View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 181

Which security control helps an organization detect unauthorized changes to critical system files?

1. File integrity monitoring
2. Network address translation
3. Data compression
4. Load balancing

Correct Answer: 1

Explanation

File integrity monitoring, or FIM, detects changes to files, directories, configurations, and other monitored objects. A baseline can be established for approved file states, and subsequent modifications can generate alerts for investigation. This is useful for detecting unauthorized configuration changes, malware activity, or tampering with important system files. Network address translation changes network addressing, data compression reduces data size, and load balancing distributes traffic. FIM is especially valuable on systems containing sensitive configurations or applications where unauthorized modifications could affect security, integrity, or compliance.

Question 182

Which risk response involves moving financial consequences of a risk to another organization?

1. Risk acceptance
2. Risk avoidance
3. Risk transfer
4. Risk escalation

Correct Answer: 3

Explanation

Risk transfer shifts some or all financial consequences of a risk to another party. Insurance is a common example, while contracts may also allocate certain responsibilities or liabilities to suppliers and service providers. Risk acceptance means knowingly retaining the risk, while risk avoidance involves eliminating the activity that creates the risk. Risk escalation moves a risk to a higher level of authority when it exceeds an individual’s decision-making responsibility. Risk transfer does not eliminate the underlying threat, so organizations should still understand and monitor the remaining exposure.

Question 183

A security architect wants systems to remain protected even when administrators do not manually configure every individual security option. Which principle is most appropriate?

1. Secure defaults
2. Open permissions
3. Shared authentication
4. Implicit trust

Correct Answer: 1

Explanation

Secure defaults configure systems to begin in a protected state rather than requiring administrators to discover and manually enable every important security setting. Examples include disabling unnecessary services, requiring authentication, restricting access, and enabling appropriate security controls by default. Open permissions and implicit trust can create unnecessary exposure, while shared authentication reduces individual accountability. Secure defaults are particularly important in large environments because configuration mistakes and omissions become more likely as the number of systems increases. They support consistent security while reducing dependence on manual configuration decisions.

Question 184

Which technology is specifically designed to protect workloads and applications running in cloud environments?

1. CWPP
2. SMTP
3. DNS
4. RAID

Correct Answer: 1

Explanation

A Cloud Workload Protection Platform, or CWPP, provides security capabilities for workloads running in cloud environments. Depending on the implementation, it may protect virtual machines, containers, serverless workloads, and applications through vulnerability management, runtime protection, monitoring, and configuration controls. SMTP supports email transmission, DNS resolves domain names, and RAID provides storage redundancy. CWPP technologies are useful because cloud workloads can be distributed across multiple environments and can change rapidly. Security teams can use workload-focused controls to protect compute resources throughout their development, deployment, and operational lifecycles.

Question 185

Which activity provides evidence that security controls continue operating effectively after deployment?

1. Continuous control monitoring
2. Password sharing
3. Asset disposal
4. Data duplication

Correct Answer: 1

Explanation

Continuous control monitoring evaluates security controls over time rather than relying only on a single assessment. Automated monitoring can identify configuration drift, control failures, policy violations, and other changes that may reduce security effectiveness. Password sharing weakens accountability, asset disposal removes retired resources, and data duplication creates additional copies of information. Continuous monitoring is valuable because enterprise environments change frequently due to software updates, configuration changes, new assets, and evolving threats. Ongoing visibility allows security teams to identify control degradation and take corrective action more quickly.

Question 186

Which security mechanism uses a centralized directory to authenticate users and provide access to organizational resources?

1. Identity and access management
2. Data loss prevention
3. Network intrusion prevention
4. File compression

Correct Answer: 1

Explanation

Identity and access management, or IAM, provides processes and technologies for managing identities, authentication, authorization, and access throughout an organization. Centralized directories can store user identities and support authentication to multiple organizational resources. IAM can also enforce policies such as least privilege, multifactor authentication, role-based access, and account lifecycle management. Data loss prevention protects sensitive information, intrusion prevention detects or blocks suspicious network activity, and file compression reduces data size. Effective IAM provides a foundation for controlling who can access systems and what actions those users are permitted to perform.

Question 187

A security analyst receives an alert showing an unusual login from a new country followed by access to sensitive resources. What should the analyst do first?

1. Ignore the alert
2. Validate and investigate the authentication activity
3. Delete the user’s account immediately
4. Disable all corporate systems

Correct Answer: 2

Explanation

The analyst should first validate and investigate the unusual authentication activity to determine whether it represents legitimate travel, a VPN connection, a compromised credential, or another condition. Relevant information may include authentication logs, device details, location data, session history, and subsequent resource access. Immediately deleting an account or disabling all corporate systems could cause unnecessary business disruption without confirming the threat. Ignoring the alert could allow an active compromise to continue. Security operations should use evidence-based triage to determine the appropriate containment action after establishing the credibility and severity of the event.

Question 188

Which approach is most appropriate for identifying security weaknesses in third-party software libraries used by an application?

1. Software composition analysis
2. Screen locking
3. Physical access control
4. Network load balancing

Correct Answer: 1

Explanation

Software composition analysis, or SCA, examines third-party and open-source software components used within an application. It can identify known vulnerabilities, outdated dependencies, licensing concerns, and component relationships. This is important because applications frequently depend on external libraries that may contain vulnerabilities even when the organization’s own source code is secure. Screen locking protects unattended devices, physical access controls protect facilities, and load balancing distributes traffic. SCA can be integrated into development pipelines so vulnerable dependencies are identified earlier and remediation can occur before software reaches production.

Question 189

Which type of backup is designed to prevent attackers from modifying previously stored recovery data?

1. Immutable backup
2. Temporary cache
3. Shared folder
4. Live database replica

Correct Answer: 1

Explanation

Immutable backups are protected against modification or deletion for a defined retention period. This makes them valuable against ransomware and other attacks where adversaries attempt to destroy or encrypt recovery data before demanding payment. A temporary cache is designed for short-term data storage, a shared folder may be accessible to users or attackers, and a live database replica can potentially replicate malicious changes. Immutable backup strategies should be combined with appropriate access controls, backup testing, monitoring, and separate recovery procedures to provide dependable protection against destructive incidents.

Question 190

Which security activity evaluates whether employees understand organizational security policies and expected behaviors?

1. Security awareness assessment
2. Penetration testing
3. Vulnerability scanning
4. Network segmentation

Correct Answer: 1

Explanation

A security awareness assessment evaluates whether personnel understand security policies, recognize common threats, and follow required organizational practices. Assessments may use quizzes, simulated phishing exercises, interviews, or other controlled methods. Penetration testing evaluates technical security by attempting authorized exploitation, while vulnerability scanning identifies potential technical weaknesses. Network segmentation separates systems into security zones. Awareness assessments are important because employees can influence security through activities such as handling sensitive information, identifying suspicious messages, protecting credentials, and reporting incidents. Results can help organizations identify topics requiring additional training.

Question 191

Which control ensures that a critical security process cannot be approved and executed entirely by the same individual?

1. Separation of duties
2. Data minimization
3. Network redundancy
4. Certificate pinning

Correct Answer: 1

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals so that one person cannot independently complete an entire high-risk process. For example, one employee may request a financial transaction while another approves it. This reduces opportunities for fraud, abuse, or unauthorized changes and provides an additional layer of accountability. Data minimization limits unnecessary information collection, network redundancy improves availability, and certificate pinning restricts trusted certificates or keys. Separation of duties is particularly important for privileged administrative, financial, security, and change-management activities where excessive individual authority could create significant risk.

Question 192

A company needs to prove that a stored file has not changed since it was collected. Which technique is most appropriate?

1. Hashing
2. Encryption only
3. Compression
4. Network translation

Correct Answer: 1

Explanation

Hashing generates a fixed-length value based on the contents of a file. Investigators can calculate the hash when evidence is collected and compare it with a later hash value. If the values match, this provides evidence that the file contents have remained unchanged, assuming an appropriate cryptographic hash algorithm and proper handling procedures. Encryption protects confidentiality, compression reduces file size, and network translation modifies addressing information. Hash values are widely used during forensic investigations to support evidence integrity and demonstrate that analyzed files correspond to the originally collected evidence.

Question 193

Which security architecture approach places the most sensitive resources behind additional controls and restrictions?

1. Security zoning
2. Flat networking
3. Universal access
4. Shared administration

Correct Answer: 1

Explanation

Security zoning separates resources according to factors such as sensitivity, trust level, business function, or regulatory requirements. Highly sensitive resources can be placed in restricted zones with stronger authentication, monitoring, access controls, and limited communication paths. Flat networking allows broad connectivity and can increase lateral movement opportunities after compromise. Universal access and shared administration can create excessive privileges and reduce accountability. Security zoning is useful for protecting critical applications, regulated information, and privileged infrastructure by ensuring that access to sensitive environments receives additional security scrutiny.

Question 194

Which process determines whether a proposed system change could introduce new security risks before implementation?

1. Change risk assessment
2. Log deletion
3. Data compression
4. Account synchronization

Correct Answer: 1

Explanation

A change risk assessment evaluates the potential security and operational effects of a proposed modification before it is implemented. The review may consider affected systems, dependencies, vulnerabilities, access changes, data exposure, availability requirements, and rollback procedures. This allows organizations to identify and address risks before changes reach production. Log deletion removes records, data compression reduces storage size, and account synchronization manages identity information. Integrating security review into change management helps prevent seemingly routine modifications from unintentionally weakening controls or creating new attack paths.

Question 195

Which control can automatically isolate a compromised endpoint from the network while allowing security personnel to investigate it?

1. EDR
2. RAID
3. DNS
4. DHCP

Correct Answer: 1

Explanation

Endpoint detection and response, or EDR, can monitor endpoint activity, detect suspicious behavior, and provide response capabilities such as isolating a compromised endpoint from network communication. Isolation can help contain an attack while preserving the endpoint for investigation and evidence collection. RAID protects storage through redundancy, DNS resolves names to network addresses, and DHCP provides network configuration. EDR platforms can also provide process information, file activity, network connections, and other telemetry that helps analysts understand the scope and behavior of an incident.

Question 196

A company wants to ensure that sensitive information is automatically identified and prevented from being sent outside approved channels. Which technology is most appropriate?

1. DLP
2. NTP
3. NAT
4. RAID

Correct Answer: 1

Explanation

Data loss prevention, or DLP, identifies and protects sensitive information according to organizational policies. DLP controls can inspect content in endpoints, email, cloud services, network channels, and storage locations to detect sensitive data and enforce actions such as blocking, quarantining, alerting, or encrypting information. NTP synchronizes system clocks, NAT translates network addresses, and RAID provides storage redundancy. DLP policies should be carefully configured to balance security with legitimate business activity and should account for data classification, approved communication channels, and organizational requirements.

Question 197

Which metric measures the average amount of time required to identify that a security incident has occurred?

1. MTTD
2. RPO
3. RTO
4. MTBF

Correct Answer: 1

Explanation

Mean time to detect, or MTTD, measures the average time between the beginning of a security event or incident and its detection by the organization. A lower MTTD generally indicates that monitoring and detection processes are identifying suspicious activity more quickly. RPO measures acceptable data loss, RTO measures targeted recovery time, and MTBF measures the average time between failures. MTTD can be used as a security operations metric to evaluate detection capabilities and identify opportunities to improve monitoring, alerting, logging, and analyst workflows.

Question 198

Which practice helps ensure that a software package can be traced back to its original source and build process?

1. Software provenance tracking
2. Password reuse
3. Data deletion
4. Network segmentation only

Correct Answer: 1

Explanation

Software provenance tracking records information about where software components originated, how they were built, which dependencies were used, and potentially which pipeline produced the final artifact. This supports software supply-chain security by helping organizations determine whether a package came from an approved source and whether unexpected modifications occurred. Password reuse weakens authentication, data deletion removes information, and network segmentation restricts communication but does not establish software origin. Provenance information can support incident investigations, software verification, dependency management, and decisions about whether an artifact should be trusted.

Question 199

A security team wants to reduce false-positive alerts without disabling detection rules entirely. What should the team perform?

1. Alert tuning
2. Log deletion
3. Sensor removal
4. Monitoring shutdown

Correct Answer: 1

Explanation

Alert tuning adjusts detection rules, thresholds, correlation logic, exclusions, and contextual conditions to improve the quality of security alerts. The goal is to reduce unnecessary alerts while preserving meaningful detections. Deleting logs, removing sensors, or shutting down monitoring can reduce alert volume but also removes valuable visibility and may allow real attacks to go undetected. Effective tuning should be based on observed alert patterns, investigation results, environmental context, and documented detection requirements. Security teams should regularly review tuned rules because changes in infrastructure and attacker behavior can affect their effectiveness.

Question 200

Which concept requires an organization to maintain security controls throughout the entire lifecycle of a system, from design through retirement?

1. Secure system lifecycle management
2. Password rotation only
3. Incident closure
4. Temporary access

Correct Answer: 1

Explanation

Secure system lifecycle management integrates security requirements throughout a system’s lifecycle, including planning, design, development, deployment, operation, maintenance, modification, and retirement. Security should not be treated as a one-time activity performed only before deployment. Requirements can include threat modeling, secure configuration, vulnerability management, monitoring, access control, change management, and secure disposal. Password rotation addresses only one aspect of authentication, incident closure applies to individual events, and temporary access concerns authorization. Lifecycle security helps ensure that protections remain appropriate as systems and their risks evolve over time.