CompTIA CAS-005 Exam Practice Questions to Pass CompTIA CASP Exam

Question 1

A security engineer is given the following requirements:

* An endpoint must only execute Internally signed applications

* Administrator accounts cannot install unauthorized software.

* Attempts to run unauthorized software must be logged

Which of the following best meets these requirements?

AMaintaining appropriate account access through directory management and controls

BImplementing a CSPM platform to monitor updates being pushed to applications

CDeploying an EDR solution to monitor and respond to software installation attempts

DConfiguring application control with blocked hashes and enterprise-trusted root certificates

Answer : D

To meet the requirements of only allowing internally signed applications, preventing unauthorized software installations, and logging attempts to run unauthorized software, configuring application control with blocked hashes and enterprise-trusted root certificates is the best solution. This approach ensures that only applications signed by trusted certificates are allowed to execute, while all other attempts are blocked and logged. It effectively prevents unauthorized software installations by restrictingexecution to pre-approved applications.

CompTIA SecurityX Study Guide: Describes application control mechanisms and the use of trusted certificates to enforce security policies.

NIST Special Publication 800-53, 'Security and Privacy Controls for Information Systems and Organizations': Recommends application whitelisting and execution control for securing endpoints.

'The Application Security Handbook' by Mark Dowd, John McDonald, and Justin Schuh: Covers best practices for implementing application control and managing trusted certificates

Question 2

A security engineer needs to remediate a SWEET32 vulnerability in an OpenSSH-based application and review existing configurations. Which of the following should the security engineer do? (Select two.)

ADisable Twofish algorithms

Bcat /etc/ashd/ash_config | grep 'HMAC'

CDisable RSA algorithms

Dcat /etc/sshd/ssh_config | grep 'PermitRootLogin'

EDisable 3DES algorithms

Fcat /etc/sshd/ssh_config | grep 'Ciphers'

Answer : E, F

Question 3

A company has the following requirements for a cloud-based web application:

* Must authenticate customers

* Must prevent data exposure

* Must allow customer access to data throughout the cloud environment

* Must restrict access by specific regions

Which of the following solutions best addresses these security requirements?

AApplying role-based access controls and configuring geolocation policies

BReplicating the data in each customer environment

CHosting the data regionally and providing each customer with a unique link

DMoving to a cloud provider that operates only in one specific region

Answer : A

The best way to address these requirements is to apply Role-Based Access Controls (RBAC) combined with geolocation policies. RBAC ensures that customers are authenticated and authorized to access only the data they are entitled to, thereby minimizing data exposure risks. At the same time, geolocation policies enforce restrictions on which regions customers can access data from, helping with compliance requirements such as GDPR or regional sovereignty laws.

Option B (replicating data in each customer environment) is inefficient, expensive, and introduces additional risks related to data sprawl. Option C (regional hosting with unique links) complicates access management and does not inherently prevent exposure or enforce strong authentication. Option D (restricting to a single region provider) removes flexibility and may conflict with customer needs for global access.

Therefore, implementing RBAC along with geolocation controls provides fine-grained access management, ensures compliance, prevents unnecessary data exposure, and is scalable for a global cloud environment.

Question 4

Which of the following best describes the reason PQC preparation is important?

ATo protect data against decryption due to increases in computational resource availability

BTo have larger key lengths available through key stretching

CTo improve encryption performance and speed using lightweight cryptography

DTo leverage asymmetric encryption for large amounts of data

Answer : A

Post-Quantum Cryptography (PQC) preparation is critical to protect data against future quantum computing attacks that could break current cryptographic algorithms (e.g., RSA, ECC). According to the CompTIA SecurityX CAS-005 study guide (Domain 3: Cybersecurity Technology, 3.3), quantum computers with sufficient computational power could perform calculations (e.g., Shor's algorithm) to decrypt data protected by traditional algorithms. PQC focuses on developing algorithms resistant to such increases in computational resources, ensuring long-term data security.

Option B:Key stretching is a technique to strengthen passwords, not related to PQC.

Option C:PQC algorithms often have higher computational costs, not improved performance.

Option D:Asymmetric encryption is not ideal for large data sets, and PQC is not specifically about this use case.

Option A:This accurately describes PQC's purpose to safeguard data against quantum-driven decryption.

CompTIA SecurityX CAS-005 Official Study Guide, Domain 3: Cybersecurity Technology, Section 3.3: 'Prepare for post-quantum cryptography challenges.'

CAS-005 Exam Objectives, 3.3: 'Evaluate the need for PQC in response to quantum computing advancements.'

Question 5

A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP Which of the following is me b way to reduce the risk oi reoccurrence?

AEnforcing allow lists for authorized network pons and protocols

BMeasuring and attesting to the entire boot chum

CRolling the cryptographic keys used for hardware security modules

DUsing code signing to verify the source of OS updates

Answer : D

The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that thehardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.

Here's why this option is optimal:

Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing unauthorized or unusual traffic.

Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography.

Preventing Unauthorized Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data.

Other options, while beneficial in different contexts, are not directly addressing the network communication threat:

B . Measuring and attesting to the entire boot chain: While this improves system integrity, it doesn't directly mitigate the risk of data exfiltration through network channels.

C . Rolling thecryptographic keys used for hardware security modules: This is useful for securing data and communications but doesn't directly address the specific method of exfiltration described.

D . Using code signing to verify the source of OS updates: Ensures updates are from legitimate sources, but it doesn't mitigate the risk of network-based data exfiltration.

CompTIA SecurityX Study Guide

NIST Special Publication 800-41, 'Guidelines on Firewalls and Firewall Policy'

CIS Controls Version 8, Control 9: Limitation and Control of Network Ports, Protocols, and Services

Question 6

A company sells a security appliance assembled from globally sourced hardware and software components. Installing the security appliance requires enabling administrative permissions for the service accounts on the appliance. Which of the following allows the company to reassure new and existing customers that the risk introduced by the appliance is minimal?

AThe results of a qualitative risk analysis performed on the appliance

BA business impact analysis and risk prioritization process

CResults of internal risk reduction studies conducted by a third-party assessor

DA transparent supply chain risk management and testing program

Answer : D

Question 7

An organization must provide access to its internal system data. The organization requires that this access complies with the following:

Access must be automated.

Data confidentiality must be preserved.

Access must be authenticated.

Data must be preprocessed before it is retrieved.

Which of the following actions should the organization take to meet these requirements?

AConfigure a reverse proxy to protect the data.

BImplement an on-demand VPN connection.

CDeploy an API gateway protected with access tokens.

DContinually publish all relevant data to a CDN.

Answer : C

CompTIA SecurityX Certification Exam CAS-005 Practice Questions