CompTIA SecurityX (CAS-005) (CAS-005) — Questions 601–675

A SOC 2 Type II report provides an independent assessment of controls over a period, confirming the vendor's control effectiveness.

URL blocking in a web proxy prevents other users from accessing the malicious link, which is a common automated response in phishing playbooks.

Conducting a Data Protection Impact Assessment (DPIA) before development is the most appropriate control because GDPR Article 35 mandates a DPIA when processing biometric data is likely to result in high risk to individuals' rights and freedoms. This aligns with the principle of data protection by design (Article 25), requiring privacy considerations to be embedded into the development process from the outset, not added later.

Keeping the root CA offline and using a hardware security module (HSM) for key storage ensures its private key is never exposed to network threats. This is a standard best practice.

A procedure details the exact steps to implement a policy, standard, or guideline.

Federating on-premises Active Directory directly with both AWS and Azure using ADFS (Active Directory Federation Services) minimizes latency and complexity by avoiding intermediate synchronization steps. ADFS acts as a single identity provider that issues SAML 2.0 assertions to both cloud providers, allowing users to authenticate against on-premises AD in real time without replicating identity data to the cloud. This eliminates the need for directory synchronization, reducing both architectural overhead and authentication latency.

Software-defined networking (SDN) with distributed firewalls is essential for enforcing micro-segmentation because it enables granular, policy-based traffic control at the virtual network layer, independent of physical topology. SDN centralizes policy management and pushes firewall rules to hypervisor-level or host-level enforcement points, allowing east-west traffic to be segmented between individual workloads or application tiers without relying on traditional perimeter firewalls.

Predictable session tokens arise from insufficient randomness. Using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy ensures that tokens are statistically unpredictable and resistant to brute-force or guessing attacks, which is the foundational requirement for secure session management per NIST SP 800-63B and OWASP guidelines.

HIPAA gives patients the right to access their protected health information (PHI). This aligns with the data subject right of access.

OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

The data classification policy JSON explicitly marks documents with a classification of 'Confidential' and a data type of 'PII' as 'block' action. The email contains a document classified as 'Confidential' with PII data, so the policy dictates that the email must be blocked and the security team notified. This aligns with the policy's enforcement rule for high-risk data, preventing unauthorized disclosure.

FIPS 140-2 Level 3 requires that cryptographic keys be created and stored in the HSM and never exist in plaintext outside the device. A key ceremony involves splitting keys into parts (m of n) and distributing them to multiple trusted individuals.

HSMs protect private keys, and OCSP provides real-time revocation status. Both are essential for CA security.

In FAIR, ALE = LEF × LM. Here, LEF=4 and LM=$25,000, so ALE = 4 × $25,000 = $100,000.

Network segmentation isolates the vulnerable system, reducing the attack surface and limiting potential damage.

Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.

Zero trust assumes no implicit trust based on network location; all access requests must be authenticated and authorized regardless of origin. Micro-segmentation and identity-centric controls support this, but the core principle is 'trust no one by default'.

PCI DSS Requirement 10 requires tracking and monitoring access to network resources and cardholder data. Log coverage percentage directly measures whether all necessary systems are logging.

If a vendor refuses to provide independent audit evidence, the organization should consider the risk level. For sensitive data, a SOC 2 report is a strong control. The organization should require a right-to-audit clause to perform its own assessment, as the questionnaire alone may be insufficient.

Just-in-time (JIT) access provisioning grants temporary privileges that expire after use, reducing standing privileges. Break-glass accounts are emergency accounts, not time-based.

Automated certificate enrollment using SCEP or ACME protocols enables devices to request and renew certificates without manual intervention.

A whitelist of allowed file paths is the most effective mitigation because it defines an explicit set of permissible paths, preventing any unauthorized file access regardless of traversal attempts. Unlike input validation, which can be bypassed with encoding or alternative traversal sequences, a whitelist enforces a positive security model that blocks all unspecified paths, including those using '..' or symbolic links. This approach directly addresses the root cause of directory traversal by restricting the application to only known-safe resources.

Static analysis examines the malware without executing it, focusing on file metadata, strings, imports, and other characteristics.

CSPM continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks, providing automated remediation and reporting.

Output encoding is the primary defense against cross-site scripting (XSS) because it neutralizes injected scripts by converting special characters (e.g., <, >, &, ") into their HTML entity equivalents (e.g., &lt; &gt; &amp; &quot;) before the data is rendered in the browser. This ensures that user-supplied data is treated as text, not executable code, regardless of how it entered the application. Input validation alone is insufficient because it can be bypassed via alternate encodings or allowed characters that are still dangerous in certain contexts.

GDPR Article 12(3) requires organizations to respond to data subject access requests without undue delay and at the latest within one month. The most important control is a documented process that ensures timely identification, validation, and fulfillment of these requests, as failure to meet the deadline constitutes a direct compliance violation. Without this process, technical controls like encryption alone cannot satisfy the regulatory requirement for a verifiable response.

CVSS v3 consists of Base, Temporal, and Environmental metric groups. Exploitability and Impact are sub-scores within the Base group, not separate groups.

An API gateway handles authentication, authorization, rate limiting, and routing, providing a central security control point.

802.1X provides port-based authentication, allowing only authorized devices to connect to the network.

Mimikatz is a tool that extracts plaintext passwords, hashes, and Kerberos tickets from memory. It is commonly used for credential dumping to enable lateral movement.

These features are covered in identity and access management and data protection domains.

A guideline suggests best practices and is not mandatory, while a procedure provides step-by-step instructions that are mandatory.

Immutable infrastructure ensures that once a container image is deployed, it is never modified. Any change requires a new image deployment, which prevents configuration drift and unauthorized changes.

Certificate Transparency (CT) logs provide an audit trail of all issued certificates, allowing domain owners to detect misissuance. Certificate pinning (or HTTP Public Key Pinning) can prevent the acceptance of fraudulent certificates by clients. OCSP stapling helps check revocation but does not prevent misissuance; CRLs are for revocation; OSCP itself doesn't prevent misissuance.

The three main cloud service models are IaaS, PaaS, and SaaS. IaaS offers virtualized infrastructure, PaaS provides a development platform, and SaaS delivers software applications. Common confusions include mixing the definitions of PaaS and IaaS, or equating PaaS with SaaS.

Capturing a network packet dump from the host allows the analyst to observe the unexpected outbound connections without altering the container's state or risking privilege escalation. By correlating the packet capture (e.g., using tcpdump or Wireshark) with container logs, the analyst can identify the destination IPs, ports, and protocols involved while maintaining the container's minimal privileges and preserving forensic integrity.

SWG (Secure Web Gateway) enforces security policies for web traffic, including URL filtering, malware detection, and data loss prevention.

ALE = SLE × ARO = $5,000 × 0.2 = $1,000.

Adding a breach notification clause directly addresses the contractual gap that left the organization without recourse or timely notification when the vendor suffered a data breach. This contractual remedy ensures that future incidents trigger a predefined notification process, aligning with regulatory requirements such as GDPR or HIPAA that mandate breach notification obligations for data processors. Without such a clause, the organization has no enforceable mechanism to compel the vendor to report breaches, regardless of other risk management activities.

Micro-segmentation (A) is correct because it divides the network into isolated segments at the workload level, enforcing granular security policies that restrict lateral movement. This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit permission for every inter-workload communication, regardless of network location.

A Data Processing Agreement (DPA) is the correct contractual mechanism to enforce data residency restrictions. By requiring the CSP to store data only in approved jurisdictions, the DPA directly addresses the compliance risk of conflicting privacy laws and potential regulatory penalties, as it legally binds the provider to specific geographic data handling requirements.

Platform Configuration Registers (PCRs) store hash measurements of boot components. Any change in the boot sequence will result in different PCR values, alerting to tampering.

Micro-segmentation allows granular policies per workload, and east-west traffic inspection detects lateral movement. Both are key to reducing risks inside the network.

In NIST RMF, the 'Select' step involves choosing baseline controls and tailoring them based on the risk assessment results. 'Categorize' determines impact level. 'Implement' executes controls. 'Assess' evaluates effectiveness.

Network policies in Kubernetes act as a firewall for pods, controlling ingress and egress traffic at the IP address or port level (OSI layer 3 or 4). By default, all pods can communicate with each other; applying network policies enforces least-privilege segmentation, which is a core security best practice for container orchestration platforms.

The primary purpose of a Public Key Infrastructure (PKI) is to bind public keys to identities through digital certificates, enabling authentication, non-repudiation, and encryption. PKI uses Certificate Authorities (CAs) to issue and manage X.509 certificates, which associate a public key with a specific entity (e.g., a user or server) and are validated via certificate chains. This binding is essential for secure communications, such as TLS/SSL, where certificates authenticate the server and establish encrypted sessions.

FedRAMP requirements are stringent and often best met by a government community cloud or a dedicated cloud environment that has been FedRAMP authorized.

The most cost-effective because Windows Defender (now Microsoft Defender Antivirus) is built into modern Windows operating systems at no additional cost, providing real-time protection against malware. Supplementing it with free on-demand scanners like Microsoft Safety Scanner or Malwarebytes Free provides periodic secondary checks without per-device licensing fees, meeting the small business's requirement for endpoint protection without recurring costs.

A multi-tier hierarchy (root offline, issuing CAs) limits exposure; strong hashing and key algorithms are essential; CRL/OCSP distribution points must be accessible for revocation checking.

KRIs are leading indicators that signal increasing risk. Number of unpatched critical vulnerabilities, percentage of users without MFA, and number of failed login attempts are KRIs. MTTD is a KPI, not a KRI.

These tools are commonly used for network troubleshooting and security assessments.

The attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.

The /api location block lacks any authentication or authorization directives, such as `allow/deny` or `auth_basic`, leaving the internal API endpoint exposed to any client that can reach the Nginx server. In a typical deployment, this would allow unauthenticated access to sensitive backend services, which is a critical security flaw. The absence of access controls on /api directly violates the principle of least privilege and can lead to data exfiltration or unauthorized operations.

LiME (Linux Memory Extractor) is the most appropriate tool because it is specifically designed to acquire volatile memory from Linux systems while minimizing the footprint on the target system. It loads as a kernel module and directly accesses physical memory, ensuring that the acquisition process does not alter the system state, which is critical for forensic integrity.

It explicitly allows only the required traffic (HTTPS on port 443 from any source, SSH on port 22 from the management subnet) and then denies all other traffic by default. This follows the principle of least privilege by ensuring no unintended services or sources are permitted, which is the core goal of firewall rule design.

In FAIR, threat event frequency (TEF) is the probable number of times a threat agent will act on a vulnerability in a given timeframe.

Volatility is a memory forensics tool that can analyze RAM dumps to extract network connections, processes, and other artifacts. It is the best choice for this task.

PCI DSS Requirement 5 mandates that entities must maintain a vulnerability management program that includes deploying anti-malware software on all systems commonly affected by malicious software, as well as performing regular vulnerability scans and applying security patches. This requirement ensures that cardholder data environments are protected against known vulnerabilities that could be exploited by attackers.

Key rotation limits exposure if a key is compromised, and separating key management from data storage reduces attack surface. Storing keys in plaintext is insecure, using a single master key increases risk, and auditing is a detective control but not as fundamental as the other two.

Immediately disconnecting the physical host from the network is the most effective immediate action to contain the spread of ransomware. Since the host is compromised and the Type 2 hypervisor runs on top of a Windows Server OS, the attacker can pivot from the host to any VM via the virtual switch. Cutting network connectivity stops all lateral movement and outbound command-and-control traffic, buying time for forensic analysis and remediation.