View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 201

Which security control provides evidence about who accessed a sensitive system and what actions were performed?

1. Audit logging
2. Data compression
3. Network translation
4. Load balancing

Correct Answer: 1

Explanation

Audit logging records security-relevant activities such as user authentication, administrative actions, resource access, configuration changes, and other events. Proper audit logs can help establish accountability and support incident investigations, compliance reviews, and forensic analysis. Data compression reduces the size of information, network translation changes addressing information, and load balancing distributes traffic across systems. Audit logs should be protected from unauthorized modification, retained according to organizational requirements, and monitored for suspicious activity. Centralized collection can also improve visibility when multiple systems contribute evidence to an investigation.

Question 202

Which security principle limits a user to only the permissions necessary to perform assigned responsibilities?

1. Separation of duties
2. Least privilege
3. High availability
4. Defense in depth

Correct Answer: 2

Explanation

Least privilege ensures that users, applications, and processes receive only the permissions required to perform their authorized tasks. Limiting privileges reduces the potential impact of compromised accounts, accidental actions, and insider misuse. Separation of duties distributes sensitive responsibilities among multiple individuals, while high availability focuses on maintaining service access. Defense in depth uses multiple layers of security controls. Least privilege should be applied throughout the identity lifecycle and reviewed periodically because permissions that were appropriate in the past may become excessive when responsibilities, projects, or organizational roles change.

Question 203

A company wants to identify systems that contain sensitive customer information before selecting additional security controls. What should be performed first?

1. Data discovery and classification
2. Password synchronization
3. Traffic shaping
4. Certificate revocation

Correct Answer: 1

Explanation

Data discovery and classification help an organization identify where sensitive information exists and categorize it according to factors such as sensitivity, regulatory requirements, business value, or confidentiality. This information allows security teams to select appropriate controls based on the actual data being protected. Password synchronization manages authentication information, traffic shaping controls network bandwidth, and certificate revocation removes trust from compromised or invalid certificates. Data discovery can involve databases, file systems, cloud storage, applications, and other repositories. Accurate classification is important because security requirements should be aligned with the sensitivity of the information.

Question 204

Which security control is designed to block malicious web requests targeting application-layer vulnerabilities?

1. WAF
2. VPN concentrator
3. DHCP server
4. RAID controller

Correct Answer: 1

Explanation

A web application firewall, or WAF, monitors and filters HTTP and HTTPS requests to help protect web applications from attacks such as SQL injection, cross-site scripting, malicious request patterns, and other application-layer threats. A VPN concentrator manages remote VPN connections, DHCP provides network configuration information, and RAID controllers support storage redundancy. A WAF should complement secure application development rather than replace it. Effective deployment requires appropriate rules, tuning, logging, and monitoring so legitimate application traffic remains available while suspicious requests are detected or blocked.

Question 205

Which process verifies that a security control meets its intended requirements before it is accepted for operational use?

1. Control validation
2. Data archiving
3. Account synchronization
4. Network translation

Correct Answer: 1

Explanation

Control validation determines whether a security control has been implemented correctly and operates as intended. Validation may involve testing, inspection, documentation review, interviews, technical measurements, or other assessment techniques. The objective is to provide evidence that the control satisfies defined requirements before or during operational use. Data archiving focuses on retaining information, account synchronization manages identity information, and network translation modifies network addressing. Control validation is important because the existence of a security mechanism does not automatically demonstrate that it provides the expected level of protection.

Question 206

An organization wants to ensure that security requirements are considered during application design rather than after deployment. Which approach is most appropriate?

1. DevSecOps
2. Post-incident analysis only
3. Manual archiving
4. Emergency recovery

Correct Answer: 1

Explanation

DevSecOps integrates security practices throughout software development and delivery rather than treating security as a final-stage activity. Security requirements can be incorporated into planning, coding, testing, dependency management, infrastructure provisioning, deployment, and monitoring. Automated security checks can help identify vulnerabilities earlier in the development lifecycle. Post-incident analysis is useful after an event but does not replace preventive development practices. Manual archiving and emergency recovery address different operational needs. DevSecOps promotes shared responsibility for security and helps organizations identify and remediate weaknesses before applications reach production.

Question 207

Which control can restrict access to a network based on the security state or identity of a connecting device?

1. NAC
2. RAID
3. HSM
4. DLP

Correct Answer: 1

Explanation

Network access control, or NAC, can evaluate devices and users before granting network access. Depending on the implementation, NAC may consider identity, device type, security posture, authentication status, or compliance with organizational requirements. A noncompliant device may be denied access, placed into a restricted network, or redirected for remediation. RAID provides storage redundancy, HSMs protect cryptographic keys, and DLP protects sensitive information from unauthorized disclosure. NAC is particularly useful for environments where unmanaged or noncompliant devices could introduce security risks to internal network resources.

Question 208

What is the primary security purpose of a certificate authority?

1. Issue and validate digital certificates
2. Compress network packets
3. Allocate IP addresses
4. Store backup images

Correct Answer: 1

Explanation

A certificate authority, or CA, issues and manages digital certificates that bind identities to public keys. Depending on the PKI architecture, the CA validates certificate requests, signs certificates, maintains certificate status information, and supports certificate revocation processes. Network packet compression reduces traffic size, IP address allocation is generally handled by services such as DHCP, and backup systems store recovery information. A trustworthy CA infrastructure is important because systems rely on certificates to establish authenticated relationships for activities such as secure web connections, device authentication, and encrypted communications.

Question 209

A company needs to determine whether its recovery procedures meet established recovery objectives. What should it conduct?

1. Recovery testing
2. Data classification
3. Password auditing
4. Asset tagging

Correct Answer: 1

Explanation

Recovery testing verifies whether systems, data, procedures, personnel, and supporting infrastructure can restore operations according to established recovery requirements. Testing can reveal problems such as missing dependencies, incomplete backups, incorrect procedures, or unrealistic recovery time and data-loss expectations. Data classification identifies information sensitivity, password auditing evaluates authentication practices, and asset tagging helps identify resources. Recovery tests can range from tabletop exercises to technical restoration tests and full simulations. Results should be documented and used to improve continuity and disaster recovery plans.

Question 210

Which security control helps protect confidential data stored on a lost or stolen laptop?

1. Full-disk encryption
2. Network load balancing
3. Port forwarding
4. Log rotation

Correct Answer: 1

Explanation

Full-disk encryption protects data stored on a device by encrypting the contents of the storage medium. If a laptop is lost or stolen and an unauthorized person cannot obtain the required encryption credentials or keys, the stored information is significantly harder to access directly. Network load balancing distributes traffic, port forwarding redirects network connections, and log rotation manages stored log files. Full-disk encryption should be combined with strong authentication, secure key management, device management, and appropriate backup procedures because encryption alone does not protect against every endpoint threat.

Question 211

Which approach provides a centralized mechanism for applying authentication policies across multiple applications?

1. Federated identity
2. Independent local accounts
3. Shared passwords
4. Anonymous access

Correct Answer: 1

Explanation

Federated identity allows organizations to use trusted identity providers to authenticate users across multiple applications or services. Instead of maintaining separate authentication systems for every application, participating services can rely on established federation relationships and protocols. This can simplify identity management and allow centralized enforcement of authentication requirements such as multifactor authentication. Independent local accounts increase administrative overhead, shared passwords weaken accountability, and anonymous access removes meaningful identity verification. Federation is particularly useful in environments where users need secure access to applications operated by different organizations or service providers.

Question 212

Which security activity identifies potential attack paths between assets, vulnerabilities, and privileges?

1. Attack path analysis
2. Data backup
3. Certificate renewal
4. Password history review

Correct Answer: 1

Explanation

Attack path analysis examines how an adversary could move from an initial point of compromise toward valuable assets by exploiting vulnerabilities, excessive privileges, trust relationships, or network connectivity. It helps security teams understand combinations of weaknesses rather than viewing vulnerabilities independently. Data backup protects recovery information, certificate renewal maintains digital trust, and password history review helps prevent password reuse. Attack path analysis can support risk prioritization by showing which weaknesses could contribute to meaningful compromise. It is especially useful in complex environments containing interconnected systems and multiple privilege levels.

Question 213

Which security measure is most appropriate for protecting data while it is being transmitted between two systems?

1. Encryption in transit
2. Data deduplication
3. File compression
4. Storage replication

Correct Answer: 1

Explanation

Encryption in transit protects information as it moves across networks by converting readable data into protected ciphertext that requires appropriate cryptographic keys for recovery. Secure protocols such as TLS can provide confidentiality and integrity for network communications. Data deduplication reduces duplicate storage, file compression reduces data size, and storage replication creates additional copies of information. Encryption in transit is important when sensitive data crosses untrusted or shared networks. Organizations should also validate certificates, use appropriate cryptographic configurations, and protect endpoints because secure transmission cannot compensate for compromised systems.

Question 214

A security team discovers that a privileged account has more permissions than required. What should be done first?

1. Remove unnecessary privileges
2. Create another privileged account
3. Disable all security monitoring
4. Publish the credentials

Correct Answer: 1

Explanation

Unnecessary privileges should be removed to restore least-privilege access. Excessive permissions increase the potential impact of compromised credentials, insider misuse, and accidental administrative actions. Creating another privileged account does not address the underlying overprivilege, while disabling monitoring removes visibility into potentially risky activity. Publishing credentials would create a serious security exposure. Organizations should document the required business justification for privileged access, review permissions regularly, and use privileged access management where appropriate. Privilege reduction should be coordinated with system owners so legitimate administrative responsibilities are not disrupted.

Question 215

Which metric is most useful for measuring how quickly an organization responds after detecting a confirmed security incident?

1. MTTR
2. RPO
3. MTBF
4. RTO

Correct Answer: 1

Explanation

Mean time to respond or remediate, commonly represented as MTTR depending on the organization’s defined measurement, evaluates how quickly security teams take effective response or recovery action after an issue is identified. It can help organizations assess incident-handling efficiency and identify process bottlenecks. RPO measures acceptable data loss, RTO measures targeted service recovery time, and MTBF measures average time between failures. Organizations should clearly define what starts and ends the MTTR measurement so results remain consistent and useful for operational improvement.

Question 216

Which technique reduces the risk of exposing real production data when developers need information for testing?

1. Data masking
2. Password sharing
3. Network bridging
4. Log deletion

Correct Answer: 1

Explanation

Data masking replaces or obscures sensitive production information so that developers can use realistic datasets without receiving unnecessary exposure to actual confidential or personal information. Depending on the requirement, masking can modify names, account numbers, addresses, or other sensitive fields while maintaining enough structure for testing. Password sharing increases credential exposure, network bridging connects network segments, and log deletion removes evidence. Data masking should be designed so sensitive values cannot be easily reconstructed and should be combined with access controls and appropriate test-environment security.

Question 217

Which control is designed to identify malicious activity occurring directly on an endpoint?

1. EDR
2. DNS
3. NAT
4. DHCP

Correct Answer: 1

Explanation

Endpoint detection and response, or EDR, monitors endpoint activity and provides security telemetry and response capabilities. It can detect suspicious processes, unusual file activity, unauthorized persistence mechanisms, malicious network connections, and other indicators of compromise. DNS resolves domain names, NAT translates network addresses, and DHCP provides network configuration information. EDR can support investigation by preserving endpoint telemetry and allowing analysts to examine processes, users, files, and connections associated with an event. It is commonly used as part of a broader security monitoring and incident response strategy.

Question 218

A company wants to ensure that encryption keys are replaced according to a defined schedule. Which process should be implemented?

1. Key rotation
2. Data replication
3. Network segmentation
4. File compression

Correct Answer: 1

Explanation

Key rotation replaces cryptographic keys according to defined lifecycle requirements. Regular rotation can limit the amount of information protected by a single key and reduce exposure if a key is compromised. Key rotation procedures should consider key generation, distribution, storage, activation, retirement, revocation, and secure destruction. Data replication creates copies of information, network segmentation separates systems, and file compression reduces data size. Organizations should carefully manage key dependencies because improper rotation can make encrypted data or services inaccessible if old keys are needed for decryption.

Question 219

Which security activity determines whether an organization has enough resources and procedures to continue critical operations during a major disruption?

1. Business continuity planning
2. Password expiration
3. Vulnerability scanning
4. Certificate pinning

Correct Answer: 1

Explanation

Business continuity planning identifies how an organization will maintain or restore critical business functions during disruptions. It considers personnel, facilities, technology, suppliers, communication methods, dependencies, and alternate operating arrangements. Password expiration manages authentication credentials, vulnerability scanning identifies technical weaknesses, and certificate pinning restricts trusted certificates or public keys. Business continuity planning is broader than technical disaster recovery because it considers the continuation of business processes as a whole. Plans should be tested and updated regularly to reflect changes in systems, personnel, suppliers, and organizational priorities.

Question 220

Which practice helps prevent unauthorized changes to infrastructure by requiring approval and documentation before implementation?

1. Change management
2. Anonymous administration
3. Unrestricted deployment
4. Credential sharing

Correct Answer: 1

Explanation

Change management provides a structured process for requesting, reviewing, approving, implementing, and documenting changes to systems and infrastructure. Security-focused change management can require impact analysis, testing, approval, maintenance windows, rollback plans, and post-implementation verification. Anonymous administration and credential sharing reduce accountability, while unrestricted deployment can introduce uncontrolled changes and security weaknesses. Effective change management helps organizations maintain configuration consistency and provides an audit trail showing who authorized and implemented modifications. Emergency changes can follow expedited procedures while still requiring appropriate documentation and review.