View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 121

Which document is primarily used to track identified risks, their owners, and planned responses?

1. Asset inventory
2. Risk register
3. Incident ticket
4. Configuration baseline

Correct Answer: 2

Explanation

A risk register is used to document identified risks and maintain information such as risk descriptions, likelihood, impact, owners, response strategies, and status. It provides security and risk teams with a centralized view of risks that require monitoring or treatment. An asset inventory identifies organizational assets but does not primarily track risks. Incident tickets document security events, while configuration baselines define expected system settings. Maintaining an accurate risk register helps organizations monitor changing conditions and ensure that significant risks have assigned owners and appropriate treatment plans.

Question 122

A company wants employees to access multiple cloud applications using one corporate identity. Which technology best supports this requirement?

1. Single sign-on
2. Network address translation
3. Port security
4. Disk encryption

Correct Answer: 1

Explanation

Single sign-on allows users to authenticate through a centralized identity provider and then access multiple authorized applications without separately authenticating to each service. In a cloud environment, SSO can improve usability while allowing the organization to centrally enforce authentication policies. Network address translation changes network addressing and does not provide application identity management. Port security controls network switch access, while disk encryption protects stored data. SSO is commonly combined with federation protocols such as SAML or OpenID Connect to establish trusted authentication between identity providers and applications.

Question 123

Which metric is most useful for indicating an emerging increase in security incidents before significant business impact occurs?

1. RTO
2. RPO
3. Key performance indicator
4. Key risk indicator

Correct Answer: 4

Explanation

A key risk indicator, or KRI, is designed to provide an early warning that exposure to a particular risk is increasing. For example, a growing number of failed privileged-login attempts could serve as a KRI for account compromise risk. An RTO measures how quickly a service should be restored after disruption, while an RPO defines acceptable data loss. A KPI generally measures performance against operational objectives rather than directly signaling increasing risk. Organizations can use KRIs to identify adverse trends early and initiate additional investigation or mitigation before the risk produces significant business consequences.

Question 124

A security architect wants multiple independent controls protecting a critical application. Which principle is being applied?

1. Defense in depth
2. Data minimization
3. Open design
4. Job rotation

Correct Answer: 1

Explanation

Defense in depth uses multiple layers of security controls so that the failure or bypass of one control does not automatically expose a critical resource. For example, an application might be protected by network segmentation, identity controls, application-layer filtering, endpoint monitoring, and encryption. Data minimization reduces unnecessary collection or retention of information, while open design is a security design principle that avoids relying on secrecy of system design. Job rotation changes personnel responsibilities. Defense in depth is particularly valuable for high-impact systems because it reduces dependence on any single protective mechanism.

Question 125

Which access model evaluates attributes of the user, resource, and environment before granting access?

1. DAC
2. MAC
3. ABAC
4. Rule-based firewall filtering

Correct Answer: 3

Explanation

Attribute-based access control, or ABAC, makes authorization decisions using attributes associated with subjects, resources, actions, and environmental conditions. A policy could allow an employee to access a specific dataset only when the employee belongs to a particular department, is using a managed device, and is connecting during an approved period. DAC generally relies on resource owners controlling permissions, while MAC uses centrally defined security classifications. Firewall filtering focuses on network traffic rather than comprehensive application authorization. ABAC is useful when organizations need flexible, context-aware access decisions across complex environments.

Question 126

During an investigation, which evidence should generally be collected first because it is most volatile?

1. Archived backups
2. Memory contents
3. Printed policies
4. Disk images

Correct Answer: 2

Explanation

Volatile information can disappear when a system is powered down, restarted, or otherwise altered. System memory may contain active processes, encryption keys, network connections, injected code, and other information that cannot necessarily be recovered later. Therefore, investigators often prioritize volatile memory collection when circumstances and procedures permit. Archived backups and disk images are generally less volatile and can often be preserved for later examination. Printed policies are documentary evidence and do not normally change when the affected system is shut down. Proper forensic procedures should always preserve evidence integrity and document collection activities.

Question 127

A cloud provider supplies the underlying physical infrastructure while the customer manages operating systems and applications. Which service model is this?

1. SaaS
2. PaaS
3. IaaS
4. DaaS

Correct Answer: 3

Explanation

Infrastructure as a Service, or IaaS, provides customers with virtualized computing resources such as servers, storage, and networking while the provider maintains the underlying physical infrastructure. Customers generally remain responsible for components such as operating systems, applications, configurations, and data, depending on the provider’s specific shared-responsibility model. SaaS delivers complete applications, while PaaS provides a managed application platform that reduces the customer’s responsibility for underlying systems. Understanding the service model is important because it determines which security controls remain the customer’s responsibility and which are provided by the cloud provider.

Question 128

What is the primary purpose of an SBOM?

1. Identify software components and dependencies
2. Encrypt source code
3. Replace vulnerability scanning
4. Store user credentials

Correct Answer: 1

Explanation

A software bill of materials, or SBOM, provides an inventory of the software components, libraries, and dependencies included in an application or software product. Security teams can use an SBOM to identify affected components when a vulnerability is discovered in a third-party library or package. An SBOM does not encrypt source code, replace all vulnerability scanning, or function as a credential store. It supports software supply chain visibility and helps organizations understand where externally developed components are being used. Maintaining accurate component information can also improve incident response and vulnerability remediation.

Question 129

A company requires a security control to remain effective even if its primary authentication server becomes unavailable. Which design best supports this requirement?

1. Centralize all authentication through one server
2. Remove authentication requirements
3. Use redundant authentication infrastructure
4. Disable account monitoring

Correct Answer: 3

Explanation

Redundant authentication infrastructure can maintain availability when a primary authentication server fails. Depending on the architecture, organizations may deploy multiple identity servers, replicated services, or geographically distributed authentication components. This design reduces dependence on a single point of failure while maintaining required access controls. Centralizing authentication through one server without redundancy creates a significant availability risk. Removing authentication would weaken security, and disabling account monitoring would not address authentication service availability. For critical environments, authentication resilience should be considered alongside security, recovery, and operational requirements.

Question 130

Which activity most directly verifies that a disaster recovery plan can actually restore business services?

1. Policy review
2. Backup restoration test
3. Asset classification
4. User awareness training

Correct Answer: 2

Explanation

A backup restoration test directly verifies whether required data and systems can be recovered successfully. A backup may appear to complete successfully while still containing corrupted, incomplete, or unusable data, so restoration testing is essential. Policy reviews can verify documentation but do not demonstrate recovery capability. Asset classification identifies the importance or sensitivity of resources, and awareness training improves user behavior. Restoration testing can reveal missing dependencies, inadequate recovery procedures, incorrect backup configurations, or unrealistic recovery objectives before an actual disaster occurs.

Question 131

Which protocol is commonly used to allow an identity provider to send authentication assertions to a cloud service provider?

1. SAML
2. FTP
3. SNMP
4. ICMP

Correct Answer: 1

Explanation

Security Assertion Markup Language, or SAML, is commonly used for exchanging authentication and authorization information between an identity provider and a service provider. It is widely used to implement federated authentication and single sign-on for web-based applications. The identity provider authenticates the user and sends a signed assertion that the service provider can validate. FTP is primarily used for file transfers, SNMP is used for network management, and ICMP supports network diagnostic and control functions. SAML helps organizations centralize identity management while allowing users to access trusted external applications.

Question 132

A company wants to reduce the amount of personal information retained after a transaction is completed. Which privacy practice is most appropriate?

1. Data duplication
2. Data minimization
3. Privilege escalation
4. Log aggregation

Correct Answer: 2

Explanation

Data minimization means collecting and retaining only the information necessary for a legitimate business purpose. Reducing unnecessary personal information can decrease the amount of sensitive data exposed during a breach and may also support privacy and regulatory requirements. Data duplication increases the number of locations where information exists, potentially increasing exposure. Privilege escalation increases access rights and does not reduce stored information. Log aggregation centralizes records for monitoring and investigation but does not inherently minimize personal data. Organizations should define retention requirements and securely dispose of information when it is no longer needed.

Question 133

Which control is most appropriate for preventing secrets such as API keys from being committed to source-code repositories?

1. Password expiration
2. Network segmentation
3. Secrets scanning
4. Physical access control

Correct Answer: 3

Explanation

Secrets scanning examines source code, repositories, commits, and related development artifacts for exposed credentials such as API keys, tokens, passwords, and private keys. It can identify sensitive values before they are deployed or distributed further. Password expiration does not detect secrets embedded in source code. Network segmentation limits network communication, while physical access controls protect facilities and equipment. Secrets scanning is particularly useful when integrated into development workflows and CI/CD pipelines. Organizations should also use dedicated secrets-management systems and revoke exposed credentials promptly when detection occurs.

Question 134

A security team wants to identify the specific techniques an adversary is using rather than only individual indicators such as IP addresses. What should the team prioritize?

1. TTP analysis
2. Asset tagging
3. Data retention
4. Certificate renewal

Correct Answer: 1

Explanation

Tactics, techniques, and procedures, or TTPs, describe how adversaries operate rather than focusing only on individual indicators such as IP addresses, domains, or file hashes. TTP-based analysis can help security teams recognize attacker behavior even when specific indicators change. Asset tagging organizes information about organizational resources, while data retention defines how long information is stored. Certificate renewal manages digital certificates. Because attackers can frequently change infrastructure and artifacts, understanding behavioral patterns and techniques can provide more durable detection opportunities across different incidents.

Question 135

What is the main purpose of access recertification?

1. Increase all users’ privileges
2. Confirm that existing access remains appropriate
3. Disable centralized authentication
4. Replace vulnerability scanning

Correct Answer: 2

Explanation

Access recertification requires responsible managers or system owners to periodically review user permissions and confirm that the access remains necessary and appropriate. This process can identify excessive privileges, access belonging to former employees, and permissions that no longer match current job responsibilities. Increasing privileges would create unnecessary exposure, while disabling centralized authentication does not address authorization review. Vulnerability scanning addresses technical weaknesses rather than user access rights. Regular recertification supports least privilege and helps organizations maintain accurate authorization as employees change roles, projects, or responsibilities.

Question 136

A security team wants applications to fail in a way that prevents unauthorized access when a critical security component malfunctions. Which principle applies?

1. Fail open
2. Fail secure
3. Maximum availability
4. Implicit trust

Correct Answer: 2

Explanation

Fail-secure design means that when a security-related component fails, the system defaults to a state that does not unnecessarily grant unauthorized access. For example, if an authorization service becomes unavailable, a sensitive application might deny access rather than automatically permitting requests. Fail-open behavior prioritizes continued availability but can create security exposure if access is granted during a failure. Maximum availability is an operational objective, not a specific security failure principle. Implicit trust also contradicts the principle of verifying access rather than assuming that requests are safe.

Question 137

Which mechanism allows a certificate authority to indicate that a digital certificate should no longer be trusted?

1. CRL
2. RAID
3. VLAN
4. NAT

Correct Answer: 1

Explanation

A certificate revocation list, or CRL, contains information about digital certificates that a certificate authority has revoked before their normal expiration dates. Revocation may occur when a private key is compromised, a certificate is incorrectly issued, or another condition requires trust to be withdrawn. RAID provides storage redundancy, VLANs provide logical network segmentation, and NAT translates network addresses. Certificate revocation is an important part of public key infrastructure because simply waiting for a compromised certificate to expire may leave systems exposed for an unacceptable period.

Question 138

A company deploys security controls at the identity, endpoint, network, and application layers. What architecture approach does this demonstrate?

1. Single-point security
2. Defense in depth
3. Flat networking
4. Data aggregation

Correct Answer: 2

Explanation

Defense in depth distributes protective controls across multiple layers of an environment. Identity controls can restrict who accesses resources, endpoint controls can detect malicious activity, network controls can limit communication, and application controls can protect specific services. If an attacker bypasses one layer, additional controls may still detect or block the activity. A single-point security model would create greater dependence on one control. Flat networking generally reduces segmentation, while data aggregation refers to collecting information from multiple sources. Layered security is especially useful for protecting critical enterprise systems against varied attack paths.

Question 139

Which process should occur when a vulnerability cannot be remediated within the organization’s required timeframe?

1. Risk exception management
2. Asset deletion
3. Credential sharing
4. Log suppression

Correct Answer: 1

Explanation

Risk exception management provides a formal process for documenting vulnerabilities that cannot be remediated within established requirements. The organization should identify the affected asset, explain the reason for the exception, assess the associated risk, define compensating controls when possible, assign an accountable owner, and establish an expiration or review date. Ignoring the vulnerability leaves the risk undocumented, while deleting assets or suppressing logs does not appropriately address the underlying exposure. A controlled exception process ensures that delayed remediation remains visible and receives appropriate management oversight.

Question 140

Which security activity provides the strongest evidence that a newly deployed application follows its approved security architecture?

1. Reviewing the application logo
2. Comparing deployment results against security requirements
3. Increasing user privileges
4. Removing application logging

Correct Answer: 2

Explanation

Comparing deployment results against documented security requirements and architecture provides evidence that the application was implemented according to approved security expectations. The review can verify configurations, authentication controls, network boundaries, encryption requirements, logging, and other architectural safeguards. A visual review of an application logo provides no meaningful security assurance. Increasing privileges can introduce unnecessary access, while removing logging reduces visibility. Architecture validation should ideally occur during deployment and through subsequent security assessments so deviations can be identified and corrected before they create significant exposure.