View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 161

Which document identifies the specific actions, responsibilities, and communication procedures to follow during a security incident?

1. Asset inventory
2. Incident response plan
3. Risk register
4. Security baseline

Correct Answer: 2

Explanation

An incident response plan defines how an organization prepares for, detects, contains, responds to, and recovers from security incidents. It can identify responsibilities, escalation paths, communication procedures, evidence-handling requirements, and recovery activities. An asset inventory identifies organizational resources, while a risk register tracks identified risks and their treatment. A security baseline defines expected system configurations. A well-maintained incident response plan helps ensure that personnel understand their responsibilities before an incident occurs and can respond in a coordinated manner instead of improvising critical decisions during an emergency.

Question 162

Which protocol is commonly used to support modern federated authentication for web and mobile applications?

1. FTP
2. LDAP only
3. OpenID Connect
4. TFTP

Correct Answer: 3

Explanation

OpenID Connect is an identity layer built on OAuth 2.0 that enables applications to authenticate users through an identity provider. It is commonly used in modern web and mobile applications because it supports token-based authentication and can provide standardized identity information. FTP and TFTP are file-transfer protocols, while LDAP is commonly used for directory services and identity information but is not itself a modern web federation protocol. OpenID Connect can allow organizations to centralize authentication while applications rely on trusted identity providers rather than maintaining separate user credentials.

Question 163

A risk owner determines that a particular risk is acceptable without implementing additional controls. Which risk treatment is being used?

1. Risk avoidance
2. Risk transfer
3. Risk acceptance
4. Risk mitigation

Correct Answer: 3

Explanation

Risk acceptance occurs when an organization knowingly acknowledges a risk and decides that no additional treatment is required, usually because the risk falls within established tolerance or the cost of further mitigation is not justified. Risk avoidance eliminates the activity creating the risk, while risk transfer shifts some financial or operational consequences to another party, such as through insurance or contractual arrangements. Risk mitigation reduces likelihood or impact through additional controls. Accepted risks should still be documented, assigned to an accountable owner, and periodically reviewed because their conditions can change.

Question 164

Which technology can protect container images by scanning them for known vulnerabilities before deployment?

1. Container image scanner
2. Network load balancer
3. DHCP server
4. Hardware RAID

Correct Answer: 1

Explanation

Container image scanning analyzes container images and their included operating-system packages, libraries, and dependencies for known vulnerabilities or policy violations. Performing these checks before deployment allows development and security teams to identify vulnerable components before they reach production environments. A load balancer distributes network traffic, DHCP provides network configuration, and hardware RAID provides storage redundancy. Container security should also consider image provenance, secure registries, runtime controls, least privilege, and configuration security. Integrating image scanning into CI/CD pipelines can make vulnerability detection an automated part of the software delivery process.

Question 165

What is the primary purpose of a security maturity assessment?

1. Identify organizational security capability and improvement areas
2. Replace all security controls
3. Eliminate risk completely
4. Disable compliance monitoring

Correct Answer: 1

Explanation

A security maturity assessment evaluates how effectively an organization performs security-related processes, governance, technologies, and controls compared with a defined maturity model or target state. It can reveal strengths, weaknesses, process gaps, and opportunities for improvement. The purpose is not to eliminate every possible risk or replace existing controls. Instead, maturity assessments help organizations prioritize improvements and measure progress over time. Results can also support strategic planning and investment decisions by showing where security capabilities are less developed or where processes require greater consistency and formalization.

Question 166

Which control helps prevent an attacker from using a compromised workstation to access unrelated internal systems?

1. Data retention
2. Network segmentation
3. Password history
4. File compression

Correct Answer: 2

Explanation

Network segmentation separates systems or workloads into distinct security zones and can restrict communication between them. If an attacker compromises one workstation, segmentation can limit the systems that the compromised device can directly reach, reducing opportunities for lateral movement. Data retention determines how long information is stored, password history prevents reuse of previous passwords, and file compression reduces storage or transmission size. Effective segmentation should be based on business requirements and trust relationships, with appropriate firewall or access-control policies governing communication between zones.

Question 167

A company wants to prove that a specific employee approved a digitally signed transaction. Which security property is most directly supported?

1. Availability
2. Confidentiality
3. Nonrepudiation
4. Redundancy

Correct Answer: 3

Explanation

Digital signatures can provide evidence that a particular private key was used to sign data and can support nonrepudiation when the associated identity and key-management processes are trustworthy. They also provide integrity because modifications to the signed content can cause signature verification to fail. Availability concerns access to services, confidentiality protects information from unauthorized disclosure, and redundancy improves resilience. Nonrepudiation is especially important for transactions, approvals, and legally significant electronic records where organizations need evidence connecting an authenticated signer to a specific action.

Question 168

Which practice provides a centralized location for storing and managing application credentials without embedding them directly in source code?

1. Secrets management
2. Data classification
3. Network address translation
4. Disk defragmentation

Correct Answer: 1

Explanation

Secrets management systems securely store and control access to sensitive values such as passwords, API keys, database credentials, and tokens. Applications can retrieve required secrets through controlled mechanisms instead of embedding credentials directly into source code or configuration files. This reduces the likelihood that credentials will be accidentally exposed through repositories or deployment artifacts. Data classification identifies information sensitivity, NAT changes network addressing, and disk defragmentation reorganizes storage data. Secrets-management platforms can also support access auditing, automatic rotation, expiration, and fine-grained permissions for applications and administrators.

Question 169

Which metric defines the maximum acceptable period during which a service can remain unavailable after a disruption?

1. MTBF
2. RPO
3. RTO
4. MTTD

Correct Answer: 3

Explanation

Recovery time objective, or RTO, defines the maximum targeted amount of time within which a system or service should be restored following a disruption. A lower RTO generally requires stronger recovery capabilities and potentially greater investment. Recovery point objective, or RPO, addresses the maximum acceptable amount of data loss measured in time. MTBF measures the average time between failures, while MTTD measures the time required to detect an event or incident. Organizations establish RTOs based on business impact and the operational importance of the affected service.

Question 170

Which security process compares current system settings against an approved configuration standard?

1. Configuration compliance assessment
2. Data anonymization
3. Threat intelligence collection
4. Certificate issuance

Correct Answer: 1

Explanation

A configuration compliance assessment compares system settings with an approved security baseline or configuration standard. It can identify deviations such as unnecessary services, weak authentication settings, insecure permissions, or missing security controls. Data anonymization protects privacy by reducing the ability to identify individuals. Threat intelligence collection gathers information about threats and adversary activity, while certificate issuance creates digital certificates for trusted identities. Configuration compliance assessments are useful because system settings can drift over time due to administrative changes, software updates, or operational requirements.

Question 171

Which component is specifically designed to protect cryptographic keys from unauthorized extraction while performing cryptographic operations?

1. Proxy server
2. HSM
3. Load balancer
4. Web application firewall

Correct Answer: 2

Explanation

A hardware security module, or HSM, is a specialized device designed to generate, store, and protect cryptographic keys while performing approved cryptographic operations. HSMs can provide strong physical and logical protections for high-value keys used by certificate authorities, payment systems, encryption services, and other critical applications. A proxy server intermediates network requests, a load balancer distributes traffic, and a web application firewall protects applications from certain web-based attacks. HSMs can also support key lifecycle functions and provide controlled access to cryptographic material.

Question 172

A security team needs information about newly observed malicious domains, attacker infrastructure, and emerging campaigns. Which source is most relevant?

1. Threat intelligence
2. Asset disposal records
3. Backup catalog
4. Configuration baseline

Correct Answer: 1

Explanation

Threat intelligence provides information about adversaries, malicious infrastructure, attack techniques, campaigns, indicators, and emerging threats. Security teams can use this information to improve detection rules, investigate suspicious activity, prioritize vulnerabilities, and strengthen defensive controls. Asset disposal records document equipment disposal, backup catalogs track stored recovery data, and configuration baselines define expected system settings. Threat intelligence can come from internal observations, commercial providers, government sources, industry groups, or other trusted channels. Its value increases when information is relevant to the organization’s technologies, threat environment, and business operations.

Question 173

Which approach allows an organization to separate sensitive workloads from general-purpose systems based on their security requirements?

1. Data deduplication
2. Microsegmentation
3. Password synchronization
4. Log compression

Correct Answer: 2

Explanation

Microsegmentation divides an environment into smaller security segments and allows organizations to apply more granular access and communication policies. Sensitive workloads can therefore be isolated from less trusted or general-purpose systems, reducing unnecessary communication paths and limiting lateral movement. Data deduplication reduces duplicate storage, password synchronization manages credentials across systems, and log compression reduces log storage requirements. Microsegmentation can be implemented using network controls, software-defined technologies, host-based policies, or cloud-native mechanisms. Policies should be based on application dependencies and security requirements to avoid disrupting legitimate communication.

Question 174

Which activity is most useful for determining the potential business consequences if a critical business process becomes unavailable?

1. Business impact analysis
2. Password auditing
3. Vulnerability scanning
4. Certificate renewal

Correct Answer: 1

Explanation

A business impact analysis, or BIA, identifies critical business processes and evaluates the consequences of their disruption. It can consider financial losses, operational effects, legal obligations, customer impact, and dependencies. BIA findings help organizations establish recovery priorities and determine appropriate recovery objectives such as RTO and RPO. Password auditing evaluates authentication practices, vulnerability scanning identifies technical weaknesses, and certificate renewal maintains digital certificates. A BIA is therefore an important foundation for business continuity and disaster recovery planning because it connects technical recovery requirements to actual business priorities.

Question 175

Which security control can prevent users from executing unauthorized applications on managed endpoints?

1. Application control
2. Data replication
3. Time synchronization
4. Traffic shaping

Correct Answer: 1

Explanation

Application control restricts which software can execute on managed systems based on organizational policy. Depending on the implementation, it may use allowlists, publisher certificates, file hashes, application identities, or other attributes to determine whether execution should be permitted. Data replication creates copies of information, time synchronization ensures consistent timestamps, and traffic shaping controls network bandwidth or traffic patterns. Application control can reduce the risk posed by unauthorized software and certain malware. It should be carefully managed so legitimate applications and required business updates remain available.

Question 176

An organization wants to identify whether an employee’s access is excessive compared with the requirements of the employee’s job. Which review is most appropriate?

1. Access review
2. Disaster recovery test
3. Packet capture
4. Software compilation

Correct Answer: 1

Explanation

An access review evaluates whether users have appropriate permissions for their current responsibilities. Reviewers can compare assigned privileges with job functions and identify unnecessary, excessive, or outdated access. This supports least privilege and reduces the possibility that compromised or misused accounts could reach sensitive resources. A disaster recovery test evaluates recovery capabilities, packet capture analyzes network traffic, and software compilation converts source code into executable or intermediate forms. Access reviews should occur periodically and after significant role changes, transfers, or other events that may affect authorization requirements.

Question 177

Which control is most effective for ensuring that software updates originate from an approved publisher and have not been modified?

1. Digital signature verification
2. Screen locking
3. Network load balancing
4. Data archiving

Correct Answer: 1

Explanation

Digital signature verification can confirm that software was signed by a trusted publisher and that the signed content has not been altered after signing. The verification process relies on trusted certificates or keys and can help prevent the installation of tampered or unauthorized software. Screen locking protects unattended devices, load balancing distributes network traffic, and data archiving supports information retention. Secure software update mechanisms should also validate the source, protect update channels, and maintain appropriate trust relationships. Code signing is an important control in software supply-chain security.

Question 178

Which activity should occur after an incident has been contained and recovered to improve future response capabilities?

1. Lessons learned review
2. Account creation
3. Asset disposal
4. Firewall replacement

Correct Answer: 1

Explanation

A lessons learned review evaluates what happened during an incident, how effectively the organization responded, which controls worked, and where improvements are needed. Findings can lead to updates to incident response procedures, technical controls, training, monitoring, and communication processes. The review should focus on improving organizational resilience rather than simply assigning blame. Account creation and asset disposal are unrelated to post-incident improvement, while firewall replacement may be appropriate in specific circumstances but is not itself the general post-incident process. Documented lessons can strengthen future preparedness and response.

Question 179

A company wants to reduce the likelihood that one stolen administrator credential can provide unrestricted access across the environment. Which strategy is most appropriate?

1. Shared administrator accounts
2. Privileged access segmentation
3. Permanent global privileges
4. Removing audit logs

Correct Answer: 2

Explanation

Privileged access segmentation limits administrative permissions according to systems, environments, responsibilities, or security boundaries. This reduces the potential impact of a compromised administrator account because the stolen credential does not automatically provide unrestricted access everywhere. Shared administrator accounts reduce accountability, permanent global privileges violate least privilege, and removing audit logs eliminates important visibility. Privileged access management can further strengthen this strategy through just-in-time access, approval workflows, session monitoring, and credential protection. Separating administrative privileges is particularly important in large environments containing highly sensitive or critical systems.

Question 180

Which security assessment method attempts to exploit identified weaknesses to determine whether they can actually be used by an attacker?

1. Vulnerability scanning
2. Penetration testing
3. Asset classification
4. Policy review

Correct Answer: 2

Explanation

Penetration testing involves controlled attempts to exploit vulnerabilities and security weaknesses to determine their practical impact and whether an attacker could successfully compromise targeted systems. Unlike vulnerability scanning, which primarily identifies potential weaknesses, penetration testing provides deeper validation by attempting exploitation within an authorized scope. Asset classification categorizes resources according to characteristics such as sensitivity or criticality, while policy review evaluates documented requirements. Penetration testing should have clearly defined authorization, scope, rules of engagement, and safety procedures to prevent unnecessary disruption to production environments.