View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 61

Which security control is designed to detect unauthorized changes to important system configurations?

1. File integrity monitoring
2. Load balancing
3. Network address translation
4. Data compression

Correct Answer: 1

Explanation

File integrity monitoring detects changes to files, configurations, and other protected resources. It can compare current values against approved baselines and alert security personnel when unexpected modifications occur. This is useful for detecting unauthorized changes caused by malware, attackers, or accidental administrative activity. Monitoring should be configured for critical files and directories while allowing legitimate changes to be documented. Load balancing, NAT, and compression perform different technical functions and do not directly provide the same capability for identifying unauthorized configuration modifications.

Question 62

Which security architecture places security controls as close as possible to individual workloads rather than relying only on a network perimeter?

1. Flat networking
2. Microsegmentation
3. Open networking
4. Perimeter bypass

Correct Answer: 2

Explanation

Microsegmentation applies security policies at a granular level around individual workloads, applications, or services. Instead of trusting systems simply because they exist inside a corporate network, microsegmentation restricts communication according to defined requirements. This can limit lateral movement if an attacker compromises one workload. Policies may be enforced through host-based controls, software-defined networking, cloud security groups, or other mechanisms. Microsegmentation is especially useful in dynamic environments where workloads frequently move or scale and traditional perimeter-based controls cannot provide sufficient internal isolation.

Question 63

A security team needs to detect malicious activity across endpoints and provide investigators with detailed process information. Which solution is MOST appropriate?

1. EDR
2. UPS
3. RAID
4. DNS

Correct Answer: 1

Explanation

Endpoint detection and response (EDR) solutions collect telemetry from endpoints and provide visibility into processes, files, network connections, user activity, and other security-relevant events. Analysts can use this information to investigate suspicious behavior and determine how an attack progressed. Many EDR platforms also support containment actions such as isolating a compromised endpoint. UPS systems provide power protection, RAID provides storage redundancy, and DNS resolves names. EDR is particularly valuable when endpoint-level investigation is required because it provides information that network-only monitoring may not capture.

Question 64

Which activity should occur before implementing a major security architecture change?

1. Risk assessment
2. Log deletion
3. Credential sharing
4. Unrestricted deployment

Correct Answer: 1

Explanation

A risk assessment helps organizations identify potential threats, vulnerabilities, impacts, and security requirements before implementing significant architectural changes. The assessment can reveal new attack paths, dependencies, compliance concerns, and operational risks. Security teams can then select appropriate controls and determine whether the proposed design meets organizational risk tolerance. Major changes made without assessment may unintentionally weaken existing protections. Credential sharing and log deletion introduce additional risks, while unrestricted deployment provides no structured validation. Risk assessment should be integrated with change management and architecture review processes.

Question 65

A company uses a public cloud provider for sensitive workloads. Which responsibility generally remains with the customer in an IaaS environment?

1. Physical data center security
2. Hypervisor maintenance
3. Guest operating system security
4. Building access control

Correct Answer: 3

Explanation

In an Infrastructure as a Service environment, the cloud provider generally manages the physical infrastructure, facilities, and virtualization layer, while the customer remains responsible for many controls within the guest environment. These commonly include operating system configuration, application security, identity management, data protection, and network security settings, depending on the provider and service. The exact shared responsibility model varies by provider and service. Organizations should review provider documentation carefully instead of assuming that cloud deployment transfers all security responsibilities to the provider.

Question 66

Which authentication method provides the strongest protection against many forms of phishing?

1. Password-only authentication
2. Security questions
3. Hardware security key
4. Shared secret

Correct Answer: 3

Explanation

Hardware security keys that support modern phishing-resistant authentication methods can provide strong protection against credential phishing because authentication is cryptographically tied to the legitimate service. Unlike passwords, a properly implemented security key does not simply provide a reusable secret that an attacker can capture and replay. Password-only authentication and security questions are more susceptible to phishing, credential theft, and reuse. Organizations should combine phishing-resistant authentication with strong identity governance, appropriate recovery procedures, and monitoring to reduce account compromise risks across critical services.

Question 67

Which process helps determine the potential consequences if a critical business service becomes unavailable?

1. Business impact analysis
2. Vulnerability scanning
3. Code signing
4. Certificate renewal

Correct Answer: 1

Explanation

Business impact analysis determines how disruptions affect critical business functions and identifies the consequences of downtime. It can establish recovery priorities, dependencies, acceptable downtime, financial impacts, regulatory concerns, and requirements for restoring services. These findings help organizations establish recovery time and recovery point objectives and select suitable continuity strategies. Vulnerability scanning identifies technical weaknesses, code signing supports software integrity and authenticity, and certificate renewal maintains valid certificates. A BIA should involve business stakeholders because operational consequences may not be fully understood by technical teams.

Question 68

A security analyst notices repeated failed login attempts followed by a successful login from an unusual geographic location. What should the analyst do FIRST?

1. Ignore the event
2. Investigate the authentication activity
3. Delete the logs
4. Disable all organizational accounts

Correct Answer: 2

Explanation

Repeated failed authentication attempts followed by a successful login from an unusual location can indicate credential attacks or account compromise. The analyst should investigate the activity using authentication logs, identity-provider records, endpoint telemetry, VPN information, and other relevant evidence. If compromise is confirmed or strongly suspected, incident response procedures may require actions such as session revocation, credential reset, or account containment. Deleting logs would destroy evidence, while disabling every account is unnecessarily disruptive. Investigation should be guided by documented incident-response procedures and risk.

Question 69

Which technology can inspect network traffic and automatically block detected malicious activity?

1. IDS
2. IPS
3. Syslog
4. SNMP

Correct Answer: 2

Explanation

An intrusion prevention system (IPS) monitors network traffic and can take preventive action when activity matches defined malicious or suspicious patterns. Depending on its configuration, an IPS can block packets, terminate connections, or apply other response mechanisms. An intrusion detection system primarily detects and alerts without directly preventing the traffic. Syslog provides a mechanism for transmitting log messages, while SNMP is commonly used for network management and monitoring. IPS effectiveness depends on appropriate rule configuration, current detection content, proper placement, and regular tuning to minimize false positives.

Question 70

An organization wants to prevent administrators from accessing systems unless they have an approved business need. Which approach BEST supports this requirement?

1. Privileged access management
2. Open administrator access
3. Shared root credentials
4. Permanent unrestricted privileges

Correct Answer: 1

Explanation

Privileged access management (PAM) controls and monitors access to high-risk administrative accounts. PAM can require approvals, enforce just-in-time access, rotate credentials, record privileged sessions, and limit access based on business requirements. These controls reduce the risk associated with permanent administrative privileges and provide stronger accountability for sensitive actions. Shared credentials make individual accountability difficult, while unrestricted or permanent access increases exposure. PAM should be integrated with identity management, multifactor authentication, logging, and periodic access reviews for effective privileged-account governance.

Question 71

Which control is MOST useful for protecting data if a company laptop is stolen?

1. Full-disk encryption
2. Screen brightness
3. Network load balancing
4. DNS caching

Correct Answer: 1

Explanation

Full-disk encryption protects information stored on a device by encrypting the contents of the storage media. If a laptop is lost or stolen and the attacker cannot obtain the necessary authentication or cryptographic keys, accessing the stored information becomes significantly more difficult. Encryption should be supported by secure key management, strong authentication, and appropriate device-management controls. Screen locking can provide additional protection when a device is unattended, but it is not equivalent to protecting the underlying storage. Network load balancing and DNS caching do not protect locally stored data.

Question 72

Which security activity identifies the systems, applications, and data that an organization owns or manages?

1. Asset inventory
2. Packet filtering
3. Certificate signing
4. Password hashing

Correct Answer: 1

Explanation

An asset inventory identifies and tracks organizational hardware, software, services, data repositories, and other resources. Accurate inventories are fundamental to security because organizations cannot effectively protect systems they do not know exist. Inventory information can include ownership, location, business purpose, classification, software versions, and lifecycle status. Security teams can use this information for vulnerability management, patching, risk assessment, incident response, and compliance activities. Inventories should be maintained continuously because cloud resources, applications, endpoints, and other assets can change frequently.

Question 73

A company needs to securely exchange sensitive information with an external business partner. Which control should be prioritized?

1. Encryption
2. Anonymous access
3. Plaintext transfer
4. Shared public passwords

Correct Answer: 1

Explanation

Encryption protects sensitive information from unauthorized disclosure while it is being transmitted or stored. When exchanging data with an external partner, organizations should select secure protocols and establish appropriate authentication, key management, and trust relationships. Depending on the use case, secure file-transfer services, encrypted email, VPN connections, or application-level encryption may be appropriate. Plaintext transmission and shared passwords can expose information to interception and credential compromise. Security requirements should also address data classification, retention, logging, and responsibilities between the participating organizations.

Question 74

Which security testing method attempts to discover weaknesses by analyzing application source code without executing it?

1. DAST
2. SAST
3. Load testing
4. Stress testing

Correct Answer: 2

Explanation

Static application security testing (SAST) analyzes source code, bytecode, or other application representations without requiring the application to execute. It can identify coding weaknesses such as insecure functions, injection risks, hardcoded secrets, and certain authentication or authorization problems. Dynamic application security testing (DAST) evaluates a running application from an external perspective. Load and stress testing primarily evaluate performance and capacity. SAST is most effective when integrated early into the development lifecycle, allowing developers to identify and remediate issues before applications reach production.

Question 75

A security team wants to ensure that an application cannot directly access sensitive resources unless explicitly authorized. Which principle should be applied?

1. Least privilege
2. Open trust
3. Maximum privilege
4. Shared access

Correct Answer: 1

Explanation

Least privilege limits applications, services, users, and processes to the minimum permissions required for their legitimate functions. Applying this principle to applications can reduce the impact of compromised software or exploited vulnerabilities. For example, an application that only needs read access to a database should not receive unrestricted administrative permissions. Least privilege should be combined with strong identity controls, segmentation, logging, and regular permission reviews. Excessive privileges can allow attackers to move from a compromised application to additional resources and significantly increase the consequences of an intrusion.

Question 76

Which document defines the specific actions personnel should follow during a cybersecurity incident?

1. Incident response plan
2. Asset purchase order
3. Network topology diagram
4. Software license

Correct Answer: 1

Explanation

An incident response plan defines how an organization prepares for, detects, analyzes, contains, eradicates, and recovers from security incidents. It can identify roles, responsibilities, escalation paths, communication requirements, evidence-handling procedures, and decision criteria. Supporting playbooks can provide more detailed instructions for specific scenarios such as ransomware, credential compromise, or data breaches. A network diagram can support investigations but does not define the overall response process. Incident response plans should be tested periodically through exercises and updated when systems, threats, regulations, or organizational responsibilities change.

Question 77

A company wants to detect whether employees are sending confidential files to unauthorized external recipients. Which technology is MOST appropriate?

1. DLP
2. DHCP
3. RAID
4. NAT

Correct Answer: 1

Explanation

Data loss prevention (DLP) solutions can identify sensitive information and enforce policies governing how that information is transmitted or shared. A DLP system may inspect email content, attachments, endpoint activity, cloud uploads, or other data channels and generate alerts or block prohibited transfers. Policies can be based on classifications, patterns, keywords, or other detection mechanisms. DHCP, RAID, and NAT do not directly inspect organizational information for unauthorized disclosure. DLP should be carefully configured because overly broad policies can interrupt legitimate business communication and create excessive alerts.

Question 78

Which technique can reduce the impact of a compromised account by requiring additional approval before privileged access is granted?

1. Just-in-time privileged access
2. Permanent administrator access
3. Shared credentials
4. Anonymous authentication

Correct Answer: 1

Explanation

Just-in-time privileged access provides elevated permissions only when they are needed and, in many implementations, for a limited period. Access may require approval, a documented request, or other validation before privileges are activated. Once the approved period ends, elevated permissions are removed. This reduces the exposure created by permanently active administrative privileges and makes unauthorized use more difficult. Just-in-time access works particularly well with privileged access management, multifactor authentication, logging, and strong approval processes.

Question 79

An organization wants to verify that backups can actually restore critical applications. What should it perform?

1. Backup restoration testing
2. Password deletion
3. Log suppression
4. Firewall removal

Correct Answer: 1

Explanation

Backup restoration testing verifies that stored backups are usable and that critical applications and data can be recovered within established requirements. A backup that has never been tested may be incomplete, corrupted, improperly configured, or dependent on unavailable systems or credentials. Testing should cover different recovery scenarios and validate data integrity, application dependencies, access to encryption keys, and recovery objectives. Results should be documented and used to improve backup procedures. Restoration testing is especially important for ransomware resilience because attackers may target both production systems and backup infrastructure.

Question 80

A security architect wants to reduce the number of systems that directly handle sensitive payment information. Which approach would BEST support this objective?

1. Data minimization and tokenization
2. Unrestricted data replication
3. Shared administrator accounts
4. Centralized plaintext storage

Correct Answer: 1

Explanation

Data minimization reduces the amount of sensitive information collected, stored, and processed, which can reduce the overall attack surface. Tokenization can further reduce exposure by replacing sensitive values with tokens that have limited usefulness outside the approved processing environment. Together, these approaches can reduce the number of systems that directly handle payment information and may simplify security and compliance requirements. Unrestricted replication and plaintext storage increase exposure, while shared administrator accounts weaken accountability. Organizations should design data flows so sensitive information reaches only systems with a legitimate business requirement.