hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a compliance audit, an organization's…
During a compliance audit, an organization's security team discovers that sensitive data in a legacy database is stored in plaintext. The database is critical for operations and cannot be taken offline for patching until the next maintenance window in three months. Which of the following is the BEST compensating control to reduce risk immediately?
⚠ Common exam trap
The key trap is that encryption solutions like TDE or file-level encryption require database downtime or reconfiguration, which is not permitted in the scenario. Network access control provides immediate risk reduction without touching the database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict network access to the database to only authorized applications
Restricting network access to the database to only authorized applications is the best compensating control because it immediately reduces the attack surface without requiring any changes to the database itself. By implementing a host-based firewall or network ACLs that limit inbound connections to only specific application servers (e.g., via IP whitelisting and port restrictions), the organization can prevent unauthorized users or malware from directly querying the plaintext data. This control is operational immediately, does not require downtime, and aligns with the principle of least privilege, making it the most practical short-term risk mitigation while awaiting the maintenance window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict network access to the database to only authorized applications
Why this is correct
Network restrictions reduce attack surface without downtime.
- ✗
Use file-level encryption on the database storage volume
Why it's wrong here
File-level encryption may not be feasible without downtime.
- ✗
Implement transparent database encryption (TDE)
Why it's wrong here
TDE would require downtime or performance impact.
- ✗
Apply a digital signature to the database files
Why it's wrong here
Signing ensures integrity, not confidentiality.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.