View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 381

Which control is most effective for preventing administrators from making unauthorized changes to production systems?

1. Data masking
2. Change approval
3. Network compression
4. Backup deduplication

Correct Answer: 2

Explanation

Change approval requires proposed modifications to production systems to be reviewed and authorized before implementation. The process should identify the requested change, business justification, affected systems, potential risks, testing requirements, implementation plan, and rollback procedure. For high-risk changes, additional approval or security review may be required. Change management reduces accidental outages and unauthorized modifications while providing an audit trail of decisions. Emergency changes should follow a defined expedited process and receive retrospective review to ensure that bypassing normal procedures does not become routine.

Question 382

Which technology provides a protected execution environment for sensitive code and data even while a system is running?

1. Secure enclave
2. Network ACL
3. Proxy server
4. Backup appliance

Correct Answer: 1

Explanation

A secure enclave provides an isolated execution environment designed to protect sensitive code and data from unauthorized access, including certain threats originating from the host operating system. Trusted execution environments can use hardware-supported protections to help preserve confidentiality and integrity while applications execute. They are useful for workloads handling cryptographic keys, confidential computations, or other sensitive information. Organizations should still evaluate the specific implementation, threat model, and trust assumptions because an enclave does not eliminate every application, hardware, or supply-chain security risk.

Question 383

A company wants to prevent a single administrator from both approving and implementing a high-risk security configuration change. Which principle applies?

1. Data minimization
2. Defense in depth
3. Separation of duties
4. Nonrepudiation

Correct Answer: 3

Explanation

Separation of duties divides sensitive responsibilities among different individuals or roles so that one person cannot independently complete an entire high-risk process. For example, one administrator may submit a configuration change while another authorized person reviews and approves it. This reduces the opportunity for fraud, abuse, and accidental mistakes. Separation of duties is particularly valuable for privileged access, financial systems, security policy changes, and production deployments. Organizations should design the process carefully so that segregation does not create unnecessary operational delays or unmanageable administrative overhead.

Question 384

Which metric measures the average time required to detect a security incident?

1. MTTR
2. RPO
3. MTTD
4. RTO

Correct Answer: 3

Explanation

Mean Time to Detect, or MTTD, measures how long it typically takes an organization to identify a security event or incident after it begins. A lower MTTD generally indicates that monitoring and detection capabilities are identifying suspicious activity more quickly. Organizations can improve detection time through centralized logging, SIEM correlation, endpoint telemetry, threat intelligence, automated alerting, and effective security operations procedures. MTTD differs from MTTR, which focuses on the time required to respond to and recover from an incident after detection.

Question 385

Which cloud security practice helps identify publicly exposed storage resources that should not be accessible from the internet?

1. CSPM
2. Tokenization
3. Code signing
4. Disk imaging

Correct Answer: 1

Explanation

Cloud Security Posture Management tools continuously evaluate cloud configurations for security weaknesses and policy violations. CSPM can identify issues such as publicly accessible storage, overly permissive identity policies, exposed management interfaces, missing encryption, and insecure network configurations. Automated findings allow security teams to prioritize remediation based on risk and organizational policy. CSPM is particularly useful because cloud environments can change rapidly through automated deployments. However, organizations should combine automated posture checks with governance, secure configuration standards, continuous monitoring, and appropriate ownership of remediation activities.

Question 386

Which approach provides an alternate processing capability at another geographic location to reduce the effect of a regional disaster?

1. Data masking
2. Geographic redundancy
3. Password rotation
4. Certificate pinning

Correct Answer: 2

Explanation

Geographic redundancy distributes systems, services, or data across separate geographic locations so that a regional outage does not necessarily make all resources unavailable. The alternate location may be designed as an active or standby environment depending on recovery requirements. Geographic redundancy can address risks such as natural disasters, regional infrastructure failures, and certain large-scale service disruptions. Its effectiveness depends on factors including data replication, network connectivity, application dependencies, recovery procedures, and the organization’s RTO and RPO requirements. Regular recovery testing is necessary to validate readiness.

Question 387

A security team discovers that an application has excessive permissions to cloud resources it does not use. What should the team do first?

1. Grant additional permissions
2. Remove unnecessary permissions
3. Disable all cloud logging
4. Share the credentials with administrators

Correct Answer: 2

Explanation

Removing unnecessary permissions applies the principle of least privilege and reduces the potential impact if the application’s credentials or execution environment are compromised. Security teams should identify which resources and actions the application actually requires and eliminate unrelated permissions. Where possible, permissions should be narrowly scoped by resource, action, and environment. Organizations should also review service accounts regularly because application requirements can change over time. Excessive permissions should not be retained simply for convenience, particularly when they provide access to sensitive production resources.

Question 388

Which security mechanism allows a certificate’s validity to be checked without requiring the client to download the entire certificate revocation list?

1. OCSP
2. SAML
3. LDAP
4. RADIUS

Correct Answer: 1

Explanation

The Online Certificate Status Protocol, or OCSP, allows a client to query the status of a digital certificate and determine whether it is valid, revoked, or otherwise unavailable for trusted use. This can avoid downloading a potentially large certificate revocation list. OCSP responses can support more timely certificate-status checking, although availability, privacy, responder reliability, and implementation considerations must be addressed. Organizations may also use OCSP stapling in appropriate environments to reduce direct client communication with certificate-status responders and improve efficiency.

Question 389

Which control helps ensure that sensitive administrative sessions are performed through a monitored intermediary system?

1. Bastion host
2. Data warehouse
3. Load balancer
4. Backup server

Correct Answer: 1

Explanation

A bastion host is a hardened intermediary system designed to provide controlled access to sensitive infrastructure. Administrative users can connect to the bastion and then access protected systems from there, allowing organizations to centralize authentication, logging, monitoring, and access restrictions. Bastion hosts should be hardened, regularly patched, and tightly limited to their intended functions. They can be combined with privileged access management, multifactor authentication, session recording, and network segmentation. The design should minimize services and permissions on the bastion to reduce its own attack surface.

Question 390

Which document identifies how different business services depend on applications, systems, personnel, and external providers?

1. Dependency map
2. Password policy
3. Data retention schedule
4. Certificate inventory

Correct Answer: 1

Explanation

A dependency map identifies relationships between business services and the resources required to operate them. These dependencies can include applications, databases, infrastructure, employees, network services, cloud providers, suppliers, and communication systems. Dependency mapping is important for business continuity and disaster recovery because an organization may restore one system successfully while an unresolved dependency still prevents the business service from operating. Maintaining accurate dependency information helps teams prioritize recovery activities, identify single points of failure, and understand the potential effects of outages or changes.

Question 391

Which security measure helps protect a private cryptographic key used to sign software releases?

1. Public DNS
2. HSM
3. Network load balancing
4. Data compression

Correct Answer: 2

Explanation

A Hardware Security Module, or HSM, provides specialized hardware protection for cryptographic keys and operations. When used for software signing, an HSM can help prevent private signing keys from being directly exposed to ordinary systems or users. The module can perform cryptographic operations while keeping sensitive key material protected within the controlled device. Organizations should also enforce strong administrative controls, authentication, auditing, backup procedures, and key lifecycle management. Protecting signing keys is critical because compromise could allow unauthorized software or updates to appear legitimately signed.

Question 392

Which activity is most appropriate for determining whether an organization’s risk remains within its approved tolerance?

1. Risk monitoring
2. File compression
3. Certificate archiving
4. Network translation

Correct Answer: 1

Explanation

Risk monitoring tracks identified risks and changes in their likelihood, impact, control effectiveness, and overall exposure. Organizations can compare current risk conditions against established risk tolerance or appetite to determine whether additional treatment is required. Monitoring may use key risk indicators, control assessments, vulnerability information, incident trends, and changes in business operations. Risk monitoring should be continuous for significant risks rather than performed only during annual assessments. When risk exceeds approved thresholds, management may need to reduce, transfer, avoid, or formally accept the exposure.

Question 393

Which secure development practice prevents unauthorized developers from directly modifying protected production branches?

1. Branch protection
2. Disk encryption
3. Network segmentation
4. Data retention

Correct Answer: 1

Explanation

Branch protection rules restrict how code can be changed in important source-control branches. Organizations can require pull requests, peer review, automated testing, security checks, and authorized approvals before changes are merged into protected branches. This reduces the possibility that a developer or compromised account can directly introduce unauthorized or untested code into production-bound software. Branch protection is particularly useful when combined with strong identity controls, commit signing, CI/CD security checks, dependency scanning, and audit logging. Administrative exceptions should be controlled and reviewed.

Question 394

Which incident response action is primarily intended to stop an attacker from continuing to access compromised systems?

1. Containment
2. Lessons learned
3. Data classification
4. Asset procurement

Correct Answer: 1

Explanation

Containment limits the attacker’s ability to continue operating within the environment and reduces further damage while investigation proceeds. Actions can include isolating compromised endpoints, blocking malicious network connections, disabling compromised accounts, restricting access to affected resources, or separating impacted network segments. Containment should be carefully planned because aggressive actions may destroy evidence or disrupt critical business services. Security teams should balance the need to stop malicious activity with operational and forensic requirements. After containment, eradication and recovery activities can address the underlying compromise.

Question 395

Which control provides evidence that a software package came from an approved publisher and was not modified after signing?

1. Digital signature
2. Network ACL
3. Tokenization
4. Data masking

Correct Answer: 1

Explanation

A digital signature can provide assurance about software integrity and the identity associated with the signing key. When users or systems verify a valid signature against a trusted public key, they can determine whether the signed artifact was altered after signing and whether it was signed by the expected publisher or authority. Organizations should protect private signing keys carefully and establish procedures for key rotation and revocation. Signature verification should occur before deployment, particularly for software, firmware, packages, and updates obtained from external or distributed sources.

Question 396

Which recovery site typically requires more preparation than a hot site before critical services can be restored?

1. Warm site
2. Active-active site
3. Production cluster
4. Fully operational primary site

Correct Answer: 1

Explanation

A warm site provides some infrastructure and resources for recovery but generally requires additional configuration, data restoration, or application preparation before becoming fully operational. It therefore usually takes longer to activate than a hot site, which is maintained in a more ready state. Warm sites can provide a balance between recovery capability and cost. Organizations should select a recovery-site strategy based on business requirements, including RTO, RPO, criticality, budget, geographic risk, and application dependencies. Recovery procedures should be tested regularly.

Question 397

Which security capability can automatically execute predefined response actions after detecting a confirmed threat?

1. SOAR
2. SAST
3. SBOM
4. DLP

Correct Answer: 1

Explanation

Security Orchestration, Automation, and Response platforms can automate repetitive security operations by connecting multiple security tools and executing predefined playbooks. For example, a SOAR workflow may receive an alert, enrich it with threat intelligence, isolate an endpoint, disable a compromised account, and create an investigation ticket. Automation can reduce response time and improve consistency, but poorly designed playbooks may cause unnecessary disruption. Organizations should carefully define approval requirements, test automation, monitor outcomes, and restrict automated actions according to their potential business impact.

Question 398

Which requirement is most important when preserving digital evidence for possible legal proceedings?

1. Chain of custody
2. Data compression
3. Network balancing
4. Password expiration

Correct Answer: 1

Explanation

Chain of custody documents how digital evidence was collected, handled, transferred, stored, and accessed from the time it was obtained. Accurate records help demonstrate that evidence was protected from unauthorized alteration and that its handling can be accounted for throughout an investigation. Investigators should document relevant timestamps, individuals, systems, acquisition methods, storage locations, and transfers. Evidence should be preserved using appropriate forensic procedures and access controls. Maintaining integrity and traceability is especially important when evidence may later be presented to legal, regulatory, or disciplinary authorities.

Question 399

Which approach allows an organization to continue operating when one critical infrastructure component fails?

1. Fault tolerance
2. Data classification
3. Identity federation
4. Threat intelligence

Correct Answer: 1

Explanation

Fault tolerance allows a system or service to continue operating despite the failure of a component. It can be achieved through redundant hardware, clustered systems, multiple network paths, replicated services, or other architectures designed to eliminate single points of failure. Fault-tolerant designs are particularly important for critical services where downtime could cause significant operational, financial, or safety consequences. Organizations should distinguish fault tolerance from backup and disaster recovery because redundancy can maintain service availability, while backups primarily support restoration after data loss or system failure.

Question 400

Which governance practice ensures that significant security risks have an accountable individual responsible for managing them?

1. Risk ownership assignment
2. Network address translation
3. Password synchronization
4. Log compression

Correct Answer: 1

Explanation

Risk ownership assignment designates an accountable individual or role responsible for managing a particular risk. The risk owner typically evaluates the exposure, coordinates treatment decisions, monitors changes, and ensures that appropriate actions are taken or formally accepted. Assigning ownership prevents important risks from becoming everyone’s responsibility and therefore effectively belonging to no one. Risk owners should have sufficient authority and business knowledge to make or escalate decisions. Ownership should be documented in the risk register and reviewed when organizational responsibilities or risk conditions change.