{"id":22017,"date":"2026-09-25T10:30:17","date_gmt":"2026-09-25T10:30:17","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=22017"},"modified":"2026-09-25T10:30:17","modified_gmt":"2026-09-25T10:30:17","slug":"comptia-securityx-cas-005-practice-test-questions-and-exam-dumps-part17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-securityx-cas-005-practice-test-questions-and-exam-dumps-part17-q321-340\/","title":{"rendered":"CompTIA SecurityX CAS-005 Practice Test Questions and Exam Dumps Part17 Q321-340"},"content":{"rendered":"

View Full <\/b>CompTIA CAS-005 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 321<\/b><\/h3>\n

Which security control can prevent unauthorized software from running on a high-value server?<\/b><\/p>\n

    \n
  1. Application allowlisting<\/span><\/li>\n
  2. Network address translation<\/span><\/li>\n
  3. Data replication<\/span><\/li>\n
  4. Log compression<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Application allowlisting restricts software execution to applications that have been explicitly approved by the organization. On high-value servers, this can reduce the risk of unauthorized tools, malware, and unapproved executables being launched. Policies may use application hashes, trusted publishers, file paths, or other attributes to determine what is permitted. Allowlisting should be carefully tested because legitimate updates and administrative tools must remain functional. It works best as part of a broader defense-in-depth strategy that includes patching, least privilege, monitoring, and endpoint protection.<\/span><\/p>\n

    Question 322<\/b><\/h3>\n

    A security administrator wants to grant elevated privileges only for the duration of a maintenance task. Which approach should be used?<\/b><\/p>\n

      \n
    1. Permanent administrator rights<\/span><\/li>\n
    2. Just-in-time privileged access<\/span><\/li>\n
    3. Shared administrator credentials<\/span><\/li>\n
    4. Anonymous access<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Just-in-time privileged access provides elevated permissions only when they are required and for a limited period. After the approved maintenance task or time window ends, the privileges can be automatically removed. This reduces the exposure created by standing administrative permissions and limits the opportunity for attackers to abuse compromised privileged accounts. Organizations can strengthen this approach with approval workflows, multifactor authentication, session recording, and detailed logging. Just-in-time access is especially valuable for administrators and third-party personnel who need occasional access to critical infrastructure.<\/span><\/p>\n

      Question 323<\/b><\/h3>\n

      Which security process determines whether an organization can continue operating during a major disruption?<\/b><\/p>\n

        \n
      1. Business continuity planning<\/span><\/li>\n
      2. Password auditing<\/span><\/li>\n
      3. Certificate enrollment<\/span><\/li>\n
      4. Vulnerability scanning<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Business continuity planning identifies how an organization will maintain critical business functions during and after disruptive events. It addresses people, processes, technology, facilities, communications, dependencies, and alternative operating arrangements. Business continuity planning is broader than technical disaster recovery because it considers the continuity of business operations rather than only restoring IT systems. Plans should be based on business impact analysis and tested periodically. Testing can reveal gaps in communication, staffing, dependencies, alternate facilities, and recovery procedures before an actual disruption occurs.<\/span><\/p>\n

        Question 324<\/b><\/h3>\n

        Which control can identify an attacker attempting to move laterally through an enterprise network?<\/b><\/p>\n

          \n
        1. Network segmentation monitoring<\/span><\/li>\n
        2. Data compression<\/span><\/li>\n
        3. Certificate archiving<\/span><\/li>\n
        4. Backup deduplication<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Monitoring traffic between segmented network zones can help identify suspicious lateral movement attempts. Security teams can examine unusual connections, unexpected protocols, authentication activity, and communication between systems that normally have limited interaction. Network segmentation itself restricts movement, while monitoring provides visibility into attempts to cross those boundaries. Combining segmentation with SIEM correlation, endpoint telemetry, and network detection capabilities can provide stronger detection. Organizations should establish expected communication patterns so that unusual internal traffic can be investigated without generating excessive false positives.<\/span><\/p>\n

          Question 325<\/b><\/h3>\n

          A company needs to determine whether a new application exposes sensitive information through unnecessary API responses. Which activity is most appropriate?<\/b><\/p>\n

            \n
          1. Application security testing<\/span><\/li>\n
          2. Backup restoration<\/span><\/li>\n
          3. Password rotation<\/span><\/li>\n
          4. Asset disposal<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Application security testing can evaluate whether an application or API exposes information beyond what is required for legitimate functionality. Testing may examine authentication, authorization, input validation, API responses, error messages, data exposure, and other application behaviors. Security teams can identify excessive data disclosure and recommend changes such as response filtering, stronger authorization checks, or data minimization. Testing should occur throughout the development lifecycle because vulnerabilities discovered before production are generally easier to correct. API security should also be supported by proper authentication, logging, and monitoring.<\/span><\/p>\n

            Question 326<\/b><\/h3>\n

            Which cryptographic concept allows an organization to replace an older algorithm with a stronger one without redesigning the entire application?<\/b><\/p>\n

              \n
            1. Cryptographic agility<\/span><\/li>\n
            2. Data masking<\/span><\/li>\n
            3. Network segmentation<\/span><\/li>\n
            4. Tokenization<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Cryptographic agility is the ability of systems and applications to change cryptographic algorithms, protocols, or key sizes without requiring major architectural redesign. This capability is important because cryptographic standards may become weak, deprecated, or unsuitable as threats and computing capabilities evolve. Applications designed with cryptographic agility can transition more efficiently to stronger algorithms when required. Organizations should avoid hard-coding cryptographic choices throughout application logic and instead use configurable, well-managed cryptographic libraries and services. Planning for algorithm changes also supports long-term security and compliance requirements.<\/span><\/p>\n

              Question 327<\/b><\/h3>\n

              Which security measure is most appropriate for protecting a private key used by a certificate authority?<\/b><\/p>\n

                \n
              1. HSM<\/span><\/li>\n
              2. Load balancer<\/span><\/li>\n
              3. Network proxy<\/span><\/li>\n
              4. DNS server<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                A hardware security module can provide strong protection for sensitive private keys used by certificate authorities. Certificate authority private keys are highly valuable because compromise could allow an attacker to issue fraudulent certificates that appear trustworthy. HSMs can provide secure key storage, cryptographic operations, and tamper-resistant protections. Organizations should also restrict administrative access, maintain appropriate backups where permitted, monitor key usage, and establish procedures for key rotation and recovery. Protecting certificate authority keys is a critical part of maintaining trust in a public key infrastructure.<\/span><\/p>\n

                Question 328<\/b><\/h3>\n

                An organization wants to ensure that users receive access based on both their job role and the sensitivity of the requested resource. Which model is most appropriate?<\/b><\/p>\n

                  \n
                1. Contextual access control<\/span><\/li>\n
                2. Unrestricted access<\/span><\/li>\n
                3. Anonymous authorization<\/span><\/li>\n
                4. Shared-account access<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Contextual access control can evaluate multiple characteristics before granting access, including user identity, role, device status, location, resource sensitivity, time, and other environmental conditions. This allows organizations to make more precise authorization decisions than simple role-only models. For example, an employee may normally access a sensitive application from a managed corporate device but receive additional verification when attempting access from an unknown device. Contextual policies support zero trust principles by evaluating the circumstances of each access request rather than relying solely on an assumed trusted network location.<\/span><\/p>\n

                  Question 329<\/b><\/h3>\n

                  Which process ensures that security requirements are included in a contract with a third-party service provider?<\/b><\/p>\n

                    \n
                  1. Contractual security requirements<\/span><\/li>\n
                  2. Password synchronization<\/span><\/li>\n
                  3. Local backup rotation<\/span><\/li>\n
                  4. Endpoint defragmentation<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Contractual security requirements formally establish the security obligations of a third-party provider. Contracts can define requirements for data protection, access control, encryption, incident notification, vulnerability management, audit rights, regulatory compliance, retention, subcontractors, and termination procedures. Including these requirements in contracts provides a formal basis for holding vendors accountable. Organizations should align contractual requirements with the sensitivity of the service and information involved. Vendor monitoring and periodic assessments should then verify whether the provider continues to meet the agreed requirements throughout the relationship.<\/span><\/p>\n

                    Question 330<\/b><\/h3>\n

                    Which metric measures the average time required to recover from or resolve a security incident?<\/b><\/p>\n

                      \n
                    1. RPO<\/span><\/li>\n
                    2. MTTR<\/span><\/li>\n
                    3. RTO<\/span><\/li>\n
                    4. MTTD<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Mean Time to Respond or Recover, commonly represented as MTTR depending on organizational usage, measures the average time required to address an incident or restore normal operations after detection. Organizations use this metric to evaluate the effectiveness of incident-response and recovery processes. A lower MTTR can indicate that teams are able to contain, remediate, and recover from incidents efficiently, although the metric should be interpreted alongside incident complexity and severity. MTTD focuses on detection time, while RTO is a business recovery objective rather than an incident-response performance metric.<\/span><\/p>\n

                      Question 331<\/b><\/h3>\n

                      Which security mechanism prevents unauthorized changes to a system configuration by automatically restoring an approved state?<\/b><\/p>\n

                        \n
                      1. Configuration enforcement<\/span><\/li>\n
                      2. Data classification<\/span><\/li>\n
                      3. Email filtering<\/span><\/li>\n
                      4. Network translation<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Configuration enforcement ensures that systems maintain approved security settings and can automatically remediate unauthorized deviations. For example, an endpoint management platform may detect that a required security setting has been changed and restore the approved configuration. This helps reduce configuration drift and limits the time during which systems operate in an insecure state. Configuration enforcement should be based on documented security baselines and integrated with change management so that authorized modifications are not incorrectly treated as violations. Continuous monitoring provides additional visibility into configuration changes.<\/span><\/p>\n

                        Question 332<\/b><\/h3>\n

                        A security team suspects that attackers are using legitimate credentials to access systems. Which capability is most useful for identifying unusual account behavior?<\/b><\/p>\n

                          \n
                        1. UEBA<\/span><\/li>\n
                        2. RAID<\/span><\/li>\n
                        3. NAT<\/span><\/li>\n
                        4. Compression<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          User and Entity Behavior Analytics can identify unusual activity associated with otherwise legitimate accounts. Attackers who obtain valid credentials may avoid traditional malware detection, making behavioral analysis particularly valuable. UEBA can identify anomalies such as unusual login locations, abnormal access times, unexpected resource access, or sudden increases in administrative activity. Analysts should correlate these findings with authentication logs, endpoint telemetry, VPN information, and known user behavior. An anomaly does not automatically prove compromise, so investigators should evaluate context before taking disruptive response actions.<\/span><\/p>\n

                          Question 333<\/b><\/h3>\n

                          Which recovery architecture maintains two environments capable of processing workloads simultaneously?<\/b><\/p>\n

                            \n
                          1. Active-active<\/span><\/li>\n
                          2. Cold site<\/span><\/li>\n
                          3. Offline backup<\/span><\/li>\n
                          4. Manual recovery<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            An active-active architecture maintains two or more environments that can simultaneously process workloads. If one environment becomes unavailable, traffic can be redirected or shifted to the remaining environment with limited interruption. This design can provide strong availability and support rapid failover, but it introduces complexity involving data consistency, synchronization, application state, networking, and operational management. Active-passive architectures are different because one environment normally remains on standby until needed. The appropriate design depends on recovery objectives, application characteristics, geographic requirements, and available resources.<\/span><\/p>\n

                            Question 334<\/b><\/h3>\n

                            Which activity should be performed before accepting a significant residual security risk?<\/b><\/p>\n

                              \n
                            1. Risk analysis and documented approval<\/span><\/li>\n
                            2. Deleting the risk record<\/span><\/li>\n
                            3. Disabling security monitoring<\/span><\/li>\n
                            4. Removing the affected asset<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Before accepting significant residual risk, the organization should evaluate the remaining exposure and obtain documented approval from the appropriate risk owner or authority. Risk acceptance should be based on a clear understanding of likelihood, impact, existing controls, compensating measures, and business justification. The decision should include an appropriate review or expiration date when applicable. Simply deleting the risk record does not reduce the underlying exposure. Formal documentation provides accountability and allows leadership to reassess the decision when conditions or threat levels change.<\/span><\/p>\n

                              Question 335<\/b><\/h3>\n

                              Which technology helps secure communications between a user and a remote private network over an untrusted connection?<\/b><\/p>\n

                                \n
                              1. VPN<\/span><\/li>\n
                              2. RAID<\/span><\/li>\n
                              3. HSM<\/span><\/li>\n
                              4. DLP<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                A virtual private network, or VPN, creates a protected communication channel across an untrusted network such as the public internet. Depending on the implementation, a VPN can provide confidentiality, integrity, authentication, and secure routing between authorized endpoints or networks. VPN security depends on strong cryptographic protocols, secure authentication, proper configuration, and current software. Organizations should also apply least privilege and access controls after the VPN connection is established. A VPN protects the communication path but does not automatically make the connected endpoint or internal resources trustworthy.<\/span><\/p>\n

                                Question 336<\/b><\/h3>\n

                                Which control helps ensure that employees understand how to identify and report suspicious phishing messages?<\/b><\/p>\n

                                  \n
                                1. Security awareness training<\/span><\/li>\n
                                2. Database replication<\/span><\/li>\n
                                3. Network address translation<\/span><\/li>\n
                                4. Certificate pinning<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Security awareness training teaches employees how to recognize and appropriately respond to common security threats such as phishing, social engineering, malicious attachments, and suspicious links. Effective programs should provide practical guidance and explain how employees can report suspected incidents through approved channels. Organizations may supplement training with simulated phishing exercises and follow-up education. Awareness does not replace technical controls such as email filtering, multifactor authentication, and endpoint protection, but it can reduce the likelihood that users will unintentionally assist attackers.<\/span><\/p>\n

                                  Question 337<\/b><\/h3>\n

                                  A company wants to ensure that a software package was produced by its authorized development organization. Which control provides this assurance?<\/b><\/p>\n

                                    \n
                                  1. Code signing<\/span><\/li>\n
                                  2. Data masking<\/span><\/li>\n
                                  3. Network segmentation<\/span><\/li>\n
                                  4. Backup encryption<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Code signing uses a digital signature to associate software with an authorized publisher and provide evidence that the signed content has not been altered after signing. The recipient can verify the signature using the publisher’s trusted public key. This helps users and systems distinguish approved software from unauthorized or modified packages. The security of code signing depends heavily on protecting the private signing key and maintaining a trustworthy certificate lifecycle. Organizations should also secure build pipelines and restrict who can authorize or publish signed software.<\/span><\/p>\n

                                    Question 338<\/b><\/h3>\n

                                    Which process helps determine whether a vulnerability should be remediated immediately or scheduled for later?<\/b><\/p>\n

                                      \n
                                    1. Risk-based vulnerability prioritization<\/span><\/li>\n
                                    2. Random patch selection<\/span><\/li>\n
                                    3. Log compression<\/span><\/li>\n
                                    4. Password synchronization<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Risk-based vulnerability prioritization considers factors such as vulnerability severity, exploitability, asset criticality, exposure, business impact, available compensating controls, and threat intelligence. A critical vulnerability on an internet-facing production system may require immediate remediation, while a lower-risk issue on an isolated system may be scheduled later. This approach helps organizations focus limited remediation resources on vulnerabilities that create the greatest practical risk. Vulnerability management should include defined remediation timelines, exception processes, validation of fixes, and continuous reassessment as threat conditions change.<\/span><\/p>\n

                                      Question 339<\/b><\/h3>\n

                                      Which security capability can identify sensitive information stored across multiple repositories before protection policies are applied?<\/b><\/p>\n

                                        \n
                                      1. Data discovery<\/span><\/li>\n
                                      2. Load balancing<\/span><\/li>\n
                                      3. Certificate revocation<\/span><\/li>\n
                                      4. Network routing<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Data discovery identifies where organizational information is stored across systems, applications, databases, endpoints, cloud services, and other repositories. It can help security teams locate sensitive or regulated information that may otherwise be unknown or poorly protected. Discovery is often combined with data classification so that appropriate controls can be applied according to sensitivity. Accurate data discovery supports DLP, encryption, retention management, access reviews, and compliance activities. Organizations should periodically repeat discovery because new data stores and applications can appear as environments change.<\/span><\/p>\n

                                        Question 340<\/b><\/h3>\n

                                        Which security design principle requires systems to remain protected even when a component or control fails?<\/b><\/p>\n

                                          \n
                                        1. Fail-safe design<\/span><\/li>\n
                                        2. Single-factor authentication<\/span><\/li>\n
                                        3. Open access<\/span><\/li>\n
                                        4. Shared administration<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Fail-safe design considers how a system should behave when a component, security control, or service fails. The objective is to prevent failures from automatically creating unacceptable security exposure. Depending on the system, this may mean denying access when an authorization service becomes unavailable or placing a system into a restricted operating mode. Fail-safe behavior should be selected according to security and availability requirements because denying all access may itself create operational consequences. Architects should explicitly define expected failure behavior and validate it through testing.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA CAS-005 Exam Dumps and Practice Test Dumps.   Question 321 Which security control can prevent unauthorized software from running on a high-value server? Application allowlisting Network address translation Data replication Log compression Correct Answer: 1 Explanation Application allowlisting restricts software execution to applications that have been explicitly approved by the organization. On […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22017"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=22017"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22017\/revisions"}],"predecessor-version":[{"id":22018,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22017\/revisions\/22018"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=22017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=22017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=22017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}