easyMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for securing a database that stores personally identifiable information (PII)? (Select TWO.)
⚠ Common exam trap
CompTIA CASP+ often tests the distinction between detective controls (like audit logging) and preventive controls (like encryption and RBAC), leading candidates to mistakenly select audit logging as a best practice for securing PII when it is only a monitoring mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt data at rest using AES-256
Encrypting data at rest using AES-256 ensures that even if the underlying storage media is compromised, the PII remains unreadable without the decryption key. AES-256 is a symmetric encryption standard approved by NIST for protecting sensitive data, providing a strong cryptographic barrier against unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encrypt data at rest using AES-256
Why this is correct
Encryption protects data confidentiality even if storage media is compromised.
- ✗
Use default admin credentials for easy access
Why it's wrong here
Default credentials are a well-known security risk and should be changed immediately.
- ✗
Enable audit logging for all queries
Why it's wrong here
Audit logging is important for monitoring but is a detective control, not a primary preventive measure for securing PII.
- ✗
Store all data in plaintext for performance
Why it's wrong here
Plaintext storage violates data protection requirements and exposes PII to unauthorized access.
- ✓
Implement role-based access control (RBAC)
Why this is correct
RBAC ensures only authorized users can access PII based on their role.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.