View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 81

Which security control is used to verify that software has not been modified after it was published?

1. Load balancing
2. Digital signature
3. Network segmentation
4. Data masking

Correct Answer: 2

Explanation

A digital signature can help verify software integrity and authenticity. Software publishers can sign packages or executables using a private key, allowing recipients to validate the signature with the corresponding public key. If the software is modified after signing, signature verification should detect the change. Digital signatures can also help establish the identity associated with the signing certificate. Organizations should still obtain software from trusted sources and maintain secure certificate and key-management practices because a valid signature alone does not guarantee that software is completely safe.

Question 82

What is the PRIMARY purpose of network segmentation?

1. Increase monitor resolution
2. Reduce storage requirements
3. Limit unnecessary communication between systems
4. Eliminate authentication

Correct Answer: 3

Explanation

Network segmentation divides an environment into separate logical or physical security zones and controls communication between them. This limits unnecessary connectivity and can reduce lateral movement if an attacker compromises one system. Segmentation can be implemented using firewalls, VLANs, access control lists, software-defined networking, or microsegmentation technologies. It should reflect business requirements and documented communication flows. Segmentation does not replace authentication or endpoint security; instead, it provides another defensive layer that limits which systems can communicate with one another.

Question 83

Which capability allows security teams to collect logs from many systems into one location?

1. Centralized logging
2. Disk partitioning
3. File compression
4. Load balancing

Correct Answer: 1

Explanation

Centralized logging collects security and operational events from multiple systems into a common location. This improves visibility and makes it easier to correlate events across servers, endpoints, network devices, applications, and identity systems. Centralized logs can support incident detection, investigations, compliance reporting, and forensic analysis. They should be protected against unauthorized modification and retained according to organizational requirements. Technologies such as SIEM platforms commonly build upon centralized logging by adding correlation, analytics, alerting, and investigation capabilities.

Question 84

An organization wants to make stolen passwords less useful to attackers. Which control should be implemented?

1. File compression
2. Multifactor authentication
3. Static routing
4. Network translation

Correct Answer: 2

Explanation

Multifactor authentication requires additional verification beyond a password, such as a hardware token, authenticator application, or biometric factor. If an attacker obtains a user’s password, the additional factor can prevent access when the attacker cannot provide the required second factor. MFA is especially important for privileged accounts, remote access, cloud applications, and systems containing sensitive information. Organizations should use strong authentication methods and protect account-recovery processes because attackers may attempt to bypass MFA through social engineering or weak recovery mechanisms.

Question 85

Which process determines whether a security control is operating as intended?

1. Control assessment
2. Data compression
3. Software compilation
4. Traffic routing

Correct Answer: 1

Explanation

A control assessment evaluates whether a security control is properly designed, implemented, and operating effectively. Assessors may review configurations, documentation, logs, procedures, interviews, and technical test results. The purpose is to determine whether the control provides the intended protection and meets applicable requirements. Assessments can identify gaps that require remediation or additional safeguards. They are different from simply documenting that a control exists. Regular assessments are especially important after major infrastructure changes, security incidents, or changes to regulatory and business requirements.

Question 86

A company needs to ensure that only approved devices can access its internal network. Which technology is MOST appropriate?

1. NAC
2. RAID
3. SMTP
4. CDN

Correct Answer: 1

Explanation

Network access control (NAC) can evaluate devices and users before or during network access and enforce policies based on organizational requirements. NAC can check device identity, security posture, authentication status, or other attributes before granting appropriate access. Noncompliant devices can be restricted or placed into remediation networks. RAID provides storage redundancy, SMTP handles email transmission, and a CDN distributes content. NAC is particularly useful in environments where organizations need to control access from managed endpoints, guest systems, or personally owned devices.

Question 87

Which principle requires an organization to collect only the data necessary for a specific business purpose?

1. Data minimization
2. Data duplication
3. Open access
4. Full replication

Correct Answer: 1

Explanation

Data minimization means collecting, processing, and retaining only the information necessary for a legitimate and defined purpose. Reducing unnecessary data can lower privacy exposure, storage requirements, breach impact, and regulatory obligations. Organizations should identify why information is needed and avoid retaining it indefinitely when there is no business or legal requirement. Data minimization works alongside data classification, retention policies, access controls, and secure disposal. Collecting excessive information can create unnecessary risk because attackers may target information that an organization did not actually need to retain.

Question 88

A security engineer wants to prevent a web application from accepting malicious SQL commands through user input. Which control is MOST appropriate?

1. SQL injection prevention through parameterized queries
2. Network load balancing
3. File compression
4. Time synchronization

Correct Answer: 1

Explanation

Parameterized queries separate SQL commands from user-supplied data and are an effective defense against SQL injection. Instead of allowing input to become part of an executable SQL statement, the application treats supplied values as data. Additional protections can include input validation, least-privileged database accounts, secure coding practices, and web application firewalls. Load balancing, compression, and time synchronization do not directly prevent SQL injection. Security testing should verify that input-handling controls remain effective across expected and unexpected application inputs.

Question 89

Which security mechanism can replace sensitive payment information with a non-sensitive substitute value?

1. Tokenization
2. Hash cracking
3. Network routing
4. Packet fragmentation

Correct Answer: 1

Explanation

Tokenization replaces sensitive information with a token that can be used within approved systems without exposing the original value. The sensitive information is typically stored in a protected tokenization system, while other applications use the token instead. This can reduce the number of systems that directly handle sensitive payment information and may reduce the impact of a compromise. Tokenization is different from encryption because tokens do not necessarily contain the original value in a mathematically reversible form. Strong access controls and protection of the tokenization system remain essential.

Question 90

Which metric specifies how quickly a critical service should be restored after an outage?

1. RPO
2. RTO
3. MTBF
4. Hash value

Correct Answer: 2

Explanation

The recovery time objective (RTO) specifies the targeted maximum time within which a service or system should be restored after a disruption. Organizations use RTO values to design recovery strategies and determine whether technologies such as clustering, redundant infrastructure, or alternate processing locations are necessary. Recovery point objective (RPO) instead describes acceptable data loss measured in time. MTBF measures the expected time between failures, while a hash value supports integrity verification. Recovery requirements should be established according to business impact and operational priorities.

Question 91

Which control provides a record of actions performed by individual users?

1. Auditing
2. Compression
3. Load balancing
4. NAT

Correct Answer: 1

Explanation

Auditing records user and system activities so organizations can determine who performed an action, when it occurred, and what resources were involved. Audit logs support accountability, incident investigation, compliance, and detection of suspicious behavior. Logging should capture appropriate events without unnecessarily collecting sensitive information, and logs should be protected from unauthorized modification. Shared accounts can weaken accountability because multiple individuals may appear as the same identity. Strong identity management combined with centralized and protected audit logging provides better attribution of security-relevant actions.

Question 92

A company wants to identify weaknesses before deploying a new application. Which activity should be performed during development?

1. Security testing
2. Log deletion
3. Credential sharing
4. Unrestricted production access

Correct Answer: 1

Explanation

Security testing during development helps identify vulnerabilities before an application reaches production. Depending on the application and risk level, testing can include static analysis, dynamic testing, dependency analysis, authentication testing, authorization testing, and penetration testing. Finding weaknesses earlier generally provides more opportunity to correct design or implementation problems before deployment. Security testing should be integrated into the development lifecycle rather than treated as an activity performed only after release. Results should be documented, prioritized, remediated, and validated before production acceptance.

Question 93

Which technology is designed to analyze security events and correlate information from multiple sources?

1. SIEM
2. RAID
3. DHCP
4. UPS

Correct Answer: 1

Explanation

A security information and event management (SIEM) platform collects and correlates security events from multiple sources. It can combine logs from endpoints, servers, network devices, cloud services, identity systems, and applications to identify patterns that may indicate an attack. SIEM platforms commonly provide alerting, dashboards, investigation capabilities, and long-term event retention. RAID provides storage redundancy, DHCP assigns network configuration, and UPS provides power protection. Effective SIEM deployment requires appropriate log sources, useful detection rules, accurate timestamps, and regular tuning to reduce unnecessary alerts.

Question 94

A security team wants to reduce the damage caused if an attacker compromises one employee workstation. Which strategy is MOST effective?

1. Flat network architecture
2. Network segmentation
3. Shared credentials
4. Unrestricted administrator access

Correct Answer: 2

Explanation

Network segmentation limits communication between systems and security zones, reducing the opportunities available to an attacker after compromising a workstation. Sensitive servers, administrative systems, and critical applications can be placed into separate zones with narrowly defined communication paths. This can restrict lateral movement and reduce the potential scope of an intrusion. A flat network provides broader connectivity, while shared credentials and unrestricted administrative access can increase the consequences of compromise. Segmentation should be combined with endpoint protection, identity controls, monitoring, and least privilege.

Question 95

Which activity helps an organization determine what information would be affected by a security incident?

1. Data classification
2. Processor overclocking
3. Screen calibration
4. Cable testing

Correct Answer: 1

Explanation

Data classification categorizes information according to sensitivity, business value, regulatory requirements, or other defined criteria. Classification helps organizations determine which security controls should protect different types of information. During an incident, knowing whether affected data is public, internal, confidential, regulated, or highly sensitive can help determine response priorities, notification requirements, and potential impact. Classification should be supported by handling procedures, access controls, retention requirements, and secure disposal practices. Without appropriate classification, organizations may struggle to determine the significance of exposed information.

Question 96

Which approach provides temporary administrative privileges only when they are required?

1. Permanent privileged access
2. Just-in-time access
3. Anonymous access
4. Shared access

Correct Answer: 2

Explanation

Just-in-time access provides elevated privileges for a limited period rather than keeping administrative permissions permanently active. This reduces the time during which privileged credentials can be abused and supports stronger control over high-risk activities. Organizations may require approval, authentication, justification, or ticket references before granting access. Once the authorized period ends, privileges are automatically removed or expire. Just-in-time access is commonly implemented with privileged access management and should be supported by logging and monitoring so administrative actions can be reviewed.

Question 97

An organization wants to identify whether a cloud provider’s security practices meet its requirements before using the service. What should be performed?

1. Vendor risk assessment
2. Password sharing
3. Log removal
4. Unrestricted deployment

Correct Answer: 1

Explanation

A vendor risk assessment evaluates whether a provider’s security practices, controls, policies, and operational processes meet organizational requirements. For cloud services, the assessment may examine identity management, encryption, data location, incident response, vulnerability management, compliance, business continuity, subcontractors, and breach notification. Organizations should also review contractual responsibilities and independent assurance reports when appropriate. Vendor risk assessments help identify risks before sensitive information or critical workloads are transferred to a provider. The depth of assessment should reflect the service’s criticality and the sensitivity of the information involved.

Question 98

Which security control can isolate a compromised endpoint from the rest of the network while allowing security personnel to investigate it?

1. EDR network isolation
2. Load balancing
3. RAID mirroring
4. DNS caching

Correct Answer: 1

Explanation

Many endpoint detection and response (EDR) platforms provide network-isolation capabilities that can restrict a compromised endpoint’s communication while preserving security-team access for investigation. This can help contain malware, prevent lateral movement, and limit communication with command-and-control infrastructure. Isolation should be performed according to incident-response procedures because disconnecting a system may affect business operations or remove useful network evidence. Load balancing, RAID, and DNS caching do not provide endpoint containment. EDR isolation is one component of a broader incident-response and containment strategy.

Question 99

Which security requirement is MOST directly addressed by encrypting data stored on a database server?

1. Confidentiality
2. Availability
3. Scalability
4. Nonrepudiation

Correct Answer: 1

Explanation

Encryption of stored database information primarily protects confidentiality by making the data unreadable without the appropriate cryptographic key. This can reduce exposure if storage media, database files, or backups are accessed by unauthorized parties. Encryption does not automatically provide availability or prove who performed an action. Effective database security should also include access controls, auditing, secure key management, backup protection, and vulnerability management. Encryption should be applied according to data sensitivity and risk because protecting the data without protecting the keys would provide limited security value.

Question 100

A company discovers that its incident response procedures have not been tested for several years. What should the security team do?

1. Delete the existing procedures
2. Conduct an incident response exercise
3. Disable security monitoring
4. Remove escalation contacts

Correct Answer: 2

Explanation

An incident response exercise validates whether personnel, procedures, communication channels, technical controls, and decision-making processes work as expected during a security event. A tabletop exercise can begin with realistic scenarios and identify gaps without affecting production systems, while more advanced exercises can test technical response capabilities. Findings should be documented and used to update procedures, contact information, escalation paths, and response playbooks. Regular testing is important because environments and threats change over time, and an untested plan may fail when an actual incident occurs.