l":null,"text":"SHA-256","isCorrect":false},{"id":"71f5b4cc-7f49-47de-9425-35a10f655cee","label":null,"text":"SHA-3","isCorrect":true},{"id":"458f048f-9852-4007-9c36-15443748b9f0","label":null,"text":"MD5","isCorrect":false}],"domainName":"Security Engineering","domainSlug":"casp-engineering-crypto"},{"id":"77f3038e-fec7-43d6-b312-482d0b3a2da6","slug":"a-security-analyst-is-using-volatility-to-analyze-a-memory-d-x2q7y","questionText":"A security analyst is using Volatility to analyze a memory dump from a compromised Windows system. The analyst suspects that a rootkit is hiding processes. Which Volatility plugin should the analyst use to detect hidden processes?","explanation":"The 'psxview' plugin compares process listings from different sources (e.g., EPROCESS list, PspCidTable) to find discrepancies, which can reveal hidden processes.","domainId":"fd8ca909-0847-4f0c-a635-2bd1df3cd86c","difficulty":"medium","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"029e07ab-2957-4e01-a65f-421351c5ce51","label":null,"text":"pslist","isCorrect":false},{"id":"7060d3aa-70fe-4c58-bb31-ed68c247acc5","label":null,"text":"psxview","isCorrect":true},{"id":"c1b660bd-b7c6-4515-b2bd-1c1bce2a5fce","label":null,"text":"malfind","isCorrect":false},{"id":"4bfe9f12-afdf-41c2-b879-bd9155ad3c08","label":null,"text":"pstree","isCorrect":false}],"domainName":"Security Operations","domainSlug":"casp-security-operations"},{"id":"808f0083-e903-4022-a252-8726014d9c80","slug":"a-security-analyst-reviews-this-configuration-and-identifies-wr7fq","questionText":"A security analyst reviews this configuration and identifies a vulnerability. What is the MOST critical issue?","explanation":"The redirect URI using HTTP (not HTTPS) is the most critical issue because it allows an attacker to intercept the authorization code during the OAuth 2.0 flow. If the redirect URI is transmitted over cleartext HTTP, an attacker on the same network can capture the authorization code via man-in-the-middle (MITM) attacks and exchange it for an access token, leading to account takeover. This violates the OAuth 2.0 security best practice (RFC 6819) that mandates the use of TLS for all redirect URIs.","domainId":null,"difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"Refer to the exhibit.\n\n\n \n abc123\n secret!\n https://auth.example.com/token\n http://app.example.com/callback\n authorization_code\n \n","options":[{"id":"c975dd39-fcd7-4789-aa01-66f1e171cc73","label":null,"text":"The grant type is authorization_code","isCorrect":false},{"id":"fc9c132f-438a-44e4-90fc-1c1e492de00e","label":null,"text":"The client secret is hardcoded","isCorrect":false},{"id":"6eb60a53-e282-42fd-8565-530ff87da3d4","label":null,"text":"The redirect URI uses HTTP","isCorrect":true},{"id":"4eab33df-1a34-41ab-bf8b-97113a9f4af3","label":null,"text":"The token endpoint uses HTTPS","isCorrect":false}],"domainName":null,"domainSlug":null},{"id":"9940f950-dea5-4164-b551-7512c3dfa669","slug":"an-organization-s-business-continuity-plan-bcp-includes-a-6e3n5","questionText":"An organization's business continuity plan (BCP) includes a recovery time objective (RTO) of 4 hours for its critical ERP system. During a disaster, the system is restored in 5 hours. Which of the following is the MOST significant impact?","explanation":"The RTO of 4 hours defines the maximum acceptable downtime for the ERP system. Restoring it in 5 hours exceeds this threshold, resulting in unacceptable business downtime. This can trigger contractual penalties if service-level agreements (SLAs) specify a 4-hour RTO, as the organization failed to meet its recovery commitment.","domainId":null,"difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"b8808003-f2f3-4376-8b89-d99c7d192117","label":null