View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 261

Which control is most appropriate for protecting a highly privileged administrative account from unauthorized use?

1. Data masking
2. Privileged access management
3. Load balancing
4. Network address translation

Correct Answer: 2

Explanation

Privileged access management, or PAM, provides controls for managing accounts with elevated permissions. PAM solutions can enforce stronger authentication, restrict administrative access, record privileged sessions, rotate credentials, and provide temporary access when needed. These capabilities reduce the risk associated with permanently enabled administrator privileges. PAM can also provide accountability by linking administrative actions to individual users rather than shared credentials. Organizations commonly combine PAM with least privilege, multifactor authentication, just-in-time access, and centralized logging to protect highly sensitive administrative operations.

Question 262

A security team wants to ensure a cloud storage bucket cannot be accessed directly from the public internet. Which setting should be reviewed first?

1. Public access configuration
2. Backup compression
3. DNS caching
4. Endpoint isolation

Correct Answer: 1

Explanation

Cloud storage services commonly provide configuration settings that determine whether resources can be accessed publicly. Reviewing public access configuration is therefore an important first step when investigating unintended exposure. Security teams should examine bucket policies, access control lists, identity permissions, and provider-level public access restrictions. A secure configuration should permit only the access required by approved users and applications. Cloud posture management tools can continuously identify publicly exposed resources and configuration drift. Reviewing these settings helps reduce the risk of unauthorized data disclosure through accidentally exposed cloud storage.

Question 263

Which security principle requires access decisions to consider the user’s identity, device, location, and other contextual information?

1. Data sovereignty
2. Static authorization
3. Context-aware access control
4. Media sanitization

Correct Answer: 3

Explanation

Context-aware access control evaluates multiple factors when deciding whether access should be permitted. These factors can include user identity, device security posture, geographic location, network characteristics, time, application, and sensitivity of the requested resource. This approach allows organizations to make more dynamic authorization decisions than simple username-and-password checks. For example, a user may receive normal access from a managed corporate device but face additional verification when attempting access from an unfamiliar device. Context-aware controls are commonly associated with zero trust architectures and adaptive access policies.

Question 264

An organization discovers that a critical vendor requires remote administrative access to internal systems. Which control most directly limits this access to approved periods?

1. Just-in-time access
2. Data classification
3. Static routing
4. Full-disk encryption

Correct Answer: 1

Explanation

Just-in-time access grants privileged permissions only for the period in which they are required. Instead of maintaining continuous administrative access for a vendor, the organization can approve a specific request and automatically remove the privileges after the authorized period ends. This reduces the attack surface associated with standing privileged access. Additional controls can include multifactor authentication, session recording, network restrictions, approval workflows, and detailed logging. Just-in-time access is particularly useful for third-party administrators because vendor credentials remain less exposed when persistent privileged permissions are avoided.

Question 265

Which assessment is specifically intended to determine the potential effects of losing a business function for an extended period?

1. Threat hunting
2. Business impact analysis
3. Code review
4. Certificate validation

Correct Answer: 2

Explanation

A business impact analysis, or BIA, evaluates the consequences of disruptions to important business processes and services. It can identify critical functions, dependencies, financial effects, operational consequences, legal considerations, and acceptable downtime. The results help organizations establish recovery priorities and objectives such as RTO and RPO. A BIA differs from a technical vulnerability assessment because its primary focus is business impact rather than identifying security weaknesses. Organizations use BIA results to design appropriate continuity and disaster recovery strategies based on the importance of affected business functions.

Question 266

Which technology is designed to detect and block malicious web requests before they reach a web application?

1. WAF
2. HSM
3. NAC
4. SIEM

Correct Answer: 1

Explanation

A web application firewall, or WAF, filters HTTP and HTTPS requests directed toward web applications. It can identify and block patterns associated with attacks such as SQL injection, cross-site scripting, malicious input, and certain application-layer exploits. WAF rules can be customized according to application behavior and organizational requirements. A WAF does not replace secure application development, vulnerability management, or endpoint security, but it provides an additional protective layer. It is particularly useful for internet-facing applications that are exposed to continuous automated scanning and exploitation attempts.

Question 267

A company needs to prove that a particular administrator approved a sensitive transaction and cannot credibly deny doing so later. Which security property is most relevant?

1. Availability
2. Confidentiality
3. Nonrepudiation
4. Scalability

Correct Answer: 3

Explanation

Nonrepudiation provides evidence that can help establish the origin or approval of an action so that a participant cannot credibly deny performing it. Digital signatures are a common mechanism for supporting nonrepudiation because they can associate an action with a private cryptographic key controlled by an authorized party. Strong identity management and reliable audit logs can provide additional evidence. Nonrepudiation differs from confidentiality, which protects information from unauthorized disclosure, and availability, which ensures authorized users can access resources when needed.

Question 268

Which security control is most useful for identifying unauthorized changes to important system files?

1. File integrity monitoring
2. Network load balancing
3. Data deduplication
4. Wireless encryption

Correct Answer: 1

Explanation

File integrity monitoring, or FIM, detects changes to files and directories that are considered important to system security. It can establish a known-good baseline and compare later file states against that baseline using hashes, metadata, or other indicators. Unexpected modifications may indicate malware, unauthorized administrative activity, or configuration changes. FIM alerts can help security teams investigate suspicious changes quickly. Organizations should carefully define monitored files and tune alerts to reduce unnecessary notifications from legitimate updates and routine system maintenance.

Question 269

A software team wants to detect vulnerabilities in third-party libraries before an application is deployed. Which process should be implemented?

1. Software composition analysis
2. Network segmentation
3. Security awareness training
4. Database replication

Correct Answer: 1

Explanation

Software composition analysis, or SCA, identifies third-party and open-source components used within applications and evaluates them for known vulnerabilities, licensing concerns, and outdated versions. SCA can help development teams determine whether a dependency introduces a security risk before software reaches production. Organizations can combine SCA with dependency management, software bills of materials, automated patching, and CI/CD security checks. This approach is important because modern applications frequently rely on many external libraries, making manual identification and tracking of every component difficult.

Question 270

Which document provides a structured list of identified risks, their owners, treatment decisions, and current status?

1. Asset inventory
2. Risk register
3. Network diagram
4. Data retention schedule

Correct Answer: 2

Explanation

A risk register provides a structured record of identified organizational risks and relevant information about each risk. Entries may include risk descriptions, affected assets, likelihood, impact, risk owner, treatment strategy, deadlines, status, and residual risk. Maintaining a current risk register helps security and business leaders track unresolved issues and verify that appropriate treatment decisions have been made. It also provides visibility into changes in the organization’s overall risk posture. The risk register should be reviewed periodically as new threats, vulnerabilities, business changes, and control improvements emerge.

Question 271

An organization wants to ensure that security requirements are incorporated into application code before runtime testing begins. Which activity is most appropriate?

1. SAST
2. DDoS mitigation
3. Log archival
4. Physical security testing

Correct Answer: 1

Explanation

Static application security testing, or SAST, analyzes source code or compiled code without executing the application. It can identify coding weaknesses such as insecure input handling, hardcoded credentials, injection risks, and certain authentication problems during development. Integrating SAST into the software development lifecycle allows developers to identify and correct issues earlier, when remediation is generally easier. SAST should be combined with other techniques such as dynamic testing, dependency analysis, code review, and runtime monitoring because no single testing method can identify every type of application security weakness.

Question 272

Which recovery objective defines the maximum acceptable amount of data that may be lost after a disruption?

1. RTO
2. MTTR
3. RPO
4. MTTD

Correct Answer: 3

Explanation

The recovery point objective, or RPO, defines the maximum acceptable amount of data loss measured in time. For example, an RPO of one hour means the organization aims to recover data to a point no more than approximately one hour before the disruption, depending on the implemented recovery architecture. RPO influences backup frequency, replication methods, and recovery design. RTO is different because it defines how quickly a service or process should be restored. Both objectives are normally established according to business requirements and the results of business impact analysis.

Question 273

Which practice helps ensure that cryptographic keys are permanently removed when they are no longer required?

1. Key destruction
2. Packet filtering
3. Data classification
4. Session recording

Correct Answer: 1

Explanation

Key destruction securely removes cryptographic keys when they are no longer needed or when policy requires their retirement. Proper destruction helps prevent former keys from being recovered and misused to decrypt protected information or authenticate unauthorized activity. The exact destruction process depends on the type of key and the storage mechanism, such as hardware security modules, operating system keystores, or cloud key-management services. Organizations should maintain appropriate lifecycle records so that key creation, use, rotation, revocation, archival, and destruction can be controlled and audited.

Question 274

A security architect wants to isolate highly sensitive workloads from general corporate systems while still allowing required communication. Which approach is most appropriate?

1. Open network access
2. Security zoning
3. Shared administrator credentials
4. Flat network design

Correct Answer: 2

Explanation

Security zoning divides an environment into logical or physical areas with different security requirements and access rules. Sensitive workloads can be placed in a restricted zone where communication is explicitly controlled through firewalls, access control lists, proxies, or other enforcement mechanisms. Required business connections can remain available while unnecessary paths are blocked. Security zoning reduces the potential impact of a compromised system and supports defense in depth. The design should reflect trust levels, data sensitivity, business dependencies, and administrative requirements rather than creating arbitrary network boundaries.

Question 275

Which cloud security service primarily protects workloads such as virtual machines and containers from runtime threats?

1. CWPP
2. CASB
3. DLP
4. DNSSEC

Correct Answer: 1

Explanation

A Cloud Workload Protection Platform, or CWPP, focuses on protecting cloud workloads such as virtual machines, containers, and sometimes serverless environments. Capabilities can include vulnerability management, runtime threat detection, malware protection, workload configuration assessment, and behavioral monitoring. A CASB primarily provides security controls between cloud service users and cloud applications, while DLP focuses on preventing inappropriate data disclosure. CWPP is therefore more directly concerned with the security of the workloads themselves and their runtime environments.

Question 276

An organization needs evidence showing that a security control was actually operating effectively during an audit period. What should auditors primarily review?

1. Control effectiveness evidence
2. Marketing documentation
3. Future project plans
4. Unverified assumptions

Correct Answer: 1

Explanation

Control effectiveness evidence demonstrates that a security control was implemented and operated as intended during the relevant assessment period. Examples may include system logs, access review records, configuration reports, vulnerability remediation records, approval documentation, test results, and monitoring reports. Simply having a written policy does not prove that employees or systems followed the required process. Auditors therefore evaluate evidence that supports both control design and operating effectiveness. Reliable evidence should be traceable, appropriately retained, and relevant to the specific control and assessment period.

Question 277

Which approach helps an organization determine whether a security exception should remain approved?

1. Periodic exception review
2. Permanent approval without review
3. Removal of all monitoring
4. Disabling risk documentation

Correct Answer: 1

Explanation

Periodic exception review ensures that approved deviations from security requirements remain justified and appropriately managed. A temporary exception may be necessary because of technical limitations, business dependencies, or implementation constraints, but circumstances can change over time. During review, the organization can determine whether the exception should be renewed, modified, remediated, or closed. The review should consider current risk, compensating controls, business justification, expiration dates, and responsible ownership. Maintaining exceptions indefinitely without reassessment can allow known security weaknesses to become permanent.

Question 278

Which security mechanism can provide a second factor that is resistant to many forms of phishing?

1. Hardware security key
2. Security question
3. Static PIN
4. Shared password

Correct Answer: 1

Explanation

Hardware security keys can provide strong phishing-resistant authentication when implemented using appropriate standards such as FIDO2 or WebAuthn. The authenticator uses cryptographic credentials associated with the legitimate website or service, making it much harder for an attacker to reuse captured credentials on a fraudulent site. Hardware security keys also avoid many weaknesses associated with passwords and security questions. Organizations should still protect account recovery processes because attackers may attempt to bypass strong authentication by targeting weaker recovery mechanisms rather than directly attacking the authentication factor.

Question 279

Which activity should occur before an organization makes a major change to a security-sensitive production architecture?

1. Risk assessment
2. Password sharing
3. Log deletion
4. Disabling monitoring

Correct Answer: 1

Explanation

A risk assessment should be performed before major architectural changes when those changes could affect security, availability, confidentiality, or compliance. The assessment can identify new threats, vulnerabilities, dependencies, attack paths, and control gaps introduced by the proposed design. Security teams can then determine appropriate safeguards before implementation. This process should integrate with formal change management so that proposed changes receive appropriate review and approval. Assessing risk beforehand is preferable to discovering security consequences after deployment, when remediation may be more difficult and disruptive.

Question 280

A company needs to ensure that logs remain available for investigations after attackers attempt to delete logs from compromised systems. Which architecture is most appropriate?

1. Local-only logging
2. Centralized remote logging
3. Manual screenshot collection
4. Disabling audit logs

Correct Answer: 2

Explanation

Centralized remote logging sends security-relevant events from systems to a separate logging infrastructure. This architecture makes it harder for an attacker who compromises an individual host to erase all evidence of their activity because copies of the events can remain on a protected central system. Centralized logs can also support SIEM correlation, incident investigation, alerting, and compliance requirements. Access to the logging infrastructure should be tightly controlled, and organizations should consider integrity protection, retention policies, redundancy, and time synchronization to preserve the usefulness of collected evidence.