hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a security assessment, the engineer…
During a security assessment, the engineer discovers that a network appliance's firmware updates are signed using a 1024-bit RSA key. The appliance was manufactured in 2015. What is the primary security concern?
⚠ Common exam trap
In CompTIA CASP+, the key length is the primary concern; 1024-bit RSA is considered weak against modern attacks. Candidates often mistake algorithm obsolescence or lack of encryption as the issue, but the question focuses on the cryptographic strength of the key itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The key length is insufficient against modern attacks
A 1024-bit RSA key is considered insufficient against modern attacks due to advances in factoring algorithms and computational power. By 2015, NIST and industry standards already recommended a minimum of 2048-bit RSA keys for secure digital signatures, making the 1024-bit key vulnerable to factorization attacks, especially with resources like the CADO-NFS or AWS clusters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The key length is insufficient against modern attacks
Why this is correct
1024-bit RSA can be broken by determined attackers; NIST recommends at least 2048 bits.
- ✗
The firmware is not encrypted
Why it's wrong here
Signing ensures integrity and authenticity; encryption is not required for firmware updates.
- ✗
The signature algorithm is obsolete
Why it's wrong here
RSA itself is not obsolete; it is the key length that is the issue.
- ✗
The signing key is not rotated
Why it's wrong here
Key rotation is a best practice but not the primary concern; the weak key length is more urgent.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.