CompTIA SecurityX (CAS-005) (CAS-005) — Questions 451–525

SLE equals asset value multiplied by exposure factor: $100,000 × 0.4 = $40,000. ALE equals SLE multiplied by annualised rate of occurrence: $40,000 × 2 = $80,000. This matches the calculated annualised loss expectancy for the credit card server.

A NAT gateway in a public subnet allows instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections. This is exactly the pattern needed for software updates. The application servers remain unreachable from the internet, and the NAT gateway handles address translation and return traffic, preserving the private subnet's isolation while still permitting necessary outbound access.

$MFT contains metadata for every file on an NTFS volume, including timestamps for creation, modification, and access. It is a primary source for file system timeline analysis. Other artifacts like prefetch or registry hives provide program execution or configuration data but are not as comprehensive for file system activity timelines.

AES-256-GCM combines AES counter-mode encryption with GHASH authentication, producing ciphertext and a tag in one operation. This satisfies the stem's single-pass requirement, unlike separate encrypt-then-MAC schemes. It also delivers the confidentiality and integrity the organization demands, using a 256-bit key for strong protection.

SPIFFE/SPIRE issues short-lived, cryptographically verifiable identities (SVIDs) to workloads based on attested node and pod attributes, and automatically rotates them. mTLS using these SVIDs lets each service authenticate peers without embedded static secrets, satisfying the rotation requirement when pods move.

Event ID 4624 records successful logons and includes the Logon Type and Source Network Address. A Type 3 (network) or Type 10 (RemoteInteractive) logon from an unusual source would confirm suspicious remote access, while a Type 2 (interactive) logon at the console would suggest a different scenario. This directly addresses the anomaly and is the fastest way to validate or dismiss the alert.

WPA3-Personal with Simultaneous Authentication of Equals (SAE) provides strong encryption and resistance to offline dictionary attacks. SAE replaces the pre-shared key handshake in WPA2, offering forward secrecy and protecting against brute-force attempts. This meets the requirements for authorized device access and encrypted traffic, making it the most secure choice for a small office wireless network.

CASB provides visibility and policy enforcement; CMKs meet PCI DSS encryption requirements.

Tamper-responsive mechanisms detect physical intrusion attempts (e.g., drilling, voltage tampering) and automatically erase sensitive key material. This prevents attackers from extracting keys even if they gain physical access to the HSM. It is a critical security property for HSMs used in CAs, as it ensures that keys cannot be recovered from a compromised device.

The environmental metric group modifies the base score using factors unique to the organisation's deployment, such as modified attack vector, confidentiality, integrity and availability requirements. It therefore reflects impact within a specific environment, exactly the constraint the question specifies.

Logs from different sources may use different time zones, formats, or clock settings. Normalizing timestamps to a common standard (e.g., UTC) is essential to accurately correlate events and establish a timeline. Without this step, the analyst might misinterpret the sequence of events. This is a fundamental step in incident response and forensic analysis to ensure data integrity and consistency across disparate sources.

Under IaaS, the customer controls everything above the hypervisor, including guest operating systems, applications and data. Encrypting data at rest within that environment therefore falls to the customer, whereas the provider secures the physical hosts, network fabric and underlying storage infrastructure.

The exp claim is a registered JWT payload field holding the expiration time as a NumericDate, after which the token must be rejected. Validating exp lets the analyst determine whether the token has lapsed, directly answering which field carries the expiration time.

A high residual risk exceeds the organisation's acceptable threshold, so the next step is implementing additional controls to reduce it to an acceptable level. Acceptance is only valid once residual risk falls within tolerance, making further mitigation the required action.

Per-archive data keys limit the blast radius of any single key exposure, and wrapping them under a root key that never leaves the HSM means the wrapped copies stored alongside the archives are useless without it. Deleting the root key destroys the only means of unwrapping, so every archive becomes permanently unrecoverable even if the bucket is fully copied, satisfying crypto-shredding.

Allows mapping to multiple regulations

A service mesh sidecar proxy intercepts pod traffic and performs automatic mTLS, issuing and rotating certificates without application changes. This satisfies the strong service-to-service authentication requirement while eliminating the manual certificate lifecycle overhead the team flagged as their concern.

System categorisation, assigning impact levels (low, moderate, high) based on confidentiality, integrity and availability, is a distinctive early step in the NIST RMF. ISO 27005 addresses risk assessment and treatment without mandating this formal categorisation phase, making it the unique element.

The provider has blocked access to internal audit reports but explicitly permits the firm to send assessors on-site. A direct on-site assessment lets the firm independently inspect the provider's controls, interview staff, and review evidence first-hand, generating the assurance the questionnaire or report-based approaches could not deliver under these constraints.

Scanning images in the pipeline before they reach the registry blocks vulnerable artefacts from ever being stored or deployed, satisfying the CI/CD constraint by shifting detection left rather than scanning after promotion, when remediation requires rebuilding and republishing.

Threat modelling examines data flows, trust boundaries and architecture during design, exposing flaws before code exists, when remediation is cheapest. It directly satisfies the requirement to identify design flaws early, unlike code scanning or penetration testing, which occur later.

Baselining normal authentication behaviour lets the rule flag deviations such as a single account authenticating to many hosts rapidly, which typifies pass-the-hash lateral movement. This behavioural axis, rather than static signature matching, suppresses benign administrative logons and reduces false positives while retaining true-positive detection.

Intel SGX uses the CPU's memory encryption engine to encrypt enclave pages when they are written to DRAM and verify their integrity when read back. This ensures that even a privileged attacker like the OS or hypervisor cannot read or modify enclave memory. The encryption keys are managed by the CPU and never exposed to software.

seccomp operates as a syscall filter, restricting which system calls a process may invoke. Applied to containers, it blocks dangerous calls such as those used in privilege-escalation exploits, directly satisfying the requirement to limit the system calls a container can make.

A firewall rule permitting only HTTP and HTTPS denies all other inbound traffic before it reaches the target, which is the defining characteristic of a preventive control. This satisfies the stem's PCI DSS scenario by stopping unauthorised access attempts rather than detecting them afterwards.

psxview cross-references multiple process-listing sources, including EPROCESS linked lists, CSRSS handles and session structures, exposing processes hidden from any single view. Rootkits unlink entries from the standard list, so this plugin's comparison directly satisfies the requirement to detect hidden processes.

malfind scans process memory for injected code by locating regions with executable permissions lacking a mapped file on disk, the hallmark of process hollowing. Given the suspicious svchost.exe parented by explorer.exe, it directly tests the injected-code hypothesis pslist cannot confirm.

Pass-the-hash and pass-the-ticket reuse stolen credential material, producing authentication events such as Windows Event ID 4624 with anomalous logon types or source hosts. Authentication logs therefore expose the credential reuse that reveals lateral movement, unlike firewall or DNS data.

Multiplying the single loss expectancy of $50,000 by the annualised rate of occurrence of 0.2 yields $10,000, satisfying the stem's quantitative risk calculation. This figure represents the expected yearly financial loss from the asset, enabling cost-benefit comparison against proposed security controls.

Endpoint DLP agents monitor and block sensitive data at the source, such as copying files to removable media or pasting into web forms. In a hybrid environment, this complements inline cloud inspection by covering local egress paths that network-based controls cannot see, ensuring enforcement follows the data.

The employee breached the company's own mandated VPN requirement, so the violation is against an organisational policy. It is not a legal, regulatory or technical-control failure; the defining factor is contravention of internally defined remote-access rules.

DAST and penetration testing exercise the running application, exposing exploitable flaws in authentication, input handling and configuration before release. This satisfies the SSDLC requirement for pre-release security validation, complementing static analysis and threat modelling rather than replacing them.

WDAC is a kernel-enforced code integrity feature that can enforce policies requiring all executables to be signed by trusted publishers with a valid certificate chain. It operates at the kernel level and cannot be bypassed by local administrators, making it suitable for this strict requirement. It also supports audit mode and multiple policy formats.

EAP-TLS provides mutual authentication using digital certificates for both the client and the server, and it integrates with a RADIUS server for centralized policy enforcement. This meets the requirements for WPA3-Enterprise, which mandates 802.1X authentication and supports EAP-TLS as a secure method.

This ensures that DMZ hosts cannot be used as a pivot point into the internal network.

An offline root CA issues only to subordinate issuing CAs, each scoped to one purpose, so compromising a user-issuing CA cannot forge code-signing or device certificates. This satisfies the constraint of minimising compromise blast radius through cryptographic and operational separation.

SASE converges network and security functions in the cloud, providing secure web gateway for malware inspection and zero trust network access for user authentication before accessing applications. It enforces policy consistently regardless of user location, meeting the branch's needs without backhauling traffic. This makes it the correct recommendation.

SHA3-256 uses the Keccak sponge construction rather than Merkle-Damgard, so it is inherently resistant to length-extension attacks. It is FIPS 202 approved and acceptable under FIPS 140-3 validated modules, and it provides 128-bit collision resistance, which is sufficient for a 15-year firmware-signing lifespan. It therefore satisfies every stated requirement without additional mitigations.

Residual risk is what remains after existing controls are applied to an inherent risk. The firewall, tokenization, and recurring penetration tests reduce the likelihood and impact of exploitation, so the lower rating reflects residual risk. The scenario explicitly describes inherent risk dropping once current controls are considered, which is the definition of residual risk.

seccomp filters the system calls a container may invoke, using a profile to block unused or dangerous calls such as ptrace or mount. This reduces the kernel attack surface, directly enforcing least privilege at the syscall layer rather than through filesystem or capability controls.

A KRI signals exposure against a defined risk appetite, not operational throughput. Critical vulnerabilities breaching that threshold indicate the security posture has moved beyond acceptable tolerance, prompting escalation. KPIs, by contrast, measure performance such as patch coverage or mean time to remediate, so this metric is the risk indicator.

Dual control requires two or more individuals to authorize an action, and split knowledge ensures that no single person possesses the entire key or the means to use it. Together, they enforce separation of duties, preventing a lone administrator from generating and using a key without oversight. This is a fundamental principle in high-security key management, such as in FIPS 140-2 Level 3 or higher validated modules.

An identity provider with continuous evaluation satisfies zero-trust's demand for ongoing verification rather than one-time login. Microsoft Entra ID's Continuous Access Evaluation enforces near-real-time revocation of tokens when user risk, location or policy conditions change, closing the window between session issuance and threat detection that static authentication leaves open.

SAST scans source code statically during development, identifying injection flaws, insecure patterns and coding errors before compilation or deployment. Running it in the development phase satisfies the shift-left constraint, giving developers immediate feedback while remediation remains cheapest.

Requesting the vendor to align its retention policy with the organisation's legal requirements directly closes the identified compliance gap while preserving the vendor relationship. Termination or acceptance would leave the organisation exposed to legal and regulatory breach, so remediation is the best course.

TLS_AES_256_GCM_SHA384 is a TLS 1.3 cipher suite that uses AES-256 in GCM mode for encryption and SHA-384 for the hash. In TLS 1.3, all cipher suites provide forward secrecy by default because key exchange uses ephemeral Diffie-Hellman. This suite is strong and meets the requirements for PFS and strong encryption.

Categorize comes first in the NIST RMF, establishing the system's impact level by assessing confidentiality, integrity and availability. This determines the baseline controls selected in later steps, so performing it first satisfies the framework's mandated sequence.

Under the shared responsibility model, the cloud customer always owns identity and access management — defining users, roles, permissions and authentication. The provider secures the underlying infrastructure, but customer identities and their access rights remain the customer's responsibility.

A virtual firewall enforcing per-VM security groups provides microsegmentation at the hypervisor layer, filtering east-west traffic between VMs regardless of subnet. This directly satisfies the requirement that different customers' VMs cannot communicate unless explicitly permitted, since policy is applied per virtual machine rather than relying on physical network boundaries.

Impact measures the severity of consequences if a risk materializes, including financial loss, reputational damage, and regulatory penalties. For an online banking platform, impact directly ties to customer trust and compliance. Prioritizing risks with high impact ensures that treatment addresses threats that could severely disrupt operations or violate regulations, aligning security efforts with business resilience.

Acceptance fits because the legacy system cannot be patched, remains operationally critical, and the mitigation cost exceeds the potential loss. Retaining the residual risk formally, with documented sign-off and monitoring, is the proportionate treatment rather than transfer, avoidance or further mitigation.

Syslog over TLS encrypts log transport on port 6514, satisfying the requirement to move logs securely while preserving the standard syslog message format that network devices, servers and endpoints already emit, so the SIEM ingests consistent records without proprietary agents.

A CASB acts as an inline policy enforcement point between users and cloud services, applying access, data-loss prevention and threat policies regardless of device or location. This satisfies the requirement to enforce security policies on cloud application traffic.

Log fields are attacker-influenceable, so unsanitised values could inject commands or malformed data into the blocking logic. Validating and sanitising all log input prevents the automation from being subverted, satisfying the critical security consideration for this script.

Security-focused code reviews catch flaws at the source, before code merges or reaches testing. Reviewers inspect authentication logic, input validation and cryptographic usage against the team's secure coding standards, satisfying the stem's requirement to identify vulnerabilities early in development rather than after deployment. This shifts remediation to the cheapest possible point in the lifecycle.

The Govern function, new in CSF 2.0, focuses on establishing and monitoring cybersecurity strategy, policies, and risk management. It ensures that governance structures are in place to support the other functions. This directly addresses the development and implementation of policies and procedures for managing risk.

AllowUsers explicitly defines which user accounts may authenticate via SSH. When password authentication is disabled and root login is prohibited, this directive further narrows access to only the named administrative accounts. It directly addresses the requirement to restrict access to authorized users and is a standard hardening step for SSH daemons on public-facing servers.

CSPM tools continuously assess cloud configurations against benchmarks and policies, surfacing misconfigurations and regulatory breaches. Detecting compliance violations is a core capability, directly matching the stem's request for typical CSPM functions rather than runtime workload protection.

This sequence appends an ACCEPT rule for the internal subnet, then appends a DROP rule for all other traffic. Because iptables processes rules in order, packets from 10.0.0.0/24 match the first rule and are accepted; all other packets fall through to the DROP rule. This correctly implements the requirement.

An HSM provides dedicated tamper-resistant hardware that generates, stores and uses cryptographic keys internally, so keys never leave the device in plaintext. FIPS 140-2 Level 3 certification confirms physical tamper resistance, satisfying the requirement for secure signing in hardware.

Privilege escalation is one of the fourteen enterprise tactics in MITRE ATT&CK, describing the adversary's goal of gaining higher-level permissions. It sits alongside discovery and lateral movement as a tactical category, under which specific techniques such as exploitation for privilege escalation are catalogued.

The Strict-Transport-Security header instructs browsers to upgrade all future requests for the domain to HTTPS for the specified max-age, and includeSubDomains extends this to subdomains while preload allows inclusion in browser preload lists. This directly prevents protocol downgrade and plaintext requests after the first secure visit.

Extracting URLs and attachments, querying threat intelligence, then blocking indicators and isolating the endpoint chains deterministic enrichment and containment actions that require no human judgement, satisfying the stem's automation requirement. These steps execute faster than manual triage while preserving analyst review for ambiguous verdicts.

Motivations and objectives reveal why the actor targets the energy sector, guiding attribution and prioritisation of defences against likely campaigns. Including intent distinguishes state-sponsored espionage from financially driven crimeware, shaping the strategic response beyond raw indicators.

Under the shared responsibility model, the customer is responsible for securing data in the cloud, including enabling encryption at rest and managing encryption keys. The cloud provider may offer key management services such as AWS KMS, Azure Key Vault, or Google Cloud KMS, but the customer must configure and use them appropriately to meet PCI DSS requirements.

A just-in-time access broker grants per-session, short-lived credentials and proxies administrative connections without exposing inbound management ports on the virtual machines. This directly reduces the attack surface by removing persistent SSH access and eliminating standing credentials, matching the architect's recommendation.

A WAF rule blocks SQL injection payloads at the perimeter without touching legacy code, giving immediate virtual patching while developers work. It satisfies the constraint of minimising performance impact and preserving defence in depth alongside the existing IDS and network controls.

NIST RMF is the U.S. federal framework built on the six-step lifecycle: Categorize, Select, Implement, Assess, Authorize and Monitor. It satisfies the stem's requirement for a federal-specific process, unlike ISO 31000 or COSO ERM, which lack this mandated authorisation step and U.S. federal alignment.

A policy engine that consumes identity and device-posture signals and enforces decisions through a policy enforcement point on every request is the core of zero trust. It removes implicit trust based on network location and makes access contingent on current device health and authenticated identity, matching the stated requirement precisely.

Requiring current SOC 2 Type II reports gives the firm an independent auditor's opinion on the design and operating effectiveness of the provider's controls over a period of time. Delivering them annually ensures the assurance stays valid rather than relying on a one-time snapshot. This directly supports ongoing, third-party-verified visibility into the provider's security posture and complements other contractual safeguards.

Immutable infrastructure replaces instances rather than patching them, so any attacker modification to system files is discarded when the instance is rebuilt. This removes the persistence mechanism attackers rely on to survive reboots and remediation.

Continuous compliance monitoring continuously assesses controls against frameworks, so drift and misconfigurations surface immediately rather than at periodic audits. This satisfies the stem's requirement for a primary benefit: real-time visibility into compliance posture, enabling prompt remediation before gaps escalate into reportable findings.