CompTIA CAS-005 Online Practice Questions and Exam Preparation

CompTIA CAS-005 Online Questions & Answers

• Question 421:

  A company has data it would like to aggregate from its PLCs for data visualization and predictive maintenance purposes.

  Which of the following is the most likely destination for the tag data from the PLCs?

  A. External drive
  B. Cloud storage
  C. System aggregator
  D. Local historian
  D. Local historian

  ---

  Explanation

  PLCs (Programmable Logic Controllers) are commonly used in industrial automation to control machinery and processes. They generate a significant amount of data known as tag data, which includes real-time information about variables such as temperatures, pressures, and other operational parameters.

  A local historian is a dedicated software or system component used in industrial automation environments to collect, store, and manage tag data from PLCs. The local historian typically resides on-site or within the industrial network environment. Its primary function is to capture and archive historical data from PLCs at a high frequency, providing insights into the operational history and trends of the industrial processes.

• Question 422:

  A company's internal network is experiencing a security breach, and the threat actor is still active. Due to business requirements, users in this environment are allowed to utilize multiple machines at the same time.

  Given the following log snippet:

  

  Which of the following accounts should a security analyst disable to best contain the incident without impacting valid users?

  A. user-a
  B. user-b
  C. user-c
  D. user-d
  C. user-c

  ---

  Explanation

  Useruser-cis showing anomalous behavior across multiple machines, attempting to run administrative tools such as cmd.exe and appwiz.CPL, which are commonly used by attackers for system modification. The activity pattern suggests a lateral movement attempt, potentially indicating a compromised account. user-a (A)anduser-b (B)attempted to run applications but only on one machine, suggesting less likelihood of compromise. user-d (D)was blocked running cmd.com, but user-c's pattern is more consistent with an attack technique.

  References:

  CompTIA SecurityX (CAS-005) Exam Objectives-Domain 4.0 (Security Operations), Section onThreat Intelligence and Indicators of Attack

• Question 423:

  After a company discovered a zero-day vulnerability in its VPN solution, the company plans to deploy cloud-hosted resources to replace its current on-premises systems. An engineer must find an appropriate solution to facilitate trusted connectivity.

  Which of the following capabilities is the most relevant?

  A. Container orchestration
  B. Microsegmentation
  C. Conditional access
  D. Secure access service edge
  D. Secure access service edge

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  The scenario involves replacing an on-premises VPN solution, which has a zero-day vulnerability, with cloud-hosted resources while ensuring trusted connectivity. Trusted connectivity in a cloud environment implies secure, scalable, and modern access control that goes beyond traditional VPNs. Let's analyze the options:

  A. Container orchestration: This refers to managing and automating containerized workloads (e.g., Kubernetes). While useful for application deployment, it doesn't directly address secure connectivity to cloud resources.

  B. Microsegmentation: This involves creating fine-grained security policies within a network to limit lateral movement. It's valuable for internal security but isn't a complete solution for trusted connectivity to cloud-hosted resources.

  C. Conditional access: This ensures access based on conditions (e.g., user identity, device health). It's relevant for identity management but lacks the broader networking and security scope needed here.

  References:

  CompTIA SecurityX (CAS-005) objectives, Domain 1: Security Architecture, emphasizing cloud security and modern connectivity solutions like SASE.

• Question 424:

  A recent batch of bug bounty findings indicates a systematic issue related to directory traversal. A security engineer needs to prevent flawed code from being deployed into production.

  Which of the following is the best mitigation strategy for the engineer?

  A. Setting up secure development training with a focus on filesystem access issues
  B. Implementing static code analysis testing into the CI/CD pipeline and blocking based on findings
  C. Using a software composition analysis tool to look for directory traversal issues in the application
  D. Developing a secure library for filesystem access and blocking builds that do not use the library
  E. Leveraging a dynamic application security testing tool to uncover issues related to directory traversal
  B. Implementing static code analysis testing into the CI/CD pipeline and blocking based on findings

• Question 425:

  Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique?

  A. It is computationally efficient and provides perfect forward secrecy.
  B. It is more resilient to brute-force attacks than ECC.
  C. It supports ephemeral key exchange and digital signatures.
  D. It is currently considered a robust PQC technique.
  E. It enables processing on data while remaining in an encrypted state.
  D. It is currently considered a robust PQC technique.

• Question 426:

  A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response.

  Which of the following should the team do to best accomplish this goal?

  A. Integrate a file-monitoring tool with the SIEM.
  B. Change the log solution and integrate it with the existing SIEM.
  C. Implement a central logging server, allowing only log ingestion.
  D. Rotate and back up logs every 24 hours, encrypting the backups.
  C. Implement a central logging server, allowing only log ingestion.

  ---

  Explanation

  A central logging server ensures logs are collected in a tamper-proof manner and only ingested (not modified). This prevents attackers from altering logs locally.

  Key concepts:

  Logs should be centrally stored to prevent tampering.

  Enabling log forwarding to a secure SIEM improves integrity.

  Other options:

  A (File monitoring tool) helps detect file changes but doesn't prevent log tampering.

  B (Changing log solutions) does not inherently improve security.

  D (Log rotation and encryption) is best practice but does not prevent modification before transmission.

• Question 427:

  A security administrator is performing a gap assessment against a specific OS benchmark.

  The benchmark requires the following configurations be applied to endpoints:

  1. Full disk encryption

  2. Host-based firewall

  3. Time synchronization

  4. Password policies

  5. Application allow listing

  6. Zero Trust application access

  Which of the following solutions best addresses the requirements? (Select two).

  A. CASB
  B. SBoM
  C. SCAP
  D. SASE
  E. HIDS
  C. SCAP
  D. SASE

  ---

  Explanation

  To address the specific OS benchmark configurations, the following solutions are most appropriate:

  C. SCAP (Security Content Automation Protocol): SCAP helps in automating vulnerability management and policy compliance, including configurations like full disk encryption, host-based firewalls, and password policies.

  D. SASE (Secure Access Service Edge): SASE provides a framework for Zero Trust network access and application allow listing, ensuring secure and compliant access to applications and data. These solutions together cover the comprehensive security requirements specified in the OS benchmark, ensuring a robust security posture for endpoints.

  References:

  CompTIA SecurityX Study Guide: Discusses SCAP and SASE as part of security configuration management and Zero Trust architectures. NIST Special Publication 800-126, " The Technical Specification for the Security Content Automation Protocol (SCAP) ": Details SCAP ' s role in security automation. " Zero Trust Networks: Building Secure Systems in Untrusted Networks " by Evan Gilman and Doug Barth: Covers the principles of Zero Trust and how SASE can implement them. By implementing SCAP and SASE, the organization ensures that all the specified security configurations are applied and maintainedeffectively.

• Question 428:

  A security engineer is assisting a DevOps team that has the following requirements for container images:

  1. Ensure container images are hashed and use version controls.

  2. Ensure container images are up to date and scanned for vulnerabilities.

  Which of the following should the security engineer do to meet these requirements?

  A. Enable clusters on the container image and configure the mesh with ACLs.
  B. Enable new security and quality checks within a CI/CD pipeline.
  C. Enable audits on the container image and monitor for configuration changes.
  D. Enable pulling of the container image from the vendor repository and deploy directly to operations.
  B. Enable new security and quality checks within a CI/CD pipeline.

  ---

  Explanation

  Implementing security and quality checks in a CI/CD pipeline ensures that:

  Container images are scanned for vulnerabilities before deployment.

  Version control is enforced, preventing unauthorized changes.

  Hashes validate image integrity.

  Other options:

  A (Configuring ACLs on mesh networks) improves access control but does not ensure scanning.

  C (Audits on container images) detect changes but do not enforce best practices.

  D (Pulling from a vendor repository) does not ensure vulnerability scanning.

• Question 429:

  The material finding from a recent compliance audit indicate a company has an issue with excessive permissions. The findings show that employees changing roles or departments results in privilege creep.

  Which of the following solutions are the best ways to mitigate this issue? (Select two).

  A. Setting different access controls defined by business area
  B. Implementing a role-based access policy
  C. Designing a least-needed privilege policy
  D. Establishing a mandatory vacation policy
  E. Performing periodic access reviews
  F. Requiring periodic job rotation
  A. Setting different access controls defined by business area
  D. Establishing a mandatory vacation policy

• Question 430:

  Which of the following best describes the challengesassociated with widespread adoption of homomorphic encryption techniques?

  A. Incomplete mathematical primitives
  B. No use cases to drive adoption
  C. Quantum computers not yet capable
  D. Insufficient coprocessor support
  D. Insufficient coprocessor support

  ---

  Explanation

  Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, preserving confidentiality. However, its adoption faces significant challenges due to performance overhead.

  According to the CompTIA SecurityX CAS-005 study materials (Domain 3: Cybersecurity Technology, 3.3), homomorphic encryption requires substantial computational resources, which standard processors struggle to provide efficiently. Specialized hardware, such as coprocessors (e.g., GPUs or TPUs), is oftenneeded to handle the complex mathematical operations involved. The lack of widespread, optimized coprocessor support in existing infrastructure is a primary barrier to adoption.

  Option A (Incomplete mathematical primitives):While early homomorphic encryption schemes had limitations, modern schemes (e.g., CKKS, BFV) have mature mathematical foundations, making this less of a challenge today.

  Option B (No use cases):Use cases exist, such as secure cloud computing and privacy-preserving data analytics, so this is not accurate.

  Option C (Quantum computers):Homomorphic encryption is not dependent on quantum computing, and quantum computers are unrelated to its current challenges.

  Option D (Insufficient coprocessor support):This is the most accurate, as performance bottlenecks require specialized hardware that is not yet widely available or integrated.

  References:

  CompTIA SecurityX CAS-005 Official Study Guide, Domain 3: Cybersecurity Technology, Section 3.3:

  "Evaluate emerging cryptographic technologies, including homomorphic encryption challenges." CAS-005 Exam Objectives, 3.3: "Analyze barriers to adopting advanced encryption techniques."