CompTIA SecurityX (CAS-005) (CAS-005) — Questions 526–600

Parameterised queries send SQL structure separately from user-supplied values, eliminating injection, while output encoding neutralises injected markup in the generated PDF. Together they address both the database and PDF generation flaws in the legacy library.

HIPAA requires audit controls that record and examine activity in information systems containing or using electronic protected health information (ePHI). Application-level logging that captures user identity, timestamp, and the specific records accessed directly satisfies this. Storing logs securely ensures integrity and availability for audits. This is the most precise control for auditing access to PHI.

Input validation enforces length and format checks on user-supplied data before processing, directly satisfying the constraint that input size must be bounded. By rejecting oversized payloads at the boundary, it prevents the buffer overflow the penetration tester exploited, whereas output encoding or parameterised queries address different vulnerability classes.

SOAR's primary operational benefit is executing automated playbooks that orchestrate response actions across tools, cutting mean time to respond. It satisfies the stem's day-to-day operations focus by replacing manual, repetitive triage and containment steps with machine-speed, consistent workflows.

A pre-commit hook scans staged changes locally and rejects commits containing detected secrets, preventing credentials from ever entering repository history. This shifts detection left of the commit, avoiding the costly history rewriting and key rotation that post-commit scanning requires.

A SOC 2 Type II report is issued by an independent auditor after testing whether controls were designed appropriately and operated effectively throughout a defined period, which is exactly the assurance enterprise customers seek when evaluating a cloud provider's security and availability posture.

Portability and format standards guarantee the provider returns records in a usable, structured form on exit, directly satisfying the security officer's data ownership and portability concern. Without defined formats, extraction becomes impractical, so this clause is the most critical contractual protection.

Immutable infrastructure replaces servers rather than modifying them, so no running instance accumulates manual tweaks. That directly satisfies the stem's constraint: configuration drift and unauthorised changes become impossible because every deployment provisions fresh, identical instances from a versioned image, and any deviation is discarded at replacement.

Recovery restores systems to normal operation after eradication, then monitors for recurrence. The stem's constraint — root cause identified and threat removed — places the incident exactly at the transition from eradication into recovery, where validated restoration and post-restoration monitoring occur.

Microsegmentation enforces least privilege between workloads, so a compromised workstation cannot freely reach other systems. Combined with default-deny rules, it contains an intruder and is a core mechanism for limiting lateral movement in a zero trust design.

The strings command extracts readable ASCII and Unicode sequences from a binary without executing it, revealing URLs, file paths and messages. This satisfies the stem's static analysis constraint, unlike dynamic tools that run the executable in a sandbox.

PowerShell script block logging captures deobfuscated script content and execution events directly within the engine, exposing fileless techniques that never write to disk. This satisfies the stem's requirement to detect fileless malware, which evades traditional file-scanning EDR by residing only in memory and script interpreters.

NET_ADMIN permits interface, routing and firewall manipulation, while SYS_ADMIN grants broad administrative operations such as mounting filesystems. Combined in one container, these capabilities enable privilege escalation and host or network compromise, outweighing the other manifest settings.

Confidential computing encrypts guest memory with keys managed by the CPU, so even a compromised hypervisor or a malicious provider administrator sees only ciphertext. TEEs provide cryptographic isolation of tenant workloads from the provider and other tenants, directly meeting the requirement that plaintext never be exposed to the cloud provider at any layer.

Constant-time algorithms execute identical operations regardless of secret data, eliminating the timing variations attackers correlate with key bits. This directly mitigates timing side-channel attacks, satisfying the stem's requirement for a valid cryptographic implementation technique that prevents secret-dependent execution paths.

A Hardware Security Module provides tamper-resistant hardware that generates, stores and uses private keys without exposing them to host memory, satisfying the stem's requirement for protected keys and cryptographic operations in a tamper-resistant environment. Unlike software keystores, its physical and logical controls detect intrusion and zeroise key material, defeating extraction attempts.

DNS exfiltration often encodes data in subdomains, resulting in long, random-looking strings. Analyzing DNS query logs for such patterns, especially repeated queries to a single domain, can reveal tunneling. This directly addresses the scenario and uses the appropriate data source.

ECDSA P-384 provides a 192-bit security strength, exceeding RSA-2048 and matching the strongest IKEv2 authentication options. It satisfies the stem's demand for maximum security by using elliptic-curve cryptography, which delivers equivalent strength with smaller keys and is approved for CNSA suite compliance.

The malfind plugin scans process memory for VAD regions marked both executable and writable, flagging likely injected code such as reflective DLL injection or shellcode. Other plugins enumerate handles, connections or loaded modules, but none specifically target executable-writable memory mappings.

STIX provides a structured language for describing indicators, actors and campaigns, while TAXII defines the transport protocol for exchanging that content. Together they let platforms ingest and act on intelligence automatically, removing manual reformatting between vendors.

Automatic revocation after use or expiry is fundamental to JIT: standing privileges are eliminated, so access exists only for the approved window. Once the task completes or the timer lapses, the entitlement is withdrawn without manual intervention, shrinking the attack surface.

Isolating the workstation and revoking repository access contains the suspected exfiltration before more intellectual property leaves, satisfying the stem's FIRST-action constraint. UEBA already flagged anomalous foreign-VPN access at 2 AM and 10x download volume, so immediate containment precedes forensic imaging or DLP tuning.

Data creation is the lifecycle phase where new data is generated, captured or acquired, establishing the asset before any classification or protection controls apply. It satisfies the stem's requirement to identify genuine lifecycle phases within a data lifecycle management programme.

Micro-segmentation satisfies the zero-trust requirement for granular, least-privilege access by dividing networks into isolated zones, each with its own policy controls. This limits lateral movement, so a compromised workload cannot reach unrelated resources, directly enforcing the "assume breach" principle central to zero-trust architecture.

PCI DSS scoping begins with identifying all system components that store, process, or transmit CHD or SAD, as well as those that could impact the security of the CDE. This includes connected systems and security-impacting systems. Without this inventory, the scope cannot be accurately defined, and the assessment will be incomplete. This is the foundational step mandated by PCI DSS.

Core governance documents

Contractual audit rights, notification obligations, and requirements for independent assurance such as SOC 2 reports give the bank ongoing visibility into vendor control status between assessments. These provisions create enforceable expectations and information flow, so the bank learns of control changes or incidents without waiting for the next scheduled review, which is exactly the continuous oversight the examiner seeks.

Reclassifying to Critical immediately aligns the database's label with its actual contents, since credit card numbers demand the highest protection level under the policy. This corrects the mislabelling before any further remediation or access review.

A default-deny seccomp profile removes access to the large majority of system calls a process never needs, shrinking the kernel interfaces an attacker can abuse from inside a compromised container. Because it is enforced per process by the kernel, a successful application exploit cannot pivot to unneeded calls such as those used to load modules or manipulate namespaces, directly reducing escape options.

Wildcard 0.0.0.255 matches the entire /24 subnet.

SLE equals asset value ($50,000) multiplied by exposure factor (0.80), giving $40,000. ALE is SLE multiplied by ARO (0.5), yielding $20,000. This quantifies expected annual loss for the payment card server, satisfying the quantitative assessment requirement.

Behavioural analysis and detection distinguishes EDR from signature-based antivirus, which matches only known file hashes. EDR continuously monitors process behaviour, registry changes and API calls, then correlates these events to identify anomalous activity such as living-off-the-land techniques that traditional antivirus, lacking behavioural telemetry, would miss entirely.

A honeypot is a decoy system deliberately exposed to attract attackers, letting defenders observe their tactics, techniques and procedures within a controlled, monitored environment. It satisfies the requirement to lure adversaries and record their behaviour without risking production assets.

POST performs non-idempotent updates because each request can create a new subordinate resource or alter server state differently, satisfying the stem's requirement for updates that are not idempotent. Unlike PUT, which replaces a resource at a known URI idempotently, POST targets a collection or processing endpoint where repeated identical requests may produce distinct outcomes.

An admission controller intercepts pod creation requests before persistence and evaluates them against policy. OPA/Gatekeeper enforces rules restricting image sources, so only images from the trusted registry are admitted, directly satisfying the stem's trusted-registry constraint.

Diffie-Hellman group exchange with SHA-1 uses a deprecated hash for key exchange integrity, weakening SSH against collision-based attacks. Disabling it enforces stronger SHA-2-based key exchange algorithms, meeting the requirement to restrict the jump host to the most secure options.

Periodic on-site assessments allow the organization to directly verify the vendor's security controls, practices, and compliance with contractual requirements. They provide firsthand evidence and can uncover issues not visible in documentation. This method is effective for ongoing monitoring, especially for critical vendors, and complements other oversight activities.

A CVSS base score of 9.8 on an internet-facing server warrants immediate remediation; a WAF is a compensating detective or blocking control, not a substitute for patching, since bypasses and rule gaps exist. Delaying based on the WAF leaves the underlying exploitable flaw unaddressed.

Downloading the file and performing static analysis with a text editor and deobfuscation tools allows the analyst to understand the script's logic, identify obfuscation techniques, and extract indicators without executing it. This avoids any risk of infection and is a standard safe practice for analyzing potentially malicious scripts.

Threat modelling identifies design-level weaknesses by systematically analysing data flows, trust boundaries and attack paths before coding completes. Applying it early satisfies the stem's requirement to find vulnerabilities during development, complementing code-level scanning with architectural risk discovery.

Risk transfer involves shifting the financial impact of a risk to a third party, such as an insurance company. Purchasing cyber insurance is a classic example of risk transfer. The organization retains the risk but transfers the potential financial loss to the insurer, which aligns with the risk owner's decision in this scenario.

IaC declares security configurations in version-controlled templates that are applied identically across every deployment, removing manual drift and configuration error. This repeatability satisfies the stem's primary-benefit question, distinguishing IaC from one-off scripting or documentation-based hardening.

Network policies can select pods and control egress by destination CIDR and port, so a rule denying 169.254.169.254 blocks the metadata path while a companion allow rule permits required external APIs. This is the least-disruptive control that directly removes the credential-theft vector without breaking legitimate traffic. It enforces the restriction at the pod network layer regardless of application behavior.

Banner grabbing and header inspection gather information about the target's technology stack without exploiting it, which is active reconnaissance within the reconnaissance phase. It precedes scanning, exploitation and post-exploitation, satisfying the lifecycle stage where target intelligence is collected.

Zero trust architecture continuously evaluates identity and device posture through a policy engine and enforces decisions at policy enforcement points. Placing enforcement at each microservice allows the hospital to authorize every request based on user, device, and context regardless of network location, satisfying both the managed workstation and unmanaged contractor scenarios with one consistent model.

Policy sits at the top of the hierarchy, establishing mandatory high-level intent, followed by standards that specify enforceable requirements. Guidelines then offer non-mandatory recommendations, and procedures come last, detailing the step-by-step actions needed to implement the higher-level directives. This ordering satisfies the stem's highest-to-lowest constraint.

A Privacy Impact Assessment identifies what personal data is processed, why, and where risks arise, giving the documented basis for designing controls before processing begins. Conducting it first satisfies the privacy-by-design requirement to embed protection at the earliest stage of any EU personal-data initiative.

Static analysis examines the file's structure, strings and headers without executing it, safely revealing the double extension and embedded indicators. This satisfies the stem's need to determine maliciousness first, before risking execution in a sandbox.

An NGFW with SSL/TLS inspection decrypts encrypted sessions, then applies application-level filtering to identify and block C2 signatures at the network layer. This satisfies both constraints: inspecting encrypted traffic and operating inline at the network layer.

Recommending the patch gives the remediation team the specific fix that closes the exploited web application vulnerability, addressing the initial access vector. This satisfies the stem's requirement for actionable remediation steps in the technical report.

Content-based automated classification inspects actual data patterns and identifiers, applying labels consistently regardless of author or department. This satisfies the requirement for uniform labelling across the organisation, unlike manual schemes that depend on inconsistent human judgement.

Many HSMs support cloning or secure backup where the key is transferred between devices in a wrapped, hardware-protected form and never exists as a recoverable plaintext blob. Storing the backup on a second, geographically separate HSM preserves availability after device failure while keeping the private key inside certified hardware boundaries, satisfying both the no-plaintext and restoration requirements.

Preparation is a foundational phase of the incident response lifecycle.

The policy grants actions on a wildcard resource, so principals can reach every object of that type rather than only those required. This violates least privilege by broadening access far beyond the intended scope, exposing unrelated resources to unintended modification or disclosure.

Privacy by design mandates data minimisation: collecting only what the application's function requires limits exposure and compliance risk at source. This is a structural safeguard embedded in design, unlike consent notices or retention policies applied after collection.

SAST analyzes source code for vulnerabilities without executing it, enabling early detection of issues like SQL injection or buffer overflows. Integrating SAST into the CI/CD pipeline ensures continuous security checks. This helps developers fix flaws before deployment, reducing risk.

A BIA identifies the organisation's critical business processes and quantifies the operational and financial impact of disrupting each one, producing the recovery priorities and timeframes that drive continuity planning. That impact analysis is its primary purpose.

Purchasing cyber insurance shifts the financial consequence of a data breach to an insurer rather than eliminating or reducing the risk itself. This is risk transfer, matching the treatment plan's intent to cover potential breach costs through a third party.

Zero trust treats network location as insufficient evidence of trust, so every access request is authenticated and authorised explicitly, regardless of whether it originates inside or outside the corporate perimeter. Continuous verification replaces the implicit trust granted by legacy castle-and-moat designs.

The NIST Risk Management Framework prescribes a continuous, iterative cycle — Prepare, Categorise, Select, Implement, Assess, Authorise and Monitor — so risk identification, assessment and response recur throughout the system lifecycle rather than as a one-off exercise.

CVSS base scores measure intrinsic severity only, not real-world threat. Exploit availability and active exploitation are captured by temporal and threat metrics, which raise actual risk. Since B is being exploited in the wild, it poses immediate likelihood of compromise, so best practise prioritises it over higher-scoring but unexploited flaws.

The -sS flag initiates a TCP SYN scan (half-open scan), which is stealthy because it does not complete the TCP handshake. The -Pn flag disables host discovery (ping), treating all hosts as online. The -p 80,443 specifies ports 80 and 443. The target is the subnet 192.168.1.0/24. This command is used to quickly identify web servers on the network without performing a full port scan or host discovery, which can be noisy and slow.

A service mesh with mutual TLS authenticates and encrypts all service-to-service communication, and authorization policies can restrict which services are allowed to talk to each other based on identity. If a container is compromised, the attacker cannot impersonate another service or communicate with services that are not explicitly authorized, which significantly limits lateral movement. This is a strong control for microservices environments.

XMSS is a stateful hash-based signature scheme whose security rests solely on hash-function collision resistance, so it resists quantum attacks via Shor's algorithm. It satisfies the quantum-resistance requirement while signing and verifying quickly, meeting the high-performance constraint. Its stateful nature, however, demands careful key-state management to prevent reuse of a one-time key.

Seccomp profiles filter the syscalls a container may invoke, blocking everything outside an explicit allowlist. This directly satisfies the stem's requirement to restrict system calls to only those the application needs, unlike AppArmor or SELinux, which enforce mandatory access control over file paths, network ports and capabilities rather than the syscall interface itself.

Even with encryption, the size and timing of packets can reveal patterns. C2 channels often exhibit regular beaconing intervals, consistent packet sizes, or specific request-response patterns. Analyzing these metadata can indicate automated malicious communication. This technique is effective because it does not require payload decryption and can be automated in network monitoring tools.

Virtual patching reduces the likelihood or impact of exploitation by blocking attack vectors, even without a vendor patch. This is a form of risk mitigation because it lowers the risk to an acceptable level through compensating controls. It does not eliminate the vulnerability but manages it effectively.

SAST analyzes source code or binaries for vulnerabilities without executing the application. Integrating it into the build process allows developers to receive immediate feedback on security issues as they commit code. This shifts security left, enabling early remediation and reducing the cost of fixes. SAST is ideal for identifying issues like SQL injection and cross-site scripting early in the SDLC.

Crafted input can inject arbitrary Ansible module calls into the generated playbook, since Ansible executes whatever modules the YAML specifies. This directly satisfies the stem's constraint: untrusted user input flows into playbook generation without validation, enabling remote code execution on managed hosts under the automation controller's privileges.

SELinux in enforcing mode applies mandatory access control, restricting processes to only the resources defined in the policy. A targeted policy confines specific services like the web server, limiting the impact of a compromise. This meets the requirement to confine the web server process even if exploited.

XDR natively ingests and correlates telemetry from endpoints, network, cloud and identity into one console, satisfying the stem's cross-layer visibility requirement. EDR's scope stops at the endpoint agent, so it cannot surface network or cloud signals. This broader correlation is the defining architectural difference between the two.