hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which THREE of the following are common…
Which THREE of the following are common techniques to mitigate side-channel attacks?
⚠ Common exam trap
CompTIA often tests the misconception that adding random delays (Option E) is a valid side-channel mitigation, but candidates must recognize that statistical averaging defeats such noise, whereas constant-time algorithms (Option B) and noise injection (Option C) are standard, effective techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement constant-time algorithms for cryptographic operations
Constant-time algorithms ensure that the execution time of cryptographic operations does not depend on secret data, such as keys. By avoiding conditional branches or variable-time instructions (e.g., multiplication or memory accesses) that vary with input, these algorithms prevent attackers from inferring secrets through timing measurements. This is a fundamental mitigation against timing side-channel attacks, as specified in standards like FIPS 140-3 and NIST SP 800-56B.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable CPU caching to prevent cache timing attacks
Why it's wrong here
Disabling caching degrades performance and is not a standard mitigation.
- ✓
Implement constant-time algorithms for cryptographic operations
Why this is correct
Constant-time execution prevents timing variations based on secret data.
- ✓
Add noise to power consumption or electromagnetic emissions
Why this is correct
Noise injection obscures side-channel signals.
- ✓
Ensure memory access patterns are independent of secret data
Why this is correct
Prevents cache-based side channels.
- ✗
Use random delays in code execution paths
Why it's wrong here
Random delays are not a reliable mitigation for side-channel attacks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.