easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Refer to the exhibit
Exhibit
import os
api_key = os.environ['API_KEY']
db_connection = os.getenv('DB_CONNECTION', 'sqlite:///default.db')
if not api_key:
print("Warning: API key not set")Refer to the exhibit. A security review is being conducted on the Python application configuration. Which of the following security issues is present?
⚠ Common exam trap
CompTIA often tests the distinction between `os.environ[]` (raises error on missing key) and `os.getenv()` (returns default), leading candidates to overlook the missing default for API_KEY while focusing on the less critical DB_CONNECTION default or the storage method of the API key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The code does not handle the case where API_KEY is not set, potentially causing an error
The code attempts to retrieve the API_KEY environment variable using `os.environ['API_KEY']`, which raises a `KeyError` if the variable is not set. This lack of a fallback or error handling can cause the application to crash at startup, making it a security issue as it could lead to denial of service or expose stack traces in production logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DB_CONNECTION environment variable is missing a default value
Why it's wrong here
The code uses getenv with a default, so it is safe.
- ✗
The default database connection is SQLite, which is insecure for production
Why it's wrong here
SQLite can be secure if properly configured; the security issue is not about SQLite per se.
- ✓
The code does not handle the case where API_KEY is not set, potentially causing an error
Why this is correct
Using os.environ with no default will raise an exception if the variable is missing, which can lead to information disclosure or denial of service.
- ✗
The API key is stored in an environment variable, which is insecure
Why it's wrong here
Environment variables are a common and acceptable way to manage secrets, though additional encryption may be needed.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.