View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 221

Which security control can detect and block suspicious traffic based on known attack patterns?

1. IPS
2. RAID
3. HSM
4. DHCP

Correct Answer: 1

Explanation

An intrusion prevention system, or IPS, monitors network traffic and can detect and block malicious or suspicious activity based on signatures, behavioral patterns, protocol analysis, or other detection methods. Unlike passive monitoring systems, an IPS can actively prevent certain attacks by dropping traffic or terminating connections. RAID provides storage redundancy, HSMs protect cryptographic keys, and DHCP provides network configuration information. IPS technology should be properly tuned because overly broad rules can block legitimate traffic, while poorly configured rules may fail to detect relevant threats.

Question 222

What is the primary purpose of a risk tolerance statement?

1. Define acceptable variation around organizational risk objectives
2. Identify every hardware component
3. Replace incident response procedures
4. Encrypt sensitive databases

Correct Answer: 1

Explanation

Risk tolerance describes the acceptable level of variation around an organization’s risk appetite or specific risk objectives. It provides more practical boundaries for determining when a risk requires escalation or additional treatment. Hardware inventories identify physical resources, incident response procedures guide actions during security events, and database encryption protects stored information. Risk tolerance can help managers make consistent decisions because it establishes thresholds for acceptable exposure. It should be aligned with business objectives, regulatory requirements, and the organization’s overall risk management framework.

Question 223

Which mechanism allows an organization to verify that a user possesses a registered physical authentication device?

1. Hardware security key
2. Data classification
3. Network segmentation
4. File integrity monitoring

Correct Answer: 1

Explanation

A hardware security key is a physical authentication device that can provide strong possession-based authentication. Modern hardware keys can support standards such as FIDO-based authentication and can help protect accounts against credential phishing because authentication depends on the registered device and cryptographic operations. Data classification categorizes information, network segmentation separates systems, and file integrity monitoring detects unauthorized changes to files. Hardware security keys are especially useful for protecting privileged, administrative, and other high-value accounts when strong phishing-resistant authentication is required.

Question 224

A security analyst needs to determine whether a suspicious executable has been modified since its original release. Which method is most appropriate?

1. Compare cryptographic hashes
2. Review screen resolution
3. Check network bandwidth
4. Examine disk capacity

Correct Answer: 1

Explanation

Cryptographic hash comparison can help determine whether a file has changed. If a trusted hash value is available from the legitimate software publisher or another trusted source, the analyst can calculate the hash of the suspicious executable and compare the results. A matching value provides evidence that the file contents are unchanged, assuming an appropriate cryptographic algorithm and trustworthy reference value. Screen resolution, network bandwidth, and disk capacity do not provide meaningful evidence about file integrity. Hash comparison is widely used in malware analysis, software verification, and forensic investigations.

Question 225

Which security principle requires an application to request only the permissions necessary for its function?

1. Least privilege
2. Maximum availability
3. Open access
4. Risk transfer

Correct Answer: 1

Explanation

Least privilege applies not only to human users but also to applications, services, and automated processes. An application should receive only the permissions required to perform its intended functions. Limiting application privileges reduces the potential impact of exploited vulnerabilities because an attacker who compromises the application inherits fewer permissions. Maximum availability focuses on service continuity, open access increases permissions rather than restricting them, and risk transfer shifts certain consequences to another party. Application-level least privilege is particularly important for cloud workloads, APIs, containers, and service accounts.

Question 226

Which technology can inspect encrypted web traffic for security purposes when organizational policy and appropriate key management permit inspection?

1. TLS inspection proxy
2. DHCP relay
3. RAID controller
4. DNS cache

Correct Answer: 1

Explanation

A TLS inspection proxy can terminate an encrypted connection, inspect the traffic according to organizational policy, and establish a separate encrypted connection to the destination. This allows security controls to examine otherwise encrypted traffic for malicious content, policy violations, or data leakage. Such inspection requires careful certificate management and consideration of privacy, legal, performance, and application compatibility requirements. DHCP relays forward DHCP messages, RAID provides storage redundancy, and DNS caches store name-resolution information. TLS inspection should be selectively applied because not all encrypted traffic should necessarily be decrypted and inspected.

Question 227

An organization discovers that an employee’s role has changed but the employee retains permissions from the previous position. What process should address this issue?

1. Identity lifecycle management
2. Data compression
3. Network load balancing
4. Certificate pinning

Correct Answer: 1

Explanation

Identity lifecycle management governs access from account creation through changes, suspension, and eventual removal. When an employee changes roles, permissions should be reviewed and adjusted so access reflects the new responsibilities. Retaining old permissions can create privilege accumulation and violate least-privilege requirements. Data compression reduces information size, load balancing distributes traffic, and certificate pinning controls trusted certificates or public keys. Effective identity lifecycle management should integrate with human resources and business processes so role changes are communicated promptly to identity administrators or automated identity systems.

Question 228

Which control can identify sensitive information leaving an organization through email or endpoint activity?

1. DLP
2. NTP
3. RAID
4. NAT

Correct Answer: 1

Explanation

Data loss prevention, or DLP, can inspect information moving through channels such as email, endpoints, cloud services, web applications, and network connections. Policies can identify sensitive information using classifications, patterns, keywords, fingerprints, or other detection methods. Depending on policy, DLP may block, quarantine, encrypt, or alert on attempted data transfers. NTP synchronizes clocks, RAID provides storage redundancy, and NAT translates network addresses. DLP should be carefully tuned to reduce false positives and should be aligned with the organization’s data classification and approved information-sharing requirements.

Question 229

Which type of evidence is most likely to disappear when a compromised system is powered off?

1. Volatile memory data
2. Archived database records
3. Printed reports
4. Offline backups

Correct Answer: 1

Explanation

Volatile memory data can be lost when a system is powered down or restarted. Memory may contain running processes, active network connections, temporary credentials, encryption keys, malicious code, and other information that may not be recoverable from persistent storage. Archived records, printed reports, and offline backups are generally more persistent. Forensic investigators should consider volatility when determining evidence-collection priorities. Collection procedures should be carefully planned and documented because interacting with a live system can also alter evidence. Proper chain-of-custody practices should be maintained throughout the process.

Question 230

A company wants to verify that a supplier follows required security practices throughout the contract period. Which activity is most appropriate?

1. Ongoing vendor monitoring
2. One-time password reset
3. Employee job rotation
4. Disk formatting

Correct Answer: 1

Explanation

Ongoing vendor monitoring evaluates whether a supplier continues to meet security requirements throughout the business relationship rather than relying only on an initial assessment. Monitoring may include reviewing security reports, compliance evidence, incident notifications, vulnerability information, audit results, or contractual performance. A one-time password reset does not assess supplier security, job rotation changes personnel responsibilities, and disk formatting removes stored data. Continuous supplier oversight is important because a vendor’s technology, personnel, infrastructure, and threat exposure can change significantly after the original contract assessment.

Question 231

Which security architecture approach assumes that every access request should be evaluated based on current context?

1. Zero trust
2. Flat trust
3. Permanent authorization
4. Open networking

Correct Answer: 1

Explanation

Zero trust treats each access request as requiring verification rather than assuming that a user or device is trustworthy because it is inside a particular network. Decisions can consider identity, device posture, resource sensitivity, location, behavior, authentication strength, and other contextual information. Flat trust and permanent authorization create broader assumptions about access, while open networking reduces restrictions between systems. Zero trust is typically implemented through identity-centric controls, least privilege, segmentation, continuous monitoring, and policy enforcement. The objective is to limit unnecessary access and reduce the impact of compromised credentials or devices.

Question 232

Which control provides an additional authentication factor based on something the user physically possesses?

1. Hardware token
2. Security question
3. Password
4. PIN

Correct Answer: 1

Explanation

A hardware token is an authentication factor based on something the user possesses. Depending on the technology, it may generate one-time passwords or perform cryptographic authentication. Passwords and PINs are generally knowledge factors because they are something the user knows, while security questions are also knowledge-based. Multifactor authentication becomes stronger when different factor categories are combined, such as a password with a hardware token or biometric factor. Hardware-based authentication can provide stronger protection against credential theft, particularly when using phishing-resistant technologies designed around public key cryptography.

Question 233

Which document should identify critical business processes and their dependencies before recovery priorities are established?

1. Business impact analysis
2. Password policy
3. Certificate inventory
4. Patch schedule

Correct Answer: 1

Explanation

A business impact analysis identifies critical business processes, their dependencies, and the consequences of disruption. It helps organizations determine which functions require priority during recovery and what level of disruption the business can tolerate. This information supports decisions about recovery objectives, alternate facilities, staffing, technology requirements, and communication needs. A password policy governs authentication requirements, a certificate inventory tracks digital certificates, and a patch schedule organizes software updates. BIA results provide an important foundation for continuity planning because recovery priorities should reflect business impact rather than technical convenience alone.

Question 234

Which control can identify unauthorized changes to critical configuration files by comparing them with a known baseline?

1. File integrity monitoring
2. Network address translation
3. Data masking
4. Load balancing

Correct Answer: 1

Explanation

File integrity monitoring compares current files or configuration objects against known trusted states and generates alerts when unexpected changes occur. This can help detect unauthorized modifications caused by malware, compromised accounts, malicious insiders, or accidental administrative activity. Network address translation changes IP addressing, data masking protects sensitive information in nonproduction environments, and load balancing distributes traffic. FIM is particularly useful for critical servers and security-sensitive configurations. Organizations should define which files require monitoring, establish trusted baselines, investigate alerts, and periodically review monitoring coverage.

Question 235

A development team wants to detect insecure coding practices before source code reaches production. Which security test is most appropriate?

1. SAST
2. Disaster recovery testing
3. Physical security assessment
4. Network availability testing

Correct Answer: 1

Explanation

Static application security testing, or SAST, analyzes source code or compiled representations without executing the application to identify potential security weaknesses. It can detect patterns associated with issues such as insecure input handling, hardcoded secrets, unsafe functions, and certain coding errors. Disaster recovery testing evaluates recovery capabilities, physical security assessments examine facility protections, and network availability testing focuses on service continuity. SAST is most effective when integrated early into the software development lifecycle, allowing developers to identify and correct weaknesses before applications are deployed.

Question 236

Which control helps ensure that security-relevant system events have consistent timestamps across multiple devices?

1. NTP
2. DLP
3. WAF
4. RAID

Correct Answer: 1

Explanation

Network Time Protocol, or NTP, synchronizes system clocks with trusted time sources. Consistent timestamps are important for security monitoring, event correlation, incident investigation, and forensic analysis because analysts need to understand the sequence of activities across different systems. DLP protects sensitive information, WAF protects web applications, and RAID provides storage redundancy. Organizations should use trusted and appropriately secured time sources because inaccurate or manipulated timestamps can complicate investigations and reduce confidence in security event timelines. Accurate time synchronization is therefore an important supporting control for centralized logging and monitoring.

Question 237

Which approach can reduce the exposure created when sensitive data is stored in multiple systems by replacing the original value with a non-sensitive substitute?

1. Tokenization
2. Network bridging
3. Port forwarding
4. Log rotation

Correct Answer: 1

Explanation

Tokenization replaces sensitive information with a substitute value called a token. The original data is stored separately in a protected system, while applications can use the token for many operational purposes without repeatedly handling the original sensitive value. This can reduce the exposure of information such as payment data and may help simplify protection requirements for systems that do not need the original value. Network bridging and port forwarding concern connectivity, while log rotation manages log storage. Tokenization requires strong protection of the system that maintains the relationship between tokens and original values.

Question 238

Which incident response phase focuses on removing malware and attacker persistence after the affected systems have been contained?

1. Eradication
2. Preparation
3. Detection
4. Identification

Correct Answer: 1

Explanation

Eradication focuses on removing the cause of an incident, such as malware, malicious accounts, persistence mechanisms, or compromised components, after the immediate threat has been contained. Preparation occurs before incidents and establishes capabilities, procedures, and resources. Detection and analysis identify and understand suspicious activity. Eradication should be performed carefully so the attacker cannot regain access after containment. Security teams may need to rebuild systems, remove malicious artifacts, reset compromised credentials, patch exploited vulnerabilities, and verify that persistence mechanisms have been eliminated before restoring normal operations.

Question 239

Which security capability can automatically execute predefined workflows when a high-confidence alert is generated?

1. SOAR
2. BIOS
3. RAID
4. DHCP

Correct Answer: 1

Explanation

Security orchestration, automation, and response, or SOAR, can execute predefined workflows in response to security alerts. For example, a workflow may enrich an alert with threat intelligence, create an incident ticket, notify an analyst, disable a compromised account, or isolate an endpoint according to approved conditions. BIOS initializes system hardware, RAID provides storage redundancy, and DHCP assigns network configuration information. Automation can reduce response times and repetitive manual work, but organizations should carefully define approval requirements and safeguards to prevent automated actions from causing unnecessary disruption.

Question 240

Which practice ensures that forensic evidence can be traced from collection through analysis and storage?

1. Chain of custody
2. Data minimization
3. Network segmentation
4. Password rotation

Correct Answer: 1

Explanation

Chain of custody documents the handling of evidence from the moment it is collected through transfer, storage, examination, and final disposition. Records should identify who handled the evidence, when it was transferred, where it was stored, and what actions were performed. This helps demonstrate that evidence was properly controlled and was not improperly altered or substituted. Data minimization limits unnecessary information collection, network segmentation separates systems, and password rotation changes credentials. Maintaining accurate chain-of-custody records is especially important when forensic findings may need to support formal investigations or legal proceedings.