easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is deploying a new application that processes…
An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?
⚠ Common exam trap
Candidates often mistake broad security frameworks like ISO 27001 or NIST SP 800-53 for the specific cryptographic module validation standard. For the CASP+ exam, remember that FIPS 140-2 is the dedicated standard for validated cryptographic modules used in government and sensitive data environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIPS 140-2
FIPS 140-2 (Federal Information Processing Standard Publication 140-2) is the U.S. government standard for validating cryptographic modules. It specifies security requirements for hardware and software modules that perform cryptographic functions, ensuring they have been tested and validated by an accredited laboratory. For an application processing sensitive user data, deploying a FIPS 140-2 validated module guarantees that the cryptographic implementation meets rigorous security standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 is an information security management system standard, not for cryptographic module validation.
- ✗
PCI DSS
Why it's wrong here
PCI DSS is a standard for payment card data security, not for validating cryptographic modules.
- ✗
NIST SP 800-53
Why it's wrong here
SP 800-53 provides security and privacy controls for federal systems, not specifically for cryptographic modules.
- ✓
FIPS 140-2
Why this is correct
FIPS 140-2 is the standard for cryptographic module validation, ensuring hardware and software meet security requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.