View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 301

Which security mechanism is specifically designed to verify that a digital certificate has not been revoked?

1. OCSP
2. NAT
3. SFTP
4. DHCP

Correct Answer: 1

Explanation

The Online Certificate Status Protocol, or OCSP, allows systems to query whether a digital certificate is currently valid or has been revoked by the issuing certificate authority. This provides more current certificate status information than relying solely on periodically downloaded certificate revocation lists. Certificate validation is important because a certificate may need to be revoked before its normal expiration date if its private key is compromised or other trust conditions change. Organizations should also consider certificate lifecycle management, trusted certificate authorities, and secure private-key protection.

Question 302

A company wants to prevent a compromised workstation from communicating with servers in a high-security zone. Which control should be implemented?

1. Data retention
2. Network segmentation
3. Password synchronization
4. Certificate archiving

Correct Answer: 2

Explanation

Network segmentation separates systems into security zones and restricts communication between those zones. A compromised workstation can therefore be prevented from directly reaching highly sensitive servers when appropriate firewall rules or access controls are enforced. Segmentation limits lateral movement and reduces the potential impact of an endpoint compromise. Security architects should identify required communication paths and explicitly permit only necessary connections. For especially sensitive environments, microsegmentation can provide more granular controls by applying policies to individual workloads rather than relying only on broad network boundaries.

Question 303

Which activity provides evidence that a backup can actually be used to restore a critical application?

1. Backup restoration test
2. Password rotation
3. Log aggregation
4. Certificate renewal

Correct Answer: 1

Explanation

A backup restoration test verifies that stored backup data can be successfully recovered and used to restore the required systems or information. A backup process may appear successful while still producing incomplete, corrupted, or unusable recovery data. Testing can identify problems involving backup integrity, dependencies, credentials, storage access, application configuration, or restoration procedures. Organizations should conduct restoration tests according to business requirements and document the results. Testing also helps determine whether actual recovery performance meets established RTO and RPO objectives.

Question 304

Which control is most appropriate for protecting cryptographic keys used by critical applications?

1. HSM
2. Proxy server
3. Load balancer
4. Network tap

Correct Answer: 1

Explanation

A hardware security module, or HSM, is a specialized device designed to securely generate, store, process, and manage cryptographic keys. HSMs can protect private keys from unauthorized extraction and may provide tamper-resistant security features. They are commonly used for certificate authorities, payment systems, digital signing, encryption services, and other applications where key protection is critical. Proper key lifecycle management remains necessary even when HSMs are deployed. Organizations should define procedures for key generation, rotation, backup, recovery, revocation, and destruction.

Question 305

An organization wants to determine which systems would be affected if a critical database becomes unavailable. Which activity should be performed?

1. Dependency mapping
2. Password auditing
3. Certificate revocation
4. Media sanitization

Correct Answer: 1

Explanation

Dependency mapping identifies relationships between systems, applications, services, data stores, and business processes. When a critical database becomes unavailable, dependency information can show which applications rely on it and which downstream services could be disrupted. This information supports business continuity planning, disaster recovery design, risk analysis, and incident response. Accurate dependency maps should be reviewed periodically because infrastructure and application relationships change over time. Understanding dependencies also helps organizations prioritize recovery activities and identify single points of failure within critical services.

Question 306

Which approach allows an organization to require additional authentication when a user attempts access from an unusual location?

1. Adaptive authentication
2. Static routing
3. Data replication
4. File compression

Correct Answer: 1

Explanation

Adaptive authentication evaluates contextual information and can increase authentication requirements when risk indicators change. For example, a user logging in from an unfamiliar country, unmanaged device, or unusual network may be required to complete an additional authentication factor. This approach provides more flexibility than applying identical authentication requirements to every access request. Adaptive policies should use reliable signals and be carefully configured to minimize false positives. They can support zero trust strategies by evaluating access requests continuously rather than assuming that previously authenticated users are always trustworthy.

Question 307

Which document is most useful for identifying the sensitivity level assigned to different categories of organizational data?

1. Data classification policy
2. Incident response plan
3. Disaster recovery schedule
4. Network topology map

Correct Answer: 1

Explanation

A data classification policy defines categories used to identify the sensitivity and handling requirements of organizational information. Classifications may include public, internal, confidential, or restricted information, depending on the organization’s requirements. Classification helps determine appropriate controls for access, encryption, storage, transmission, retention, and disposal. Without consistent classification, security teams may apply inadequate or excessive controls. Data owners should participate in classification decisions because they understand the business value, regulatory requirements, and potential impact associated with the information.

Question 308

A security team wants to prevent unauthorized users from changing firewall configurations. Which principle should be applied?

1. Least privilege
2. Data duplication
3. Availability
4. Compression

Correct Answer: 1

Explanation

Least privilege ensures that users receive only the permissions required to perform their assigned responsibilities. Applying least privilege to firewall administration means only authorized network or security administrators should have permission to modify firewall policies. Administrative access can be further protected through multifactor authentication, privileged access management, approval workflows, and centralized logging. Restricting configuration privileges reduces the likelihood of accidental or malicious changes that could weaken network defenses. Organizations should also periodically review administrative permissions to ensure they remain appropriate.

Question 309

Which security control provides an additional layer of protection when a primary security mechanism fails?

1. Defense in depth
2. Data minimization
3. Single sign-on
4. Tokenization

Correct Answer: 1

Explanation

Defense in depth uses multiple complementary security controls so that the failure or bypass of one control does not automatically result in complete compromise. For example, an organization may combine endpoint protection, network segmentation, multifactor authentication, encryption, monitoring, and application security controls. Each layer addresses different attack paths and provides additional opportunities to prevent, detect, or contain malicious activity. Defense in depth is especially important for high-value systems because no individual control is guaranteed to remain effective against every threat or configuration failure.

Question 310

Which control can prevent sensitive information from being transmitted outside the organization through unauthorized channels?

1. DLP
2. DHCP
3. NAT
4. RAID

Correct Answer: 1

Explanation

Data loss prevention, or DLP, identifies and helps prevent unauthorized transmission, storage, or use of sensitive information. DLP policies can inspect content and context across endpoints, email, cloud services, and network channels. For example, a policy might prevent confidential files from being emailed to external recipients or copied to unauthorized removable media. Effective DLP requires accurate data classification and carefully designed policies to reduce false positives. Organizations should balance protection with legitimate business requirements so that necessary data sharing is not unnecessarily disrupted.

Question 311

Which control is designed to ensure that a user cannot approve their own high-risk access request?

1. Separation of duties
2. Network segmentation
3. Encryption at rest
4. Data masking

Correct Answer: 1

Explanation

Separation of duties prevents a single individual from controlling multiple conflicting stages of a sensitive process. For access management, this can mean that one employee requests elevated permissions while another authorized person approves the request. The separation reduces opportunities for unauthorized privilege escalation and creates an independent review point. Workflow systems can enforce these requirements automatically by preventing requesters from approving their own requests. This control is particularly valuable for privileged access, financial systems, production environments, and other areas where excessive authority could create significant risk.

Question 312

Which security activity involves actively searching for threats that may have avoided automated detection?

1. Threat hunting
2. Data archiving
3. Patch packaging
4. Certificate enrollment

Correct Answer: 1

Explanation

Threat hunting is a proactive security activity in which analysts search systems, networks, and data for indicators or behaviors associated with potential threats. Instead of waiting for automated alerts, hunters may investigate unusual processes, authentication patterns, network connections, persistence mechanisms, or known attacker techniques. Threat hunting can uncover malicious activity that bypassed traditional security controls. Effective hunting uses threat intelligence, telemetry, behavioral analysis, and knowledge of attacker tactics and techniques. Findings should be fed back into detection engineering and security monitoring to improve future automated detection.

Question 313

A company wants to make sure a compromised administrator cannot directly manage every critical network device. Which architecture is most appropriate?

1. Management network isolation
2. Flat network access
3. Shared administrative accounts
4. Public management interfaces

Correct Answer: 1

Explanation

Management network isolation separates administrative interfaces from normal user and production traffic. Critical network devices can expose their management interfaces only through a restricted administrative network accessible to authorized personnel. This limits the number of systems capable of reaching sensitive management functions and reduces the risk that a compromised endpoint can directly administer infrastructure. Organizations can strengthen this design with jump servers, multifactor authentication, privileged access management, and centralized logging. Isolating the management plane is particularly important for high-value network and security infrastructure.

Question 314

Which process helps ensure that security requirements are considered when acquiring a new third-party service?

1. Vendor security assessment
2. Log deletion
3. Password sharing
4. Network flattening

Correct Answer: 1

Explanation

A vendor security assessment evaluates the security practices, controls, risks, and capabilities of a third-party provider before or during procurement. The assessment can review security policies, incident response, access controls, encryption, compliance evidence, vulnerability management, data handling, and subcontractor relationships. Results can be incorporated into contractual requirements and risk treatment decisions. Vendor assessments should not necessarily end after onboarding because supplier risk can change over time. Organizations should establish appropriate monitoring and reassessment requirements based on the sensitivity of the service and information involved.

Question 315

Which security technology can automatically isolate an endpoint when malicious behavior is detected?

1. EDR
2. DNS resolver
3. Load balancer
4. Certificate authority

Correct Answer: 1

Explanation

Endpoint detection and response, or EDR, monitors endpoint activity and can detect suspicious behavior such as malicious processes, persistence attempts, unauthorized changes, and unusual connections. Many EDR platforms provide response capabilities that allow security teams or automated policies to isolate a compromised endpoint from the network while preserving the system for investigation. Isolation helps contain threats and limit lateral movement. EDR should operate alongside other controls such as endpoint hardening, patch management, application control, identity security, and centralized security monitoring.

Question 316

Which control provides evidence of who accessed a sensitive database and when the access occurred?

1. Audit logging
2. Data compression
3. Network segmentation
4. Tokenization

Correct Answer: 1

Explanation

Audit logging records security-relevant activities such as authentication attempts, data access, configuration changes, and administrative actions. For a sensitive database, audit logs can provide evidence of which account accessed specific resources and when the activity occurred. Logs should be protected against unauthorized modification and retained according to organizational, legal, and compliance requirements. Centralizing database audit events in a SIEM can make correlation and investigation easier. Audit logging supports accountability, incident response, compliance assessments, and forensic investigations when properly configured.

Question 317

A company needs to reduce the risk that a stolen password can be reused against its cloud applications. Which control provides the strongest additional protection?

1. Multifactor authentication
2. Password hints
3. Shared accounts
4. Longer session timeouts

Correct Answer: 1

Explanation

Multifactor authentication requires users to provide an additional authentication factor beyond a password. If an attacker obtains the password, the attacker may still be unable to access the account without the additional factor. Strong implementations can use phishing-resistant hardware authenticators or platform-based credentials. MFA should be applied especially to privileged accounts, remote access, and sensitive cloud applications. Organizations should also secure account recovery procedures because weak recovery mechanisms can undermine otherwise strong authentication controls.

Question 318

Which activity verifies that a security architecture meets its intended design before deployment?

1. Architecture validation
2. Data destruction
3. User provisioning
4. Backup deletion

Correct Answer: 1

Explanation

Architecture validation reviews whether a proposed or implemented architecture satisfies defined security requirements and design objectives. The process may examine trust boundaries, data flows, access controls, network segmentation, encryption, dependencies, logging, resilience, and attack paths. Validation can identify design weaknesses before they become expensive production problems. Organizations may use threat modeling, architecture reviews, security testing, and control mapping as part of the process. Performing validation before deployment provides an opportunity to correct structural weaknesses rather than relying only on operational controls after implementation.

Question 319

Which method can help verify that a downloaded file is identical to the version published by a trusted source?

1. Cryptographic hash comparison
2. Data masking
3. Network segmentation
4. Password rotation

Correct Answer: 1

Explanation

Cryptographic hash comparison can verify the integrity of a file by comparing its calculated hash with a trusted reference value. If the values match using a suitable cryptographic hash algorithm, the file content is consistent with the reference at the time of comparison. A mismatch indicates that the content differs, although additional verification may be needed to determine why. Hashes should be obtained from a trustworthy source because an attacker who controls both the file and its published hash could potentially replace both.

Question 320

An organization wants to ensure that critical services continue operating if one data center becomes unavailable. Which strategy provides geographic resilience?

1. Geographic redundancy
2. Local file compression
3. Password synchronization
4. Single-server deployment

Correct Answer: 1

Explanation

Geographic redundancy places critical services or their recovery capabilities across separate physical locations so that a major outage at one site does not necessarily eliminate the organization’s ability to operate. Depending on requirements, organizations may use active-active or active-passive architectures, replicated data, redundant network connectivity, and automated failover. Geographic redundancy can protect against regional disasters, facility failures, and certain infrastructure outages. The design should account for application dependencies, data consistency, recovery objectives, connectivity, operational complexity, and the cost of maintaining multiple locations.