CompTIA CAS-005 Online Practice Questions and Exam Preparation

CompTIA CAS-005 Online Questions & Answers

• Question 1:

  DRAG DROP

  IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern.

  Options may be used once or not at all.

  Select and Place:

  

  

  Explanation

  Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.

  With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.

  Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.

  SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.

  No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.

  Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.

  Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.

  The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.

• Question 2:

  Due to locality and budget constraints, an organization's satellite office has a lower bandwidth allocation than other offices. As a result, the local security infrastructure staff is assessing architectural options that will help preserve network bandwidth and increase speed to both internal and external resources while not sacrificing threat visibility.

  Which of the following would be the best option to implement?

  A. Distributed connection allocation
  B. Local caching
  C. Content delivery network
  D. SD-WAN vertical heterogeneity
  B. Local caching

  ---

  Explanation

  The goal is to optimize bandwidth, increase speed, and maintain threat visibility in a low-bandwidth satellite office.Local cachingstores frequently accessed data locally, reducing bandwidth usage by minimizing repeated requests to external or internal resources. It speeds up access and doesn't inherently reduce security visibility if paired with monitoring tools.

  Option A:Distributed connection allocation might balance traffic but doesn't directly reduce bandwidth usage or speed up access.

  Option B:Local caching is ideal--reduces bandwidth, improves performance, and maintains visibility with proper security controls.

  Option C:A CDN is great for external content delivery but less relevant for internal resources and doesn't inherently address threat visibility.

  Option D:SD-WAN improves WAN performance, but "vertical heterogeneity" is vague and not a standard term; it's less tailored to this scenario than caching.

  References:

  CompTIA SecurityX CAS-005 Domain

  2: Security Architecture ?Network Optimization and Security.

• Question 3:

  A senior security engineer flags the following log file snippet as having likely facilitated an attacker's lateral movement in a recent breach:

  

  Which of the following solutions, if implemented, would mitigate the risk of this issue reoccurring?

  A. Disabling DNS zone transfers
  B. Restricting DNS traffic to UDP/53
  C. Implementing DNS masking on internal servers
  D. Permitting only clients from internal networks to query DNS
  A. Disabling DNS zone transfers

  ---

  Explanation

  The log shows an AXFR (zone transfer) query, which exposed internal DNS records, aiding lateral movement.

  Let's evaluate:

  A. Disabling DNS zone transfers:AXFR allows full DNS zone data to be transferred. Disabling it externally prevents attackers from mapping internal networks, directly mitigating this issue per CAS-005's security operations focus.

  B. Restricting to UDP/53:AXFR uses TCP/53, so this wouldn't stop it.

  C. DNSmasking:Obscures records but isn't a standard term for this fix.

  References:

  CompTIA SecurityX (CAS-005) objectives, Domain 2: Security Operations, covering DNS security.

• Question 4:

  A commercial OSINT provider utilizes and reviews data from various sources of publicly available information. The provider is transitioning the subscription service to a model that limit's the scope of available data based on subscription tier.

  Which of the following approaches would best ensure subscribers are only granted access to data associated with their tier? (Choose two.)

  A. Storing collected data on separate physical media per tier
  B. Controlling access to data based on the role of users
  C. Employing attribute-based access control
  D. Implementing a behavior-based IDS positioned at the storage network gateway
  E. Establishing a classification and labeling scheme
  F. Implementing a mandatory access control scheme
  B. Controlling access to data based on the role of users
  E. Establishing a classification and labeling scheme

• Question 5:

  A penetration tester is drafting a report of findings and recommendations. Multiple EOL biomedical devices were compromised using a combination of known-exploit payloads for CVEs and VLAN hopping. The tester acknowledges that the systems cannot be changed or replaced in the hospital due to regulatory, safety, and cost reasons.

  Which of the following are the most effective controls for this scenario? (Select two).

  A. Deploying an IDS with active response for threat activities from a network tap
  B. Implementing QoS that limits the throughput of the link speeds from some VLANs
  C. Limiting trunking protocols to specific uplink ports of access switches
  D. Adding a proxy and requiring medical staff to authenticate every connection
  E. Inserting an in-line IPS between network segments of the affected hosts
  F. Performing security awareness training for these device users
  C. Limiting trunking protocols to specific uplink ports of access switches
  E. Inserting an in-line IPS between network segments of the affected hosts

  ---

  Explanation

  The best two controls are C and E because the scenario has two distinct technical problems: the biomedical devices are EOL and vulnerable to known CVEs, and the attacker also used VLAN hopping.

  Since the devices cannot be patched, replaced, or materially changed, the strongest response is to apply compensating network controls around them. That makes this primarily a Security Architecture question focused on segmentation and preventive controls. CompTIA's official SecurityX CAS-005 objectives explicitly include "Network architecture: segmentation, microsegmentation..." and also list "proactive, detective, and preventative controls" as part of control strategy design.

  Why C is correct: Limiting trunking protocols to specific uplink ports of access switches directly addresses the VLAN hopping portion of the attack. VLAN hopping commonly succeeds when switch ports are incorrectly allowed to negotiate or carry trunk traffic where they should function only as access ports.

  Restricting trunking to designated uplinks reduces the chance that an attacker can pivot between VLANs by abusing switch behavior. This fits CompTIA's official SecurityX objective area covering network segmentation and secure boundary enforcement.

  Why E is correct:

  Inserting an in-line IPS between network segments of the affected hosts is the strongest compensating control for the known CVE exploit traffic against EOL devices. Because the systems cannot be updated, an in-line IPS can actively inspect and block malicious payloads moving between segments. This is much more effective than passive monitoring alone because it is a preventive control, not just a detective one.

  CompTIA's official SecurityX objectives specifically emphasize preventative controls and segmentation / microsegmentation, which is exactly what this design uses to protect unpatchable assets.

  Why the other options are not the best answers:

  A. IDS with active response from a network tap is weaker than an in-line IPS in this case. A network tap is out-of-band, so detection may help visibility, but it does not provide the same direct traffic-blocking capability as an in-line preventive control. In a hospital with unpatchable biomedical systems, prevention at segmentation boundaries is more effective than relying mainly on monitoring. CompTIA's objectives distinguish between detective and preventative controls, and this scenario clearly favors prevention.

  B. QoS limiting throughput does not address either root cause. Lower bandwidth does not stop CVE exploitation and does not prevent VLAN hopping. It may reduce traffic volume, but it is not a meaningful security mitigation for the attack described.

  D. Adding a proxy and requiring staff authentication every connection is not the most effective answer because the compromise described is tied to device vulnerabilities and network segmentation weaknesses, not primarily to user authentication. It also may be operationally unsuitable for biomedical workflows.

  F. Security awareness training is valuable in general, but it is not an effective primary control for exploit payloads against EOL medical devices or VLAN hopping. The problem is architectural and technical, so the answer must also be architectural and technical. Official extract alignment: A short official extract from CompTIA's SecurityX CAS-005 objectives summary that supports this answer is: "Network architecture: segmentation, microsegmentation..." and "Cloud control strategies: proactive, detective, and preventative controls...". Also, in CompTIA's official SecurityX practice questions, CompTIA gives a related design pattern for constrained/embedded devices: "Operating IoT devices on a separate network with no access to other devices internally", which reinforces isolation and segmentation as the preferred control approach for hard-to-modify devices.

  References:

  CompTIA SecurityX (CAS-005) official certification page and exam objectives summary. CompTIA SecurityX (V5) official practice questions, especially the separate-network control example for IoT devices.

• Question 6:

  Before launching a new web application, an organization would like to perform security testing.

  Which of the following resources should the organization use to determine the objectives for the test?

  A. CASB
  B. SOAR
  C. OWASP
  D. ISAC
  C. OWASP

• Question 7:

  A company that relies on an COL system must keep it operating until a new solution is available.

  Which of the following is the most secure way to meet this goal?

  A. Isolating the system and enforcing firewall rules to allow access to only required endpoints
  B. Enforcing strong credentials and improving monitoring capabilities
  C. Restricting system access to perform necessary maintenance by the IT team
  D. Placing the system in a screened subnet and blocking access from internal resources
  A. Isolating the system and enforcing firewall rules to allow access to only required endpoints

  ---

  Explanation

  To ensure the most secure way of keeping a legacy system (COL) operating until a new solution is available, isolating the system and enforcing strict firewall rules is the best approach. This method minimizes the attack surface by restricting access to only the necessary endpoints, thereby reducing the risk of unauthorized access and potential security breaches. Isolating the system ensures that it is not exposed to the broader network, while firewall rules control the traffic that can reach the system, providing a secure environment until a replacement is implemented.

  References:

  CompTIA SecurityX Study Guide: Recommends network isolation and firewall rules as effective measures for securing legacy systems. NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security": Advises on isolating critical systems and using firewalls to control access.

  "Network Security Assessment" by Chris McNab: Discusses techniques for isolating systems and enforcing firewall rules to protect vulnerable or legacy systems. By isolating the system and implementing strict firewall controls, the organization can maintain the necessary operations securely while working on deploying a new solution.

• Question 8:

  The Chief Information Security Officer (CISO) reviews some reports indicating that the length of time to patch endpoints with vulnerabilities has been steadily increasing. Many endpoints are missing security agents, and the number of unapproved BYOD endpoints has increased.

  Which of the following would be best to address the CISO ' s security concerns?

  A. Using an Always On VPN for remote staff to receive patches faster
  B. Implementing Conditional Access with device certifications and compliance requirements
  C. Writing a formal BYOD policy to enforce application containerization and receive board approval
  D. Using compliance baselines in the MDM to ensure all endpoints receive the required agents
  B. Implementing Conditional Access with device certifications and compliance requirements

  ---

  Explanation

  The best answer is B. Implementing Conditional Access with device certifications and compliance requirements. The CISO's concerns are not only about patch latency; they also include missing security agents and a rise in unapproved BYOD endpoints. Conditional Access tied to device identity, compliance posture, and certificates can block or limit access from unmanaged or noncompliant devices. That directly addresses all three concerns at once: only compliant devices with required controls can access enterprise resources, which pressures patching hygiene, ensures agent presence, and reduces unauthorized BYOD access. CompTIA's SecurityX objectives include IAM controls and enterprise enforcement of access decisions based on trust and security posture.

  Why the other options are weaker: A helps remote connectivity for patch delivery, but it does not solve missing agents or rogue BYOD. C is governance-oriented and too slow and indirect compared with an enforceable technical control. D helps with managed devices, but it does not adequately stop unapproved BYOD devices unless access control is tied to device compliance. Conditional Access is the strongest enterprise control because it can enforce both identity and endpoint posture before access is granted.

  References:

  CompTIA SecurityX official exam objectives summary, especially IAM and enterprise access-control enforcement themes.

• Question 9:

  An ISAC supplied recent threat intelligence information about pictures used on social media that provide reconnaissance of systems in use in secure facilities. In response, the Chief Information Security Officer (CISO) wants several configuration changes implemented via the MDM to ensure the following: Camera functions and location services are blocked for corporate mobile devices.

  All social media is blocked on the corporate and guest wireless networks.

  Which of the following is the CISO practicing to safeguard against the threat?

  A. Adversary emulation
  B. Operational security
  C. Open-source intelligence
  D. Social engineering
  B. Operational security

  ---

  Explanation

  The actions described fall under Operational Security (OPSEC), which is the practice of identifying critical information, analyzing potential adversary intelligence collection, and implementing measures to protect sensitive details from disclosure. In this case, the ISAC report highlights how adversaries may use photos shared on social media as reconnaissance, revealing details about technology or configurations inside secure facilities.

  By disabling cameras and location services on corporate devices and blocking access to social media from corporate and guest networks, the CISO is reducing the chance of inadvertent information disclosure. This prevents employees from unintentionally leaking images or metadata that adversaries could exploit.

  Adversary emulation (A) involves simulating threat actors' tactics in controlled exercises, which is not what is occurring here.

  Open-source intelligence (C) is the method adversaries use to gather data, not the defensive practice the CISO is implementing.

  Social engineering (D) describes manipulative attacks against humans, but this control is preventive, not reactive.

  Thus, these measures are clear examples of Operational Security to limit information exposure.

• Question 10:

  An organization recently acquired another company that is running a different EDR solution. A SOC analyst wants to automate the isolation of endpoints that are found to be compromised.

  Which of the following workflows best mitigates the risk of false positives and reduces the spread of malicious code?

  A. Using a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs
  B. Setting a policy on each EDR management console to isolate all endpoints that trigger any alerts
  C. Reviewing all alerts manually in the various portals and taking action to isolate them
  D. Automating the suppression of all alerts that are not critical and sending an email asking SOC analysts to review these alerts
  A. Using a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs