenticationMethods publickey,keyboard-interactive
AnswerB

This enforces key-based auth and removes weak ciphers/MACs.

Why this answer

Setting PubkeyAuthentication yes and PasswordAuthentication no enforces key-only access. Disabling weak ciphers and MACs ensures strong cryptographic algorithms are used. Option A permits password authentication with 'PasswordAuthentication yes'.

Option C allows passwords. Option D allows keyboard-interactive, which can include passwords. Only Option B meets both requirements.

Full explanation →
405
MCQmedium

An organization wants to implement a hardware root of trust for measuring system integrity at boot. Which technology should be used to store measurements in Platform Configuration Registers (PCRs) and support remote attestation?

A.HSM
B.Secure Enclave
C.TPM 2.0
D.UEFI Secure Boot
AnswerC

TPM 2.0 includes PCRs for boot measurements and attestation capabilities.

Why this answer

TPM 2.0 provides PCRs for measured boot and supports attestation, making it suitable for hardware root of trust.

Full explanation →
406
MCQmedium

A systems administrator must automate the patching of 200 Windows servers. The environment has strict security requirements and change management. Which scripting approach best balances automation and control?

A.Use PowerShell DSC (Desired State Configuration) with a pull server and authorized users via JEA.
B.Write a Python script that uses WMI to apply patches and reboot servers.
C.Create a scheduled task on each server that runs a script from a network share.
D.Use Group Policy to install updates during the next restart.
AnswerA

DSC ensures desired state, JEA provides least privilege, and pull server allows control and auditing.

Why this answer

PowerShell DSC with a pull server enforces a desired configuration state across all servers, ensuring patches are applied consistently. Combining this with Just Enough Administration (JEA) restricts authorized users to only the necessary commands, providing granular control and auditability, which meets strict security and change management requirements.

Exam trap

The trap here is that candidates often choose a simpler scripting approach (like Python with WMI or scheduled tasks) because they focus on automation speed, overlooking the critical requirement for centralized control, auditability, and security that DSC with JEA uniquely provides.

How to eliminate wrong answers

Option B is wrong because a Python script using WMI lacks built-in idempotency and centralized reporting, making it harder to enforce consistent state and audit changes across 200 servers. Option C is wrong because a scheduled task running a script from a network share introduces a single point of failure and security risks (e.g., credential exposure, unauthorized script modification), and does not provide robust change control. Option D is wrong because Group Policy for updates only applies during restart and does not offer real-time compliance enforcement or granular authorization, failing to meet strict automation and control needs.

Full explanation →
407
Multi-Selectmedium

A security analyst is reviewing a CVSS score for a vulnerability that affects a critical server. The base score is 7.5, but the analyst needs to adjust for the environment. Which TWO of the following are valid CVSS environmental metrics that can modify the score? (Choose two.)

Select 2 answers
A.Exploit Code Maturity (ECM)
B.Privileges Required (PR)
C.Modified Attack Vector (MAV)
D.Attack Vector (AV)
E.Modified Privileges Required (MPR)
AnswersC, E

Modified Attack Vector is an environmental metric that adjusts the base Attack Vector based on the environment.

Why this answer

CVSS environmental metrics include Confidentiality Requirement, Integrity Requirement, and Availability Requirement (the CIA requirements), as well as Modified Attack Vector, Modified Attack Complexity, etc. The question asks for metrics that modify the score; Modified Attack Vector and Modified Privileges Required are environmental metrics that adjust the base according to the environment.

Full explanation →
408
Multi-Selectmedium

A security architect is designing a zero trust network architecture and needs to implement micro-segmentation. Which TWO of the following techniques are commonly used to achieve micro-segmentation? (Select TWO).

Select 2 answers
A.Network Access Control (NAC)
B.Software-defined networking (SDN) policies
C.IPsec VPN tunnels between subnets
D.Host-based firewalls
E.VLAN segmentation
AnswersB, D

SDN enables dynamic, granular policy enforcement between workloads.

Why this answer

Micro-segmentation can be implemented using software-defined networking (SDN) policies and host-based firewalls (e.g., via agents) to control traffic between workloads at a granular level. VLANs are too coarse; IPsec VPNs are for site-to-site, not internal segmentation.

Full explanation →
409
MCQeasy

An engineer reviews the TLS configuration for a web server, which includes the following line: ssl_verify_client optional; Which of the following is a security concern present in this configuration?

A.The cipher suite does not include perfect forward secrecy (PFS).
B.The configuration supports outdated TLS 1.2 protocols.
C.The private key is stored in an accessible location.
D.The server does not require client certificates for authentication.
AnswerD

With ssl_verify_client = optional, clients can skip certificate authentication, weakening mutual authentication.

Why this answer

The TLS configuration sets ssl_verify_client to optional, allowing clients to connect without a certificate. This undermines mutual TLS (mTLS) enforcement, leaving the server vulnerable to unauthorized access if client authentication is expected. Option A is incorrect; perfect forward secrecy is provided by modern cipher suites, and its absence is not a concern here.

Option B is incorrect; TLS 1.2 and 1.3 are industry-standard secure protocols. Option C is incorrect; the private key path is outside the document root and properly secured, which is a typical configuration.

Full explanation →
410
MCQhard

An organization's security policy defines that all sensitive data must be encrypted. However, a business unit has a legacy application that cannot support encryption without a major rewrite. The risk owner decides to accept the risk. This is an example of which risk treatment strategy?

A.Risk acceptance
B.Risk mitigation
C.Risk transfer
D.Risk avoidance
AnswerA

The risk owner formally accepts the residual risk.

Why this answer

Risk acceptance is acknowledging the risk and deciding to tolerate it without additional controls, often documented in a risk register.

Full explanation →
411
Multi-Selecthard

During a compliance audit for PCI DSS, the auditor identifies that cardholder data is stored beyond the required retention period. The organization wants to implement proper data lifecycle management. Which THREE of the following should the organization include in its data retention policy? (Select THREE.)

Select 3 answers
A.Encryption requirements for data in transit
B.Retention schedules for each data classification level
C.Process for legal hold to suspend deletion
D.Data classification scheme definitions
E.Secure disposal methods for data at end of life
AnswersB, C, E

Specifies how long each type of data should be kept.

Why this answer

A data retention policy should specify retention schedules for each data type, define secure destruction methods, and include a process for legal hold exceptions. Encryption during transmission is a security control, not a retention policy element. The data classification scheme is separate from retention.

Full explanation →
412
MCQmedium

A security team is evaluating the effectiveness of their patching program. Which metric would best indicate how quickly the organization applies critical patches?

A.Number of unpatched systems
B.Patch compliance percentage
C.Mean time to patch
D.Vulnerabilities by severity
AnswerC

This directly measures how quickly patches are applied.

Why this answer

Mean time to patch measures the average time from patch release to deployment, indicating responsiveness.

Full explanation →
413
MCQmedium

An organization is adopting SASE to converge network and security functions. Which component of SASE provides secure web gateway (SWG) capabilities?

A.ZTNA
B.SD-WAN
C.Secure Web Gateway
D.CASB
AnswerC

Correct; SWG provides web filtering and threat protection.

Why this answer

SWG is a key SASE component that protects users from web-based threats by filtering traffic.

Full explanation →
414
MCQmedium

A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?

A.SOC 2 Type II report
B.ISO 27001 certificate
C.Penetration test report
D.Vulnerability scan results
AnswerA

This report evaluates the design and operating effectiveness of controls over time, suitable for assessing a service provider's control environment.

Why this answer

A SOC 2 Type II report provides an auditor's opinion on the effectiveness of controls over a period, directly addressing the service provider's control environment and compliance with Trust Services Criteria.

Full explanation →
415
MCQmedium

A cloud security engineer reviews the above S3 bucket policy. Which of the following is the most significant security concern?

A.The bucket policy grants unnecessary permissions for s3:GetObject.
B.The IP address restriction uses an incorrect format for the condition key.
C.The bucket policy allows public read access to all objects.
D.The bucket policy allows any user to upload objects to the bucket.
AnswerD

The second statement grants s3:PutObject to Principal "*", meaning anyone can write to the bucket.

Why this answer

The bucket policy statement includes a Principal of '*' and an Action of 's3:PutObject' without any condition restricting who can upload, meaning any unauthenticated user on the internet can write objects to the bucket. This creates a severe data integrity and malware-upload risk, as attackers can place arbitrary content into the bucket, potentially leading to data corruption, storage cost abuse, or serving malicious files.

Exam trap

CompTIA often tests the distinction between read and write permissions in S3 policies, and the trap here is that candidates focus on the IP restriction or the read permission being 'public' while overlooking that the write action (s3:PutObject) has no such restriction, making it the more dangerous vulnerability.

How to eliminate wrong answers

Option A is wrong because s3:GetObject is explicitly allowed only to the specific AWS account root user (AWS:SourceOwner condition) and only from the allowed VPC endpoint, so it is not 'unnecessary'—it is the intended read permission for that trusted principal. Option B is wrong because the IP address restriction uses the 'aws:SourceIp' condition key with a valid CIDR notation (10.0.0.0/16), which is the correct format for IP-based conditions in S3 bucket policies. Option C is wrong because the bucket policy does not allow public read access; the s3:GetObject action is restricted by both the SourceOwner condition and the VpcSourceIp condition, so anonymous users cannot read objects.

Full explanation →
416
MCQeasy

A security architect is designing a secure remote access solution for employees using personal devices (BYOD). The company requires that corporate data is separated from personal data and can be wiped remotely without affecting personal data. Which solution best meets these requirements?

A.Deploy a virtual desktop infrastructure (VDI) solution
B.Provide a full VPN client and remote wipe capability
C.Implement mobile device management (MDM) with containerization
D.Require employees to use company-owned devices only
AnswerC

MDM containerization isolates corporate data and allows selective wipe.

Why this answer

Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the BYOD device that isolates corporate data from personal data. The MDM policy can remotely wipe only the corporate container (selective wipe) without affecting the user's personal apps, photos, or settings, meeting both separation and remote wipe requirements.

Exam trap

The trap here is that candidates confuse full-device remote wipe (common in early MDM) with selective wipe, or assume VDI inherently provides client-side data separation, when in fact containerization is the precise mechanism for BYOD data isolation and selective wipe.

How to eliminate wrong answers

Option A is wrong because VDI streams a full desktop session to the device but does not inherently separate or wipe corporate data stored locally on the BYOD device; it relies on server-side isolation, not client-side containerization. Option B is wrong because a full VPN client only encrypts network traffic and does not enforce data separation on the device; remote wipe capability in this context typically wipes the entire device, not just corporate data. Option D is wrong because requiring company-owned devices violates the BYOD premise and does not address the requirement of allowing personal devices.

Full explanation →
417
Multi-Selecthard

A security engineer is designing a secure enclave for processing sensitive personally identifiable information (PII). The enclave must protect data at rest and in use, and must support attestation to verify its integrity. Which THREE technologies should the engineer incorporate? (Choose three.)

Select 3 answers
A.Trusted Platform Module (TPM)
B.AMD Secure Encrypted Virtualization (SEV)
C.ARM TrustZone
D.Intel Software Guard Extensions (SGX)
E.Hardware Security Module (HSM)
AnswersB, C, D

Encrypts memory for VMs, supports attestation.

Why this answer

AMD Secure Encrypted Virtualization (SEV) encrypts the memory of virtual machines, protecting data in use from the hypervisor and other VMs. It also supports attestation via the AMD Secure Processor, which generates a signed measurement of the VM's initial state, allowing a remote party to verify integrity. This makes SEV a valid choice for a secure enclave that must protect data at rest and in use and support attestation.

Exam trap

CompTIA often tests the distinction between hardware roots of trust (TPM, HSM) and actual secure enclave technologies (SGX, SEV, TrustZone), so candidates mistakenly choose TPM or HSM because they associate them with 'trust' and 'security' without understanding that enclaves require isolated memory regions for processing data in use.

Full explanation →
418
MCQmedium

An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?

A.Non-disclosure agreement (NDA)
B.Service-level agreement (SLA) for uptime
C.Right-to-audit clause
D.Data processing agreement (DPA)
AnswerC

Correct: This clause gives the organization the right to audit the vendor's security controls.

Why this answer

A right-to-audit clause allows the organization to audit the vendor's controls and verify compliance.

Full explanation →
419
Multi-Selectmedium

A security analyst is performing a risk assessment for a critical application. Which TWO of the following are characteristics of a quantitative risk assessment methodology?

Select 2 answers
A.Calculates Annualized Loss Expectancy (ALE)
B.Relies on expert judgment and scenarios
C.Determines Exposure Factor (EF) for each asset
D.Uses high/medium/low ratings for likelihood and impact
E.Assigns dollar values to assets and potential losses
AnswersA, E

ALE is a key output of quantitative risk assessment.

Why this answer

Quantitative risk assessment uses numerical values and dollar amounts to calculate risk. Option A (Calculates Annualized Loss Expectancy (ALE)) is correct because ALE is a quantitative metric (ALE = SLE × ARO). Option E (Assigns dollar values to assets and potential losses) is also correct because quantitative assessment assigns monetary values.

Option B is qualitative, relying on expert judgment. Option C is incorrect; Exposure Factor (EF) is part of quantitative assessment, but it is not a characteristic of the methodology itself—rather, it's an input. Option D uses qualitative ratings.

Therefore, the correct choices are A and E.

Full explanation →
420
Multi-Selecthard

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

Select 3 answers
A.Implicit trust based on network location
B.Least privilege access with just-in-time privileges
C.Continuous verification of identity and device health
D.Multi-factor authentication (MFA) for all users
E.Single static firewall perimeter
AnswersB, C, D

Least privilege is fundamental.

Why this answer

Identity-centric zero trust focuses on strong authentication, least privilege, and continuous verification of identity for every access request.

Full explanation →
421
Multi-Selectmedium

A penetration tester is conducting a black-box test on a web application. The tester wants to gather information about the target without directly interacting with the target systems. Which three techniques are considered passive reconnaissance? (Select THREE).

Select 3 answers
A.Searching public social media profiles
B.Port scanning with Nmap
C.WHOIS lookups
D.DNS zone transfers
E.Searching for DNS records in public archives
AnswersA, C, E

Social media is public information gathering.

Why this answer

Passive reconnaissance involves collecting information from public sources without engaging the target.

Full explanation →
422
MCQhard

A company is deploying a just-in-time (JIT) privileged access management solution. Which of the following BEST describes a key security benefit of JIT access?

A.It eliminates the need for multi-factor authentication
B.It replaces the need for a break-glass account
C.It reduces the risk of lateral movement by limiting the duration of elevated privileges
D.It provides continuous monitoring of all user actions
AnswerC

JIT minimizes the window of opportunity for attackers.

Why this answer

JIT access grants temporary privileges only when needed, reducing the attack surface and the risk of standing privileges being misused.

Full explanation →
423
Multi-Selectmedium

A company's incident response team is developing a playbook for ransomware incidents. The playbook should cover the preparation phase. Which THREE of the following are appropriate preparation activities? (Choose THREE.)

Select 3 answers
A.Train employees on how to recognize and report phishing attempts
B.Conduct regular backup testing and ensure offline backups are available
C.Isolate infected systems from the network immediately after detection
D.Develop communication procedures, including legal and PR contacts
E.Perform threat hunting in the network to identify potential threats
AnswersA, B, D

User training helps prevent ransomware infections.

Why this answer

Preparation involves ensuring the team is ready to respond. This includes maintaining backups, training staff, and having communication plans. Threat hunting is a proactive activity, not preparation, and containment is during the response phase.

Full explanation →
424
MCQeasy

A security analyst receives an alert from the SIEM indicating a potential phishing email with a malicious attachment. The analyst wants to automatically isolate the affected endpoint and block the sender. Which technology should be used to automate this response?

A.SOAR
B.EDR
C.XDR
D.SIEM
AnswerA

SOAR is designed for automated incident response orchestration.

Why this answer

SOAR (Security Orchestration, Automation, and Response) platforms enable automated response playbooks to handle incidents like phishing.

Full explanation →
425
Multi-Selecteasy

A healthcare organization is implementing HIPAA Security Rule safeguards. Which TWO of the following are required administrative safeguards? (Choose TWO.)

Select 2 answers
A.Security management process.
B.Encryption of ePHI at rest.
C.Unique user identification.
D.Assigned security responsibility.
E.Facility access controls.
AnswersA, D

Required administrative safeguard per HIPAA §164.308(a)(1).

Why this answer

The HIPAA Security Rule requires covered entities to implement administrative safeguards as part of their security management program. The security management process (Option A) is a required administrative safeguard that mandates organizations conduct a risk analysis, implement risk management policies, and regularly review system activity. Assigned security responsibility (Option D) is also a required administrative safeguard, requiring the organization to designate a specific individual or team responsible for developing and implementing security policies and procedures.

Exam trap

On the CASP+ exam, the trap is correctly distinguishing between administrative, physical, and technical safeguards under HIPAA. Candidates often mistake technical controls like encryption (ePHI at rest) or unique user identification for administrative safeguards, or think facility access controls are administrative instead of physical. The required administrative safeguards listed are security management process and assigned security responsibility.

Full explanation →
426
MCQmedium

A security architect is designing a microservices application that uses JWTs for authentication. Which of the following is the most critical security concern regarding JWT handling?

A.Token expiration not being enforced
B.The JWT being transmitted over HTTP instead of HTTPS
C.The server not validating the JWT's 'alg' header properly
D.The JWT containing personally identifiable information (PII)
AnswerC

Why this answer

A failure to validate the JWT's 'alg' header can allow an attacker to change the algorithm to 'none' or from an asymmetric algorithm (e.g., RS256) to a symmetric one (e.g., HS256), potentially bypassing signature verification. This vulnerability, known as a JWT algorithm confusion attack, is a critical security concern because it directly undermines the integrity and authenticity of the token, which is the core security mechanism for authentication in microservices.

Exam trap

The trap here is that candidates often focus on obvious issues like HTTP vs. HTTPS or token expiration, but CompTIA tests the deeper understanding that a JWT's security hinges on proper validation of the 'alg' header, as a single misconfiguration can completely bypass all other security controls.

Why the other options are wrong

A

Though important, expiration can be mitigated with refresh tokens; algorithm confusion is more fundamental.

B

Transmission security is important but is a network-layer concern, not JWT-specific.

D

PII in JWT is a data privacy concern, but not the most critical security vulnerability.

Full explanation →
427
MCQmedium

A company's data classification policy labels all financial data as 'Confidential.' An employee accidentally emails a spreadsheet containing customer payment information to an unauthorized external party. Which type of control failure occurred?

A.Preventive control failure
B.Corrective control failure
C.Administrative control failure
D.Detective control failure
AnswerA

A DLP solution should have prevented the email

Why this answer

A preventive control failure occurred because the organization lacked a technical safeguard—such as Data Loss Prevention (DLP) rules, email content filtering, or mandatory access controls—to block the outbound transmission of confidential financial data. Preventive controls are designed to stop unauthorized actions before they happen, and the absence of such a mechanism allowed the accidental email to be sent. The failure is not in detection or correction, but in the inability to prevent the data exfiltration at the point of transmission.

Exam trap

The trap here is that candidates confuse the existence of a policy (administrative control) with the technical enforcement of that policy, leading them to incorrectly select 'Administrative control failure' when the real issue is the lack of a preventive technical control.

How to eliminate wrong answers

Option B is wrong because corrective controls (e.g., data backup restoration, incident response procedures) are activated after an incident to repair damage or restore normal operations, not to block the initial unauthorized email. Option C is wrong because administrative controls (e.g., policies, training, user awareness programs) are procedural and human-focused; while a policy existed, the failure was in the technical enforcement layer, not in the policy itself. Option D is wrong because detective controls (e.g., audit logs, SIEM alerts, DLP monitoring) would identify the breach after it occurred, but the question asks about the control that should have prevented the email from being sent in the first place.

Full explanation →
428
MCQmedium

An IoT device manufacturer wants to ensure secure firmware updates. Which approach best protects against malicious firmware being installed on devices?

A.Digitally sign the firmware with a private key
B.Compress the firmware to reduce size
C.Use a hash of the firmware for integrity verification
D.Encrypt the firmware with a symmetric key
AnswerA

Digital signatures provide authenticity and integrity.

Why this answer

Code signing with a trusted key ensures only authorized firmware can be installed.

Full explanation →
429
MCQmedium

A security architect is designing a system for a healthcare provider that must comply with HIPAA. Which control is required for ePHI transmission?

A.Encryption of data in transit
B.Integrity verification mechanisms
C.Role-based access control
D.Audit logging for all access
AnswerA

Encryption of data in transit is required by HIPAA to protect ePHI during transmission.

Why this answer

HIPAA requires encryption for ePHI in transit. Option B (integrity verification mechanisms) is wrong because integrity controls, while important, are not the specific requirement for transmission encryption. Option C (role-based access control) is wrong because access controls are required for data at rest and access, but not specifically for transmission.

Option D (audit logging for all access) is wrong because audit logs are required for monitoring but not a transmission-specific requirement.

Full explanation →
430
MCQhard

An organization uses a SIEM to collect logs from multiple sources. The security team wants to identify users who are accessing resources outside of normal business hours and exhibiting unusual data transfer patterns. Which advanced SIEM capability would be most effective?

A.Threat intelligence feed integration
B.User and Entity Behavior Analytics (UEBA)
C.Log normalization and aggregation
D.Correlation rules with threshold-based alerts
AnswerB

UEBA uses machine learning to detect deviations from established baselines.

Why this answer

User and Entity Behavior Analytics (UEBA) establishes baselines for user activity and detects anomalies, such as unusual access times and data transfer patterns.

Full explanation →
431
MCQeasy

Which of the following is a primary advantage of using ChaCha20-Poly1305 over AES-256-GCM in certain environments?

A.Better hardware acceleration support
B.Higher security margin
C.Smaller ciphertext size
D.Faster performance on devices without AES-NI
AnswerD

ChaCha20 is optimized for software implementation.

Why this answer

ChaCha20-Poly1305 is designed to be faster in software that lacks AES hardware acceleration, making it suitable for mobile devices.

Full explanation →
432
Multi-Selectmedium

A security operations center (SOC) is implementing User Behavior Analytics (UBA) to detect insider threats. Which TWO of the following data sources are most critical for establishing a baseline of normal user behavior?

Select 2 answers
A.Authentication logs from Active Directory
B.Threat intelligence feeds
C.Network traffic logs from firewalls and proxies
D.HR records of employee performance reviews
E.Email content and subject lines
AnswersA, C

Authentication logs track login times, locations, and failures.

Why this answer

UBA relies on authentication logs to understand login patterns and network traffic logs to understand communication patterns. HR records and email content are less relevant for technical baselines; threat feeds are external.

Full explanation →
433
Multi-Selecthard

Which THREE of the following are required components of a Business Continuity Plan (BCP) per ISO 22301?

Select 3 answers
A.Detailed technical recovery procedures for IT systems
B.Scope and policy for business continuity
C.Vulnerability scanner configuration
D.Communication and notification plan
E.Business Impact Analysis (BIA)
AnswersB, D, E

The BCP must define its scope and the policy that drives it.

Why this answer

ISO 22301 mandates that a Business Continuity Plan (BCP) must include the scope and policy for business continuity (Option B) to define the boundaries and objectives of the BCP. This ensures alignment with organizational strategy and compliance requirements, as specified in Clause 4.3 (Scope) and Clause 5.2 (Policy) of the standard.

Exam trap

CompTIA often tests the distinction between a BCP (organizational continuity) and a DRP (technical recovery), leading candidates to mistakenly select detailed IT recovery procedures as a BCP component.

Full explanation →
434
MCQmedium

A security architect is designing a hybrid cloud environment. The organization requires low-latency, private connectivity between on-premises and a public cloud provider, bypassing the public internet. Which solution best meets this requirement?

A.Site-to-site VPN over the internet
B.Private link (e.g., AWS PrivateLink)
C.Direct Connect / ExpressRoute
D.SD-WAN with internet breakout
AnswerC

Correct – dedicated private connection with low latency.

Why this answer

Direct Connect (AWS) or Azure ExpressRoute provide dedicated private network connections from on-premises to the cloud, offering low latency and security.

Full explanation →
435
MCQmedium

A security analyst is calculating the annualized loss expectancy (ALE) for a server that processes credit card data. The server has a $100,000 asset value, and the exposure factor for a security breach is 0.4. Historical data shows that such breaches occur twice per year. What is the ALE?

A.$100,000
B.$40,000
C.$80,000
D.$200,000
AnswerC

Correct. ALE = SLE × ARO = ($100,000 × 0.4) × 2 = $80,000.

Why this answer

ALE = SLE × ARO, where SLE = AV × EF = $100,000 × 0.4 = $40,000, and ARO = 2. So ALE = $40,000 × 2 = $80,000.

Full explanation →
436
MCQmedium

An organization requires a cryptographic algorithm that provides both encryption and authentication in a single pass. Which algorithm should be selected?

A.AES-256-GCM
B.AES-256-CBC
C.SHA-256
D.RSA 4096
AnswerA

GCM is an authenticated encryption mode that provides both encryption and integrity.

Why this answer

AES-256-GCM is an authenticated encryption mode that provides both confidentiality and integrity in a single operation.

Full explanation →
437
Drag & Dropmedium

Drag and drop the steps to deploy a new certificate from an internal CA using Group Policy into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Certificate deployment involves requesting, approving, exporting with private key, importing, and then distributing via Group Policy.

Full explanation →
438
MCQhard

A security auditor is reviewing the cryptographic controls of a financial application that processes transactions. The application uses digital signatures with RSA 4096 and SHA-256. The auditor recommends migrating to a stronger algorithm due to concerns about long-term security and quantum resistance. Which of the following would be the MOST appropriate replacement?

A.SHA-3
B.Ed25519
C.ECDSA P-521
D.ECDSA P-256
AnswerB

Ed25519 is a modern, secure signature algorithm with good performance and smaller key size.

Why this answer

Ed25519 offers strong security, smaller keys, and better performance than RSA. It is also resistance to some side-channel attacks. While not quantum-resistant, it is a forward-looking choice.

ECDSA P-384 is also strong but larger key sizes. SHA-3 is a hash function, not a signature algorithm.

Full explanation →
439
MCQhard

A security architect at a financial institution is designing a cloud-native application using AWS. The application processes sensitive customer data and must comply with PCI DSS. Which of the following security architecture decisions best supports both compliance and operational efficiency?

A.Place all application resources in a VPC with no internet gateway and use VPC endpoints for AWS services
B.Use a cloud-based web application firewall (WAF) and enable logging for all API calls
C.Deploy the application on a single tenant dedicated instance and rely on the cloud provider's compliance certifications
D.Implement a cloud access security broker (CASB) and use customer-managed encryption keys (CMKs) for data at rest
AnswerD

CASB provides visibility and policy enforcement; CMKs meet PCI DSS encryption requirements.

Why this answer

A CASB provides visibility and control over data in cloud environments, which is critical for PCI DSS compliance, while customer-managed encryption keys (CMKs) give the institution direct control over encryption of data at rest, meeting both compliance requirements and operational flexibility. This combination allows the financial institution to enforce data protection policies and audit access without sacrificing the agility of cloud-native deployment.

Exam trap

The CAS-004 exam often tests the misconception that network isolation (Option A) or a single security tool (Option B) is sufficient for compliance, when in reality PCI DSS requires a layered approach including encryption key management and data access governance, which a CASB and CMKs directly address.

How to eliminate wrong answers

Option A is wrong because placing all resources in a VPC with no internet gateway and using VPC endpoints does not address PCI DSS requirements for encryption key management, access control, or logging; it only restricts network access, which is insufficient for full compliance. Option B is wrong because a WAF and API logging are important for security monitoring but do not cover PCI DSS mandates for encryption of data at rest, key management, or data access controls; they are supplementary, not foundational. Option C is wrong because relying solely on a single tenant dedicated instance and the cloud provider's compliance certifications does not meet PCI DSS requirements for the customer to implement and manage their own encryption keys, access controls, and audit logging; shared responsibility means the customer must still enforce specific controls.

Full explanation →
440
MCQmedium

Which CVSS metric component is used to reflect the impact of a vulnerability based on the specific environment of an organization?

A.Attack vector metric
B.Temporal metric
C.Environmental metric
D.Base metric
AnswerC

Environmental metric tailors the score to the organization's environment.

Why this answer

The environmental metric allows customization of CVSS score based on the organization's environment, including security requirements and modified base metrics.

Full explanation →
441
Multi-Selectmedium

A security operations team is designing a threat hunting program. They want to use the MITRE ATT&CK framework to structure their hunts. Which TWO components of the ATT&CK framework should they focus on to develop hypothesis-driven hunts? (Select TWO.)

Select 2 answers
A.Indicators of Compromise (IOCs)
B.Tactics
C.Procedures
D.Mitigations
E.Techniques
AnswersB, E

Tactics represent the 'why' of an attack, e.g., lateral movement.

Why this answer

Hypothesis-driven hunts are based on tactics (why) and techniques (how). Procedures are specific implementations but too granular for initial hypotheses. IOCs are not part of ATT&CK framework components.

Full explanation →
442
MCQeasy

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer when using an Infrastructure as a Service (IaaS) model?

A.Configuration of the hypervisor
B.Network infrastructure maintenance
C.Physical security of data centers
D.Encryption of data at rest within the environment
AnswerD

Customers are responsible for encrypting their own data, including data at rest, as they control the encryption keys and policies.

Why this answer

In IaaS, the customer is responsible for securing the operating system, applications, and data. The cloud provider is responsible for the physical infrastructure, hypervisor, and network. Encryption of data at rest is typically a customer responsibility, as they control the data.

Physical security is the provider's responsibility. Network infrastructure is the provider's responsibility.

Full explanation →
443
MCQeasy

A security analyst is investigating an API that uses JSON Web Tokens (JWT) for authentication. Which field in a JWT contains the token expiration time?

A.exp
B.iss
C.iat
D.sub
AnswerA

exp is expiration time.

Why this answer

The 'exp' (expiration) claim in the JWT payload specifies the time after which the token is no longer valid, preventing replay attacks.

Full explanation →
444
MCQhard

During a risk assessment, a residual risk is identified as high. What should be the NEXT step?

A.Transfer the risk to a third party
B.Implement additional controls to reduce the risk to an acceptable level
C.Ignore the risk because it is residual
D.Accept the residual risk as is
AnswerB

The next step is to apply additional controls to lower residual risk.

Why this answer

When residual risk remains high after applying controls, the correct next step is to implement additional controls to reduce it to an acceptable level. This aligns with the risk treatment process in NIST SP 800-37, where residual risk must be evaluated against the organization's risk appetite and, if unacceptable, further mitigation is required. Simply transferring, ignoring, or accepting a high residual risk without analysis violates governance principles.

Exam trap

In CASP+, a common misconception is that residual risk is automatically acceptable or can be ignored, when in fact it must be actively managed and reduced if it exceeds the defined risk appetite.

How to eliminate wrong answers

Option A is wrong because transferring a high residual risk (e.g., via cyber insurance or outsourcing) does not eliminate the underlying risk; the organization retains residual liability and compliance exposure, and transfer is a treatment option for inherent risk, not a default response to residual risk. Option C is wrong because ignoring a high residual risk violates the fundamental risk management principle that residual risk must be continuously monitored and addressed if it exceeds the risk appetite; it is never acceptable to simply ignore it. Option D is wrong because accepting a high residual risk as-is is only permissible if it falls within the organization's risk appetite after formal risk acceptance by senior management; automatic acceptance without documentation or justification is a governance failure.

Full explanation →
445
MCQmedium

During a forensic investigation, an analyst needs to collect volatile data from a compromised Linux server. Which of the following orders of volatility is correct for collecting the listed data?

A.Processes, memory contents, files on disk, network connections
B.Files on disk, memory contents, processes, network connections
C.Memory contents, network connections, processes, files on disk
D.Network connections, processes, memory contents, files on disk
AnswerC

This is the correct order from most to least volatile.

Why this answer

The order of volatility starts with the most volatile data: memory contents, then network connections, then processes, and finally files on disk. Network connections and processes are both highly volatile but memory is the most volatile.

Full explanation →
446
MCQmedium

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

A.Adopt a unified control framework such as NIST SP 800-53
B.Focus only on the most stringent regulation
C.Implement automated GRC tools without changing controls
D.Maintain separate control sets for each regulation
AnswerA

Allows mapping to multiple regulations

Why this answer

Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Exam trap

The CAS-004 exam often tests the misconception that simply automating compliance with GRC tools or focusing on the strictest regulation is sufficient, but the correct approach requires a unified framework that harmonizes controls across all applicable regulations.

How to eliminate wrong answers

Option B is wrong because focusing only on the most stringent regulation ignores unique requirements of other regulations (e.g., GDPR's data subject rights or SOX's financial reporting controls), leading to compliance gaps. Option C is wrong because implementing automated GRC tools without changing controls merely automates existing inefficiencies and does not consolidate or harmonize the control sets across frameworks. Option D is wrong because maintaining separate control sets for each regulation increases administrative overhead, audit complexity, and the risk of control conflicts, contradicting the requirement for consolidation.

Full explanation →
447
Multi-Selecteasy

Which TWO of the following are common compliance frameworks used in the healthcare industry?

Select 2 answers
A.HIPAA
B.PCI DSS
C.ISO 27001
D.SOX
E.HITECH
AnswersA, E

HIPAA governs healthcare data.

Why this answer

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that sets national standards for protecting sensitive patient health information (PHI). It mandates administrative, physical, and technical safeguards, including encryption of ePHI at rest and in transit, access controls, and audit controls, making it a foundational compliance framework for healthcare organizations.

Exam trap

The trap here is that candidates often confuse HITECH as a separate framework rather than an enhancement to HIPAA, or they mistakenly select PCI DSS or SOX because they associate them with data security without recognizing the healthcare-specific context.

Full explanation →
448
MCQmedium

A company is deploying a new web application that handles sensitive customer data. The application is built using a microservices architecture running in containers on a Kubernetes cluster. The security team wants to implement mutual TLS (mTLS) for service-to-service communication. However, they are concerned about the operational overhead of certificate management. Which approach minimizes management overhead while still ensuring strong authentication?

A.Generate self-signed certificates for each service and manually distribute them
B.Use a service mesh that provides automatic mTLS and certificate rotation
C.Use a single certificate for all services with Subject Alternative Names
D.Implement TLS termination at the ingress and use plaintext inside the cluster
AnswerB

Service mesh handles lifecycle automatically.

Why this answer

A service mesh (e.g., Istio, Linkerd) automates mTLS by injecting sidecar proxies that handle certificate issuance, validation, and rotation via a built-in certificate authority (CA). This eliminates manual certificate management while ensuring strong, per-service authentication and encryption, directly addressing the operational overhead concern.

Exam trap

A common trap is assuming that a single shared certificate or TLS termination at the edge is sufficient for internal security. However, mTLS requires per-service identity and encryption end-to-end, not just at the perimeter.

How to eliminate wrong answers

Option A is wrong because manually generating and distributing self-signed certificates for each service introduces significant operational overhead and does not scale; it also lacks automated rotation, leading to certificate expiry issues and potential security gaps. Option C is wrong because using a single certificate with Subject Alternative Names (SANs) for all services violates the principle of least privilege—if compromised, an attacker can impersonate any service, and it does not provide per-service authentication. Option D is wrong because terminating TLS at the ingress and using plaintext inside the cluster exposes sensitive inter-service traffic to eavesdropping and tampering, completely defeating the purpose of mTLS and violating security best practices.

Full explanation →
449
MCQhard

A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?

A.System categorization
B.Risk identification
C.Risk treatment
D.Risk assessment
AnswerA

Correct: NIST RMF starts with categorizing the system and information based on FIPS 199, which is unique.

Why this answer

NIST RMF includes a formal step to categorize the information system and information based on impact, which is not explicitly part of ISO 27005's risk assessment process.

Full explanation →
450
Multi-Selecthard

A DevOps engineer is automating container orchestration using Kubernetes. Which of the following are security best practices to include in the automation? (Choose two.)

Select 2 answers
A.Disable RBAC to simplify automation scripts
B.Enforce Pod Security Policies to restrict privileged containers
C.Allow all network traffic between pods for simplicity
D.Implement network policies to restrict pod-to-pod communication
AnswersB, D

Why this answer

Enforcing Pod Security Policies (PSPs) is a critical security best practice in Kubernetes because it restricts the creation of privileged containers, prevents host namespace sharing, and enforces read-only root filesystems. This reduces the attack surface by ensuring that containers run with the least privilege necessary, mitigating risks of container breakout or host compromise. Disabling PSPs or failing to enforce them would allow developers to deploy containers with excessive capabilities, violating the principle of least privilege.

Exam trap

CompTIA often tests the misconception that disabling security features like RBAC or network policies simplifies automation and is acceptable in a DevOps pipeline, when in fact automation should enforce security controls, not bypass them.

Why the other options are wrong

A

RBAC is a critical security control.

C

Network policies should restrict traffic.

Full explanation →
Page 5

Page 6 of 13

Page 7

All pages

12345678910111213

Practice CAS-005 by domain

Target a specific domain to shore up weak areas.

Security ArchitectureSecurity EngineeringSecurity OperationsGovernance, Risk, and Compliance
See all domains with question counts →