CAS-005 sample questions

Question 1

A security architect discovers the following while reviewing code for a company's website: selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")Which of the following should the security architect recommend?

Accepted Answer

Query parameterization

Answer

Client-side processing

Answer

Data normalization

Answer

Escape character blocking

Answer

URL encoding

Question 2

A security architect needs to enable a container orchestrator for DevSecOps and SOAR initiatives. The engineer has discovered that several Ansible YAML files used for the automation of configuration management have the following content:Which of the following should the engineer do to correct the security issues presented within this content?

Accepted Answer

Update the insecure-bind-address from localhost to the COMPTIA001 in the manifests file.

Answer

Update the kubernetes.core.k8s module to kubernetes.core.k8s_service in the main.yml file.

Answer

Update the COMPTIA001 hostname to localhost using the hostnamectl command.

Answer

Update the state: present module to state: absent in the main.yml file.

Answer

Update or remove the ansible.cfg file.

Question 3

A CRM company leverages a CSP PaaS service to host and publish Its SaaS product. Recently, a large customer requested that all infrastructure components must meet strict regulatory requirements, including configuration management, patch management, and life-cycle management. Which of the following organizations is responsible for ensuring those regulatory requirements are met?

Accepted Answer

The CRM company

Answer

The CRM company's customer

Answer

The CSP

Answer

The regulatory body

Question 4

Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer's (CIO's) first day, a fire breaks out at Company B's main data center. Which of the following actions should the CIO take first?

Accepted Answer

Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer's (CIO's) first day, a fire breaks out at Company B's main data center. Which of the following actions should the CIO take first?

Accepted Answer

Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.

Answer

Determine whether the incident response plan has been tested at both companies, and use it to respond.

Answer

Ensure hot, warm, and mobile disaster recovery sites are available, and give an update to the companies' leadership teams.

Answer

Initiate Company A's IT systems processes and procedures, assess the damage, and perform a BI

Question 5

The results of an internal audit indicate several employees reused passwords that were previously included in a published list of compromised passwords.The company has the following employee password policy:Which of the following should be implemented to best address the password reuse issue? (Choose two.)

Accepted Answer

Increase the minimum age to two days.

Accepted Answer

Increase the history to 20.

Answer

Increase the character length to 12.

Answer

Add case-sensitive requirements to character class.

Answer

Decrease the maximum age to 30 days.

Answer

Remove the complexity requirements.

Question 6

A mobile administrator is reviewing the following mobile device DHCP logs to ensure the proper mobile settings are applied to managed devices:Which of the following mobile configuration settings is the mobile administrator verifying? A.Service set identifier authenticationB.Wireless network auto joiningC.802.1X with mutual authenticationD.Association MAC address randomization

Accepted Answer

Association MAC address randomization

Answer

Service set identifier authentication

Answer

Wireless network auto joining

Answer

802.1X with mutual authentication

Question 7

A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device. Which of the following actions should the analyst take next?

Accepted Answer

Classify the incident as a false negative.

Answer

Classify the incident as a false positive.

Answer

Classify the incident as a true positive.

Answer

Classify the incident as a true negative.

Question 8

Which of the following security features do email signatures provide?

Accepted Answer

Non-repudiation

Answer

Body encryption

Answer

Code signing

Answer

Sender authentication

Answer

Chain of custody

Question 9

A financial services firm is architecting a new cloud-native trading platform using microservices deployed on Kubernetes. To comply with Zero Trust principles, the Chief Architect mandates that service-to-service communication must be authenticated using short-lived, cryptographically verifiable identities, without relying on static secrets like API keys stored in environment variables. The solution must automatically issue and rotate these identities for all workloads. Which of the following technologies should be implemented to meet these requirements?

Accepted Answer

SPIFFE/SPIRE to provide a universal identity control plane for workloads across the Kubernetes cluster.

Answer

An API Gateway using OAuth 2.0 client credentials flow for each service.

Answer

A service mesh, such as Istio, configured to enforce mutual TLS (mTLS) using manually provisioned certificates.

Answer

Kubernetes Secrets managed by HashiCorp Vault, with periodic rotation handled by a custom controller.

Question 10

A security engineer is tasked with creating a SOAR playbook to automate the initial response to a suspected phishing email reported by an employee. The goal is to enrich the indicators of compromise (IOCs) from the email and take initial containment actions without human intervention. Which THREE of the following actions should be included in the automated playbook? (Select THREE)

Accepted Answer

Submit URLs and file hashes from the email to a sandbox for detonation and analysis.

Accepted Answer

Query threat intelligence platforms for the reputation of sender IPs, domains, and hashes.

Accepted Answer

If indicators are confirmed malicious, add the file hash to the EDR blocklist and the domain to the web proxy blocklist.

Answer

Automatically delete all emails from the sender for all users across the organization.

Answer

Initiate a forensic image of the reporting user's workstation for detailed analysis.

Answer

Immediately reset the reporting user's password as a precautionary measure.

Free CAS-005 sample questions

A security architect discovers the following while reviewing code for a company's website: selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")Which of the following should the security architect recommend?

Which of the following security features do email signatures provide?

10 more free samples are waiting