How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CAS-004 exam, each with detailed explanations and wrong-answer analysis.

How should I approach CAS-004 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA SecurityX CAS-004 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise CompTIA SecurityX CAS-004 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CAS-004

exam code

CompTIA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)

A
Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.
Terminates external TLS and can re-encrypt internally; manages certificates for external-facing services.
B
Use Kubernetes Secrets mounted as volumes with integration to an external vault.
Kubernetes Secrets store sensitive data; integrating with an external vault ensures secure access and rotation.
C
Apply Kubernetes network policies to restrict pod-to-pod communication.
Why wrong: Network policies control traffic flow but do not provide encryption or authentication.
D
Implement a service mesh such as Istio to handle mTLS between pods.
Service mesh provides mutual TLS, authentication, and encryption between microservices.
E
Configure RPM package signing for all container images.
Why wrong: RPM signing is for binary packages, not container images; container images use image signing (e.g., Notary).

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CAS-004 topic practice pages

Scripting, Containers and Automation practice questions

Application Environment, Configuration and Security practice questions

Governance, Risk and Compliance practice questions

Security Engineering practice questions

Security Architecture practice questions

Security Operations practice questions

CAS-004 fundamentals practice questions

CAS-004 scenario practice questions

CAS-004 troubleshooting practice questions

Practice scenarios

Which TWO of the following are examples of administrative controls? (Select TWO)

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

A security architect is evaluating a new cloud-based application that will process sensitive customer data. The architect must ensure compliance with GDPR and PCI DSS. Which THREE of the following controls should be implemented? (Select THREE.)

An organization is deploying a new cloud-based application that processes personally identifiable information (PII). The security team must ensure data at rest is encrypted. Which THREE of the following controls should be implemented to protect the data? (Select THREE.)

A security architect is designing a secure software development pipeline. The organization wants to ensure that code is thoroughly analyzed before deployment. Which TWO of the following should be integrated into the pipeline to identify vulnerabilities early? (Select TWO.)

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Which TWO of the following are key elements of a data classification policy?

A security analyst is reviewing a web application's authentication mechanism. Which of the following are best practices to prevent session hijacking? (Select TWO.)

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

An organization is implementing a DevSecOps pipeline. Which of the following are essential security controls to include? (Select TWO.)

A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?