How should I use these Security Engineering practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Engineering questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Engineering domain.

CAS-005 · topic practice

Security Engineering practice questions

Security Engineering is 31% of CAS-005 and covers designing and implementing secure systems. Expect scenario questions on MFA factor selection, certificate pinning, secure boot chains, firmware signing, and cryptographic protections across cloud, endpoint, and embedded environments. Answers hinge on matching controls to stated threats, not memorizing definitions.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Security Engineering

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Engineering

You must design and validate layered controls: pick phishing-resistant MFA, pin the correct certificate, enforce a hardware-rooted boot chain, and require signed firmware. The single most important skill is mapping each control to the specific threat and trust boundary described in the scenario.

Selecting phishing-resistant MFA such as FIDO2/WebAuthn over TOTP or push

Pinning leaf or intermediate CA certificates in mobile app code

Verifying secure boot chain of trust from ROM to bootloader to kernel

Signing firmware and validating signatures before installation on IoT devices

Watch out for

Common Security Engineering exam traps

▸Choosing push-based MFA as phishing-resistant when only FIDO2/WebAuthn or certificate-based authentication meets that requirement
▸Pinning the root CA instead of the leaf or intermediate certificate, weakening protection against compromised intermediates
▸Assuming secure boot alone secures updates; firmware must also be signed and verified at install time

Practice set

Security Engineering questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Engineering explanation →

A security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?

Trap 1: Kerberos with PKINIT

Kerberos with PKINIT uses certificates but still requires a password or PIN for the private key.

Trap 2: TOTP/HOTP

TOTP/HOTP require a shared secret and are susceptible to phishing if the token is intercepted.

Trap 3: X.509 certificates with smart cards

X.509 certificates provide strong authentication but are not passwordless; they require a PIN or biometric.

Study all Security Engineering common traps →

A
Kerberos with PKINIT
Why it fails: Kerberos with PKINIT uses certificates but still requires a password or PIN for the private key.
B
FIDO2/WebAuthn
FIDO2/WebAuthn binds credentials to the origin and uses public-key cryptography, so a phishing site cannot replay the assertion. The private key stays on the authenticator, defeating credential harvesting and enabling passwordless login, which satisfies both the phishing-resistance and passwordless constraints.
C
TOTP/HOTP
Why it fails: TOTP/HOTP require a shared secret and are susceptible to phishing if the token is intercepted.
D
X.509 certificates with smart cards
Why it fails: X.509 certificates provide strong authentication but are not passwordless; they require a PIN or biometric.

Security Engineering practice questions

What to know about Security Engineering

Common Security Engineering exam traps

Security Engineering questions

A security architect is designing a new authentication system for a high-security environment. The system must support passwordless authentication while providing strong protection against phishing attacks. Which of the following protocols best meets these requirements?

A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?

A security analyst is configuring a TPM 2.0 for a new fleet of laptops. The requirement is to ensure that only authorized operating systems can boot and that any tampering with the boot process is detected. Which TPM feature should be used?

A web server is configured to use TLS 1.3. Which of the following is a key security benefit of TLS 1.3 over earlier versions?

A security engineer is selecting an asymmetric encryption algorithm for a system that must provide non-repudiation and long-term security (at least 20 years). The system has limited computational resources. Which of the following is the best choice?

During a security assessment, an analyst discovers that an HSM used for key generation is FIPS 140-2 Level 2 compliant. The organization requires a higher level of physical security to prevent tampering. Which upgrade would best address this requirement?

An organization is implementing a PKI with a three-tier hierarchy (root CA, intermediate CA, issuing CA). The security team wants to ensure that certificate revocation information is available quickly and efficiently. Which TWO mechanisms should they implement? (Select TWO.)

A security engineer is configuring a new web server to support TLS 1.3. The server must provide forward secrecy and support clients that may not have updated certificates frequently. Which of the following is a feature of TLS 1.3 that addresses these requirements?

An organization is implementing a Windows Hello for Business deployment to enable passwordless authentication. The solution uses TPM 2.0 for key storage. Which of the following TPM features ensures that the system has not been tampered with before the user authenticates?

A security architect is evaluating hardware security modules (HSMs) for a new PKI deployment. The HSM must be compliant with FIPS 140-2 Level 3. Which of the following is a requirement for Level 3 that distinguishes it from Level 2?

An organization uses a PKI with a three-tier hierarchy: root CA, issuing CA, and registration authority. The root CA is kept offline. An intermediate CA certificate must be renewed. Which of the following is the correct process?

During a security assessment, a penetration tester discovers that a smart card used for authentication is vulnerable to a timing attack. The card uses a cryptographic algorithm that has data-dependent timing variations. Which of the following algorithms is MOST likely being used on the smart card?

An organization is planning to deploy digital certificates for various use cases. Which TWO of the following certificate types are typically used for email security?

A company wants to implement certificate pinning for its mobile app to prevent man-in-the-middle attacks. Which approach is most secure and maintainable?

Track your progress over time

Start a Security Engineering only practice session

Related CAS-005 topic practice pages

Governance, Risk, and Compliance practice questions

Security Architecture practice questions

Security Engineering practice questions

Security Operations practice questions

CAS-005 fundamentals practice questions

CAS-005 scenario practice questions

CAS-005 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid