View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 281

Which control is most effective for limiting access to a sensitive database to only authorized application servers?

1. Network access control list
2. Data masking
3. Security awareness training
4. Backup replication

Correct Answer: 1

Explanation

A network access control list can restrict which source systems are permitted to communicate with a sensitive database. By allowing connections only from approved application servers and required administrative systems, the organization reduces unnecessary network exposure. Additional controls such as database authentication, encryption, and least privilege should also be implemented. Network restrictions provide an important defense-in-depth layer because even if an attacker compromises another internal system, that system may be unable to establish a connection to the protected database.

Question 282

An organization discovers that employees can access applications immediately after their accounts are created, even when managers have not approved the requested permissions. Which process should be improved?

1. Log retention
2. Identity access approval
3. Backup validation
4. Network monitoring

Correct Answer: 2

Explanation

Identity access approval ensures that requested permissions are reviewed and authorized before users receive access to protected resources. Without an approval process, users may receive excessive or inappropriate privileges simply because their accounts were automatically provisioned. Access requests should be evaluated according to job responsibilities, resource sensitivity, and least-privilege requirements. Organizations can automate approval workflows while maintaining managerial or resource-owner authorization. Periodic access reviews should also verify that previously approved permissions remain appropriate as employees change roles or responsibilities.

Question 283

Which technology can detect suspicious activity by establishing a baseline of normal user behavior?

1. Firewall
2. Certificate authority
3. UEBA
4. Backup server

Correct Answer: 3

Explanation

User and Entity Behavior Analytics, or UEBA, establishes behavioral patterns for users and entities and identifies activity that deviates from expected behavior. Examples include unusual login locations, abnormal access times, unexpected data downloads, or atypical administrative activity. UEBA can correlate multiple behavioral indicators rather than relying on a single predefined signature. Analysts can then investigate whether an anomaly represents legitimate activity, compromised credentials, insider misuse, or another security event. UEBA is particularly useful when attackers use valid credentials and traditional signature-based controls may not immediately detect their actions.

Question 284

A security team wants to verify that a server’s system files match their approved baseline after a suspected compromise. Which method should be used?

1. File integrity comparison
2. Load balancing
3. Data compression
4. Network translation

Correct Answer: 1

Explanation

File integrity comparison can determine whether important system files have changed from a known-good baseline. Cryptographic hashes can be generated for approved files and compared with hashes calculated after a suspected compromise. Unexpected differences can indicate unauthorized modification, malware, or configuration changes. Investigators should consider legitimate updates before concluding that a modification is malicious. File integrity monitoring can automate this process by continuously watching selected files and generating alerts when changes occur. This provides useful evidence during incident investigation and ongoing security monitoring.

Question 285

Which principle requires an organization to collect only the personal information necessary for a defined business purpose?

1. Data minimization
2. Nonrepudiation
3. Fault tolerance
4. Network segmentation

Correct Answer: 1

Explanation

Data minimization means collecting, processing, and retaining only the information necessary for a legitimate and defined purpose. Reducing unnecessary personal information lowers the amount of sensitive data that could be exposed during a breach or misused by unauthorized parties. Organizations should identify the purpose of collection, determine which data elements are genuinely required, and establish appropriate retention periods. Data minimization can also reduce storage, management, and compliance burdens. It should be considered during system design rather than only after excessive data has already been collected.

Question 286

A company wants to prevent compromised endpoints from communicating with other internal systems. Which architectural strategy is most appropriate?

1. Centralized backups
2. Network segmentation
3. Data classification
4. Certificate renewal

Correct Answer: 2

Explanation

Network segmentation separates systems into controlled security zones and restricts communication between them. If an endpoint becomes compromised, segmentation can prevent or limit lateral movement toward servers, databases, and other sensitive resources. Firewalls, VLANs, access control lists, and microsegmentation technologies can enforce these boundaries. Segmentation should be based on trust levels, business requirements, and data sensitivity. It does not eliminate the need for endpoint protection, but it provides another defensive layer that can significantly reduce the potential impact of a successful endpoint compromise.

Question 287

Which recovery metric identifies the maximum acceptable time required to restore a business service?

1. RPO
2. MTTD
3. RTO
4. MTBF

Correct Answer: 3

Explanation

The recovery time objective, or RTO, defines the targeted maximum amount of time within which a business service or process should be restored after a disruption. RTO requirements influence recovery architecture, staffing, alternate facilities, redundancy, and restoration procedures. A highly critical service may require a very short RTO, while a less important process may tolerate a longer outage. RPO addresses acceptable data loss rather than restoration time. Organizations normally establish both RTO and RPO based on business impact analysis and operational requirements.

Question 288

Which mechanism provides centralized correlation of security events collected from multiple systems?

1. SIEM
2. DLP
3. HSM
4. MDM

Correct Answer: 1

Explanation

A security information and event management system, or SIEM, collects and correlates security events from multiple sources such as servers, endpoints, firewalls, identity systems, applications, and cloud platforms. Correlation can reveal relationships that would be difficult to identify when reviewing individual logs separately. SIEM platforms can generate alerts, support investigations, maintain searchable event records, and provide reporting capabilities. Effective SIEM deployment depends on appropriate log sources, accurate time synchronization, sufficient retention, and properly tuned detection rules to reduce excessive false positives.

Question 289

An organization wants to ensure that a vendor cannot access production systems using a permanent administrator account. Which control is most appropriate?

1. Data encryption
2. Temporary privileged access
3. File compression
4. Static routing

Correct Answer: 2

Explanation

Temporary privileged access provides elevated permissions only for an approved period or specific administrative task. This approach reduces the risk associated with permanent vendor administrator accounts and limits the time during which compromised credentials could be abused. Organizations can require approval, multifactor authentication, session monitoring, and automatic expiration of the assigned privileges. Just-in-time access is a common implementation of this principle. Vendor access should also be restricted to necessary systems and reviewed periodically to ensure that permissions remain appropriate.

Question 290

Which activity helps determine whether an organization’s security controls continue to meet established requirements?

1. Control validation
2. Password reuse
3. Asset deletion
4. Network expansion

Correct Answer: 1

Explanation

Control validation determines whether security controls are properly designed, implemented, and operating as intended. Validation activities can include testing, configuration reviews, technical assessments, log analysis, interviews, and simulated attacks. The goal is to provide evidence that controls actually address their intended security objectives rather than simply existing on paper. Organizations should validate important controls periodically and after significant changes. Findings can identify gaps, ineffective configurations, or unexpected weaknesses that require remediation or additional risk treatment.

Question 291

Which technology can enforce security policies on mobile devices managed by an organization?

1. MDM
2. DNSSEC
3. WAF
4. HSM

Correct Answer: 1

Explanation

Mobile device management, or MDM, allows organizations to centrally manage and enforce security policies on smartphones, tablets, and other supported mobile devices. MDM capabilities can include device enrollment, configuration enforcement, encryption requirements, application restrictions, remote lock or wipe, certificate deployment, and compliance monitoring. Organizations can use these controls to reduce risks associated with lost devices, unauthorized applications, and insecure configurations. MDM should be integrated with identity and access policies so that devices that fail security requirements can have access restricted until compliance is restored.

Question 292

A security analyst needs to preserve the original state of a disk for forensic examination. Which practice is most appropriate?

1. Editing files directly
2. Creating a forensic image
3. Reinstalling the operating system
4. Clearing temporary files

Correct Answer: 2

Explanation

Creating a forensic image provides a bit-for-bit copy of storage media that can be examined without modifying the original evidence. Investigators should use appropriate forensic tools and maintain documentation showing how the evidence was acquired and handled. Hashes can be calculated to verify that the acquired image remains unchanged. Working from a forensic copy helps preserve the original media and supports repeatable analysis. Proper evidence handling is important because careless modification of the original source can affect the reliability and admissibility of forensic findings.

Question 293

Which security practice reduces the risk of attackers exploiting known vulnerabilities in unsupported software?

1. Removing unsupported software
2. Increasing password length only
3. Disabling centralized logging
4. Expanding network access

Correct Answer: 1

Explanation

Unsupported software no longer receives normal security updates or vendor assistance, which increases the risk that known vulnerabilities will remain unpatched. Removing unsupported software and replacing it with a supported alternative is generally the most direct way to eliminate this exposure. When immediate replacement is impossible, organizations may use compensating controls such as network isolation, application allowlisting, restricted access, and enhanced monitoring. However, these measures should not become a permanent substitute for modernization when the unsupported platform presents significant security or operational risk.

Question 294

Which control can prevent users from executing applications that have not been explicitly approved?

1. Application allowlisting
2. Data masking
3. Network address translation
4. Backup replication

Correct Answer: 1

Explanation

Application allowlisting permits execution only for software that has been explicitly approved according to organizational policy. This can prevent unauthorized or malicious programs from running even when they reach an endpoint through phishing, removable media, downloads, or other attack paths. Allowlisting policies should be carefully managed because overly restrictive rules can interfere with legitimate business applications. Organizations should establish trusted publishers, application hashes, paths, or other appropriate criteria. Allowlisting is particularly useful for high-value systems where controlling executable software is an important security requirement.

Question 295

Which activity is most useful for identifying weaknesses introduced by a newly deployed firewall rule?

1. Security validation testing
2. Data archival
3. Password rotation
4. User provisioning

Correct Answer: 1

Explanation

Security validation testing can determine whether a newly deployed firewall rule produces the intended security result without introducing unexpected exposure. Testing may verify permitted and denied connections, inspect traffic paths, review logs, and attempt unauthorized communication from relevant network locations. Change management should document the expected behavior before implementation so that results can be compared against approved requirements. Testing after deployment helps identify mistakes such as overly broad rules, unintended access paths, or blocked business services that were not anticipated during design.

Question 296

A company wants to ensure that employees cannot access confidential files unless their job responsibilities require it. Which principle should guide the access model?

1. Least privilege
2. High availability
3. Data replication
4. Open access

Correct Answer: 1

Explanation

Least privilege requires users and systems to receive only the permissions necessary to perform their authorized responsibilities. Applying this principle to confidential files means access should be based on legitimate business requirements rather than broad organizational membership. Role-based access control, attribute-based policies, and periodic access reviews can help enforce least privilege. Permissions should also be removed when no longer required. Limiting access reduces the likelihood that compromised accounts, insider misuse, or accidental actions will expose sensitive information.

Question 297

Which capability allows security teams to automate repetitive incident-response actions after receiving a validated alert?

1. SOAR
2. RAID
3. NAT
4. DHCP

Correct Answer: 1

Explanation

Security orchestration, automation, and response, or SOAR, can automate predefined security workflows after alerts or incidents are identified. A SOAR platform may enrich indicators, query threat intelligence, disable compromised accounts, isolate endpoints, create tickets, or notify analysts according to approved playbooks. Automation can reduce response time and repetitive manual work, but high-impact actions should use appropriate approvals or safeguards to avoid causing unnecessary disruption. Effective SOAR deployment requires well-defined workflows, reliable integrations, and carefully tested automation logic.

Question 298

An organization wants to identify whether a software artifact came from its approved build pipeline. Which security capability is most relevant?

1. Software provenance
2. Data masking
3. Network translation
4. Wireless isolation

Correct Answer: 1

Explanation

Software provenance provides information about where a software artifact originated and how it was produced. Provenance records can identify the source repository, build process, dependencies, signing process, and other information needed to establish trust in the artifact’s origin. Organizations can combine provenance with digital signatures, secure build pipelines, access controls, and software bills of materials. This helps detect unauthorized or tampered artifacts before they are deployed. Provenance is especially valuable in modern software supply chains where applications may incorporate numerous external dependencies and automated build processes.

Question 299

Which disaster recovery design provides a secondary environment that is partially prepared but may require additional configuration before production use?

1. Hot site
2. Warm site
3. Cold site
4. Offline archive

Correct Answer: 2

Explanation

A warm site is a partially prepared recovery environment that contains some infrastructure and resources needed to resume operations but may require additional configuration, data restoration, or equipment preparation. It generally provides a balance between the rapid recovery capability of a hot site and the lower cost of a cold site. The appropriate recovery site depends on business priorities, RTO requirements, budget, and operational dependencies. Organizations should regularly test their recovery procedures to verify that the selected site can actually support the required business functions.

Question 300

Which process should occur after an incident to identify improvements that can prevent similar events in the future?

1. Lessons learned review
2. Account creation
3. Certificate enrollment
4. Asset procurement

Correct Answer: 1

Explanation

A lessons learned review evaluates an incident after immediate response activities are complete and identifies improvements for future prevention and response. The review can examine detection effectiveness, communication, containment, technical controls, decision-making, policies, and recovery procedures. Findings should be converted into actionable improvements with assigned owners and appropriate deadlines. The purpose is not simply to document what happened but to strengthen the organization’s security and response capabilities. Lessons learned can also identify recurring control weaknesses that require architectural, procedural, or training changes.