easyMultiple Choice
CAS-004 Practice Question: Is deploying a new application that processes…
An organization is deploying a new application that processes sensitive user data. The security team recommends using a dedicated cryptographic module. Which standard should the module comply with to ensure it is validated for security?
⚠ Common exam trap
Candidates often mistake broad security frameworks like ISO 27001 or NIST SP 800-53 for the specific cryptographic module validation standard. For the CASP+ exam, remember that FIPS 140-2 is the dedicated standard for validated cryptographic modules used in government and sensitive data environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIPS 140-2
FIPS 140-2 (Federal Information Processing Standard Publication 140-2) is the U.S. government standard for validating cryptographic modules. It specifies security requirements for hardware and software modules that perform cryptographic functions, ensuring they have been tested and validated by an accredited laboratory. For an application processing sensitive user data, deploying a FIPS 140-2 validated module guarantees that the cryptographic implementation meets rigorous security standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 certifies an organisation's information security management system, not the cryptographic strength or validation of a module. It is tempting because it is a widely recognised security certification, but it addresses governance processes; FIPS 140-3 is the standard that validates cryptographic modules themselves.
- ✗
PCI DSS
Why it's wrong here
PCI DSS is a payment-card industry data security standard governing how cardholder data is stored and transmitted, not a cryptographic module validation scheme. It is tempting because it mandates encryption of cardholder data, but it does not certify modules; FIPS 140-3 is the standard against which a cryptographic module is validated.
- ✗
NIST SP 800-53
Why it's wrong here
NIST SP 800-53 is a catalogue of security and privacy controls for federal information systems, not a validation programme for cryptographic modules. It is tempting because it is a well-known NIST security publication, but the standard that validates cryptographic modules is FIPS 140-3, which specifies the security requirements and testing levels a module must meet.
- ✓
FIPS 140-2
Why this is correct
FIPS 140-2 is the NIST validation standard for cryptographic modules, specifying security requirements across eleven areas including key management and physical tampering. Compliance certifies the module has been independently tested, satisfying the demand for a validated cryptographic module.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.