View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 341

Which security control can restrict a user’s access based on both attributes and environmental conditions?

1. Static ACL
2. ABAC
3. RAID
4. NAT

Correct Answer: 2

Explanation

Attribute-based access control, or ABAC, makes authorization decisions using attributes associated with users, resources, actions, and environmental conditions. For example, a policy could allow an employee to access confidential records only when the employee has a specific department attribute, uses a managed device, and connects during an approved period. ABAC can provide more granular authorization than simple role-based access control. Organizations should define attributes carefully and ensure that the underlying identity and device information is trustworthy before relying on those attributes for security decisions.

Question 342

A security team wants to verify that a cloud resource does not violate the organization’s approved configuration baseline. Which capability should be used?

1. Configuration compliance monitoring
2. Tokenization
3. Email encryption
4. Disk defragmentation

Correct Answer: 1

Explanation

Configuration compliance monitoring compares the current configuration of systems or cloud resources against approved security baselines. It can identify issues such as excessive permissions, publicly accessible storage, disabled logging, weak encryption settings, or unauthorized network exposure. Continuous monitoring is especially useful in cloud environments because resources can change rapidly through automated deployments and administrative actions. When deviations are identified, security teams can investigate whether the change was authorized and either remediate it or document an approved exception through the organization’s risk management process.

Question 343

Which security control is most appropriate for preventing unauthorized physical access to a restricted server room?

1. SIEM
2. DLP
3. Badge reader
4. WAF

Correct Answer: 3

Explanation

A badge reader is a physical access control that verifies whether an individual has authorization to enter a restricted area. It can use credentials such as smart cards, access badges, or other authentication mechanisms. Access events can be logged to provide accountability and support investigations. Sensitive server rooms may use additional controls such as security guards, cameras, mantraps, biometric authentication, and environmental monitoring. Physical security is an important part of defense in depth because an attacker who gains physical access may be able to bypass many logical security controls.

Question 344

Which approach reduces the amount of sensitive information retained after it is no longer required for a legitimate purpose?

1. Data retention management
2. Network segmentation
3. Load balancing
4. Certificate pinning

Correct Answer: 1

Explanation

Data retention management establishes how long different categories of information should be retained and when they should be securely disposed of. Limiting unnecessary retention reduces the amount of sensitive information available to attackers and can help organizations meet legal, regulatory, and contractual requirements. Retention periods should be based on business needs and applicable obligations rather than arbitrary deletion. Secure disposal methods should also be defined for different storage media. Retention management works alongside data classification, data minimization, access control, and privacy processes.

Question 345

An organization needs to identify which employees have retained excessive permissions after changing jobs. What should be performed?

1. Network discovery
2. Access recertification
3. Backup verification
4. Certificate renewal

Correct Answer: 2

Explanation

Access recertification is the process of periodically reviewing user permissions to determine whether they remain appropriate. When employees change roles, old permissions may remain active and create privilege accumulation. During recertification, managers or resource owners can confirm required access and request removal of unnecessary privileges. The process is particularly important for sensitive systems and privileged accounts. Automated identity governance tools can assist by generating review campaigns and tracking approvals. Removing unnecessary permissions supports least privilege and reduces the potential impact of compromised or misused accounts.

Question 346

Which technology can provide secure access to private applications without placing them directly on the public internet?

1. ZTNA
2. RAID
3. DHCP
4. File compression

Correct Answer: 1

Explanation

Zero Trust Network Access, or ZTNA, provides controlled access to private applications based on identity, device posture, policy, and other contextual factors rather than granting broad network-level access. Unlike traditional approaches that may provide users with extensive network connectivity after establishing a VPN connection, ZTNA can restrict access to specifically authorized applications. This reduces the attack surface and supports zero trust principles. Organizations can combine ZTNA with multifactor authentication, endpoint compliance checks, least privilege, and continuous monitoring to strengthen remote access security.

Question 347

Which security practice helps prevent secrets such as API keys from being accidentally committed to source code repositories?

1. Database replication
2. Secrets scanning
3. Network load balancing
4. File compression

Correct Answer: 2

Explanation

Secrets scanning searches source code, repositories, commits, and related development artifacts for sensitive values such as passwords, API keys, private keys, and access tokens. Detecting exposed secrets before code reaches production can prevent attackers from obtaining credentials through public or compromised repositories. Organizations should combine scanning with secure secrets-management systems so that sensitive credentials are stored outside source code. Automated CI/CD checks can block commits or builds when high-confidence secrets are detected. Previously exposed credentials should also be revoked and replaced promptly.

Question 348

A company wants to prevent an administrator from directly accessing production servers from a normal employee workstation. Which control is most appropriate?

1. Jump server
2. Data classification
3. Backup rotation
4. Email filtering

Correct Answer: 1

Explanation

A jump server provides a controlled intermediary system through which administrators can access restricted infrastructure. Administrators can authenticate to the hardened jump server and then connect to authorized production systems from there. This design reduces direct administrative exposure from ordinary user workstations and creates a centralized point for logging, monitoring, and access control. Jump servers can be combined with privileged access management, multifactor authentication, session recording, and network restrictions. The jump server itself should be hardened and limited to approved administrative functions.

Question 349

Which security mechanism allows an organization to revoke trust in a certificate before its expiration date?

1. CRL
2. RAID
3. VLAN
4. SSO

Correct Answer: 1

Explanation

A certificate revocation list, or CRL, contains certificates that a certificate authority has revoked before their normal expiration dates. Revocation may occur when a private key is compromised, a certificate is issued incorrectly, or the certificate should no longer be trusted for another reason. Systems validating certificates can consult the appropriate revocation information before accepting a certificate. OCSP provides another method for checking certificate status. Organizations must maintain reliable certificate lifecycle processes because expired and revoked certificates can create authentication or trust problems when not handled correctly.

Question 350

Which cloud security capability is primarily intended to enforce security policies between users and cloud applications?

1. CASB
2. HSM
3. EDR
4. RAID

Correct Answer: 1

Explanation

A cloud access security broker, or CASB, provides security controls between users and cloud services. Depending on implementation, CASB capabilities can include visibility, access control, data loss prevention, threat detection, compliance monitoring, and policy enforcement. CASBs can help organizations manage security requirements when employees use multiple cloud applications and services. CASB differs from CSPM, which focuses primarily on cloud configuration posture, and CWPP, which focuses on workload protection. Selecting the appropriate capability depends on whether the primary concern involves users, cloud configurations, or workloads.

Question 351

Which security practice ensures that evidence collected during an investigation can be traced from collection through analysis?

1. Data classification
2. Chain of custody
3. Network segmentation
4. Key rotation

Correct Answer: 2

Explanation

Chain of custody documents how evidence was collected, transferred, stored, accessed, and analyzed throughout an investigation. Maintaining this record helps demonstrate that evidence was handled appropriately and that unauthorized modification did not occur. Investigators should record relevant details such as dates, times, individuals handling the evidence, storage locations, and integrity verification methods. Digital forensic procedures commonly use cryptographic hashes to help demonstrate that acquired copies remain unchanged. Strong evidence handling improves the reliability of investigative findings and supports legal or disciplinary proceedings when applicable.

Question 352

A security architect wants to ensure that an application cannot use an overly broad cloud service account permission set. Which principle should guide the design?

1. Least privilege
2. Maximum availability
3. Open authorization
4. Shared access

Correct Answer: 1

Explanation

Least privilege requires applications and service accounts to receive only the permissions necessary to perform their intended functions. Excessive cloud permissions can allow an attacker who compromises an application or service account to access unrelated resources. Architects should identify required actions and resources, then create narrowly scoped permissions. Permissions should be reviewed periodically because application functionality and cloud environments change. Temporary privileges, separate service accounts, strong credential protection, and monitoring can further reduce the risks associated with machine identities and application-level access.

Question 353

Which testing method evaluates an application while it is running to identify security weaknesses?

1. SAST
2. DAST
3. SBOM generation
4. Source code formatting

Correct Answer: 2

Explanation

Dynamic application security testing, or DAST, evaluates an application while it is running and interacts with the application from an external perspective. It can identify issues involving input validation, authentication, session handling, configuration, and certain application-layer vulnerabilities. DAST differs from SAST, which analyzes source or compiled code without executing the application. Using both methods provides broader coverage because they identify different classes of weaknesses. DAST should be integrated into appropriate testing stages and should be performed in environments where testing cannot disrupt production services.

Question 354

Which control is designed to identify and remove unauthorized devices from a corporate network?

1. NAC
2. HSM
3. WAF
4. SIEM

Correct Answer: 1

Explanation

Network access control, or NAC, evaluates devices before or during network access and can enforce policies based on identity, device type, security posture, or compliance status. An organization can use NAC to restrict unmanaged, unknown, or noncompliant devices from accessing sensitive network resources. Depending on policy, a noncompliant device may be denied access or placed into a restricted remediation network. NAC can work with identity services, endpoint management, and authentication protocols such as 802.1X to provide stronger device and user-based network control.

Question 355

Which security measure protects information if a laptop is stolen and its storage drive is removed from the device?

1. Full-disk encryption
2. Network segmentation
3. Security awareness training
4. Load balancing

Correct Answer: 1

Explanation

Full-disk encryption protects data stored on a device by encrypting the contents of the storage medium. If a laptop is stolen and an attacker removes the drive, the encrypted data should remain unreadable without the necessary authentication or cryptographic keys. Encryption should be combined with secure authentication, device management, and appropriate key recovery procedures. Full-disk encryption primarily protects data at rest and does not prevent an attacker from accessing data through an already unlocked device. Additional endpoint security controls are therefore still required.

Question 356

Which activity helps determine whether a proposed security control actually reduces the identified risk?

1. Control effectiveness testing
2. Data deletion
3. Password sharing
4. Asset duplication

Correct Answer: 1

Explanation

Control effectiveness testing evaluates whether a security control operates as intended and meaningfully addresses the risk it was designed to reduce. Testing may involve technical validation, configuration review, sample analysis, simulated attacks, log examination, or other appropriate methods. A control can exist but still be ineffective because of incorrect configuration, incomplete coverage, or operational weaknesses. Results should be documented and compared against defined security objectives. Where testing identifies gaps, the organization can remediate the control, introduce compensating measures, or formally reassess the remaining risk.

Question 357

A company wants to prevent a build server from retrieving arbitrary dependencies from untrusted sources. Which control is most appropriate?

1. Approved software repository
2. Open internet access
3. Shared administrator account
4. Unrestricted package installation

Correct Answer: 1

Explanation

An approved software repository provides a controlled source for packages and dependencies used by development and build systems. Restricting build servers to trusted repositories can reduce the risk of downloading malicious, tampered, or unauthorized components. Organizations should also verify package signatures where available, maintain dependency inventories, use version controls, and monitor repository access. Supply chain security requires protection throughout the development process because a compromised dependency can introduce malicious functionality into otherwise legitimate applications. Repository controls should therefore be integrated with CI/CD security and software provenance practices.

Question 358

Which resilience strategy uses geographically separated systems so that a regional disaster is less likely to disrupt all copies simultaneously?

1. Geographic redundancy
2. Single-site backup
3. Local caching
4. Password rotation

Correct Answer: 1

Explanation

Geographic redundancy distributes critical systems, data, or recovery capabilities across physically separated locations. This reduces the likelihood that a single regional event, such as a natural disaster, major utility failure, or facility outage, will affect every operational copy. Depending on requirements, organizations may use active-active, active-passive, or other replication architectures. Geographic separation must also account for network connectivity, data synchronization, regulatory requirements, latency, and recovery objectives. Simply maintaining multiple copies in the same facility does not provide equivalent protection against site-level disasters.

Question 359

Which process determines whether an organization should transfer, mitigate, accept, or avoid an identified risk?

1. Risk treatment
2. Asset discovery
3. Certificate enrollment
4. Log rotation

Correct Answer: 1

Explanation

Risk treatment determines how an organization will respond to an identified risk. Common treatment strategies include mitigation through additional controls, transfer through mechanisms such as insurance or contractual arrangements, acceptance when the residual risk falls within approved tolerance, and avoidance by eliminating the risky activity. The selected treatment should consider likelihood, impact, cost, business objectives, and organizational risk appetite. Treatment decisions should be documented, assigned to responsible owners, and periodically reviewed because threat conditions and business circumstances can change.

Question 360

Which capability allows an organization to identify security events by combining information from several independent indicators?

1. SIEM correlation
2. Data compression
3. Disk partitioning
4. Certificate renewal

Correct Answer: 1

Explanation

SIEM correlation combines events from multiple sources to identify relationships that may indicate suspicious or malicious activity. For example, a sequence involving an unusual login, privilege escalation, access to a sensitive server, and abnormal data transfer may be more significant when analyzed together than when each event is viewed independently. Effective correlation requires reliable log sources, synchronized timestamps, appropriate detection rules, and tuned thresholds. Security teams should continuously refine correlation logic based on incident findings and changing attacker techniques to improve detection quality while limiting false positives.