How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 14 Refer to the Exhibit Practice Questions scenario questions for the CAS-005 exam, each with detailed explanations and wrong-answer analysis.

How should I approach CAS-005 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA SecurityX (CAS-005) questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise CompTIA SecurityX (CAS-005) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CAS-005

exam code

CompTIA

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Exhibit

type=AVC msg=audit(1234567890.123:456): avc:  denied  { connectto } for  pid=1234 comm="httpd" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_t:s0 tclass=unix_stream_socket

A
Disable SELinux entirely
Why wrong: Disabling SELinux removes all protections, which is insecure.
B
Restart the httpd service
Why wrong: Restarting does not change SELinux policy; the denial will persist.
C
Change the SELinux enforcing mode to permissive
Why wrong: Permissive mode disables enforcement but is a temporary workaround, not a proper resolution.
D
Add an SELinux policy module to allow httpd_t to connectto unconfined_t
This creates a targeted policy rule to allow the specific connection while maintaining enforcement.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Refer to the exhibit. A security engineer reviews the S3 bucket policy. Which of the following is the most concerning security issue?

Network Topology

A
The policy does not require encryption in transit
Why wrong: Encryption in transit is not controlled by bucket policies; it is configured separately via endpoints or bucket policies that deny HTTP requests.
B
The policy uses the incorrect version of the policy language
Why wrong: The version 2012-10-17 is the current and correct version for IAM policies.
C
The policy allows any user to list the objects in the bucket
Why wrong: The action is s3:GetObject, not s3:ListBucket, so listing is not allowed.
D
The policy allows public read access to all objects in the bucket
Principal: * with s3:GetObject allows anonymous read access to all objects.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Exhibit

Refer to the exhibit.

```
[Security Policy JSON]
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucket-name/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::bucket-name/*"
    }
  ]
}
```

A
Requests from outside 10.0.0.0/8 are allowed to read objects.
Why wrong: No Allow statement for outside IPs, and Deny blocks all.
B
All requests from IPs in 10.0.0.0/8 are allowed to read objects.
Why wrong: The explicit Deny overrides the Allow.
C
Only anonymous requests are denied.
Why wrong: The Deny applies to all principals, including authenticated ones.
D
All requests to the bucket are denied regardless of source IP.
The Deny statement applies to all actions and all principals, so it denies everything.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

Exhibit

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0x1234567890abcdef
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=Example Corp, CN=Example Root CA
        Validity
            Not Before: Jan  1 00:00:00 2024 GMT
            Not After : Dec 31 23:59:59 2024 GMT
        Subject: C=US, O=Example Corp, CN=server01.example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus: ...
        X509v3 extensions:
            ...

A
The certificate uses the SHA-1 hash algorithm
SHA-1 is considered broken and should not be used for digital signatures.
B
The RSA key length is 2048 bits
Why wrong: 2048-bit RSA is currently acceptable and meets security standards.
C
The certificate is self-signed
Why wrong: The issuer and subject are different (Example Root CA vs server01), so it is not self-signed.
D
The validity period is only one year
Why wrong: One-year validity is common for TLS certificates and is not a security concern.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Exhibit

Vulnerability Scan Report
Host: 10.0.0.50
Port: 443
Vulnerability: TLS 1.0 enabled (CVE-2016-2183)
Severity: High
CVSS: 7.5
PCI DSS: Non-compliant (Requirement 4.1)

A
Move the host to a separate VLAN
Why wrong: Does not address the underlying vulnerability.
B
Disable TLS 1.0 and enable TLS 1.2 only
Eliminates the vulnerability and achieves compliance.
C
Apply a compensating control such as an API gateway
Why wrong: Compensating controls may not meet audit requirements.
D
Accept the risk because the CVSS score is below 8.0
Why wrong: PCI DSS requires remediation of high-severity findings.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?

Exhibit

Refer to the exhibit.

```
# auth.log excerpt
Mar 15 10:23:45 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Mar 15 10:23:46 server sshd[1235]: Failed password for root from 192.168.1.100 port 22 ssh2
Mar 15 10:23:47 server sshd[1236]: Failed password for root from 192.168.1.100 port 22 ssh2
Mar 15 10:23:48 server sshd[1237]: Failed password for root from 192.168.1.100 port 22 ssh2
Mar 15 10:23:49 server sshd[1238]: Failed password for root from 192.168.1.100 port 22 ssh2
Mar 15 10:23:50 server sshd[1239]: Failed password for invalid user admin from 192.168.1.100 port 22 ssh2
Mar 15 10:23:51 server sshd[1240]: Failed password for admin from 192.168.1.100 port 22 ssh2
Mar 15 10:23:52 server sshd[1241]: Failed password for admin from 192.168.1.100 port 22 ssh2
```

A
Disable root login and remove the admin account.
Why wrong: These are long-term hardening steps but won't stop the ongoing attack immediately.
B
Block the entire 192.168.1.0/24 subnet at the firewall.
Why wrong: Blocking the whole subnet may affect other legitimate hosts.
C
Configure fail2ban to block the IP address after a threshold of failed attempts.
fail2ban automatically blocks the attacking IP, stopping the attack.
D
Change the SSH port to a non-standard port.
Why wrong: Changing the port may reduce automated scans but won't prevent this specific attack from the same IP.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

An organization uses a SIEM to collect logs from multiple sources. The security team wants to identify users who are accessing resources outside of normal business hours and exhibiting unusual data transfer patterns. Which advanced SIEM capability would be most effective?

A
Threat intelligence feed integration
Why wrong: Threat feeds provide known bad indicators, not behavioral anomalies.
B
User and Entity Behavior Analytics (UEBA)
UEBA uses machine learning to detect deviations from established baselines.
C
Log normalization and aggregation
Why wrong: Normalization and aggregation are foundational but do not detect anomalies.
D
Correlation rules with threshold-based alerts
Why wrong: Threshold alerts may generate false positives and miss complex anomalies.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

Refer to the exhibit. A security architect is reviewing this S3 bucket policy. Which of the following security concerns is MOST evident?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

A
The policy denies all write access
Why wrong: The policy only grants GetObject; write access is not granted or denied explicitly.
B
The policy allows public read access
The wildcard principal '*' allows any anonymous user to read objects.
C
The policy uses an outdated version
Why wrong: Version 2012-10-17 is the current version.
D
The policy lacks encryption
Why wrong: Encryption is not specified in bucket policies; it is handled via bucket properties or server-side encryption.

Full breakdown with real-world context →

Question 9easymultiple choice

Full question →

Based on the exhibit, what type of attack is indicated?

Exhibit

Refer to the exhibit.
Log entry:
2025-02-14 09:23:45 VPN login FAILED from IP 192.0.2.10 user admin
2025-02-14 09:23:46 VPN login FAILED from IP 192.0.2.10 user admin
2025-02-14 09:23:47 VPN login FAILED from IP 192.0.2.10 user admin
2025-02-14 09:23:48 VPN login SUCCESS from IP 192.0.2.10 user admin

A
Brute-force attack
Multiple failed attempts then success is characteristic of brute-force.
B
Man-in-the-middle
Why wrong: MITM attacks involve intercepting communications, not repeated login attempts.
C
Denial of service
Why wrong: DoS floods resources, not targeted login attempts.
D
Replay attack
Why wrong: Replay attacks capture and retransmit valid data, not brute-force.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

Refer to the exhibit. A security analyst reviews this pod specification. Which attack surface is most increased by the added capabilities?

Exhibit

apiVersion: v1
kind: Pod
metadata:
  name: security-example
spec:
  containers:
  - name: my-container
    image: nginx:latest
    securityContext:
      capabilities:
        add: ["NET_ADMIN", "SYS_ADMIN"]

A
The container can modify network settings
Why wrong: NET_ADMIN allows network modification, but SYS_ADMIN is more severe.
B
The container can kill other processes
Why wrong: Killing processes requires CAP_KILL, not added here.
C
The container can read all host files
Why wrong: SYS_ADMIN does not directly allow reading all files; that requires other capabilities.
D
The container can install new kernel modules
SYS_ADMIN capability allows loading kernel modules, potentially compromising the host.

Full breakdown with real-world context →

Question 11hardmultiple choice

Full question →

Given the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit.

```
[timestamp] firewall: Deny TCP 10.0.1.100:54321 -> 203.0.113.5:80 (Drop)
[timestamp] firewall: Allow TCP 10.0.1.100:54322 -> 203.0.113.5:443 (Allow)
[timestamp] IDS: Alert - SQL Injection attempt detected from 10.0.1.100 to 203.0.113.5:443
[timestamp] web_server: HTTP POST /login.php with sql_injection_pattern
```

A
A misconfigured application is sending malformed data to a server.
Why wrong: The pattern of SQL injection is intentional, not misconfiguration.
B
An external attacker is scanning the internal network.
Why wrong: All source IPs are internal 10.0.1.100.
C
An internal host is compromised and attacking an external web server.
The host adapts to firewall rules and launches SQL injection attack.
D
A web vulnerability scanner is performing authorized tests.
Why wrong: The SQL injection alert suggests malicious intent, and there's no authorization indication.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full network assurance explanation →

A security analyst reviews the syslog messages from the company's ASA firewall. Based on the exhibit, which of the following is the MOST likely cause of the denied traffic?

Exhibit

Refer to the exhibit.

=== syslog excerpt ===
Mar 15 14:23:45 firewall1 %ASA-4-106023: Deny tcp src inside:192.168.1.10/54321 dst outside:10.0.0.1/80 by access-group "OUTSIDE_IN" [0x0, 0x0]
Mar 15 14:23:46 firewall1 %ASA-4-106023: Deny tcp src inside:192.168.1.10/54322 dst outside:10.0.0.1/80 by access-group "OUTSIDE_IN" [0x0, 0x0]
Mar 15 14:23:47 firewall1 %ASA-4-106023: Deny tcp src inside:192.168.1.10/54323 dst outside:10.0.0.1/80 by access-group "OUTSIDE_IN" [0x0, 0x0]

A
The external server is trying to initiate connections to the internal host on port 80.
Why wrong: The log shows source IP from inside, so the connections originate from inside.
B
Network address translation (NAT) is not configured correctly for the internal host.
Why wrong: NAT issues would typically not cause a deny by an access-group; they would cause unreachability or translation failures.
C
The access-group "OUTSIDE_IN" is applied to the wrong interface or direction, blocking legitimate outbound traffic.
The access list name suggests it is meant for inbound traffic on the outside interface, but it is blocking outbound traffic, indicating a misapplication.
D
The internal host is attempting a port scan against the external server.
Why wrong: Multiple connections to the same destination IP and port could be a scan, but the log shows only a few connections, and the problem is likely a rule misconfiguration.

Full breakdown with real-world context →

Question 13mediummultiple choice

Full question →

Refer to the exhibit. Which of the following best describes the security constraint imposed by this policy?

Exhibit

Refer to the exhibit.
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-123abc"
        }
      }
    }
  ]
}
```

A
Only allows access during business hours.
Why wrong: This option describes a time-based constraint, not a network-based one.
B
Only allows access from a specific user account.
Why wrong: This option describes an identity-based constraint, not a network-based one.
C
Only allows access to a specific storage bucket.
Why wrong: This option describes a resource-based constraint, not a network-based one.
D
Only allows access from a specific network endpoint.
Correct. The policy condition requires the request to originate from a specific network endpoint, enforcing network-level access control.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

Refer to the exhibit. The data classification policy defines levels and rules. During an audit, a database containing both PII and credit card numbers is found labeled as 'Internal'. Which of the following is the BEST first action?

Exhibit

{
  "dataClassification": {
    "levels": ["Public", "Internal", "Confidential", "Critical"],
    "default": "Internal",
    "rules": [
      {"dataType": "PII", "level": "Confidential"},
      {"dataType": "PCI", "level": "Critical"}
    ]
  }
}

A
Accept the risk as the data is not public
Why wrong: Violates policy requirement for PCI data.
B
Remove the credit card numbers from the database
Why wrong: Removing the credit card numbers does not address the core issue: the database is mislabelled as 'Internal' despite containing PII and credit card data that, under the classification policy, likely requires a higher tier such as 'Confidential' or 'Restricted'. This action is tempting because data sanitisation is a legitimate method to reduce compliance scope, and it would be correct if the policy mandated eliminating sensitive fields to keep the database at the 'Internal' level, but here the policy violation stems from incorrect classification, not the data's presence.
C
Create a new classification level for mixed data
Why wrong: Unnecessary; existing levels can be used.
D
Reclassify the database as 'Critical' to reflect the highest required level
Aligns with policy rule that PCI data must be Critical.

Full breakdown with real-world context →

These CAS-005 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style CAS-005 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CAS-005 topic practice pages

Security Architecture practice questions

Security Engineering practice questions

Security Operations practice questions

Governance, Risk, and Compliance practice questions

CAS-005 fundamentals practice questions

CAS-005 scenario practice questions

CAS-005 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Exhibit

Refer to the exhibit. A security engineer reviews the S3 bucket policy. Which of the following is the most concerning security issue?

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Exhibit

Refer to the exhibit. A security engineer is reviewing an X.509 certificate used for TLS. Which security concern should the engineer identify?

Exhibit

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Exhibit

Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?

Exhibit

An organization uses a SIEM to collect logs from multiple sources. The security team wants to identify users who are accessing resources outside of normal business hours and exhibiting unusual data transfer patterns. Which advanced SIEM capability would be most effective?

Refer to the exhibit. A security architect is reviewing this S3 bucket policy. Which of the following security concerns is MOST evident?

Exhibit

Based on the exhibit, what type of attack is indicated?

Exhibit

Refer to the exhibit. A security analyst reviews this pod specification. Which attack surface is most increased by the added capabilities?

Exhibit

Given the exhibit, what is the MOST likely scenario?

Exhibit

A security analyst reviews the syslog messages from the company's ASA firewall. Based on the exhibit, which of the following is the MOST likely cause of the denied traffic?

Exhibit

Refer to the exhibit. Which of the following best describes the security constraint imposed by this policy?

Exhibit

Refer to the exhibit. The data classification policy defines levels and rules. During an audit, a database containing both PII and credit card numbers is found labeled as 'Internal'. Which of the following is the BEST first action?

Exhibit