View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 361

Which security control is most appropriate for restricting administrative access to only authorized management workstations?

1. Data masking
2. Management access control
3. Backup replication
4. Email filtering

Correct Answer: 2

Explanation

Management access control restricts administrative interfaces so that only approved users, systems, or network locations can reach them. Organizations can require administrators to use dedicated management workstations or hardened jump servers rather than ordinary employee endpoints. This reduces the opportunity for a compromised workstation to reach sensitive infrastructure. Additional safeguards can include multifactor authentication, privileged access management, network segmentation, and session logging. Restricting management access is especially important for routers, switches, hypervisors, security appliances, and other infrastructure where unauthorized administrative changes could have significant consequences.

Question 362

Which security activity identifies whether an organization’s security controls align with specific regulatory or contractual requirements?

1. Control mapping
2. Disk imaging
3. Password synchronization
4. Network translation

Correct Answer: 1

Explanation

Control mapping links organizational security controls to specific regulatory, contractual, or framework requirements. This allows security teams to determine which controls satisfy particular obligations and where gaps may exist. A single security control may address multiple requirements, while some requirements may need several controls. Control mapping can simplify audits, compliance reporting, and security program management. Organizations should maintain mappings as requirements change and verify that mapped controls remain effective. Documentation alone is not sufficient; the organization should also retain evidence showing that applicable controls are implemented and operating.

Question 363

A company wants to detect unauthorized modifications to critical configuration files immediately after they occur. Which capability is most appropriate?

1. File integrity monitoring
2. Data retention
3. Network load balancing
4. Certificate pinning

Correct Answer: 1

Explanation

File integrity monitoring continuously or periodically checks important files for unauthorized changes. It can compare current file characteristics against a trusted baseline using cryptographic hashes, metadata, or other indicators. When unexpected modifications occur, alerts can be generated for investigation. FIM is useful for critical operating system files, application configurations, security policies, and other sensitive resources. Organizations should identify which files require monitoring and tune alerting to distinguish legitimate administrative changes from suspicious activity. Centralized logging can preserve FIM alerts for later investigation.

Question 364

Which security architecture provides the strongest isolation between highly sensitive workloads and ordinary user systems?

1. Flat networking
2. Microsegmentation
3. Shared VLAN access
4. Unrestricted routing

Correct Answer: 2

Explanation

Microsegmentation applies granular security policies to individual workloads, applications, or groups of systems rather than relying only on broad network boundaries. This allows organizations to restrict communication based on application identity, workload, port, protocol, or other attributes. If an ordinary user system becomes compromised, microsegmentation can prevent unnecessary connections to sensitive workloads. It supports zero trust and defense-in-depth strategies by reducing implicit trust between systems. Proper implementation requires understanding application dependencies and continuously maintaining policies as workloads and business requirements change.

Question 365

Which process determines whether a security policy exception should be renewed, modified, or closed?

1. Exception review
2. Data classification
3. Certificate issuance
4. Backup compression

Correct Answer: 1

Explanation

Exception review evaluates whether an approved deviation from a security policy remains necessary and acceptable. Reviewers should consider the original business justification, current risk, compensating controls, remediation progress, expiration date, and changes in the technical environment. If the underlying reason for the exception no longer exists, the organization can close it and restore normal compliance. If the risk remains, the exception may require renewal with updated approval. Formal reviews prevent temporary exceptions from becoming permanent unmanaged weaknesses.

Question 366

A security team needs to identify the attack techniques used during a confirmed intrusion. Which framework-based activity is most useful?

1. TTP analysis
2. Data masking
3. Backup rotation
4. Certificate enrollment

Correct Answer: 1

Explanation

TTP analysis examines an attacker’s tactics, techniques, and procedures to understand how an intrusion was conducted. Analysts can compare observed behavior with known adversary techniques and use the findings to improve detection and response capabilities. TTP information can help identify related activity across systems and determine whether other parts of the environment may have been affected. Security teams can use frameworks such as MITRE ATT&CK as references for categorizing adversary behavior. TTP analysis should be based on collected evidence rather than assumptions about attacker activity.

Question 367

Which authentication approach is generally strongest against phishing when properly implemented?

1. Security questions
2. SMS-only verification
3. FIDO2-based authentication
4. Password hints

Correct Answer: 3

Explanation

FIDO2-based authentication can provide phishing-resistant authentication by using public-key cryptography tied to the legitimate relying party. The authenticator does not simply provide a reusable secret that an attacker can capture and replay on a fraudulent website. Depending on implementation, FIDO2 can use hardware security keys or platform authenticators. Strong account recovery procedures remain important because attackers may attempt to bypass authentication through weaker recovery mechanisms. Organizations should deploy phishing-resistant authentication especially for privileged accounts and other high-value identities.

Question 368

Which control helps prevent an attacker from using stolen credentials after the legitimate user’s employment has ended?

1. Account deprovisioning
2. Network compression
3. Database replication
4. Certificate pinning

Correct Answer: 1

Explanation

Account deprovisioning removes or disables access when a user no longer requires organizational resources. Termination and role-change processes should trigger timely updates to identity systems, application accounts, privileged credentials, tokens, and other access mechanisms. Delayed deprovisioning can leave former employees or attackers with valid credentials. Organizations should integrate human resources processes with identity lifecycle management where appropriate and perform periodic account reviews to identify dormant or orphaned accounts. Strong deprovisioning controls reduce the risk of unauthorized access after employment or responsibilities change.

Question 369

Which security measure provides a way to verify that a message was not altered during transmission?

1. Integrity protection
2. Data retention
3. Availability monitoring
4. Network address translation

Correct Answer: 1

Explanation

Integrity protection ensures that data has not been modified without authorization. Cryptographic mechanisms such as hashes, message authentication codes, and digital signatures can provide evidence of data integrity. The appropriate mechanism depends on the communication and trust model. For example, a message authentication code can verify integrity when communicating parties share a secret key, while a digital signature can provide integrity and support authenticity and nonrepudiation. Integrity protection is distinct from confidentiality, which prevents unauthorized parties from reading the protected information.

Question 370

A security team wants to detect suspicious changes to privileged accounts and permissions. Which data source should be monitored closely?

1. Identity and access logs
2. Printer status reports
3. Temperature readings
4. File compression statistics

Correct Answer: 1

Explanation

Identity and access logs provide valuable information about account creation, authentication, privilege changes, access requests, and administrative actions. Monitoring these events can reveal suspicious activities such as unexpected privilege escalation, creation of unauthorized accounts, or changes to authentication settings. Security teams can correlate identity events with endpoint, network, and application telemetry to improve detection accuracy. Logs should be protected against unauthorized modification and retained according to security and compliance requirements. Privileged identity events deserve particular attention because misuse of administrative access can have broad consequences.

Question 371

Which practice reduces the likelihood that a compromised service account can access unrelated cloud resources?

1. Narrow permission scoping
2. Shared credentials
3. Broad administrator rights
4. Permanent root access

Correct Answer: 1

Explanation

Narrow permission scoping applies least privilege to service accounts by granting only the resources and actions required by the application. A service account with broad permissions creates a significant risk if its credentials or execution environment are compromised. Cloud administrators should identify the application’s actual requirements and remove unnecessary permissions. Separate service accounts can also be used for different applications or functions to limit the potential blast radius. Permissions should be reviewed regularly because application requirements and cloud environments can change over time.

Question 372

Which security process helps determine how long specific categories of information should be retained?

1. Data retention management
2. Threat hunting
3. Network segmentation
4. Certificate validation

Correct Answer: 1

Explanation

Data retention management establishes appropriate retention periods for different categories of information based on business, legal, regulatory, and contractual requirements. Retaining data indefinitely can increase privacy, security, and storage risks, while deleting it too early can create compliance or operational problems. Retention schedules should identify responsible owners, applicable data categories, retention periods, and secure disposal requirements. Organizations should periodically review retention rules because legal obligations and business needs can change. Effective retention management works alongside data classification, minimization, and secure destruction practices.

Question 373

Which activity provides a realistic evaluation of how security personnel would respond to a simulated major incident?

1. Tabletop exercise
2. Data classification
3. Certificate renewal
4. Vulnerability patching

Correct Answer: 1

Explanation

A tabletop exercise uses a simulated incident scenario to evaluate how personnel, procedures, communication channels, and decision-making processes would function during a real event. Participants discuss actions they would take without necessarily making production changes. Tabletop exercises can expose gaps in incident response plans, escalation procedures, responsibilities, communications, and resource availability. They can be conducted for scenarios such as ransomware, data breaches, cloud outages, or insider incidents. Findings should be documented and used to update response plans and improve organizational preparedness.

Question 374

Which control can limit an application’s ability to communicate only with approved external services?

1. Egress filtering
2. Data compression
3. Password rotation
4. Certificate archiving

Correct Answer: 1

Explanation

Egress filtering controls outbound network traffic leaving an environment or system. By allowing connections only to approved destinations, ports, or protocols, organizations can reduce the ability of compromised systems to communicate with attacker-controlled infrastructure. Egress filtering can help limit command-and-control communications, unauthorized data transfers, and other malicious outbound activity. Rules should be designed carefully because applications may require legitimate external services. Combining egress controls with DNS security, endpoint monitoring, proxy inspection, and DLP can provide stronger protection against unauthorized outbound communications.

Question 375

Which security control is specifically intended to protect the integrity of software build artifacts?

1. Artifact signing
2. Network address translation
3. Data masking
4. Load balancing

Correct Answer: 1

Explanation

Artifact signing applies a digital signature to software packages, binaries, containers, or other build outputs. Consumers can verify the signature to determine whether an artifact originated from an approved source and whether it changed after signing. This protects the software supply chain from certain forms of tampering and unauthorized replacement. Signing keys must be strongly protected because compromise could allow attackers to produce apparently trusted artifacts. Organizations should combine signing with secure build environments, access controls, provenance tracking, dependency management, and verification before deployment.

Question 376

A company wants to identify whether a cloud administrator has granted excessive permissions to a user. Which activity should be performed?

1. Access review
2. Disk imaging
3. Network translation
4. Certificate renewal

Correct Answer: 1

Explanation

An access review evaluates existing permissions to determine whether they remain appropriate for a user’s responsibilities and current risk level. In cloud environments, excessive permissions can expose large numbers of resources if an account is compromised. Reviewers should examine roles, policies, direct permissions, inherited access, and privileged assignments. Unnecessary permissions should be removed or reduced according to least-privilege requirements. Automated identity governance and cloud security tools can assist with identifying excessive permissions, but human review may still be required for business context and authorization decisions.

Question 377

Which security capability helps identify vulnerable dependencies included in an application’s software supply chain?

1. SCA
2. NAC
3. WAF
4. MDM

Correct Answer: 1

Explanation

Software composition analysis identifies third-party and open-source components used within an application and evaluates them for known vulnerabilities and other risks. SCA can identify outdated libraries, vulnerable package versions, and dependency relationships that may not be obvious from reviewing application source code alone. Integrating SCA into CI/CD pipelines allows developers to detect problems before deployment. Organizations can strengthen supply chain security by combining SCA with dependency pinning, software bills of materials, trusted repositories, vulnerability monitoring, and controlled update processes.

Question 378

Which incident response phase focuses on removing malware and attacker persistence from affected systems?

1. Eradication
2. Preparation
3. Identification
4. Recovery

Correct Answer: 1

Explanation

Eradication focuses on eliminating the underlying causes and malicious components of an incident. Activities can include removing malware, deleting persistence mechanisms, disabling compromised accounts, closing exploited vulnerabilities, and addressing malicious configuration changes. Eradication should occur after sufficient investigation and containment so that important evidence is not destroyed prematurely. Once eradication is complete, systems can proceed toward recovery and normal operation. Organizations should verify that the underlying weakness has been addressed to reduce the likelihood that attackers can regain access using the same method.

Question 379

Which approach provides a controlled alternative when a required security control cannot be implemented immediately?

1. Compensating control
2. Control removal
3. Unrestricted access
4. Risk concealment

Correct Answer: 1

Explanation

A compensating control provides an alternative security measure when the preferred control cannot be implemented because of technical, operational, or business constraints. For example, if an older system cannot support a required authentication mechanism, network isolation and enhanced monitoring may temporarily reduce the associated risk. Compensating controls should be documented, approved, and evaluated to determine whether they provide adequate protection. They should not automatically become permanent substitutes without periodic review. Organizations should continue pursuing the intended control when practical.

Question 380

Which activity verifies that an organization’s incident response procedures work effectively before a real emergency occurs?

1. Incident response exercise
2. Data deletion
3. Certificate expiration
4. Password sharing

Correct Answer: 1

Explanation

An incident response exercise evaluates whether personnel, procedures, technologies, and communication processes can operate effectively during a simulated security event. Exercises can range from discussion-based tabletop scenarios to more technical simulations involving security tools and response teams. They can reveal unclear responsibilities, missing contact information, ineffective escalation paths, insufficient logging, or gaps in containment procedures. Results should be documented and converted into corrective actions. Regular exercises improve preparedness and help organizations validate that written response plans are practical rather than merely documented.