Courseiva

CompTIA SecurityX (CAS-005) (CAS-005) — Questions 451–525

968 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 13

Page 8
451
MCQmedium

A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?

A.Use a runtime security tool that scans containers only when they are running.
B.Scan the container image only after deployment to production.
C.Rely on the developers to manually check for vulnerabilities.
D.Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
AnswerD

Early scanning prevents vulnerable images from being stored or deployed.

Why this answer

Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.

Exam trap

A common misconception is that runtime security scanning is sufficient for vulnerability management. However, runtime tools detect active threats but not static vulnerabilities in image layers, which must be caught earlier in the pipeline via image scanning.

How to eliminate wrong answers

Option A is wrong because runtime security tools (e.g., Falco) monitor container behavior during execution, not the image itself, and may miss vulnerabilities in unused packages or layers that are never executed. Option B is wrong because scanning only after deployment to production introduces risk by allowing vulnerable images to run in production, violating the principle of early detection in CI/CD. Option C is wrong because relying on developers to manually check for vulnerabilities is error-prone, inconsistent, and does not scale, especially in microservices environments with frequent builds.

Full explanation →
452
MCQmedium

During a secure SDLC, a security architect wants to identify design flaws early. Which activity is most appropriate for the design phase?

A.Threat modeling
B.Penetration testing
C.Dynamic application security testing (DAST)
D.Static application security testing (SAST)
AnswerA

Correct – threat modeling identifies design flaws.

Why this answer

Threat modeling is performed during the design phase to identify potential security threats and vulnerabilities before code is written.

Full explanation →
453
MCQhard

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The analyst wants to minimize false positives while ensuring detection of true positives. Which approach is most effective for reducing false positives in this scenario?

A.Alert on any use of NTLM authentication
B.Alert on multiple failed logins followed by a successful login from a different workstation
C.Disable NTLM authentication across the network
D.Compare authentication events against a baseline of normal user behavior and alert on anomalies
AnswerD

UBA techniques help identify unusual authentication patterns indicative of pass-the-hash.

Why this answer

Baselining normal authentication behavior and alerting on deviations helps reduce false positives because legitimate pass-the-hash activity is rare.

Full explanation →
454
Multi-Selectmedium

A security analyst is triaging a suspicious file. The analyst wants to perform static analysis to gather initial information. Which TWO of the following are static analysis techniques?

Select 2 answers
A.Running the file in a sandbox
B.Disassembling the binary to examine assembly code
C.Checking the file hash against known malware databases
D.Observing network traffic generated by the file
E.Extracting human-readable strings from the binary
AnswersC, E

Hash lookup is a static technique.

Why this answer

Static analysis examines the file without executing it. Checking file hashes against known malware databases and extracting strings from the binary are static techniques. Running in a sandbox is dynamic, and disassembly is more advanced reverse engineering.

Full explanation →
455
MCQmedium

An organization is deploying containerized applications and needs to enforce security policies that restrict the system calls a container can make. Which Linux security module should be used?

A.seccomp
B.AppArmor
C.chroot
D.SELinux
AnswerA

seccomp can restrict system calls available to a container.

Why this answer

seccomp (secure computing mode) allows filtering of system calls, reducing the kernel attack surface.

Full explanation →
456
MCQeasy

A company is implementing a risk management framework to comply with PCI DSS. Which type of control is a firewall rule that blocks all inbound traffic except HTTP and HTTPS?

A.Corrective
B.Compensating
C.Preventive
D.Detective
AnswerC

Preventive controls block or avoid security incidents.

Why this answer

A firewall rule that blocks all inbound traffic except HTTP (port 80) and HTTPS (port 443) is a preventive control because it actively enforces a security policy by denying unauthorized traffic before it can reach internal systems. This aligns with PCI DSS Requirement 1, which mandates a firewall configuration to restrict inbound traffic to only necessary services, thereby reducing the attack surface. Preventive controls are designed to stop security incidents from occurring, which is exactly what this rule accomplishes by filtering traffic at the network layer.

Exam trap

The trap here is that candidates often confuse 'preventive' with 'detective' because they think of firewall logs as detective, but the rule itself is a preventive control that stops traffic, while logging is a separate detective function.

How to eliminate wrong answers

Option A is wrong because corrective controls are used to remediate or restore systems after an incident has occurred (e.g., patching a vulnerability or restoring from backup), not to block traffic preemptively. Option B is wrong because compensating controls are alternative measures used when an organization cannot meet a PCI DSS requirement due to technical or business constraints (e.g., using a WAF instead of network segmentation), but this firewall rule directly satisfies the requirement without needing a substitute. Option D is wrong because detective controls identify and log malicious activity after it has happened (e.g., IDS alerts or log monitoring), whereas a firewall rule that blocks traffic is proactive, not reactive.

Full explanation →
457
MCQmedium

A security analyst is using Volatility to analyze a memory dump from a compromised Windows system. The analyst suspects that a rootkit is hiding processes. Which Volatility plugin should the analyst use to detect hidden processes?

A.pslist
B.psxview
C.malfind
D.pstree
AnswerB

psxview cross-references multiple process lists to identify hidden processes.

Why this answer

The 'psxview' plugin compares process listings from different sources (e.g., EPROCESS list, PspCidTable) to find discrepancies, which can reveal hidden processes.

Full explanation →
458
MCQhard

During an incident response, a forensic analyst captures the memory of a compromised Windows system. Using Volatility, the analyst runs the 'pslist' command and sees a suspicious process 'svchost.exe' with a parent process 'explorer.exe'. Which Volatility plugin should the analyst use next to detect potential process hollowing?

A.netscan
B.psxview
C.dlllist
D.malfind
AnswerD

malfind detects injected code and process hollowing by scanning for executable memory.

Why this answer

Process hollowing occurs when a legitimate process is created in a suspended state, its memory is unmapped, and malicious code is written. The 'malfind' plugin identifies processes with suspicious memory characteristics (e.g., executable memory not mapped to a file).

Full explanation →
459
MCQeasy

A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?

A.Authentication logs (e.g., Windows Event ID 4624)
B.Antivirus logs
C.DNS logs
D.Firewall logs
AnswerA

Authentication logs track logon events and can reveal anomalous access patterns.

Why this answer

Authentication logs, such as Windows Event ID 4624, are the most critical for detecting lateral movement via pass-the-hash or pass-the-ticket attacks because they record logon events across systems, revealing when an attacker uses stolen credentials to access other machines. Option B (antivirus logs) is less relevant as they focus on malware, not authentication patterns. Option C (DNS logs) shows name resolution but not authentication.

Option D (firewall logs) indicate network flows but lack authentication context.

Full explanation →
460
MCQmedium

A security analyst calculates the annual loss expectancy (ALE) for a critical asset. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the annual loss expectancy?

A.$0
B.$10,000
C.$50,200
D.$250,000
AnswerB

ALE = SLE × ARO = $50,000 × 0.2 = $10,000.

Why this answer

ALE = SLE × ARO = $50,000 × 0.2 = $10,000. Annual loss expectancy represents the expected monetary loss per year from a risk.

Full explanation →
461
MCQhard

An organization is migrating its on-premises monolithic application to a containerized microservices architecture on a Kubernetes cluster. The development team has created a set of Docker images that are stored in a private registry. The security team requires that all container images be scanned for vulnerabilities before deployment. The current CI/CD pipeline uses Jenkins to build images, push them to the registry, and then deploy to Kubernetes via kubectl. The scanning is performed by a tool that generates a report, but developers have been ignoring critical vulnerabilities and deploying anyway. The security team wants to enforce a policy that blocks deployment if the image has any critical or high-severity vulnerabilities. Additionally, the cluster must ensure that containers run with the least privilege and that secrets are not exposed in environment variables. The operations team is concerned about performance overhead from runtime security monitoring. Which of the following approaches best addresses these requirements while minimizing operational overhead?

A.Implement admission controller webhooks that check vulnerability scan results from the registry before allowing pod creation, and use a service mesh with mutual TLS to encrypt secrets.
B.Use a custom script in Jenkins to parse the scan report and abort the build if vulnerabilities are found, and store secrets in Kubernetes secrets mounted as volumes.
C.Deploy a runtime security agent that monitors container activity and rejects pods that contain known vulnerability signatures, and use Kubernetes RBAC to limit permissions.
D.Configure a network policy in Kubernetes to restrict pod-to-pod communication, and use a static analysis tool during development to find coding flaws.
AnswerA

Admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure.

Why this answer

Admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure. Option B is incorrect because aborting the Jenkins build does not prevent deployment from other sources (e.g., direct kubectl) and secrets mounted as volumes are still vulnerable to compromise.

Option C is incorrect because runtime security agents incur performance overhead and do not block deployment upfront; they monitor activity but don't prevent vulnerable images from being scheduled. Option D is incorrect because network policies do not address vulnerability scanning or secret protection; they only control pod-to-pod communication.

Full explanation →
462
MCQeasy

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

A.Legal violation
B.Standards violation
C.Regulatory compliance violation
D.Organizational policy violation
AnswerD

Directly contravenes company policy

Why this answer

The employee's action directly violates the company's internal security policy requiring VPN for all remote access. This is a policy violation, not a legal or regulatory one, as the company has established a mandatory rule that the employee failed to follow. The use of a personal device without VPN to access company email is a clear breach of organizational policy, which is a governance issue within the company's risk management framework.

Exam trap

The trap here is that candidates often confuse 'organizational policy violation' with 'regulatory compliance violation,' mistakenly thinking that any security breach automatically involves a regulatory mandate, when in fact the question explicitly describes a breach of internal policy.

How to eliminate wrong answers

Option A is wrong because a legal violation involves breaking a law (e.g., data protection statutes like GDPR or HIPAA), and while the action may have legal implications, the question specifically asks about a policy violation, not a legal one. Option B is wrong because a standards violation refers to non-compliance with industry or technical standards (e.g., ISO 27001, NIST SP 800-53), not internal company rules. Option C is wrong because a regulatory compliance violation involves failing to meet external regulatory requirements (e.g., PCI DSS, SOX), and the scenario describes a breach of internal policy, not a specific regulatory mandate.

Full explanation →
463
Multi-Selecthard

Which THREE of the following are essential components of a secure software development lifecycle (SSDLC) to ensure security engineering? (Select exactly 3.)

Select 3 answers
A.Dynamic application security testing (DAST) and penetration testing before release.
B.User acceptance testing (UAT) to validate business requirements.
C.Static application security testing (SAST) in the development phase.
D.Daily stand-up meetings for developers.
E.Threat modeling during design phase.
AnswersA, C, E

Dynamic application security testing and penetration testing identify vulnerabilities in the running application, crucial before release.

Why this answer

Options A, C, and E are correct. Threat modeling, static analysis, and penetration testing are core SSDLC activities. Option B is wrong because user acceptance testing (UAT) validates business requirements, not security.

Option D is wrong because daily stand-up meetings are a project management practice, not security-specific.

Full explanation →
464
MCQeasy

You are a SOC analyst at a mid-sized company. The SIEM alerts on anomalous outbound traffic from a finance workstation to an external IP address never seen before. The workstation belongs to an employee in the accounts payable department. The alert shows that 500 MB of data was transferred via SMB over the internet, which is unusual because internal file shares are normally used. The employee is currently logged in and is in a meeting across the building. The initial triage confirms the workstation is not domain-joined and has been bypassing corporate firewall rules using a personal VPN. Which of the following actions should you take FIRST?

A.Isolate the workstation by disabling the network port or using endpoint security tools to block connectivity.
B.Escalate the incident to the incident response team lead.
C.Contact the employee's manager to discuss the situation.
D.Interview the employee about the suspicious activity.
AnswerA

Immediate containment stops the exfiltration and limits risk.

Why this answer

Isolating the workstation stops the ongoing data exfiltration over SMB and prevents further damage. The employee is in a meeting and not at their desk, so they cannot be involved in the initial response. Containment is the priority before escalation or investigation.

Option B may be necessary but not first; Option C and D could delay containment and alert the potential insider.

Full explanation →
465
MCQeasy

During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?

A.Allow only specific IPs in the DMZ to connect to internal servers
B.Replace the DMZ firewall with a next-generation firewall that includes IPS
C.Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services
D.Move all DMZ services to a cloud provider and use a site-to-site VPN
AnswerC

This ensures that DMZ hosts cannot be used as a pivot point into the internal network.

Why this answer

The most effective way to prevent a compromised DMZ host from pivoting into the internal network is to enforce a unidirectional traffic flow. By blocking all outbound connections from the DMZ to the internal network at the firewall and using a reverse proxy (e.g., HAProxy, Nginx, or Apache with mod_proxy) to handle inbound requests, the DMZ hosts never directly initiate connections to internal resources. This eliminates the lateral movement path even if a DMZ host is fully compromised, as the reverse proxy terminates the external connection and forwards requests to internal servers without allowing the DMZ host to establish a new outbound session.

Exam trap

The CAS-004 exam often tests the misconception that adding more security features (like IPS or IP allowlists) to an existing architecture is sufficient, when the real solution requires a fundamental change in traffic flow direction (unidirectional vs. bidirectional) to eliminate the attack vector entirely.

How to eliminate wrong answers

Option A is wrong because allowing only specific IPs in the DMZ to connect to internal servers still permits outbound connections from the DMZ, which means a compromised host could still initiate a connection to an internal server if its IP is on the allowlist, failing to fully contain a breach. Option B is wrong because replacing the DMZ firewall with a next-generation firewall (NGFW) that includes IPS does not change the fundamental architecture of allowing outbound connections from the DMZ; while IPS can detect some malicious traffic, it cannot prevent a zero-day exploit or a sophisticated attacker from using allowed protocols to pivot into the internal network. Option D is wrong because moving DMZ services to a cloud provider and using a site-to-site VPN does not inherently block outbound connections from the DMZ to the internal network; the VPN would still allow bidirectional traffic between the cloud DMZ and the internal network unless explicit egress filtering is applied, and it introduces additional complexity without addressing the core architectural flaw.

Full explanation →
466
MCQmedium

A security architect is designing a PKI hierarchy for a large enterprise that issues certificates for internal users, devices, and code signing. Which of the following best practices should be implemented to minimize the impact of a CA compromise?

A.Rely on certificate transparency logs to detect compromises
B.Keep the root CA online for immediate certificate revocation
C.Use a single CA for all certificate types to reduce complexity
D.Implement a segmented CA hierarchy with offline root CA and separate issuing CAs for each purpose
AnswerD

This compartmentalizes risk and allows easier recovery.

Why this answer

Using a tiered CA hierarchy with a root CA that remains offline and issuing CAs for specific purposes limits exposure. If an issuing CA is compromised, only its certificates need to be revoked, and the root CA can issue a new subordinate CA.

Full explanation →
467
MCQmedium

A security architect is designing a secure remote access solution for a global workforce. The company requires that all remote connections be authenticated using certificates issued by the company's internal PKI, and that the connection be encrypted and integrity-protected. Additionally, the solution must support IP-based network access control to restrict access to specific internal subnets based on the user's role. Which of the following should the architect recommend?

A.Deploy SSH tunneling with certificate-based authentication and configure iptables rules on the bastion host.
B.Deploy an SSL/TLS VPN using client certificates and rely on the VPN client to enforce access policies.
C.Deploy a RDP gateway with certificate authentication and restrict access via group policies.
D.Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.
AnswerD

IPsec provides network-layer access, RADIUS can enforce subnet restrictions based on user role.

Why this answer

An IPsec VPN with certificate-based authentication satisfies the requirement for encrypted, integrity-protected connections using the company's internal PKI. Integrating with a RADIUS server enables role-based IP access control, allowing the VPN gateway to restrict access to specific internal subnets based on the user's role, which aligns with the need for IP-based network access control.

Exam trap

The trap here is that candidates often choose SSL/TLS VPN (Option B) because it is commonly associated with certificate authentication, but they overlook the critical requirement for IP-based network access control enforced by the server, not the client.

How to eliminate wrong answers

Option A is wrong because SSH tunneling provides only application-layer port forwarding, not full IP-based network access control, and iptables rules on a bastion host cannot dynamically enforce role-based subnet restrictions per user. Option B is wrong because relying on the VPN client to enforce access policies is a security flaw; policy enforcement must occur on the gateway, not the client, which can be compromised or misconfigured. Option C is wrong because an RDP gateway is designed for remote desktop sessions, not general IP-based network access, and group policies do not provide the granular role-based subnet restrictions required for a global workforce.

Full explanation →
468
MCQhard

A financial company is expanding its hybrid cloud architecture. They have an AWS VPC connected to an on-premises network via an IPsec VPN using IKEv2. The on-premises firewall is a Cisco ASA. Recently, users report intermittent connectivity to cloud resources. The security team reviews logs and finds the following message on the ASA: 'no matching crypto map entry for traffic from on-prem to cloud'. The team also suspects potential data leakage due to occasional unencrypted traffic. The corporate policy requires all traffic between environments to be encrypted. The engineer has verified that the IKEv2 proposals match on both sides. The cloud side uses a virtual private gateway with a static route to the on-premises network. Which of the following should the engineer do FIRST to resolve the issue?

A.Check the crypto map configuration on the Cisco ASA and ensure it matches the peer IP and proxy IDs
B.Disable NAT traversal on both VPN endpoints
C.Reconfigure the IKEv2 policies on both sides to use different encryption algorithms
D.Replace the VPN connection with AWS Direct Connect for dedicated bandwidth
AnswerA

The 'no matching crypto map entry' error is resolved by correcting the crypto map.

Why this answer

The error message 'no matching crypto map entry for traffic from on-prem to cloud' indicates that the Cisco ASA does not have a crypto map that matches the traffic. This is a common issue when proxy IDs (or interesting traffic definitions) do not align between the VPN endpoints. Since the IKEv2 proposals match, the problem is likely in the crypto map configuration.

Checking the crypto map on the ASA to ensure it matches the peer IP and proxy IDs is the correct first step. Option A is correct. Option B is incorrect because disabling NAT traversal could cause connectivity issues if NAT is present.

Option C is unnecessary as IKEv2 policies already match. Option D is too drastic and not the first troubleshooting step.

Full explanation →
469
MCQeasy

A developer is implementing input validation for a web application that accepts file uploads. Which of the following is the most secure method to prevent path traversal attacks?

A.Using a whitelist of allowed file extensions
B.Sanitizing the filename by removing '../' sequences
C.Storing files outside the web root directory
D.Validating the file size before storage
AnswerC

Storing files outside web root ensures they cannot be accessed directly via path traversal even if validation fails.

Why this answer

Storing uploaded files outside the web root directory (e.g., in a non-public directory like /var/uploads) prevents the attacker from directly accessing or executing files via URL manipulation, even if the filename contains path traversal sequences. This architectural control decouples file storage from the web server's document root, making path traversal attacks ineffective since the web server cannot serve files from outside its configured root.

Exam trap

The exam often tests the misconception that input sanitization (like removing '../') is sufficient, but the trap here is that blacklist-based filtering is inherently bypassable, whereas storing files outside the web root is a secure architectural control that eliminates the attack surface entirely.

How to eliminate wrong answers

Option A is wrong because a whitelist of allowed file extensions only restricts the file type, not the path used to store or retrieve it; an attacker can still upload a .jpg file with a name like '../../../etc/passwd' and traverse directories if the application uses the filename in file operations. Option B is wrong because sanitizing by removing '../' sequences is a blacklist approach that can be bypassed with encoding (e.g., '..%2f' or '....//') or alternative traversal patterns like '..\' on Windows; it does not address the root cause of trusting user-supplied path components. Option D is wrong because validating file size only limits storage consumption and has no effect on path traversal; an attacker can upload a small file with a malicious filename to traverse directories.

Full explanation →
470
MCQhard

A container security team wants to enforce that containers run with the least privileges possible. Which Linux security module can be used to restrict system calls available to a container?

A.Pod Security Policy
B.AppArmor
C.SELinux
D.seccomp
AnswerD

seccomp enables filtering of system calls to reduce attack surface.

Why this answer

seccomp allows filtering system calls, enabling a whitelist of allowed calls to reduce the kernel attack surface.

Full explanation →
471
MCQmedium

A security manager is reviewing Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for the security program. Which of the following is an example of a KRI?

A.Mean time to detect (MTTD) security incidents
B.Number of critical vulnerabilities exceeding the risk appetite threshold
C.Percentage of systems patched within 30 days
D.Number of security incidents per month
AnswerB

This indicates risk level relative to tolerance.

Why this answer

KRIs measure risk levels, such as the number of critical vulnerabilities that exceed the risk appetite threshold. KPIs measure performance, like patch compliance percentage.

Full explanation →
472
MCQhard

An organization is implementing a zero-trust architecture for remote access. Which component is essential for continuous authentication?

A.VPN concentrator
B.Identity provider with continuous evaluation
C.Firewall with deep packet inspection
D.Network access control (NAC)
AnswerB

An IdP with conditional access can step up authentication based on anomalous behavior, ensuring continuous identity verification.

Why this answer

In a zero-trust architecture, continuous authentication requires an identity provider (IdP) that can evaluate user and device attributes in real time, such as risk scores, location, and behavior patterns, to maintain trust throughout a session. Unlike static authentication at login, continuous evaluation ensures that access is revoked immediately if conditions change, which is essential for zero-trust remote access.

Exam trap

The trap here is that candidates confuse the initial authentication and encryption provided by a VPN concentrator with the continuous, adaptive trust evaluation required by zero-trust, leading them to choose Option A instead of recognizing that an identity provider with continuous evaluation is the core component.

How to eliminate wrong answers

Option A is wrong because a VPN concentrator provides encrypted tunnels and initial authentication but does not perform continuous evaluation of user or device trust after the session is established. Option C is wrong because a firewall with deep packet inspection inspects traffic content and enforces policies at the network layer, but it does not handle identity-based continuous authentication or session-level trust decisions. Option D is wrong because network access control (NAC) typically authenticates devices at the network edge and enforces compliance at initial connection, but it lacks the continuous, risk-based evaluation of user identity and behavior required for zero-trust.

Full explanation →
473
Multi-Selecthard

A security team is implementing a secure SDLC for a new application. Which THREE activities should be included as part of the development phase? (Choose three.)

Select 3 answers
A.Runtime application self-protection (RASP) deployment
B.Penetration testing on production environment
C.Static application security testing (SAST)
D.Threat modeling
E.Dependency analysis for open-source libraries
AnswersC, D, E

Correct; SAST analyzes source code for vulnerabilities during development.

Why this answer

During development, SAST scans source code, dependency analysis checks libraries, and threat modeling identifies design flaws.

Full explanation →
474
Matchingmedium

Match each acronym to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Cloud Access Security Broker

Data Loss Prevention

Identity and Access Management

Security Information and Event Management

Security Orchestration, Automation, and Response

Why these pairings

The correct matches are: SIEM - Security Information and Event Management, SOAR - Security Orchestration, Automation and Response, DLP - Data Loss Prevention, IAM - Identity and Access Management, PAM - Privileged Access Management. Option F is incorrect because it incorrectly pairs SIEM with the definition for SOAR.

Full explanation →
475
MCQhard

During a third-party risk assessment, a security architect discovers that a vendor's data retention policy does not align with the organization's legal requirements. Which of the following is the BEST course of action?

A.Request the vendor to update its retention policy to align with legal requirements.
B.Accept the risk and document it in the risk register.
C.Immediately terminate the vendor contract.
D.Implement compensating controls to enforce data deletion after the required period.
AnswerA

This directly addresses the discrepancy and leverages the contractual requirement to follow best practices.

Why this answer

The vendor's data retention policy must comply with the organization's legal requirements, such as GDPR or HIPAA, which mandate specific data lifecycle controls. Requesting the vendor to update its policy is the most direct and effective way to achieve compliance, as it addresses the root cause without prematurely terminating a business relationship or relying on compensating controls that may not fully satisfy regulatory obligations.

Exam trap

CompTIA often tests the misconception that compensating controls can fully substitute for vendor compliance, but the trap here is that legal requirements demand the vendor's own policy and processes be compliant, not just the organization's technical workarounds.

How to eliminate wrong answers

Option B is wrong because accepting the risk without attempting to remediate a legal compliance gap is not acceptable; risk acceptance requires that the risk be within the organization's risk appetite, and legal non-compliance typically exceeds that threshold. Option C is wrong because immediately terminating the contract is an extreme response that ignores the possibility of remediation through contractual negotiation, which is a standard third-party risk management practice. Option D is wrong because implementing compensating controls, such as automated data deletion scripts, does not absolve the vendor of its contractual and legal responsibility to align its own policy; the vendor's non-compliant policy remains a liability, and compensating controls may not satisfy regulatory audit requirements for vendor due diligence.

Full explanation →
476
Multi-Selecthard

An organization is planning to adopt quantum-resistant cryptography. According to NIST PQC standards, which THREE algorithms are currently selected for standardization? (Select THREE).

Select 3 answers
A.Elliptic Curve Diffie-Hellman (ECDH)
B.CRYSTALS-Kyber
C.FALCON
D.CRYSTALS-Dilithium
E.RSA-4096
AnswersB, C, D

CRYSTALS-Kyber is the selected KEM.

Why this answer

NIST has selected CRYSTALS-Kyber (for key encapsulation), CRYSTALS-Dilithium (for digital signatures), and FALCON (for digital signatures, with SPHINCS+ as a backup) for standardization. RSA and ECDH are not quantum-resistant.

Full explanation →
477
Drag & Dropmedium

Drag and drop the steps to configure a host-based firewall (Windows Defender Firewall) to block all inbound traffic except RDP into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Firewall configuration: open console, create allow rule for RDP, ensure it's enabled, then set default block, and test.

Full explanation →
478
MCQmedium

A company is migrating to a public cloud and wants to ensure they understand their security responsibilities. According to the shared responsibility model, which of the following is typically the responsibility of the cloud customer?

A.Hypervisor security
B.Physical security of data centers
C.Network infrastructure security
D.Identity and access management
AnswerD

Correct; IAM is a customer responsibility.

Why this answer

The customer is responsible for securing data, applications, and access management even in IaaS/PaaS/SaaS.

Full explanation →
479
Matchingmedium

Match each security tier or model to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Highest privilege assets like domain controllers

Server and application administration

User workstations and devices

Separates admin accounts by sensitivity

Never trust, always verify

Why these pairings

Tier 0 is the highest privilege tier controlling identity and security; Tier 1 controls servers and applications; Tier 2 controls user devices. Zero Trust is a model that eliminates implicit trust.

Full explanation →
480
MCQmedium

A virtualization administrator needs to ensure that virtual machines (VMs) from different customers cannot communicate with each other unless explicitly allowed. Which network security control should be implemented on the hypervisor?

A.Patch the hypervisor regularly
B.Assign each VM to a different physical server
C.Use a virtual firewall to create per-VM security groups
D.Enable hypervisor memory overcommitment
AnswerC

Virtual firewalls can apply policies to individual VMs, isolating them.

Why this answer

Micro-segmentation (e.g., NSX) allows fine-grained control over VM-to-VM traffic at the virtual switch level.

Full explanation →
481
MCQmedium

An organization has identified a vulnerability in a legacy system that cannot be patched. The system is critical for operations, and the cost of mitigating the vulnerability exceeds the potential loss. Which risk treatment option is most appropriate?

A.Risk acceptance
B.Risk avoidance
C.Risk mitigation
D.Risk transfer
AnswerA

Correct: The organization accepts the residual risk because mitigation is too expensive.

Why this answer

Risk acceptance is chosen when the cost of mitigation exceeds the potential loss and the risk is within risk appetite.

Full explanation →
482
MCQeasy

A company is implementing a SIEM solution and needs to ensure that logs from network devices, servers, and endpoints are collected in a consistent format. Which protocol should be used to transport logs securely?

A.Syslog over UDP
B.Syslog over TLS
C.SFTP
D.SNMP traps
AnswerB

Syslog over TLS ensures encrypted and authenticated log transport.

Why this answer

Syslog over TLS provides encryption and reliable delivery for log transport. Option A (Syslog over UDP) is unencrypted and unreliable. Option C (SFTP) is a file transfer protocol, not suitable for real-time log streaming.

Option D (SNMP traps) is used for network management alerts, not comprehensive log collection.

Full explanation →
483
MCQmedium

A company uses a CASB to monitor cloud application usage. Which primary function does a CASB provide for enforcing security policies between users and cloud services?

A.Encryption key management for cloud storage
B.Vulnerability scanning of cloud infrastructure
C.Policy enforcement point for cloud services
D.Workload protection runtime monitoring
AnswerC

Correct – CASB enforces policies for cloud usage.

Why this answer

A CASB acts as an intermediary to enforce security policies such as access control, data loss prevention, and threat protection between users and cloud services.

Full explanation →
484
MCQmedium

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

A.Using the most efficient parsing algorithm
B.Ensuring the script runs with root privileges
C.Validating and sanitizing all input from logs
D.Writing detailed audit logs of script actions
AnswerC

Why this answer

Log files can contain maliciously crafted entries designed to exploit parsing logic. Without input validation and sanitization, an attacker could inject commands or manipulate the script into blocking legitimate IPs or executing unintended actions, leading to a denial-of-service or compromise of the automation system itself.

Exam trap

CompTIA often tests the misconception that automation security is about efficiency or privilege escalation, when the real trap is that log data is untrusted input that must be validated to prevent injection attacks.

Why the other options are wrong

A

Efficiency is secondary; security is paramount.

B

Least privilege principle suggests non-root.

D

Auditing is important but not the most critical.

Full explanation →
485
MCQhard

A company that processes credit card transactions discovers that a third-party vendor with access to its network has suffered a data breach. The vendor's access was limited but included a connection to the cardholder data environment. The company must comply with PCI DSS. Which of the following is the FIRST action the company should take?

A.Revoke the vendor's access immediately and change all shared credentials.
B.Notify all affected cardholders as required by law.
C.Perform a forensic investigation to determine the scope of the breach.
D.Contact the acquiring bank and report the breach.
AnswerA

Immediate containment is the first priority to stop further exfiltration.

Why this answer

Under PCI DSS Requirement 7 and 12, the company must immediately contain the breach by revoking the third-party vendor's access and changing all shared credentials. This is the first action because it stops further unauthorized access to the cardholder data environment (CDE) and prevents the attacker from using compromised credentials to pivot or exfiltrate data. Delaying containment could expand the breach scope and increase compliance penalties.

Exam trap

The trap here is that candidates often choose forensic investigation (Option C) first, thinking they need to understand the full scope before acting, but PCI DSS and incident response best practices mandate immediate containment (revoke access) to stop the bleeding before any analysis begins.

How to eliminate wrong answers

Option B is wrong because notifying affected cardholders is a downstream obligation that occurs only after the breach scope is confirmed and forensic analysis is complete; doing it first could violate PCI DSS notification timing rules and cause unnecessary panic. Option C is wrong because performing a forensic investigation is critical but should follow immediate containment to preserve evidence and prevent further data loss; starting forensics first without revoking access could allow ongoing exfiltration. Option D is wrong because contacting the acquiring bank is a reporting step that typically occurs after containment and initial scoping, as the bank will require a preliminary assessment of compromised card numbers and breach details.

Full explanation →
486
MCQhard

A SOC analyst is reviewing an alert about a suspicious process execution on a critical server. The alert shows that cmd.exe spawned from Microsoft Word. Which of the following is the BEST next step for the analyst?

A.Collect a memory dump from the host without any immediate action.
B.Reimage the server to ensure it is clean.
C.Isolate the host from the network and collect a memory dump.
D.Terminate the cmd.exe process immediately.
AnswerC

Isolation prevents lateral movement; memory dump preserves evidence.

Why this answer

The alert indicates a classic living-off-the-land (LotL) attack where Microsoft Word (likely via a malicious macro) spawns cmd.exe, suggesting code execution. Isolating the host prevents lateral movement and data exfiltration, while collecting a memory dump preserves volatile evidence (e.g., process memory, network connections, injected code) for forensic analysis. Immediate termination (Option D) or reimaging (Option B) would destroy critical evidence, and doing nothing (Option A) risks further compromise.

Exam trap

The trap here is that candidates may choose Option D (terminate the process) thinking it stops the attack, but fail to recognize that isolation and evidence preservation are higher priorities in incident response, as termination destroys volatile data and may not prevent reinfection.

How to eliminate wrong answers

Option A is wrong because taking no immediate action allows the potentially compromised host to continue communicating with an attacker, risking lateral movement or data exfiltration; a memory dump alone without isolation does not contain the threat. Option B is wrong because reimaging the server destroys all volatile evidence (e.g., running processes, network connections, in-memory malware) needed to determine the root cause and scope of the compromise, and it may be premature without confirming persistence. Option D is wrong because terminating cmd.exe alone does not address the underlying malicious macro or payload in Word, and the attacker may have already established persistence or exfiltrated data; it also destroys the process memory that could contain critical forensic artifacts.

Full explanation →
487
MCQeasy

A security analyst reviews this configuration and identifies a vulnerability. What is the MOST critical issue?

A.The grant type is authorization_code
B.The client secret is hardcoded
C.The redirect URI uses HTTP
D.The token endpoint uses HTTPS
AnswerC

HTTP transmits the authorization code in plaintext, making it vulnerable to interception.

Why this answer

The redirect URI using HTTP (not HTTPS) is the most critical issue because it allows an attacker to intercept the authorization code during the OAuth 2.0 flow. If the redirect URI is transmitted over cleartext HTTP, an attacker on the same network can capture the authorization code via man-in-the-middle (MITM) attacks and exchange it for an access token, leading to account takeover. This violates the OAuth 2.0 security best practice (RFC 6819) that mandates the use of TLS for all redirect URIs.

Exam trap

CompTIA often tests the misconception that hardcoded secrets (Option B) are always the most critical vulnerability, but in OAuth flows, an insecure redirect URI over HTTP is a more direct and exploitable attack vector that can lead to immediate token theft.

How to eliminate wrong answers

Option A is wrong because authorization_code is a secure grant type that does not expose the client secret to the user agent and is recommended for confidential clients. Option B is wrong because while hardcoding secrets is a bad practice, it is not the most critical issue in this specific OAuth configuration; the hardcoded secret could be mitigated with proper access controls, but the HTTP redirect URI is an exploitable network-level vulnerability. Option D is wrong because the token endpoint using HTTPS is actually a secure practice and does not introduce a vulnerability; the issue is with the redirect URI, not the token endpoint.

Full explanation →
488
Drag & Dropmedium

Drag and drop the steps to perform a vulnerability scan using Nessus into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Vulnerability scanning: configure policy, set targets, run scan, review results, and report.

Full explanation →
489
Multi-Selectmedium

A company is adopting a secure software development lifecycle (SDLC). Which two practices are most effective for identifying vulnerabilities early in the development process? (Select TWO.)

Select 2 answers
A.Runtime application self-protection (RASP)
B.Dynamic application security testing (DAST)
C.Regular code reviews with security focus
D.Static application security testing (SAST) integrated into the IDE
E.Penetration testing after deployment
AnswersC, D

Code reviews can find logic flaws and security issues before build.

Why this answer

Options C and D are correct because both are early-phase security practices in the SDLC. Regular code reviews with a security focus (C) involve manual inspection of source code for logic flaws, injection vulnerabilities, and insecure design patterns, enabling detection before compilation or deployment. Static application security testing (SAST) integrated into the IDE (D) automatically scans source code for known vulnerability patterns, providing immediate feedback during development.

Both practices target the coding phase, allowing early detection and remediation. In contrast, DAST, RASP, and penetration testing require a running application or occur post-deployment, making them late-phase practices.

Exam trap

CompTIA often tests the distinction between early-phase (SAST, code reviews) and late-phase (DAST, RASP, pentesting) security practices, and the trap here is that candidates may confuse DAST or RASP as 'early' because they are automated, when in fact they require a running application.

Full explanation →
490
Multi-Selectmedium

A security architect is evaluating Cloud Security Posture Management (CSPM) tools. Which TWO capabilities are typically provided by CSPM? (Choose two.)

Select 2 answers
A.Detection of compliance violations
B.Web application firewall (WAF) management
C.Vulnerability scanning of container images
D.DDoS protection
E.Continuous monitoring of cloud resource configurations
AnswersA, E

CSPM identifies violations against frameworks like SOC 2, ISO 27001.

Why this answer

CSPM tools continuously monitor cloud environments for misconfigurations and compliance violations, and they provide remediation guidance.

Full explanation →
491
MCQeasy

A system administrator needs to securely store cryptographic keys and perform signing operations in a tamper-resistant hardware device. Which solution should be used?

A.A Hardware Security Module (HSM) with FIPS 140-2 Level 3 certification.
B.A secure enclave like Intel SGX.
C.A software-based key store with encrypted files.
D.A Trusted Platform Module (TPM) 2.0.
AnswerA

HSMs provide strong tamper resistance and are designed for cryptographic operations.

Why this answer

An HSM (Hardware Security Module) is designed to securely generate, store, and manage cryptographic keys in a tamper-resistant environment.

Full explanation →
492
Multi-Selecthard

A security analyst is using the MITRE ATT&CK framework to map adversarial behaviors. Which THREE of the following are tactics defined by ATT&CK? (Select THREE.)

Select 3 answers
A.Incident response
B.Privilege escalation
C.Persistence
D.Exfiltration
E.Phishing
AnswersB, C, D

Privilege escalation is a tactic.

Why this answer

Persistence, privilege escalation, and exfiltration are all ATT&CK tactics. Phishing is a technique, not a tactic; incident response is a process, not a tactic.

Full explanation →
493
MCQmedium

An organization is implementing a SOAR solution to automate responses to common incidents. They want to create a playbook for phishing email handling. Which of the following actions should be automated in the playbook after a user reports a suspicious email?

A.Extract URLs and attachments, query threat intel feeds, and if malicious, block indicators and isolate the affected endpoint
B.Call the user to confirm they clicked the link
C.Send a warning email to all users
D.Immediately delete the email from all user inboxes
AnswerA

This is a standard automated phishing response.

Why this answer

A SOAR playbook for phishing should automate initial triage actions such as extracting indicators and checking against threat intelligence, then isolating the user's system if malicious.

Full explanation →
494
MCQhard

A multinational organization is subject to GDPR and local data protection laws. A data subject from country X requests deletion of personal data, but the data is also required for a legal hold under country Y's law. What is the BEST course of action?

A.Anonymize the data to satisfy both requirements
B.Escalate to the data protection authority
C.Retain the data and inform the data subject of the conflicting legal obligation
D.Delete the data to comply with GDPR
AnswerC

This balances compliance requirements transparently.

Why this answer

When a legal hold under country Y's law conflicts with a GDPR deletion request, the organization must retain the data to comply with the legal obligation and inform the data subject of the conflicting legal requirement. GDPR Article 17(3)(e) explicitly allows retention when necessary for compliance with a legal obligation under Union or Member State law. This balances the data subject's right to erasure with overriding legal holds, which are common in e-discovery and litigation scenarios.

Exam trap

The trap here is that candidates assume GDPR always takes precedence over local laws, but CompTIA tests the understanding that conflicting legal obligations require retaining the data and notifying the data subject, not automatically deleting or escalating.

How to eliminate wrong answers

Option A is wrong because anonymization removes direct identifiers but may not satisfy a legal hold requirement if the data must be preserved in its original form for evidentiary purposes; the legal hold typically requires retaining the exact data, not a de-identified version. Option B is wrong because escalating to the data protection authority is not the best first course of action; the organization should first apply the legal exception under GDPR Article 17(3)(e) and inform the data subject, not immediately involve the regulator for a routine conflict. Option D is wrong because deleting the data to comply with GDPR would violate the legal hold obligation under country Y's law, exposing the organization to legal sanctions for spoliation of evidence.

Full explanation →
495
MCQmedium

A security engineer is configuring a new web server to support TLS 1.3. The server must provide forward secrecy and support clients that may not have updated certificates frequently. Which of the following is a feature of TLS 1.3 that addresses these requirements?

A.Mandatory use of ephemeral Diffie-Hellman key exchange
B.Support for certificate pinning
C.Support for 0-RTT handshake
D.Removal of cipher suites that use RSA key exchange
AnswerA

Correct. TLS 1.3 mandates ephemeral Diffie-Hellman key exchange (ECDHE) for forward secrecy, ensuring session keys remain secure even if the server's long-term key is compromised. This also helps clients with infrequent certificate updates because forward secrecy relies on ephemeral keys rather than static certificate usage.

Why this answer

TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (ECDHE) key exchange for all sessions. This ensures that if the server's long-term private key is compromised, past session keys remain secure. While TLS 1.3 does remove cipher suites that use RSA key exchange (which lack forward secrecy), this removal does not directly address the requirement to support clients with infrequently updated certificates.

The question asks for a feature that satisfies both forward secrecy and support for clients with infrequently updated certificates; only mandatory use of ephemeral Diffie-Hellman key exchange directly provides forward secrecy, which is the key requirement.

Exam trap

Candidates may think that removing RSA key exchange directly helps with certificate update frequency, but it does not; the key feature for forward secrecy is mandatory ephemeral key exchange.

Full explanation →
496
MCQeasy

An organization is deploying a new wireless network for employees and guests. The security policy requires that all wireless traffic be encrypted using AES-CCMP, and that clients must authenticate using 802.1X with EAP-TLS. Which of the following wireless security standards should be implemented?

A.WPA2-Personal
B.WEP
C.WPA3-Enterprise
D.WPA2-Enterprise
AnswerD

WPA2-Enterprise with AES-CCMP and 802.1X meets all requirements.

Why this answer

WPA2-Enterprise (D) is the correct choice because it supports AES-CCMP encryption and 802.1X authentication with EAP-TLS. WPA2-Enterprise uses a RADIUS server for centralized authentication, allowing per-user credentials via EAP methods, and mandates CCMP (AES-based) for data confidentiality and integrity, meeting all stated security policy requirements.

Exam trap

The trap here is that candidates often confuse WPA3-Enterprise with WPA2-Enterprise, assuming newer is always better, but the question explicitly requires AES-CCMP and 802.1X with EAP-TLS, which are core to WPA2-Enterprise, while WPA3-Enterprise introduces optional stronger ciphers (GCMP-256) and a different handshake (SAE), making it not the direct match for the given requirements.

How to eliminate wrong answers

Option A is wrong because WPA2-Personal uses a pre-shared key (PSK) for authentication, not 802.1X with EAP-TLS, and thus cannot meet the enterprise authentication requirement. Option B is wrong because WEP uses RC4 encryption with weak IVs and does not support AES-CCMP or 802.1X authentication; it is deprecated and insecure. Option C is wrong because WPA3-Enterprise, while it supports 802.1X and AES-CCMP (via GCMP-256 in some modes), is not the standard that matches the explicit requirement for AES-CCMP and 802.1X with EAP-TLS; WPA2-Enterprise is the established standard for these specific protocols, and WPA3 introduces SAE handshake and optional GCMP-256, which are not mandated here.

Full explanation →
497
Multi-Selecthard

A threat intelligence analyst is profiling a threat actor that has been targeting the energy sector. Which THREE of the following attributes are most important to include in a threat actor profile? Select THREE.

Select 3 answers
A.Vulnerabilities exploited (CVEs)
B.Motivations and objectives
C.Targeted industries and regions
D.Tactics, Techniques, and Procedures (TTPs)
E.List of known indicators of compromise (IOCs)
AnswersB, C, D

Understanding why they attack helps predict future behavior.

Why this answer

Key attributes include motivations (e.g., espionage), TTPs (tactics, techniques, procedures), and targeted sectors. IOCs and CVEs are important but may change frequently; motivations, TTPs, and sectors are more stable.

Full explanation →
498
MCQhard

During a red team exercise, an attacker exploits a vulnerability in a containerized web application to gain a shell. The container is running with a read-only root filesystem. What is the most likely persistence mechanism the attacker will use?

A.Modify the container's entrypoint script in the image.
B.Write a cron job to the container's writable /tmp directory.
C.Create a new user account in /etc/passwd.
D.Install a kernel module on the host.
AnswerB

/tmp is often writable and can be used for persistence.

Why this answer

With a read-only root filesystem, the attacker cannot modify system files like /etc/passwd or the container's entrypoint. However, writable directories such as /tmp can be used to place a cron job script. By writing a cron job to /tmp and ensuring the cron daemon is running, the attacker can achieve persistence by having the script executed at a scheduled interval, even after the container restarts.

Exam trap

The trap here is that candidates assume persistence requires modifying system files or the container image, but they overlook that writable directories like /tmp can be used for cron jobs or scripts, which is a common persistence technique in read-only container environments.

How to eliminate wrong answers

Option A is wrong because modifying the container's entrypoint script in the image requires write access to the root filesystem, which is read-only, and the image itself is immutable at runtime. Option C is wrong because creating a new user account in /etc/passwd requires write access to /etc, which is part of the read-only root filesystem. Option D is wrong because installing a kernel module on the host requires host-level privileges and is not possible from within a container without specific capabilities (e.g., SYS_MODULE) and host filesystem access, which are not implied by the scenario.

Full explanation →
499
MCQmedium

A security architect is reviewing the architecture of a critical web application that handles sensitive financial transactions. The application is deployed across three tiers: a web server, an application server, and a database server. The application is protected by a web application firewall (WAF) and a network-based intrusion detection system (IDS). Recent penetration testing identified a SQL injection vulnerability in the application's search feature. The architect needs to propose a remediation that minimizes performance impact and maintains defense in depth. The development team is slow to fix code due to legacy dependencies. What should the security architect recommend as the MOST effective immediate control?

A.Disable the search feature until the code is fixed.
B.Isolate the database server on a separate network segment with strict firewall rules.
C.Add a WAF rule to block common SQL injection payloads and signatures.
D.Increase the IDS sensitivity to detect SQL injection attempts and automatically block them.
AnswerC

A WAF can provide virtual patching to mitigate the vulnerability until code fix is deployed.

Why this answer

The development team is slow to fix the SQL injection vulnerability in code, so an immediate control is needed. Adding a WAF rule (option C) can block common SQL injection payloads at the perimeter without code changes, minimizing performance impact and maintaining defense in depth. Option A (disable search) is too disruptive.

Option B (isolate database server) is a good defense-in-depth measure but does not address the vulnerability at the application layer. Option D (increase IDS sensitivity) only detects, not prevents. Therefore, C is the most effective immediate control.

Full explanation →
500
MCQhard

A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?

A.Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.
B.Use EDR to identify the process or service generating the outbound connections on the web server.
C.Isolate the web server from the network to prevent further data exfiltration.
D.Immediately remove the outbound HTTPS rule to block the traffic.
AnswerB

EDR can pinpoint the root cause (e.g., a webshell or backdoor) for further investigation.

Why this answer

The best first step because using EDR to identify the process or service generating the outbound connections provides immediate visibility into the source of the unusual traffic without disrupting the potential evidence. This allows the architect to determine if the traffic is malicious (e.g., a compromised process) or benign (e.g., a legitimate update). Once the process is identified, further steps like SSL inspection, isolation, or rule modification can be taken based on the findings.

Option A (SSL inspection) is resource-intensive and premature without first understanding the process. Option C (isolation) may destroy forensic evidence and is a containment step that should follow identification. Option D (removing the rule) could disrupt legitimate applications and does not help identify the scope.

Full explanation →
501
MCQeasy

Which risk management framework is specifically designed for U.S. federal agencies and includes a six-step process: Categorize, Select, Implement, Assess, Authorize, and Monitor?

A.ISO 27005
B.COBIT
C.NIST RMF
D.FAIR
AnswerC

NIST RMF is the framework used by U.S. federal agencies.

Why this answer

NIST Risk Management Framework (RMF) includes the six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor.

Full explanation →
502
MCQhard

A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?

A.It eliminates all security vulnerabilities in the infrastructure
B.It removes the need for vulnerability scanning of base images
C.It simplifies compliance by eliminating the need for patching
D.It prevents attackers from establishing persistence by modifying system files
AnswerD

Since instances are replaced rather than updated, any unauthorized changes are lost when the instance is replaced.

Why this answer

Immutable infrastructure ensures that servers are never modified after deployment. This prevents configuration drift and makes it harder for attackers to persist. It also facilitates rapid recovery.

It does not eliminate vulnerabilities or remove the need for patching; instead, patching is done by replacing instances. It simplifies forensics because instances are ephemeral and can be analyzed post-incident.

Full explanation →
503
Multi-Selecthard

A security engineer is hardening a Linux web server. The team requires that the web server process cannot run with root privileges and that any file it writes must have minimal permissions. Which two controls should be implemented together? (Select TWO).

Select 2 answers
A.Run the web server process under a dedicated non-privileged user account
B.Place the web server in a chroot jail
C.Enable SELinux in enforcing mode with a targeted policy for the web server
D.Apply mandatory access control (MAC) to restrict file permissions
E.Use file capability bounding sets to limit the web server's capabilities
AnswersA, D

This ensures the process does not run as root.

Why this answer

Running the web server process under a dedicated non-privileged user account (Option A) ensures that even if the process is compromised, the attacker does not gain root privileges. This is a fundamental principle of least privilege, typically implemented by creating a system user (e.g., 'www-data' or 'httpd') with no login shell and assigning ownership of web directories to that user.

Exam trap

The trap here is that candidates often confuse chroot jails (Option B) or SELinux (Option C) as substitutes for running the process as a non-root user, but neither addresses the core requirement of preventing root-level execution; the question explicitly requires the process to not run with root privileges, which only a dedicated non-privileged user account achieves.

Full explanation →
504
Multi-Selectmedium

A security officer is reviewing continuous compliance monitoring tools. Which TWO of the following are primary benefits of implementing such tools? (Select TWO.)

Select 2 answers
A.Guarantees 100% compliance with all regulations
B.Provides real-time visibility into compliance posture
C.Reduces the need for periodic audits by enabling ongoing tracking
D.Replaces the need for a risk management framework
E.Eliminates all security risks
AnswersB, C

Correct. Continuous monitoring offers real-time insight.

Why this answer

Continuous monitoring provides real-time visibility and allows for ongoing tracking of controls, enabling quicker detection of non-compliance.

Full explanation →
505
MCQmedium

A security analyst reviews a web application that accepts user-supplied data to generate PDF reports. The application uses a legacy library that directly inserts user input into SQL queries and also includes user input in the PDF generation without sanitization. Which is the most effective countermeasure?

A.Use parameterized queries and output encoding
B.Enable HTTPS and HSTS
C.Implement a web application firewall (WAF) to block malicious input
D.Deploy a SIEM to log all database queries and PDF generation events
AnswerA

Parameterized queries prevent SQL injection; output encoding prevents XSS in PDF output.

Why this answer

Parameterized queries prevent SQL injection by separating SQL logic from user input, and output encoding prevents injection in PDF generation by ensuring user input is treated as data, not executable code. Option B (HTTPS/HSTS) only encrypts in transit and does not prevent injection attacks. Option C (WAF) can be bypassed and does not address the root cause.

Option D (SIEM) only logs events, not prevents them.

Full explanation →
506
MCQmedium

A company wants to implement certificate pinning for its mobile app to prevent man-in-the-middle attacks. Which approach is most secure and maintainable?

A.Pin the entire certificate chain, including the root CA certificate.
B.Pin the SHA-256 hash of the server's public key.
C.Pin the Subject Public Key Info (SPKI) using base64 encoding.
D.Pin the issuing CA certificate only.
AnswerB

This allows certificate renewal without changing the key, providing flexibility and security.

Why this answer

Pinning the public key hash rather than the certificate itself allows certificate rotation without updating the app, as long as the key pair remains the same.

Full explanation →
507
MCQeasy

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $100,000, an exposure factor (EF) of 0.5, and an annualized rate of occurrence (ARO) of 2. What is the ALE?

A.$100,000
B.$150,000
C.$50,000
D.$200,000
AnswerA

Correct calculation: ALE = AV × EF × ARO = $100,000 × 0.5 × 2 = $100,000.

Why this answer

ALE = SLE × ARO, where SLE = AV × EF = $100,000 × 0.5 = $50,000. Then ALE = $50,000 × 2 = $100,000.

Full explanation →
508
MCQhard

During a security assessment, a penetration tester discovers that a web application fails to validate the size of user input, leading to a buffer overflow. Which application security control would have BEST prevented this vulnerability?

A.Input validation
B.Static application security testing (SAST)
C.Web application firewall (WAF)
D.Rate limiting
AnswerA

Input validation directly prevents malformed input from causing buffer overflows.

Why this answer

Input validation ensures that data conforms to expected formats and sizes, preventing malformed input from causing overflows.

Full explanation →
509
MCQmedium

A SOC manager is considering implementing a SOAR platform. Which is the primary benefit of SOAR in day-to-day operations?

A.Automated playbook execution and orchestration of response actions
B.Centralized storage of all security logs
C.Elimination of the need for human analysts
D.Reduction in false positive alerts from the SIEM
AnswerA

SOAR automates incident response playbooks, reducing manual effort and response time.

Why this answer

SOAR automates repetitive tasks and orchestrates workflows, enabling faster and consistent incident response. Option B is wrong because SOAR is not primarily for centralized log storage; that's typically a SIEM or log management system. Option C is wrong because SOAR does not replace human analysts; it augments them.

Option D is wrong because reducing false positive alerts is primarily a function of SIEM tuning, not SOAR. SOAR can help by automating responses, but it does not directly reduce false positives.

Full explanation →
510
MCQhard

A financial services company uses a continuous integration/continuous delivery (CI/CD) pipeline to deploy microservices. The security team wants to ensure that no secrets (e.g., API keys, database passwords) are hard-coded in source code repositories. Which tool or practice is most appropriate for detecting secrets before they are committed?

A.Run dynamic application security testing (DAST) on deployed apps
B.Implement a pre-commit hook using git-secrets or similar
C.Perform static application security testing (SAST) in the build pipeline
D.Deploy runtime application self-protection (RASP)
AnswerB

Scans code before commit, blocking secrets from being pushed.

Why this answer

A pre-commit hook using a tool like git-secrets scans staged changes for patterns matching common secret formats (e.g., AWS keys, passwords) before the commit is finalized. This prevents secrets from ever entering the local repository, which is the earliest and most effective point of control. Unlike later-stage scans, pre-commit hooks catch issues before they are pushed to shared branches or CI/CD pipelines.

Exam trap

CompTIA CASP+ often tests the distinction between 'detecting secrets before commit' (pre-commit hooks) versus 'scanning after commit' (SAST in build pipeline), where candidates mistakenly choose SAST because it is a familiar security testing method, but it fails to prevent the secret from entering the repository history.

How to eliminate wrong answers

Option A is wrong because DAST tests running applications for runtime vulnerabilities (e.g., SQL injection, XSS) and cannot inspect source code or detect hard-coded secrets in repositories. Option C is wrong because SAST scans source code in the build pipeline after code is committed, meaning secrets have already been stored in the repository history, making removal difficult and potentially exposing them in logs or artifacts. Option D is wrong because RASP protects applications at runtime by monitoring behavior and blocking attacks, but it does not scan source code or prevent secrets from being committed.

Full explanation →
511
MCQmedium

An organization is deploying deception technology to detect lateral movement by attackers. Which of the following would be the most effective to detect an attacker who has gained access to the internal network and is attempting to move to a sensitive server?

A.A honeytoken in the form of a fake password file on a file server
B.A network-based intrusion detection system (NIDS) on the segment
C.A honeypot configured to mimic a high-value database server
D.An endpoint detection and response (EDR) agent on all workstations
AnswerA

Honeytokens like fake credentials are effective because they trigger alerts when an attacker attempts to use them for authentication.

Why this answer

Honeytokens are deceptive data (e.g., fake credentials) placed on systems; if an attacker uses them, it triggers an alert. This is effective for detecting lateral movement without requiring interaction with a full honeypot.

Full explanation →
512
MCQhard

A security architect is designing a deception-based detection system for a high-security environment. The goal is to detect lateral movement by attackers who have already breached the perimeter. Which of the following deception techniques would be most effective at identifying an attacker without alerting them to the deception?

A.Configure a network share with honey files and monitor for file access.
B.Create a honeypot web server with known vulnerabilities and monitor for interactions.
C.Deploy fake database tables containing plausible but fictitious data.
D.Plant honey credentials (username/password) for non-existent Active Directory accounts in a common password manager.
AnswerD

Honey credentials are low interaction and high value; usage indicates compromise without tipping off attackers.

Why this answer

Planting honey credentials for non-existent Active Directory accounts in a common password manager is the most effective deception technique for detecting lateral movement because attackers often search for stored credentials to move laterally. When they attempt to use these credentials, the authentication failure will trigger an alert without alerting the attacker to the deception. Other techniques like honey files or honeypots may be more obvious or require interaction that could tip off the attacker, making them less suitable for stealthy detection.

Full explanation →
513
MCQmedium

A SOC analyst is investigating an alert from the EDR system indicating that a user's workstation made multiple failed login attempts to a sensitive server, followed by a successful login from an unusual IP address. The analyst suspects a brute force attack. Which type of threat hunting methodology is being used?

A.Hypothesis-driven hunting
B.TTP-driven hunting
C.IoC-driven hunting
D.Baseline-driven hunting
AnswerA

The analyst formed a hypothesis based on an alert and is investigating.

Why this answer

This is hypothesis-driven threat hunting, as the analyst starts with a hypothesis (brute force attack) and then searches for evidence to confirm or deny it based on the alert.

Full explanation →
514
MCQmedium

A healthcare provider is migrating patient records to a cloud EHR system. The security officer is concerned about data ownership and portability. Which contractual clause is MOST critical to include in the cloud service agreement?

A.A clause on data portability and format standards
B.A service level agreement guaranteeing 99.999% uptime
C.A stipulation that encryption keys are managed by the customer
D.A requirement for breach notification within 24 hours
AnswerA

Data portability ensures the organization can retrieve data.

Why this answer

Data portability and format standards clauses directly address the security officer's concerns about data ownership and the ability to move patient records out of the cloud EHR system. Without such a clause, the provider could lock the healthcare organization into proprietary formats, making migration difficult or impossible. This is critical for compliance with regulations like HIPAA, which require patients to access and transfer their health information.

Exam trap

The CASP+ exam often tests the distinction between security controls (encryption, breach notification) and contractual governance clauses (data portability, ownership), leading candidates to pick a technically valid but contextually irrelevant option like customer-managed encryption keys.

How to eliminate wrong answers

Option B is wrong because a 99.999% uptime SLA addresses availability, not data ownership or portability; it does not ensure the customer can retrieve or transfer their data. Option C is wrong because customer-managed encryption keys protect data confidentiality but do not guarantee the ability to export data in a usable format; the cloud provider could still store data in a proprietary schema. Option D is wrong because a 24-hour breach notification clause is a security incident response requirement, not a contractual safeguard for data ownership or portability.

Full explanation →
515
MCQmedium

A security analyst discovers that an employee has been using a personal USB drive to transfer sensitive customer data from a workstation to a home computer. This violates the company's data handling policy. According to the company's incident response plan, which of the following is the FIRST step the analyst should take?

A.Perform a forensic analysis of the workstation
B.Isolate the workstation from the network
C.Escalate the incident to the data protection officer (DPO)
D.Notify law enforcement
AnswerB

Isolation contains the incident and prevents further data transfer.

Why this answer

The first priority in any incident response is containment to prevent further data loss or network propagation. Isolating the workstation from the network (Option B) immediately stops the employee from exfiltrating additional data and prevents any potential lateral movement by malware that might be on the USB drive. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Exam trap

CompTIA often tests the candidate's ability to prioritize containment over investigation or notification, trapping those who confuse the order of the incident response phases (e.g., jumping to forensic analysis or legal escalation before stopping the bleeding).

How to eliminate wrong answers

Option A is wrong because forensic analysis is a post-containment step; performing it first could alter volatile evidence and does not stop ongoing data exfiltration. Option C is wrong because escalation to the DPO is a notification step that occurs after containment and initial triage, not as the first action. Option D is wrong because notifying law enforcement is a final step reserved for criminal activity after the incident is fully contained and evidence is preserved, and it is not the immediate priority.

Full explanation →
516
MCQeasy

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

A.Reduces operational costs by reusing existing servers
B.Eliminates configuration drift and unauthorized changes
C.Increases system performance through hardware acceleration
D.Simplifies monitoring by reducing the number of servers
AnswerB

Why this answer

Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Exam trap

The trap here is that candidates confuse immutable infrastructure with traditional configuration management (e.g., Puppet, Ansible) that corrects drift by modifying existing servers, whereas immutable infrastructure prevents drift entirely by never modifying servers in place.

Why the other options are wrong

A

Immutable infrastructure typically increases costs because new instances are spun up instead of patching old ones.

C

Immutable infrastructure is about deployment methodology, not hardware performance.

D

Immutable infrastructure may actually increase server count due to frequent redeployments.

Full explanation →
517
MCQeasy

During a security incident, the incident response team has identified the root cause and removed the threat from all affected systems. Which phase of the incident response lifecycle involves returning systems to normal operation and monitoring for any signs of recurrence?

A.Eradication
B.Containment
C.Recovery
D.Lessons Learned
AnswerC

Recovery restores systems and monitors for recurrence.

Why this answer

The incident response lifecycle includes preparation, detection, containment, eradication, recovery, and lessons learned. Recovery is the phase where systems are restored to normal operation and monitoring is implemented to ensure the threat does not return.

Full explanation →
518
MCQmedium

A security operations center (SOC) analyst is investigating a potential malware infection on a workstation. The analyst wants to perform static analysis on a suspicious executable. Which tool or technique is most appropriate for examining the executable without executing it?

A.Run the executable in a sandbox
B.Use a memory forensics tool like Volatility
C.Use the strings command to extract readable ASCII and Unicode strings
D.Perform a network traffic capture
AnswerC

Strings is a common static analysis tool for extracting embedded text from binaries.

Why this answer

Static analysis involves examining the file without running it. Using a disassembler like IDA Pro or a tool to view strings and PE headers is typical. Strings utility extracts readable text from the binary, which can reveal clues about its functionality.

Full explanation →
519
Multi-Selectmedium

A security administrator is evaluating ways to improve endpoint detection and response (EDR) capabilities. Which TWO of the following approaches would most effectively enhance the detection of fileless malware attacks?

Select 2 answers
A.Monitor PowerShell script block logging and execution events.
B.Install a network intrusion detection system (NIDS) to inspect traffic.
C.Monitor process creation chain events to detect anomalous parent-child relationships.
D.Enable file integrity monitoring (FIM) on critical system files.
E.Deploy advanced antivirus with machine learning signatures.
AnswersA, C

PowerShell is commonly abused for fileless execution.

Why this answer

Fileless malware operates in memory and exploits legitimate system tools, making traditional file-based detection ineffective. Option A (monitor PowerShell script block logging and execution events) captures malicious PowerShell activity, a common vector for fileless attacks. Option C (monitor process creation chains) detects anomalous parent-child relationships, such as a PDF spawning PowerShell, which is indicative of fileless execution.

Option B (NIDS) inspects network traffic but misses host-level behavioral anomalies. Option D (FIM) monitors file integrity, which fileless malware avoids. Option E (antivirus with ML) may still fail to detect fileless malware that uses living-off-the-land binaries.

Full explanation →
520
MCQhard

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

A.The image tag "latest" might pull an outdated image.
B.The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.
C.The readOnlyRootFilesystem prevents logging.
D.The pod runs as root by default.
AnswerB

These capabilities can lead to container escape or host compromise.

Why this answer

Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Exam trap

Candidates often mistakenly choose running as root as the most critical issue, but the added capabilities NET_ADMIN and SYS_ADMIN are more dangerous because they directly enable host-level attacks, bypassing container isolation.

How to eliminate wrong answers

Option A is wrong because while using the 'latest' tag is a bad practice for reproducibility and may pull an unintended version, it is not the most critical security concern; the image is still subject to the same registry and digest controls, and the risk is primarily operational rather than a direct privilege escalation. Option C is wrong because readOnlyRootFilesystem is actually a security hardening measure that prevents writes to the container's filesystem, reducing the attack surface; it does not prevent logging if logs are written to stdout/stderr or a mounted volume. Option D is wrong because running as root by default is a common but less critical issue compared to granting dangerous capabilities; root inside a container is still restricted by user namespaces and seccomp profiles, whereas capabilities like NET_ADMIN and SYS_ADMIN directly bypass those restrictions.

Full explanation →
521
MCQmedium

A security analyst is tuning the SIEM and wants to create a correlation rule that detects potential lateral movement using pass-the-hash attacks. Which log sources are most essential for detecting this technique?

A.DNS logs and web proxy logs
B.Windows Security Event Logs (4624) and network flow logs
C.Application logs and antivirus logs
D.DHCP logs and VPN logs
AnswerB

These logs show authentication attempts and network connections.

Why this answer

Pass-the-hash attacks often use Windows authentication logs (Event ID 4624) and network logs for unusual remote connections. Windows Security Event Logs and network logs are key.

Full explanation →
522
Multi-Selectmedium

Which TWO of the following are valid techniques to mitigate the risk of side-channel attacks on cryptographic implementations? (Select exactly 2.)

Select 2 answers
A.Obfuscating the source code of the cryptographic library.
B.Using a cryptographically secure random number generator for key generation.
C.Implementing constant-time algorithms to avoid timing variations.
D.Increasing the key length to 4096 bits.
E.Adding noise to power consumption or using power analysis resistant logic.
AnswersC, E

Constant-time code ensures that execution time does not depend on secret data, preventing timing attacks.

Why this answer

Constant-time cryptographic implementations ensure that the execution time does not depend on secret data, such as keys or plaintext. This directly mitigates timing side-channel attacks, where an attacker measures variations in execution time to infer secret values. By making all code paths take the same amount of time regardless of input, the attacker cannot exploit timing differences.

Exam trap

CompTIA CASP+ often tests the misconception that cryptographic strength (e.g., key length or random number generation) can prevent side-channel attacks, but these attacks exploit implementation flaws, not algorithmic weaknesses.

Full explanation →
523
MCQmedium

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

A.Hardware Security Module (HSM)
B.Certificate Revocation List (CRL)
C.Key Management Service (KMS)
D.Certificate Authority (CA)
AnswerA

HSM is designed for tamper-resistant key protection and cryptographic operations.

Why this answer

A hardware security module (HSM) provides secure generation, storage, and management of cryptographic keys in a tamper-resistant device.

Full explanation →
524
Multi-Selecthard

A company is migrating its legacy VPN to use IPsec with IKEv2. The security team wants to ensure the strongest possible security. Which THREE configuration options should be selected?

Select 3 answers
A.Use ECDSA P-384 for authentication
B.Use SHA-1 for integrity
C.Use AES-256-GCM for encryption
D.Use IKEv1 instead of IKEv2
E.Enable perfect forward secrecy (DHE)
AnswersA, C, E

ECDSA P-384 provides strong public key authentication.

Why this answer

IKEv2, AES-256-GCM for encryption, and ECDSA for authentication provide strong security. AES-128 is weaker, SHA-1 is deprecated, and IKEv1 is legacy.

Full explanation →
525
MCQhard

A SOC analyst is investigating a suspicious process that is making outbound connections to an unknown IP address. The analyst wants to examine the process memory for injected code. Which Volatility plugin is most appropriate for detecting code injection by listing all Virtual Address Descriptors (VADs) that are mapped as executable and writable?

A.netscan
B.malfind
C.pslist
D.dlllist
AnswerB

malfind detects injected code by examining VADs.

Why this answer

Volatility's 'malfind' plugin scans VADs and looks for executable and writable pages that may indicate injected code. It is commonly used for detecting code injection.

Full explanation →
Page 6

Page 7 of 13

Page 8

All pages

12345678910111213

Practice CAS-005 by domain

Target a specific domain to shore up weak areas.

Security ArchitectureSecurity EngineeringSecurity OperationsGovernance, Risk, and Compliance
See all domains with question counts →