CompTIA SecurityX (CAS-005) (CAS-005) — Questions 526–600

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) provide a standardized framework for representing and exchanging threat intelligence, enabling interoperability between different tools and organizations.

In a zero-trust architecture, the Policy Enforcement Point (PEP) is the critical component that enforces access decisions by mediating all traffic between users and resources. It evaluates policies based on user identity, device health, and contextual attributes (e.g., location, time) before allowing or denying access, aligning with the NIST SP 800-207 zero-trust framework.

The correct first step because the UEBA alert combined with anomalous behavior (access at 2 AM via foreign VPN, excessive download volume) strongly suggests malicious activity. Immediate isolation of the developer's workstation and revocation of repository access prevents further exfiltration and preserves evidence. Options A, B, and D are incorrect as they either focus on secondary controls, risk alerting the suspect, or delay containment.

The data lifecycle typically includes creation, storage, use, sharing, archiving, and destruction. Creation and destruction are standard phases.

Micro-segmentation is a core component of zero-trust architecture because it divides the network into isolated zones, each requiring separate authentication and authorization for any cross-zone traffic. This enforces the 'never trust, always verify' principle by preventing lateral movement even if an attacker compromises a single segment, unlike traditional flat networks where internal traffic is implicitly trusted.

Policies and procedures are foundational to a governance framework because they define the rules, standards, and operational guidelines that an organization must follow to ensure compliance, security, and risk management. They establish the 'what' and 'how' for decision-making and behavior, aligning with frameworks like ISO 27001 or NIST SP 800-53. Without documented policies and procedures, governance lacks enforceable structure and accountability.

The IAM policy explicitly allows 's3:ListBucket' on 'example-bucket', so listing objects in that bucket is permitted. The policy does not grant any actions on 'secret-bucket' or any write/delete permissions, so only Option D is allowed.

The database should be reclassified to 'Critical' because it contains PCI data, which requires the highest level. Creating a new level is unnecessary; accepting risk violates policy; removing data is not the first step.

In Cisco ACL syntax, the wildcard mask 0.0.0.255 matches all addresses in the 192.168.1.0/24 network. The 'deny ip 192.168.1.0 0.0.0.255 any' entry blocks any IP traffic from the source subnet 192.168.1.0 through 192.168.1.255 to any destination.

ALE = SLE × ARO, where SLE = AV × EF = $50,000 × 0.8 = $40,000, and ARO = 0.5, so ALE = $40,000 × 0.5 = $20,000.

EDR focuses on continuous monitoring and recording of endpoint activities, enabling detection of suspicious behaviors that may indicate an attack, even if no known signature exists. Traditional antivirus relies on signature-based detection. Behavior-based detection is a core EDR capability.

A honeypot is a decoy system designed to attract attackers and gather intelligence.

POST is correct because it is not idempotent, meaning multiple identical requests can result in different outcomes (e.g., creating a new resource each time). For updates that are not idempotent, POST is the appropriate HTTP method as it allows side effects such as appending data or triggering a process, unlike PUT which is idempotent and replaces the entire resource.

Admission controllers can intercept requests to the Kubernetes API server and enforce policies, such as allowing only images from a specific registry.

Diffie-Hellman group-exchange with SHA-1 is weak and should be disabled in favor of stronger key exchange algorithms.

The correct matches are AES with symmetric encryption, RSA with asymmetric encryption, and SHA-256 with hashing. Common confusions include mistaking AES for asymmetric or RSA for symmetric.

Pod Security Policy (PSP) is a Kubernetes admission controller that enforces security constraints on pods, such as preventing access to the host file system (via `readOnlyRootFilesystem`) and requiring containers to run as a non-root user (`runAsNonRoot`). This directly aligns with the least privilege principle and the requirement to block host file system access.

PCI DSS requires several controls, but the question asks for THREE. Options A, B, and D are mandatory controls per PCI DSS: encryption of cardholder data at rest (Requirement 3.4), multi-factor authentication for remote access (Requirement 8.3), and unique IDs for each person with access (Requirement 7.1). While antivirus (Requirement 5) and quarterly vulnerability scans (Requirement 11.2) are also required, they are part of broader operational requirements and not the focus of this specific selection.

Compensating controls can reduce risk, but patching should still be prioritized for critical vulnerabilities even if compensating controls are in place, as controls can be bypassed.

Threat modeling identifies design issues, SAST finds vulnerabilities in source code, and DAST finds vulnerabilities in running applications.

Infrastructure as code (IaC) enables security configurations to be defined in declarative or procedural scripts (e.g., Terraform, AWS CloudFormation, Ansible). This ensures that every deployment applies the exact same security settings (e.g., firewall rules, IAM policies, encryption at rest) without drift, making configurations consistent and repeatable across environments. The primary benefit is eliminating manual, error-prone processes that lead to configuration inconsistencies.

Hypothesis-driven hunting starts with a hypothesis about a threat and then searches for evidence. The hunter is hypothesizing about ransomware behavior.

Correct matches: SIEM provides centralized log analysis, IDS monitors for malicious activity, and firewalls enforce traffic rules. Common confusions include mixing SIEM and firewall functions.

Active reconnaissance involves directly interacting with the target to gather information, such as by sending probes and analyzing responses. Discovering version numbers via HTTP headers is a form of active reconnaissance because the tester is making requests and inferring information from the responses.

The policy hierarchy typically is: Policy (high-level requirements), Standard (mandatory rules), Guideline (recommended practices), Procedure (step-by-step instructions). The correct order is Policy then Procedure is not correct; Policy, Standard, Guideline, Procedure is the full order.

The typical hierarchy is Policy (high-level), Standard (mandatory controls), Guideline (recommended), Procedure (step-by-step).

FIPS 140-2 Level 3 requires tamper-evident coatings or seals and identity-based authentication (e.g., passwords, biometrics). Level 2 requires tamper-evident coatings but not identity-based. Level 4 requires tamper detection and zeroization.

Privacy by design requires embedding privacy into the design of systems and processes from the outset. Conducting a Privacy Impact Assessment (PIA) early helps identify and mitigate privacy risks before implementation.

A TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.

Static analysis (e.g., checking file extensions, strings, and hashes) is non-executing and safe to perform first to gather initial indicators.

A next-generation firewall (NGFW) with SSL/TLS inspection and application-level filtering is the best choice because it can decrypt and inspect encrypted C2 traffic at the network layer, then apply application-aware rules to block malicious communications. This directly addresses the requirement to detect and block C2 traffic that uses encryption to evade traditional inspection.

The technical report should include specific recommendations (patch, input validation), evidence (command used), and impact (privilege escalation path). The business impact belongs in the executive summary.

A DMZ behind a stateful firewall with least-privilege rules provides network-level isolation by placing the application in a separate security zone that restricts inbound and outbound traffic to only necessary ports and protocols. The stateful firewall tracks connection states, preventing unauthorized traffic from reaching the enclave while allowing legitimate responses. This approach directly addresses the requirement to isolate the application from the rest of the network, as the DMZ acts as a buffer between the internal network and the application.

Automated classification based on data content is the most effective method for ensuring consistent labeling across an organization because it removes human error and subjectivity. By using content inspection, pattern matching, and metadata analysis, the system can apply labels uniformly based on predefined rules, such as detecting credit card numbers (PCI-DSS) or personally identifiable information (PII). This approach enforces policy without relying on individual user judgment, which is critical for large-scale compliance.

NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation (Option B) is the foundational phase that ensures the organization has the tools, policies, and trained personnel ready before an incident occurs. Detection and Analysis (Option E) is the second phase, focusing on identifying and validating security incidents through monitoring, alerting, and forensic analysis.

The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.

Privacy by design means embedding privacy into the design and architecture of systems, not as an afterthought. Data minimization (collecting only what is necessary) is a key principle.

The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Cyber insurance transfers the financial risk to an insurance company, which is risk transfer.

Zero Trust requires verifying every request and limiting access to only what is needed, regardless of user location or network.

The NIST Risk Management Framework (RMF) describes a continuous process that includes steps like categorize, select, implement, assess, authorize, and monitor.

While CVSS base score is important, temporal factors like active exploitation increase risk. Vulnerability B, despite a lower base score, is being exploited and thus poses a more immediate threat. Patching should prioritize actively exploited vulnerabilities.

Process hollowing replaces the memory of a legitimate process with malicious code. The parent PID 0 indicates that the process was spawned by the kernel, which can occur after hollowing.

Software Composition Analysis (SCA) is the correct tool because it specifically analyzes open-source and third-party libraries (dependencies) for known vulnerabilities by cross-referencing them against databases like the National Vulnerability Database (NVD). In a CI/CD pipeline for a Java application, SCA tools (e.g., OWASP Dependency-Check, Snyk) scan build artifacts such as pom.xml or build.gradle to identify vulnerable components before deployment.

The CSP includes 'unsafe-inline' in the script-src directive, which explicitly allows inline scripts. This bypasses the primary protection CSP offers against XSS, as an attacker can inject malicious JavaScript directly into the HTML (e.g., via a <script> tag or event handler) without violating the policy. The 'self' source only restricts external scripts to the same origin, but inline scripts remain permitted, leaving the application vulnerable to stored, reflected, or DOM-based XSS attacks.

seccomp (secure computing mode) filters system calls a process can make, reducing the kernel attack surface. It is a Linux kernel feature commonly used in container security.

The application directly incorporates user input into an Ansible playbook without sanitization or validation. An attacker can inject arbitrary YAML or Ansible module directives (e.g., `shell`, `command`, `raw`) to execute unauthorized commands on managed hosts. This is a classic injection vulnerability specific to automation frameworks, not a generic injection type.

XDR extends detection beyond endpoints to include network, email, cloud, and other data sources, providing broader visibility and correlation across the entire environment.

RADIUS setup: install NPS, register in AD, add RADIUS client, configure connection policy, then network policy.

The customer is responsible for securing their data, applications, and access management, while the provider secures the infrastructure.

SBOMs provide transparency of components, dependency scanning reveals known vulnerabilities, and image scanning ensures container images are free of malware. Together they strengthen supply chain security.

The RTO of 4 hours defines the maximum acceptable downtime for the ERP system. Restoring it in 5 hours exceeds this threshold, resulting in unacceptable business downtime. This can trigger contractual penalties if service-level agreements (SLAs) specify a 4-hour RTO, as the organization failed to meet its recovery commitment.

Cloud Access Security Broker (CASB) provides visibility and data protection across cloud services, CSPM identifies misconfigurations that could lead to breaches, and Cloud Workload Protection Platform (CWPP) secures workloads in public clouds. IAM and VPC are important but are more basic controls; they are not the primary focus for this scenario.

All four pairs are correct. Immutable infrastructure ensures that instances are never modified after deployment; Infrastructure as Code mandates version control for all configuration files; Secret management relies on a dedicated vault for credentials; CI/CD pipeline security scanning involves scanning container images before deployment.

Allowing only necessary ports and protocols (E) implements least privilege, and implementing stateful packet inspection (C) enables intelligent traffic filtering. Default allow (D) is insecure, static IPs (B) are not a design principle, and logging (A) is operational, not a design principle.

CRYSTALS-Kyber is a NIST-selected algorithm for key encapsulation, designed to resist quantum attacks. It is used for establishing symmetric keys.

Honeypots are decoy systems designed to attract attackers, allowing security teams to observe their tactics, techniques, and procedures without risking real assets.

The detection phase involves identifying potential incidents through alerts and analysis. The analyst has received an alert and is likely investigating, which is part of detection.

Kubernetes Network Policies allow you to define ingress and egress rules for pods, controlling traffic at the IP address or port level, which is essential for micro-segmentation.

HSMs (Hardware Security Modules) provide tamper-resistant, FIPS 140-2 Level 3+ certified hardware for key generation, storage, and signing operations.

FTK Imager with memory capture is the correct tool because it is specifically designed to acquire a bit-for-bit copy of volatile memory (RAM) from a live system while preserving forensic integrity. Unlike disk imaging tools, FTK Imager can capture the contents of physical memory, including running processes, network connections, and encryption keys, which are critical for incident response. This tool also generates a hash of the captured memory to ensure data integrity during analysis.

The ACL is misordered because Cisco ACLs process rules sequentially from top to bottom, and a 'deny any' statement placed before a 'permit' statement will block all traffic, including the desired web traffic to 10.0.0.10 port 80. Since the exhibit shows a deny statement preceding the permit, the permit is never evaluated, causing the block.

TLS 1.3 removes support for insecure cipher suites like CBC mode and RC4, and only supports AEAD ciphers. It also provides forward secrecy by default.

API security best practices include using OAuth 2.0 for authentication/authorization, implementing rate limiting to prevent abuse, and validating input to prevent injection attacks. WPA3 is for Wi-Fi; symmetric encryption alone is not a complete API security practice.

The order of volatility dictates collecting the most volatile data first. RAM is highly volatile and should be captured before less volatile data like disks.

Code signing certificates are specifically designed for signing software; they are typically issued by a publicly trusted CA.

Certificate Transparency (CT) requires all certificates to be publicly logged in CT logs. This allows domain owners and CAs to monitor for misissuance.

PowerShell is the most native and efficient scripting language for automating the retrieval of failed login events from the Windows Security log because it provides direct access to the Windows Event Log via the Get-WinEvent cmdlet, which can filter for Event ID 4625 (failed logon) using XPath queries or FilterHashtable for optimal performance. It runs natively on Windows without additional dependencies and integrates seamlessly with the .NET framework and Windows Management Instrumentation (WMI), making it the default automation tool for Windows administrators.