View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 1

An organization wants to reduce the risk of sensitive data being exposed when employees use cloud-based applications. Which control is MOST appropriate for identifying and preventing unauthorized transfer of sensitive information?

1. Network address translation
2. Data loss prevention
3. Load balancing
4. Endpoint time synchronization

Correct Answer: 2

Explanation

Data loss prevention (DLP) is designed to identify sensitive information and apply controls that reduce unauthorized disclosure or transfer. DLP solutions can inspect data in motion, at rest, or in use and can enforce policies when protected information is detected. For example, an organization can configure a policy to prevent confidential files from being uploaded to an unauthorized cloud service. NAT, load balancing, and time synchronization serve different infrastructure or operational purposes and do not directly provide the same level of data protection.

Question 2

A security architect is designing a segmented network for an enterprise that processes payment information. Which approach BEST limits unauthorized communication between systems with different security requirements?

1. Network segmentation using security zones
2. Increasing wireless transmission power
3. Disabling system logging
4. Using a common administrator account

Correct Answer: 1

Explanation

Network segmentation separates systems into security zones according to their business function, sensitivity, or trust level. Firewalls, access control lists, and other enforcement mechanisms can then restrict communication between those zones. For a payment-processing environment, segmentation can help isolate systems handling sensitive information from general corporate networks. Increasing wireless power does not improve segmentation, disabling logging removes valuable visibility, and shared administrator accounts weaken accountability. Effective segmentation should be based on documented data flows and business requirements rather than simply dividing networks arbitrarily.

Question 3

A company discovers that an application contains a vulnerability that cannot be patched immediately because the vendor has not released a fix. Which action should the security team take FIRST to reduce exposure?

1. Remove all security monitoring from the application
2. Publish the vulnerability details externally
3. Implement a compensating control
4. Permanently disable every system in the organization

Correct Answer: 3

Explanation

A compensating control provides an alternative safeguard when the preferred remediation, such as patching, cannot be performed immediately. The security team could use additional network restrictions, application-layer filtering, increased monitoring, or access limitations to reduce the vulnerability’s exposure. The exact control depends on the vulnerability and business requirements. Security monitoring should generally be strengthened rather than removed. Public disclosure may create additional risk, and disabling every organizational system is disproportionate. The team should also continue tracking the vendor remediation and reassess the residual risk.

Question 4

Which cloud security model gives an organization the greatest responsibility for configuring operating systems, applications, and security controls within the cloud environment?

1. Software as a Service
2. Infrastructure as a Service
3. Function as a Service
4. Managed database service

Correct Answer: 2

Explanation

Infrastructure as a Service (IaaS) generally gives the customer more responsibility for the configuration and security of virtual machines, operating systems, applications, identities, and network controls than higher-level cloud services. The provider remains responsible for underlying physical infrastructure and other components defined by the service model. SaaS typically places much more operational responsibility on the provider, while managed database services reduce the customer’s responsibility for database infrastructure. Security teams must understand the shared responsibility model because responsibilities vary according to the cloud service being consumed.

Question 5

A security team needs to determine whether an attacker successfully moved from a compromised workstation to a server. Which information source would provide the MOST useful evidence?

1. Historical office floor plans
2. Printer toner levels
3. Network and authentication logs
4. Employee vacation schedules

Correct Answer: 3

Explanation

Network and authentication logs can provide evidence about connections, login attempts, source and destination systems, account usage, and unusual authentication activity. When investigating possible lateral movement, analysts can correlate events from endpoints, servers, firewalls, identity systems, and other security controls to reconstruct attacker activity. Office floor plans, printer status, and vacation schedules generally do not provide direct technical evidence of network movement. Effective investigation also requires synchronized timestamps and sufficient log retention so events from multiple systems can be accurately correlated.

Question 6

An enterprise wants to establish a formal process for identifying, analyzing, prioritizing, and treating cybersecurity risks. Which activity BEST supports this objective?

1. Risk management
2. Password rotation only
3. Hardware inventory disposal
4. User interface testing

Correct Answer: 1

Explanation

Risk management provides a structured process for identifying threats and vulnerabilities, assessing likelihood and impact, prioritizing risks, selecting treatment strategies, and monitoring changes over time. It allows organizations to make security decisions based on business objectives and acceptable levels of risk. Password rotation can address a specific security requirement, while hardware disposal and interface testing address narrower operational concerns. A mature risk-management program also considers risk ownership, residual risk, business impact, regulatory obligations, and the effectiveness of selected controls.

Question 7

A company wants to verify that a newly deployed application meets its security requirements before allowing production use. Which activity should be included in the validation process?

1. Removing all application logs
2. Conducting security testing against defined requirements
3. Granting developers unrestricted production access
4. Disabling authentication temporarily

Correct Answer: 2

Explanation

Security testing should verify that the application satisfies established security requirements before production deployment. Depending on the application’s risk profile, testing can include vulnerability assessments, code analysis, authentication and authorization testing, input validation testing, and penetration testing. The results should be compared against acceptance criteria and documented requirements. Removing logs, granting unrestricted access, or disabling authentication weakens security rather than validating it. Security validation should occur throughout the development lifecycle so significant weaknesses can be identified and addressed before they become production risks.

Question 8

An organization uses zero trust principles for internal applications. Which statement BEST describes a core characteristic of this approach?

1. Internal users are automatically trusted
2. Network location alone determines access
3. All traffic is permanently blocked
4. Access is continuously evaluated based on identity and context

Correct Answer: 4

Explanation

Zero trust assumes that network location by itself does not establish trust. Access decisions can consider identity, device security posture, application, resource sensitivity, location, behavior, and other contextual information. Authentication and authorization are continuously enforced rather than assuming that an authenticated user is trustworthy for every resource. This approach helps reduce the impact of compromised credentials and lateral movement. Zero trust does not mean that every connection is permanently blocked; instead, it applies explicit and appropriately scoped access policies.

Question 9

A security analyst receives thousands of alerts from multiple security products and wants to correlate related events into a single investigation. Which technology is MOST appropriate?

1. SIEM
2. UPS
3. RAID
4. DHCP

Correct Answer: 1

Explanation

A security information and event management (SIEM) platform collects and correlates security events from multiple sources. By applying rules, analytics, and contextual information, a SIEM can group related events and help analysts identify suspicious activity across endpoints, networks, applications, and identity systems. This reduces the need to investigate every alert independently. A UPS provides power protection, RAID provides storage redundancy, and DHCP assigns network configuration information. SIEM capabilities are particularly valuable in large environments where centralized visibility and event correlation are required.

Question 10

A company needs to protect an encryption key so that administrators cannot easily export or directly access the underlying key material. Which technology is MOST suitable?

1. Plaintext configuration file
2. Hardware security module
3. Shared network folder
4. Spreadsheet

Correct Answer: 2

Explanation

A hardware security module (HSM) is designed to securely generate, store, and use cryptographic keys while protecting key material from unauthorized access. HSMs can perform cryptographic operations within a controlled hardware boundary and provide security mechanisms such as access controls, auditing, and tamper resistance. Storing keys in plaintext configuration files or spreadsheets creates significant exposure, while a shared network folder does not inherently provide specialized cryptographic key protection. Organizations often use HSMs when protecting high-value keys for encryption, digital signatures, certificates, or other sensitive cryptographic operations.

Question 11

During a business impact analysis, an application is determined to support a critical business process. Which metric identifies the maximum acceptable period for restoring the application after a disruption?

1. Recovery point objective
2. Mean time between failures
3. Recovery time objective
4. Maximum transmission unit

Correct Answer: 3

Explanation

The recovery time objective (RTO) defines the targeted maximum amount of time an application or service can remain unavailable following a disruption. It helps organizations design recovery strategies that meet business requirements. The recovery point objective (RPO), by contrast, focuses on the acceptable amount of data loss measured in time. Mean time between failures concerns system reliability, while maximum transmission unit relates to network packet size. RTO requirements influence decisions about redundancy, backup systems, alternate processing locations, recovery automation, and the resources needed to restore critical services.

Question 12

An organization wants to ensure that a user can access only the applications required for the user’s assigned job duties. Which principle should the security architect apply?

1. Least privilege
2. Open authorization
3. Implicit trust
4. Shared accountability

Correct Answer: 1

Explanation

The principle of least privilege requires users, applications, and systems to receive only the permissions necessary to perform their authorized functions. Applying least privilege reduces the potential impact of compromised accounts and limits accidental or intentional misuse of resources. Permissions should be reviewed periodically and removed when they are no longer needed. Open authorization and implicit trust can create excessive access, while shared accountability does not specifically define an access-control strategy. Role-based access control can help implement least privilege by aligning permissions with documented job responsibilities.

Question 13

A company is planning to acquire a smaller organization. The security team wants to identify inherited vulnerabilities and compliance concerns before systems are integrated. What should the team perform?

1. Capacity planning only
2. Security due diligence
3. User interface redesign
4. Routine password reset

Correct Answer: 2

Explanation

Security due diligence helps an organization evaluate the cybersecurity posture, risks, controls, obligations, and weaknesses of another organization before an acquisition or major integration. The assessment can include vulnerabilities, security architecture, incident history, regulatory requirements, identity systems, third-party dependencies, and outstanding remediation activities. The results help decision-makers understand risks that may be inherited during integration. Capacity planning, interface redesign, and password resets can have operational value but do not provide the comprehensive risk assessment needed before combining organizational environments.

Question 14

An organization wants to prevent a compromised endpoint from communicating with known malicious infrastructure. Which security control can directly enforce this restriction at the network boundary?

1. Firewall
2. File compression utility
3. Backup scheduler
4. Asset labeling system

Correct Answer: 1

Explanation

A firewall can enforce network communication policies based on characteristics such as source and destination addresses, ports, protocols, applications, and other available attributes. When configured appropriately, it can block communication between internal systems and known malicious infrastructure. Modern firewalls may also integrate threat intelligence and application-aware inspection. File compression, backup scheduling, and asset labeling do not directly control network traffic. Firewall rules should be carefully managed because overly broad blocking can disrupt legitimate business communications while insufficiently restrictive rules may leave malicious paths available.

Question 15

A security team wants to determine whether a vulnerability poses significant business risk rather than simply counting the number of vulnerabilities. Which factors should be considered?

1. Screen resolution and monitor size
2. Asset criticality, exploitability, and business impact
3. Number of installed printers only
4. Employee job titles without system context

Correct Answer: 2

Explanation

Vulnerability prioritization should consider more than vulnerability counts. Factors such as asset criticality, exploitability, exposure, available compensating controls, data sensitivity, and potential business impact help determine which vulnerabilities require urgent remediation. A vulnerability affecting a critical internet-facing system may require faster action than a similar issue on an isolated noncritical asset. Screen resolution, printer counts, and job titles without system context do not adequately represent cybersecurity risk. Risk-based prioritization helps security teams direct limited remediation resources toward issues with greater potential consequences.

Question 16

A company wants to ensure that security requirements are considered from the earliest stages of software development. Which practice BEST supports this goal?

1. Waiting until production to conduct all security testing
2. Removing security requirements from project documentation
3. Integrating security activities throughout the development lifecycle
4. Giving security responsibilities exclusively to end users

Correct Answer: 3

Explanation

Integrating security throughout the software development lifecycle helps identify and address security requirements before weaknesses become expensive or difficult to remediate. Security activities can include threat modeling, secure design reviews, code analysis, dependency assessment, testing, and remediation validation. Waiting until production may allow vulnerabilities to persist through multiple development stages. Removing security requirements or shifting responsibility entirely to end users does not establish effective application security governance. A lifecycle-based approach also helps development and security teams share responsibility for reducing application risk.

Question 17

An organization has experienced repeated security incidents caused by employees clicking malicious links. Which control would MOST directly address the human behavior involved?

1. Additional disk storage
2. Security awareness training
3. Increased processor speed
4. Database normalization

Correct Answer: 2

Explanation

Security awareness training can help employees recognize phishing messages, suspicious links, social engineering techniques, and other common attack methods. Effective programs should be reinforced through periodic training, realistic simulations where appropriate, clear reporting procedures, and feedback. Training alone should not be considered a complete security solution because technical controls such as email filtering, URL protection, multifactor authentication, and endpoint defenses can provide additional layers of protection. However, when the recurring problem involves unsafe user behavior, awareness training directly addresses the human component of the risk.

Question 18

A security architect must protect data while it is being transmitted between two trusted enterprise locations over an untrusted network. Which solution provides confidentiality and integrity for the communication?

1. Unencrypted HTTP
2. Plain FTP
3. VPN using strong cryptography
4. Anonymous file sharing

Correct Answer: 3

Explanation

A virtual private network (VPN) using strong cryptographic protocols can protect data transmitted across an untrusted network by providing confidentiality and integrity protections. Depending on the implementation, authentication can also verify the endpoints participating in the communication. Plain HTTP, FTP, and anonymous file sharing do not inherently provide the same level of secure transport protection. The selected VPN technology should use current cryptographic algorithms and secure authentication methods, and its configuration should be reviewed periodically to ensure that deprecated protocols or weak algorithms are not enabled.

Question 19

An enterprise wants to determine whether its security controls continue to operate effectively after major infrastructure changes. Which activity provides the MOST appropriate assurance?

1. Security control assessment
2. Changing all usernames
3. Increasing screen brightness
4. Removing system documentation

Correct Answer: 1

Explanation

A security control assessment evaluates whether security controls are appropriately designed, implemented, and operating as intended. After major infrastructure changes, reassessment can identify controls that were weakened, bypassed, misconfigured, or made ineffective by the changes. The assessment may include configuration reviews, testing, interviews, technical validation, and evidence examination. Changing usernames or screen brightness does not provide meaningful assurance about security-control effectiveness, while removing documentation makes validation more difficult. Assessments should be performed according to organizational risk, regulatory requirements, and significant changes to the environment.

Question 20

A company wants to maintain security visibility if its primary monitoring platform becomes unavailable. Which architecture BEST supports this requirement?

1. A single centralized monitoring server with no redundancy
2. Redundant monitoring infrastructure and alternate data collection paths
3. Disabling logs during maintenance
4. Storing all security events on one workstation

Correct Answer: 2

Explanation

Redundant monitoring infrastructure and alternate data collection paths improve resilience when a primary monitoring component becomes unavailable. Organizations can use redundant collectors, geographically separated infrastructure, resilient storage, failover mechanisms, and appropriate buffering to reduce the chance of losing important security events. A single monitoring server or workstation creates a single point of failure, while disabling logs during maintenance creates visibility gaps. The architecture should also define how events are retained during outages and how quickly monitoring services must be restored according to business and security requirements.