mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Refer to the exhibit
Exhibit
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0x1234567890abcdef
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=Example Corp, CN=Example Root CA
Validity
Not Before: Jan 1 00:00:00 2024 GMT
Not After : Dec 31 23:59:59 2024 GMT
Subject: C=US, O=Example Corp, CN=server01.example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus: ...
X509v3 extensions:
...Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?
⚠ Common exam trap
In the CASP+ exam, candidates may mistakenly think that a 2048-bit RSA key is weak or that a one-year validity period is a vulnerability, but the deprecated SHA-1 hash algorithm is the critical security issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The certificate uses the SHA-1 hash algorithm
The certificate uses the SHA-1 hash algorithm, which is cryptographically broken and vulnerable to collision attacks. SHA-1 is deprecated by major browsers and the CA/Browser Forum, and its use in TLS certificates poses a significant security risk because an attacker could forge a certificate with the same hash.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The certificate uses the SHA-1 hash algorithm
Why this is correct
SHA-1 is considered broken and should not be used for digital signatures.
- ✗
The RSA key length is 2048 bits
Why it's wrong here
2048-bit RSA is currently acceptable and meets security standards.
- ✗
The certificate is self-signed
Why it's wrong here
The issuer and subject are different (Example Root CA vs server01), so it is not self-signed.
- ✗
The validity period is only one year
Why it's wrong here
One-year validity is common for TLS certificates and is not a security concern.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.