View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.

 

Question 101

Which security principle limits access to only the resources necessary for a specific task?

1. Availability
2. Least privilege
3. Nonrepudiation
4. Redundancy

Correct Answer: 2

Explanation

Least privilege ensures that users, applications, and systems receive only the permissions required to perform authorized tasks. Limiting permissions reduces the potential impact of compromised accounts, malicious activity, and accidental misuse. Privileges should be reviewed regularly and removed when no longer necessary. Role-based access control, privileged access management, and just-in-time access can help implement this principle. Least privilege should be applied to administrative accounts as well as application and service accounts because excessive permissions can provide attackers with additional opportunities for lateral movement.

Question 102

Which technology can detect suspicious activity by analyzing endpoint processes, files, and connections?

1. EDR
2. RAID
3. DHCP
4. UPS

Correct Answer: 1

Explanation

Endpoint detection and response (EDR) continuously collects security telemetry from endpoints and analyzes activities such as processes, file changes, network connections, and user behavior. EDR can generate alerts when suspicious patterns are detected and may provide response capabilities such as endpoint isolation. This visibility is valuable during both detection and investigation because analysts can examine what occurred on an individual system. RAID provides storage redundancy, DHCP supplies network configuration, and UPS provides power protection. EDR should be integrated with centralized monitoring and incident-response processes.

Question 103

What is the primary purpose of a compensating control?

1. Replace all security policies
2. Provide an alternative safeguard when the preferred control cannot be implemented
3. Eliminate the need for risk assessment
4. Remove all system monitoring

Correct Answer: 2

Explanation

A compensating control provides an alternative security measure when a required or preferred control cannot be implemented as originally intended. For example, if a legacy system cannot support a required security feature, network isolation, enhanced monitoring, or additional access restrictions may reduce the associated risk. The compensating control should provide an appropriate level of protection and be documented along with the reason it is required. Organizations should continue pursuing the preferred remediation where possible rather than treating the compensating control as a permanent replacement automatically.

Question 104

Which security technology is commonly used to protect web applications from malicious HTTP requests?

1. WAF
2. RAID
3. NTP
4. DHCP

Correct Answer: 1

Explanation

A web application firewall (WAF) filters HTTP and HTTPS traffic to protect web applications from attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer abuse. WAF rules can be customized according to application requirements and threat conditions. A WAF should complement secure coding, vulnerability management, authentication controls, and application testing rather than replace them. RAID provides storage redundancy, NTP synchronizes system clocks, and DHCP provides network configuration. Proper tuning is important because overly restrictive WAF rules can block legitimate application traffic.

Question 105

A security architect needs to ensure that two critical administrative tasks are performed by different individuals. Which principle should be applied?

1. Data minimization
2. Separation of duties
3. Elasticity
4. Federation

Correct Answer: 2

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals so that one person cannot complete a high-risk process without oversight. This reduces the opportunity for fraud, unauthorized changes, and abuse of privileged access. For example, one administrator may request a sensitive configuration change while another reviews and approves it. Separation of duties is particularly valuable for financial transactions, security administration, and other high-impact activities. It should be implemented carefully so that controls remain practical and do not create unnecessary operational delays or conflicts with legitimate emergency procedures.

Question 106

Which control helps identify whether an application contains known vulnerable third-party components?

1. Software composition analysis
2. Load balancing
3. Network address translation
4. Disk defragmentation

Correct Answer: 1

Explanation

Software composition analysis (SCA) examines application dependencies and third-party components to identify known vulnerabilities, outdated packages, licensing concerns, and other risks. Modern applications frequently rely on open-source libraries, making dependency visibility important for software supply-chain security. SCA tools can compare component versions against vulnerability databases and help development teams prioritize updates. SCA does not replace source-code analysis or penetration testing because different security issues require different techniques. Organizations should maintain an inventory of software components and establish processes for responding to newly discovered dependency vulnerabilities.

Question 107

Which security measure protects a backup from being altered or deleted by ransomware affecting production systems?

1. Immutable backup
2. Shared administrator account
3. Public file share
4. Unrestricted write access

Correct Answer: 1

Explanation

Immutable backups are designed so that stored backup data cannot be altered or deleted during a defined protection period. This can help protect recovery data from ransomware and other attacks that attempt to destroy backups before encrypting production systems. Immutability should be combined with access controls, separate credentials, monitoring, and regular restoration testing. Simply storing a backup on another server does not necessarily protect it if attackers can access that server using compromised administrative credentials. Organizations should also consider geographic separation and appropriate backup retention requirements.

Question 108

Which metric identifies the maximum acceptable period of data loss?

1. RTO
2. SLA
3. RPO
4. MTTR

Correct Answer: 3

Explanation

The recovery point objective (RPO) identifies the amount of data loss an organization can tolerate, normally expressed as a period of time. For example, a 30-minute RPO indicates that recovery should ideally restore data to a point no more than 30 minutes before the disruption. RTO instead measures the targeted restoration time for a service. MTTR measures repair or recovery performance, while an SLA defines agreed service expectations. RPO requirements influence backup frequency, replication methods, and other data-protection strategies.

Question 109

An organization wants to prevent sensitive information from leaving endpoints through unauthorized USB devices. Which control is MOST appropriate?

1. Endpoint DLP
2. DNS
3. Load balancer
4. NTP

Correct Answer: 1

Explanation

Endpoint data loss prevention (DLP) can monitor and control sensitive information leaving endpoints through channels such as removable media, applications, email, or network connections. Policies can identify specific data types and block, alert, or require authorization for prohibited transfers. Organizations can also restrict USB storage through endpoint management policies, but DLP provides additional visibility into the information being transferred. DNS, load balancing, and NTP serve different infrastructure purposes. Endpoint controls should be designed carefully to protect sensitive information without unnecessarily disrupting legitimate business workflows.

Question 110

Which security practice BEST reduces the risk of unauthorized changes to production systems?

1. Change management
2. Shared passwords
3. Anonymous access
4. Unrestricted deployment

Correct Answer: 1

Explanation

Change management provides a controlled process for requesting, reviewing, approving, testing, implementing, and documenting changes to production systems. It helps organizations evaluate security and operational risks before modifications are introduced. Proper change management can require approvals, maintenance windows, rollback plans, testing evidence, and post-implementation verification. Emergency changes may follow an accelerated process but should still be documented and reviewed afterward. Shared passwords and unrestricted deployment weaken accountability and increase the possibility that unauthorized or poorly tested changes will affect production environments.

Question 111

Which capability allows an organization to verify that a user is authorized to perform a specific action after authentication?

1. Authorization
2. Encryption
3. Hashing
4. Accounting

Correct Answer: 1

Explanation

Authorization determines what an authenticated user, application, or service is permitted to access or perform. Authentication establishes identity, while authorization evaluates permissions associated with that identity. For example, a user may successfully authenticate to an application but still be prohibited from viewing administrative settings. Effective authorization should follow least privilege and may use role-based, attribute-based, or policy-based access controls. Organizations should also log important authorization decisions so that inappropriate access can be detected and investigated.

Question 112

A security team wants to identify weaknesses caused by incorrect operating system settings across thousands of servers. Which solution would help most?

1. Configuration compliance assessment
2. File compression
3. Video conferencing
4. Network load balancing

Correct Answer: 1

Explanation

Configuration compliance assessments compare systems against approved security baselines or configuration standards. They can identify settings that violate organizational requirements, such as unnecessary services, weak authentication configurations, excessive permissions, or insufficient logging. Automated compliance tools can make this process practical across large server environments. Findings can then be prioritized and remediated through controlled configuration management. Configuration compliance is different from vulnerability scanning because a system can have a secure baseline issue even when no specific software vulnerability is detected.

Question 113

Which security concept assumes that access should be continuously verified rather than automatically trusted?

1. Zero trust
2. Open access
3. Implicit trust
4. Perimeter-only security

Correct Answer: 1

Explanation

Zero trust requires organizations to avoid automatically trusting users or devices based solely on network location or previous authentication. Access decisions should consider identity, device condition, resource sensitivity, and other relevant context. Continuous verification and least privilege can reduce the impact of compromised credentials and limit lateral movement. Zero trust does not mean that every request is denied; legitimate requests are evaluated against policy and granted only the required level of access. Organizations generally implement zero trust through multiple technologies and governance practices rather than a single product.

Question 114

Which control is MOST useful for protecting an encryption key from unauthorized administrative access?

1. Plaintext storage
2. Hardware security module
3. Shared spreadsheet
4. Public repository

Correct Answer: 2

Explanation

A hardware security module (HSM) provides specialized protection for cryptographic keys and can perform cryptographic operations within a controlled hardware environment. HSMs can support secure key generation, storage, use, and management while providing strong access controls and auditing. Depending on the model, tamper-resistant features can provide additional protection. Storing keys in plaintext files, spreadsheets, or public repositories creates significant exposure. Organizations using HSMs should still establish appropriate key-management policies, administrative separation, backup procedures, and recovery processes to ensure keys remain protected and available when required.

Question 115

Which activity is MOST appropriate for determining whether a cloud provider meets organizational security requirements before onboarding?

1. Vendor security assessment
2. Password reuse
3. Log deletion
4. Anonymous testing

Correct Answer: 1

Explanation

A vendor security assessment evaluates the provider’s security controls, processes, compliance posture, data handling, incident response, availability, access management, and other relevant requirements. For a cloud provider, the organization should also examine the shared responsibility model and determine which controls remain the customer’s responsibility. Contracts should address important security obligations, notification requirements, audit rights, and data handling expectations where appropriate. The depth of assessment should reflect the sensitivity of the data and criticality of the service rather than applying exactly the same process to every vendor.

Question 116

Which attack specifically attempts to overwhelm a service with excessive traffic or requests?

1. DDoS
2. Phishing
3. Credential stuffing
4. Privilege escalation

Correct Answer: 1

Explanation

A distributed denial-of-service (DDoS) attack attempts to make a service unavailable by overwhelming it with traffic, requests, or resource consumption. Distributed attacks commonly use many compromised systems, making simple blocking more difficult. Organizations can reduce exposure through DDoS protection services, rate limiting, traffic filtering, scalable architectures, redundant infrastructure, and appropriate incident-response procedures. DDoS attacks primarily target availability rather than directly seeking data theft. However, attackers may use a service disruption as a distraction while conducting other malicious activity, so monitoring should continue during the event.

Question 117

Which method provides evidence that a downloaded file has not changed since its expected version?

1. Hash comparison
2. Load balancing
3. NAT
4. VLAN tagging

Correct Answer: 1

Explanation

A cryptographic hash produces a fixed-length value derived from data. Comparing the calculated hash of a downloaded file with a trusted reference value can help determine whether the file has changed. A mismatch indicates that the contents differ, although the hash alone does not establish who produced the file or whether the original file was trustworthy. Digital signatures can provide stronger authenticity and integrity assurances when a trusted signer is involved. Hash verification is commonly used for software downloads, forensic evidence, and file-integrity monitoring.

Question 118

A company wants to make security monitoring available even if its primary SIEM server fails. Which architecture is MOST appropriate?

1. Single-server deployment
2. Redundant SIEM infrastructure
3. Manual log deletion
4. Local-only logging

Correct Answer: 2

Explanation

Redundant SIEM infrastructure reduces dependence on a single monitoring component and helps maintain security visibility during failures. Organizations may use clustered systems, redundant collectors, replicated storage, geographically separated components, or cloud-based failover capabilities depending on their requirements. The design should also address log buffering so events are not lost during temporary outages. A single SIEM server creates a potential single point of failure, while local-only logging can make centralized investigation difficult. High availability should be tested periodically to verify that failover mechanisms operate as expected.

Question 119

Which security activity attempts to determine how an attacker could move from one compromised system to another?

1. Attack path analysis
2. Data compression
3. Certificate renewal
4. Storage formatting

Correct Answer: 1

Explanation

Attack path analysis examines how an attacker could progress through an environment after gaining an initial foothold. It can identify trust relationships, excessive permissions, exposed services, network connectivity, and other conditions that enable lateral movement or privilege escalation. Security architects can use this information to prioritize segmentation, identity controls, least privilege, monitoring, and other mitigations. Attack path analysis is particularly useful in complex enterprise and cloud environments where many systems are interconnected. It complements vulnerability management by considering how multiple weaknesses may combine into a practical attack route.

Question 120

A company discovers that an employee has excessive permissions that are no longer required. What should the organization do?

1. Increase the permissions
2. Remove unnecessary privileges
3. Share the account with another employee
4. Disable all auditing

Correct Answer: 2

Explanation

Unnecessary permissions should be removed to maintain least privilege and reduce the potential impact of account compromise or misuse. Access reviews should identify privileges that are no longer required because of role changes, project completion, organizational changes, or outdated access assignments. Organizations can automate parts of this process through identity governance and privileged access management solutions. Removing unnecessary access should be documented and performed through appropriate change procedures. Regular access recertification is important because excessive privileges can accumulate over time if organizations do not review them systematically.