CompTIA SecurityX (CAS-005)

Question 1

A DevSecOps team uses Ansible to orchestrate configuration of thousands of Linux hosts. During a security review, an engineer discovers that database passwords and API tokens are stored in cleartext within playbook group_vars files committed to the shared Git repository, and that playbooks run under a single privileged service account with unrestricted SSH access to all managed nodes. Which combination of changes MOST effectively hardens the automation platform against secret exposure and blast-radius escalation?

Accepted Answer

Encrypt the sensitive variables with Ansible Vault backed by a secret retrieved at runtime from an external secrets manager, and scope the control node's credentials using just-in-time, task-limited SSH access per host group

Answer

Move the group_vars files to a private repository, enable branch protection, and rotate the shared service account password every 30 days

Answer

Base64-encode the passwords and tokens in the playbooks and restrict repository read access to the DevSecOps team members only

Answer

Replace the SSH key on the control node with a longer RSA key and enable verbose logging on all managed nodes to detect misuse

Question 2

A security operations team at a multinational firm has been relying on quarterly authenticated internal vulnerability scans of its known asset inventory. During a recent breach investigation, responders discovered that the initial foothold was an internet-facing marketing microsite spun up by a business unit on a third-party cloud account that IT never inventoried. Leadership wants a program change that will systematically reduce the chance of another unknown internet-exposed asset being exploited. Which approach best addresses the underlying gap?

Accepted Answer

Implement a continuous external attack surface management (ASM) capability that discovers and monitors internet-facing assets from an outside-in perspective, including unsanctioned and shadow deployments

Answer

Increase the frequency of authenticated internal vulnerability scans from quarterly to weekly against the existing asset inventory

Answer

Deploy endpoint EDR agents to every server in the corporate data center and enforce agent health reporting to the SIEM

Answer

Require all business units to submit change tickets before deploying new applications and audit the change management system monthly

Question 3

A hospital's security architect is redesigning the backup architecture after a tabletop exercise revealed that a ransomware actor with domain admin credentials could encrypt or delete both production data and the existing network-attached backup repository. Regulatory requirements mandate a 4-hour RPO for patient records, and the organization needs assurance that backups cannot be altered or deleted during their retention window, even by a compromised administrator account. Which design BEST meets these resilience requirements?

Accepted Answer

Write backups to immutable (WORM) object storage with a locked retention policy and maintain a logically air-gapped copy, ensuring no single administrator can shorten or bypass the retention lock

Answer

Increase backup frequency to hourly and store copies on the same NAS with role-based access control restricting deletion to a dedicated backup service account

Answer

Replicate backups to a second on-premises NAS in a different building and enable full-disk encryption on both repositories

Answer

Deploy an EDR agent on the backup server and require MFA for all administrative logins to the backup console

Question 4

A financial services company must migrate encryption for a regulated SaaS workload to a public cloud provider. Compliance requires that the organization retain sole control over the origin of the key material and be able to demonstrate to auditors that the cloud provider never generated the master key. The team wants to use the provider's managed KMS for performance but must satisfy this key-provenance requirement. Which approach best meets the requirement?

Accepted Answer

Use Bring Your Own Key (BYOK): generate the key material in the on-premises HSM, wrap it with the KMS public wrapping key, and import it into the cloud KMS

Answer

Enable the cloud KMS default key generation and rotate keys automatically every 90 days

Answer

Store customer-managed keys in the cloud KMS but enable audit logging to prove the provider did not misuse them

Answer

Use Hold Your Own Key (HYOK) by keeping all keys on-premises and forwarding every encrypt/decrypt call over the internet to the on-premises HSM

Question 5

A financial services company is preparing for post-quantum cryptography migration. Leadership asks the security engineering team to first understand where and how cryptography is used across thousands of applications, libraries, and hardware devices before selecting replacement algorithms. Which action best positions the organization to prioritize migration and achieve crypto-agility?

Accepted Answer

Generate a cryptographic bill of materials (CBOM) that inventories algorithms, key sizes, protocols, and their locations across systems

Answer

Immediately replace all RSA-2048 certificates with ML-KEM (Kyber) hybrid certificates across the environment

Answer

Increase all symmetric AES keys to 256-bit and consider the migration complete

Answer

Deploy a network intrusion detection system tuned to flag quantum-based attack signatures

Question 6

A financial services company experienced a production outage when a TLS certificate on a customer-facing API gateway expired without warning. The certificate was manually issued 12 months earlier by an internal CA, and the responsible engineer had left the company. The security architect is tasked with preventing recurrence across hundreds of internal and public-facing certificates. Which approach BEST addresses the root cause while supporting long-term operational resilience?

Accepted Answer

Implement an automated certificate lifecycle management platform integrated with the CA that handles enrollment, renewal, and revocation, with monitoring and expiration alerting

Answer

Extend all certificate validity periods to the maximum allowable duration to reduce the frequency of renewals and administrative overhead

Answer

Assign a dedicated staff member to maintain a spreadsheet of all certificates and manually renew each one 30 days before expiration

Answer

Switch all endpoints to self-signed certificates managed locally on each server to eliminate dependence on the internal CA

Question 7

A DevSecOps team discovers that a compromised open-source package was pulled during a recent CI build, injecting a malicious script into the resulting container image before it was pushed to the production registry. The pipeline currently pulls dependencies directly from public repositories at build time and signs images only after they reach the registry. Which combination of controls would MOST effectively prevent this class of build-integrity compromise going forward?

Accepted Answer

Use a curated internal artifact proxy with pinned dependency versions and hash verification, then generate and sign a provenance attestation (e.g., SLSA-style) as part of the build step

Answer

Increase the frequency of vulnerability scans on the production registry and quarantine any image that fails a CVE threshold

Answer

Require multi-factor authentication for all developers pushing to the source repository and enforce branch protection rules

Answer

Encrypt all build artifacts at rest in the registry using an HSM-backed key and rotate the key quarterly

Question 8

A financial services firm is migrating a highly regulated trading platform to a public cloud provider. Compliance mandates strict isolation from other customers' workloads at the physical hardware level, and the firm's risk team will not accept any control that relies solely on hypervisor-enforced logical separation. Cost is a secondary concern. Which cloud compute deployment approach best satisfies these requirements?

Accepted Answer

Deploy on dedicated hosts (single-tenant physical servers) so the firm's instances are the only workloads running on that hardware

Answer

Deploy on standard shared multi-tenant instances but enable full-disk encryption with customer-managed keys

Answer

Deploy on shared instances placed in a dedicated VPC with private subnets and security groups restricting all inbound traffic

Answer

Deploy on burstable shared instances within a separate cloud account under the same organization

Question 9

A retail analytics team must run demographic reports on a dataset containing customer national ID numbers stored in a cloud data warehouse. Legal requires that raw national IDs never reside in the warehouse or be recoverable by analysts, yet the reports must still correlate records belonging to the same customer across multiple tables and preserve the original field length/format for the legacy reporting tool. Which data protection design best meets these requirements?

Accepted Answer

Apply deterministic format-preserving tokenization at ingestion, storing raw IDs only in an isolated token vault outside the warehouse

Answer

Encrypt the national ID column with AES-256 using envelope encryption and grant analysts decrypt permissions on the KMS key

Answer

Apply randomized (non-deterministic) tokenization to each occurrence of the national ID at load time

Answer

Hash the national IDs with SHA-256 and a per-table salt before loading them into the warehouse

Question 10

A multinational manufacturer must simultaneously demonstrate compliance with ISO 27001, PCI DSS, and a new regional privacy law. The CISO notices the compliance team is running three separate audits, duplicating evidence collection, and producing conflicting control statements that confuse the board. The CISO wants to reduce audit fatigue and cost while maintaining assurance across all three regimes. Which approach best addresses this problem?

Accepted Answer

Establish a unified control framework (control crosswalk) that maps overlapping requirements across all three regimes to a single set of enterprise controls, then collect evidence once and satisfy multiple mandates

Answer

Adopt only ISO 27001 as the authoritative framework and assume its certification will automatically satisfy PCI DSS and the regional privacy law

Answer

Continue running separate audits but stagger them across the fiscal year so the teams are never working on more than one at a time

Answer

Outsource all three audits to a single external assessor and let them decide which controls apply to each regime

Question 11

A DevSecOps team is hardening its Kubernetes workloads. During a security review, an analyst finds that production containers run as root, mount the host Docker socket for logging sidecars, and allow shell access via kubectl exec for troubleshooting. The team wants to reduce the container attack surface while keeping the ability to investigate incidents. Which combination of controls BEST hardens these containers without eliminating incident investigation capability?

Accepted Answer

Run containers as a non-root user with a read-only root filesystem and drop all Linux capabilities, remove the host Docker socket mount, and use an ephemeral debug container for troubleshooting

Answer

Enforce image signing on all pushes and require multi-factor authentication for the container registry while leaving runtime privileges unchanged

Answer

Add a privileged security context to every pod so sidecars can access host resources, and restrict kubectl exec to cluster administrators only

Answer

Deploy a network policy that blocks all egress from production namespaces and scan images for vulnerabilities during the build stage

Question 12

A DevSecOps team runs a Kubernetes platform where developers can push arbitrary images to the cluster's namespaces. Recent incident review found a workload running an unsigned image pulled from an untrusted public registry that contained a cryptominer. The team already signs internal images using Cosign and stores public keys in a trusted store. Which control most directly prevents unsigned or untrusted images from being deployed to the cluster going forward?

Accepted Answer

Deploy an admission controller policy that verifies image signatures against trusted public keys and blocks pods whose images fail verification

Answer

Enable image vulnerability scanning in the CI pipeline and fail builds that exceed a critical CVE threshold

Answer

Configure network egress filtering so cluster nodes cannot reach untrusted public registries

Answer

Apply Pod Security Standards at the 'restricted' level to prevent privileged containers from running

Question 13

A DevSecOps engineer is hardening a containerized microservice deployment on Kubernetes. During a review, the security team discovers that database passwords and API keys are being passed to containers as plaintext environment variables defined directly in the Deployment manifest, which is stored in a Git repository. The team wants to eliminate secret exposure both at rest in source control and at runtime within the container. Which approach BEST addresses both concerns?

Accepted Answer

Integrate an external secrets manager with a CSI driver that mounts secrets as ephemeral volumes at runtime and remove secrets from the manifests

Answer

Move the secrets into Kubernetes ConfigMaps and restrict RBAC access to the namespace

Answer

Base64-encode the environment variable values in the Deployment manifest before committing them to Git

Answer

Store the secrets in native Kubernetes Secrets objects and commit the Secret manifests alongside the Deployment in Git

Question 14

A hospital's business continuity plan is being revised after a ransomware incident forced a full recovery from backups. During recovery, teams restored systems alphabetically, which delayed the electronic health record (EHR) system and its authentication dependency for over 14 hours while a low-priority reporting server came online first. The CISO wants to prevent this during the next event. Which action MOST directly addresses the failure demonstrated during this recovery?

Accepted Answer

Define a recovery sequence in the disaster recovery plan based on business impact analysis, tiering systems by RTO and mapping upstream dependencies before restore order is set

Answer

Decrease the backup RPO by increasing snapshot frequency so less data is lost during the next ransomware event

Answer

Migrate all backups to immutable object storage with an air-gapped copy to prevent encryption of recovery media

Answer

Increase backup verification frequency by running monthly integrity checks against restore images

Question 15

A vulnerability management analyst runs a weekly authenticated scan against a Linux server fleet. This week, one server that historically reported dozens of missing-patch findings suddenly reports only two open-port findings and no OS-level vulnerabilities. The scan job completed without errors, and the host is confirmed reachable. Other servers in the same subnet still return full patch-level results. What is the MOST likely explanation the analyst should investigate first?

Accepted Answer

The scanner's credentials failed to authenticate to that host, causing it to fall back to an unauthenticated scan

Answer

The server was fully patched since the last scan cycle, so only network-facing findings remain

Answer

The scanner's vulnerability plugin feed was not updated before the scan ran

Answer

The server's EPSS scores dropped below the reporting threshold configured in the scanner

Question 16

A financial services company operates a private PKI with an offline root CA. To enable trust for a newly acquired subsidiary that already deployed thousands of endpoints trusting a different existing root, the security engineer must allow certificates issued by the company's intermediate CA to validate on the subsidiary's endpoints WITHOUT redeploying a new root to those endpoints or replacing existing leaf certificates. Which approach best achieves this?

Accepted Answer

Cross-sign the company's intermediate CA with the subsidiary's existing trusted root, so chains can build a path to a root the endpoints already trust

Answer

Distribute the company's offline root CA certificate to all subsidiary endpoints via a mass push and add it to their trust stores

Answer

Reissue every leaf certificate from the subsidiary's existing intermediate CA and revoke the originals

Answer

Configure the company's intermediate CA as a self-signed root and install it only on the company's own servers

Question 17

A security engineer is standardizing how TLS certificates are requested for a fleet of application servers. Compliance requires that private keys never leave the host on which they will be used and cannot be exported or copied, even by an administrator. The engineer must define the certificate enrollment workflow. Which approach best satisfies this requirement while producing a valid certificate signing request (CSR)?

Accepted Answer

Generate the key pair inside each host's TPM as a non-exportable key, create the CSR referencing that key, and submit it to the internal CA for signing

Answer

Generate the key pair on a central provisioning server, create CSRs there, sign them, then push the signed certificate and private key to each host over mTLS

Answer

Have the CA generate the key pair and certificate together, then distribute the PKCS#12 bundle to each host through the configuration management system

Answer

Generate an exportable key pair on each host, back up the private key to an encrypted vault, then create and submit the CSR to the CA

Question 18

A financial services company stores highly sensitive customer records in a cloud-hosted database. Regulators require that the organization retain full control over the master key used to protect the data, that the master key never leave a FIPS 140-2 Level 3 boundary, and that individual data-encryption keys be rotatable without re-encrypting the entire dataset. Which data-at-rest design BEST satisfies all three requirements?

Accepted Answer

Implement envelope encryption where data-encryption keys are wrapped by a customer-controlled master key stored in a dedicated HSM/KMS, using bring-your-own-key (BYOK) or hold-your-own-key

Answer

Enable the cloud provider's default server-side encryption using provider-managed keys and rely on the provider's shared HSM infrastructure

Answer

Encrypt all records directly with a single AES-256 master key stored in an application configuration secret and rotate the secret quarterly

Answer

Use transparent database encryption with keys escrowed by the cloud provider and enable automatic annual key rotation

Question 19

A multinational retailer's SOC confirms that attackers exfiltrated a database containing EU residents' personal data and U.S. customers' payment card information. The CISO convenes a response meeting to determine notification obligations. Legal confirms the breach involves both personal data protected under GDPR and cardholder data governed by PCI DSS agreements with the acquiring bank. Which action correctly reflects the organization's regulatory and contractual notification obligations?

Accepted Answer

Notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach, and notify the acquiring bank/card brands per the payment card agreement timelines, treating each obligation independently

Answer

Wait until the forensic investigation is fully complete before making any notification, to ensure all reported facts are verified and avoid regulatory penalties for inaccurate reporting

Answer

Issue a single consolidated notification to the EU supervisory authority within 30 days that also satisfies the PCI DSS card brand reporting requirement

Answer

Notify only affected data subjects directly and skip regulator notification, since individual notice is the higher-priority obligation under both GDPR and PCI DSS

Question 20

A financial services firm stores customer records, internal marketing plans, and public regulatory filings on the same file-sharing platform. The security architect has been asked to design a data protection scheme that applies the strongest controls (encryption, egress blocking, watermarking) only where warranted, while avoiding unnecessary friction for low-sensitivity content. Which approach should the architect implement FIRST to make the downstream control decisions defensible and consistent?

Accepted Answer

Establish a data classification scheme with defined sensitivity labels, then map DLP, encryption, and handling controls to each classification tier

Answer

Deploy a DLP engine in monitor-only mode across all repositories and refine rules based on the volume of alerts each dataset generates

Answer

Encrypt every file in the platform with the same customer-managed key and enable blanket egress blocking to the internet

Answer

Require all users to manually tag files as confidential during upload and rely on that tag to trigger the appropriate protection

Question 21

A financial services firm is designing a data security architecture that spans Microsoft 365, an on-premises file server, and an AWS S3 data lake used for analytics. Regulators require that once a document is labeled 'Restricted,' the classification and its associated protections must remain enforced regardless of where the file is moved, copied, or downloaded. The security architect must select an approach that ensures the label and its protection travel with the data across all three environments. Which approach best meets this requirement?

Accepted Answer

Apply sensitivity labels that embed persistent metadata and enforce encryption/usage rights within the file itself, integrated with the DLP and rights-management service across all platforms

Answer

Configure S3 bucket policies and NTFS ACLs to restrict access to Restricted files based on the storage location

Answer

Deploy a network DLP appliance at the perimeter to block Restricted files from leaving the corporate network

Answer

Maintain a central classification register that maps file hashes to their classification level for auditing purposes

Question 22

A multinational manufacturer is establishing a formal data governance program after an audit found that no one could authoritatively decide who may approve access to sensitive engineering design files. The CISO wants to assign accountability for the business value, classification level, and acceptable use of these datasets, while separating that responsibility from the team that manages storage, backups, and technical access controls. Which role assignment best satisfies this requirement?

Accepted Answer

Designate a data owner accountable for classification and access decisions, and a data custodian responsible for implementing technical controls

Answer

Assign the storage administration team as both data owner and custodian to streamline access approvals

Answer

Make the Data Protection Officer the data owner for all engineering datasets and delegate classification to end users

Answer

Designate a data processor to define classification and a data controller to implement backups and encryption

Question 23

A financial services company is redesigning the TLS configuration for its customer-facing web portal. The security architect wants to ensure that even if the server's long-term private key is compromised in the future, previously captured encrypted session traffic cannot be retroactively decrypted. Which configuration decision most directly achieves this requirement?

Accepted Answer

Enforce cipher suites that use ephemeral Diffie-Hellman (ECDHE) key exchange and disable static RSA key exchange

Answer

Increase the RSA server certificate key length from 2048 to 4096 bits

Answer

Enable HTTP Strict Transport Security (HSTS) with a long max-age directive

Answer

Deploy certificate pinning in the mobile and web clients to prevent rogue certificate use

Question 24

A financial services firm discovers that employees are exfiltrating sensitive client records by copying files to USB drives and by pasting data into personal webmail accessed over HTTPS from company laptops. The existing DLP deployment consists solely of a network-based inspection appliance at the internet egress gateway that decrypts and scans outbound traffic. The security architect is asked to close the identified gaps while minimizing additional decryption infrastructure. Which design change most directly addresses BOTH exfiltration vectors?

Accepted Answer

Deploy endpoint DLP agents on the laptops with policies covering removable-media control and local content inspection before encryption

Answer

Add a second network DLP appliance clustered with the first to increase TLS decryption throughput

Answer

Route all laptop traffic through a cloud access security broker (CASB) in API-only mode for sanctioned SaaS

Answer

Enforce full-disk encryption on all laptops and require encrypted USB drives issued by IT

Question 25

A retailer wants to use existing customer purchase history to send targeted product recommendations via email. The DPO must document the appropriate GDPR lawful basis before the marketing team launches the campaign. The customers were not asked for marketing consent at signup, and the retailer believes the processing is reasonably expected by customers but wants to avoid over-relying on consent. Which action should the DPO take to establish a defensible lawful basis for this processing?

Accepted Answer

Conduct and document a legitimate interests assessment (LIA) that balances the retailer's interest against the customers' rights, and provide an opt-out mechanism

Answer

Rely on the contractual necessity basis because the customers already have a purchase relationship with the retailer

Answer

Proceed under the legal obligation basis since retaining purchase records is required for tax purposes

Answer

Treat the processing as exempt because purchase history is not special category personal data

Question 26

A retail company processes millions of loyalty transactions per hour and must protect customer national ID numbers. The architecture team requires that the sensitive values be replaced with surrogate tokens usable in analytics joins, but the solution must scale horizontally without a centralized data store that could become a performance bottleneck or single point of failure. Reversibility must still be supported for authorized fraud investigations. Which tokenization approach best meets these requirements?

Accepted Answer

Vaultless tokenization using a deterministic cryptographic algorithm with securely managed keys

Answer

Vault-based tokenization storing all token-to-value mappings in a single relational database

Answer

One-way salted hashing of the national ID numbers before storage

Answer

Column-level AES-256 encryption applied inline at the application tier

Question 27

A DevSecOps team is integrating automated security testing into a CI/CD pipeline for a customer-facing web application. Leadership wants defects caught as early as possible to reduce remediation cost, but also insists that runtime vulnerabilities involving authentication flows and server misconfiguration be detected before production release. The team must select where to place Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST). Which pipeline design best satisfies both requirements?

Accepted Answer

Run SAST and SCA during the commit/build stage against source and dependencies, then run DAST against a deployed build in a staging environment before the production gate

Answer

Run DAST at the commit stage against source code, defer SAST to staging, and run SCA only after production deployment during monitoring

Answer

Run all three tools (SAST, SCA, DAST) exclusively in production against live traffic to ensure realistic results

Answer

Run only SCA at build time and rely on manual penetration testing quarterly to cover both static and runtime defects

Question 28

During an enterprise incident, the SOC contained a compromised workload by isolating the affected host and rebuilding it from a golden image. Within 48 hours, the same malware family reappears on the rebuilt host and two adjacent servers. Endpoint telemetry shows the initial detection was a dropper, but the reinfection has no matching download event. Which action would most effectively prevent further reinfection during the eradication phase?

Accepted Answer

Hunt for and remove persistence mechanisms across the environment—scheduled tasks, service accounts, GPOs, and startup entries—before restoring hosts

Answer

Re-image the three affected hosts again from the same golden image and re-enable them on the production network

Answer

Increase EDR sensitivity thresholds and add the malware hash to the blocklist across all endpoints

Answer

Restore the affected servers from the most recent backup taken before the initial detection

Question 29

A cloud-hosted web application was compromised via an exploited API endpoint. During the enterprise incident response, the DFIR team discovers that CloudTrail management events are available but the S3 data-plane access logs and the application-tier logs were only retained for 7 days—well short of the estimated 6-week dwell time. Leadership demands a root-cause determination of the initial access vector. Which action MOST effectively enables the team to reconstruct the earliest attacker activity despite the retention gap?

Accepted Answer

Pivot to durable secondary telemetry—VPC flow logs, WAF logs, load balancer access logs, and CDN records—and correlate their retained timestamps to bound the intrusion window and infer the entry vector

Answer

Immediately extend the S3 and application log retention policy to 365 days so the missing historical events become available for analysis

Answer

Restore the application servers from the oldest available backup and replay production traffic to regenerate the missing log entries

Answer

Declare the root cause undeterminable and proceed directly to eradication, since the primary logs covering the dwell period no longer exist

Question 30

During an enterprise incident, an analyst recovers a suspicious executable from a compromised finance workstation. The malware appears heavily packed, and static string extraction reveals only obfuscated data. The IR team needs to determine the file's command-and-control infrastructure and file-system modifications as quickly as possible while preserving the ability to attribute behavior to the sample. Which approach best meets these requirements?

Accepted Answer

Detonate the sample in an isolated, instrumented sandbox and capture network, process, and registry telemetry during execution

Answer

Compute the file hash and submit it to a reputation service, then wait for the vendor to publish an analysis report

Answer

Perform additional static disassembly of the packed binary to manually reconstruct the unpacking stub before any execution

Answer

Run the executable directly on the original workstation with a packet capture enabled to observe live traffic

Question 31

During an active intrusion on a Linux production server, the IR team must collect evidence before decommissioning the host. Business requires the server be reimaged within 30 minutes to restore service. The lead analyst wants to maximize forensic value while respecting the time constraint. Which data should be collected FIRST to preserve the most fragile evidence?

Accepted Answer

CPU cache, registers, and the contents of RAM including network connection state

Answer

Bit-for-bit forensic image of the system's SATA disk

Answer

Archived syslog files copied to an external evidence drive

Answer

Configuration backups and installed package manifests from the host

Question 32

During an enterprise incident response engagement, a forensic analyst must acquire a bit-for-bit image of a suspect employee's laptop SSD that has already been powered off. The evidence may be used in future litigation. Which combination of actions BEST preserves the forensic integrity and admissibility of the acquired image?

Accepted Answer

Remove the drive and image it through a hardware write blocker, generate a cryptographic hash of both source and image, and document a signed chain-of-custody form

Answer

Boot the laptop into its normal OS, copy the user's profile folder to an evidence share, and record the file hashes afterward

Answer

Create a logical backup using the built-in OS backup utility and store it on an encrypted external drive labeled with the case number

Answer

Image the running system over the network using a remote agent, then immediately shut the laptop down to prevent tampering

Question 33

A financial services firm discovers that employees are exfiltrating classified customer records by uploading them to personal cloud storage accounts over TLS-encrypted connections. The existing network DLP appliance sees only encrypted traffic and cannot inspect payloads. The security architect must design a control that reliably detects and blocks sensitive data leaving via these HTTPS uploads while preserving user privacy for personal banking and healthcare sites. Which design best meets these requirements?

Accepted Answer

Deploy a forward proxy performing TLS inspection with selective decryption bypass for categorized privacy-sensitive domains, integrated with content-aware DLP policies that classify and block sensitive uploads

Answer

Block all outbound TLS traffic to uncategorized and personal cloud storage domains at the perimeter firewall, allowing only approved corporate SaaS destinations

Answer

Enable full-packet capture at the network egress and retroactively analyze traffic for indicators of data loss during incident response

Answer

Deploy endpoint disk encryption and require multifactor authentication for all cloud storage logins to prevent unauthorized data access

Question 34

A financial services company is designing a resilient enterprise architecture. Their threat model identifies data exfiltration via DNS tunneling as a critical risk because compromised endpoints have been observed encoding stolen data into DNS queries to attacker-controlled authoritative name servers. The security architect must design a control that preserves normal name resolution for legitimate business while preventing covert data channels over DNS. Which design approach BEST addresses this requirement?

Accepted Answer

Force all endpoint DNS traffic through a controlled internal resolver with a protective DNS service that inspects query patterns, blocks known malicious/newly-registered domains, and detects high-entropy/high-volume query anomalies, while blocking direct outbound port 53 and DoH/DoT to external resolvers

Answer

Deploy DNSSEC validation on all internal resolvers to cryptographically verify the authenticity of DNS responses received from external authoritative servers

Answer

Configure endpoints to use a public encrypted DNS provider over DoH so that all resolution traffic is confidential and cannot be tampered with in transit

Answer

Increase the TTL values on internal DNS records to reduce the total number of outbound queries endpoints must generate

Question 35

A financial services company is deploying a microservices application across a Kubernetes cluster. Security requirements mandate that all service-to-service traffic be encrypted and that each service cryptographically prove its identity before communication is allowed, without embedding credentials in application code. Services scale up and down dynamically, so certificates must be issued and rotated automatically. Which approach best satisfies these requirements?

Accepted Answer

Deploy a service mesh that enforces mutual TLS with automatically issued and rotated short-lived workload certificates

Answer

Terminate TLS at the ingress controller and route internal traffic in cleartext across a private VLAN

Answer

Store a shared API key in a Kubernetes ConfigMap that each service reads at startup to authenticate peers

Answer

Enable IPsec tunnels between worker nodes to encrypt all pod traffic at the network layer

Question 36

A financial analytics firm must process highly sensitive customer datasets on a public cloud provider. Regulatory reviewers accept the firm's existing controls for data at rest (envelope encryption with a CMK) and in transit (mTLS), but they raise a concern: during active computation, plaintext data and the derived models reside in host memory where a compromised hypervisor or malicious cloud administrator could theoretically extract them. The architecture team must select a control that protects data while it is being processed, without moving the workload off the provider. Which approach BEST addresses this specific requirement?

Accepted Answer

Deploy the workload inside hardware-based confidential computing enclaves (trusted execution environments) with remote attestation before releasing keys to the enclave

Answer

Enable full-disk encryption on the compute instances and rotate the CMK on a more aggressive schedule

Answer

Apply format-preserving encryption to the datasets so that computations operate directly on the ciphertext

Answer

Move the datasets into a dedicated single-tenant VPC with private endpoints and strict security group rules

Question 37

A security engineer is hardening a fleet of Windows workstations used by financial analysts. Incident data shows repeated infections from malicious macro-enabled documents and unsigned PowerShell scripts downloaded from the internet. Leadership wants to block execution of untrusted code without preventing analysts from running their approved line-of-business applications and internally developed automation scripts. Which control set most directly and durably meets these requirements?

Accepted Answer

Deploy application allowlisting (e.g., WDAC/AppLocker) with publisher and hash rules, and enforce PowerShell Constrained Language Mode with script signing via an internal code-signing certificate

Answer

Enable the host firewall to block outbound connections from Office applications and increase antivirus scan frequency to hourly

Answer

Push a GPO that disables macros entirely across all Office products and require analysts to submit documents to IT for manual review

Answer

Roll out an EDR agent in detect-only mode and rely on SOC analysts to triage and quarantine malicious script executions after alerts fire

Question 38

A security engineer is hardening a fleet of Windows workstations that run an EDR agent. During a recent incident, an attacker who gained local administrator rights was able to stop the EDR service, delete its logs, and load an unsigned kernel driver to disable telemetry before exfiltrating data. The engineer must implement controls that prevent a privileged local attacker from neutralizing endpoint protection in a similar way. Which combination of controls BEST addresses the root cause?

Accepted Answer

Enable EDR tamper protection enforced from the management console, deploy HVCI/memory integrity to block unsigned drivers, and require Windows Defender Credential Guard

Answer

Increase log retention on the SIEM, enable verbose EDR logging, and configure alerts when the EDR service stops

Answer

Deploy application allowlisting for user-space executables and disable the local administrator account on all workstations

Answer

Rotate local administrator passwords with a password manager and enforce full-disk encryption on all endpoints

Question 39

A software vendor distributes signed installers to millions of customers. During an audit, security discovers the code-signing private key is stored on a build server's disk and reused across all releases for the past three years. A recent near-miss showed an attacker with build-server access could have exfiltrated the key and signed malware trusted by every customer. The team must redesign the signing process to minimize the blast radius of a key compromise while preserving the ability to validate previously released software. Which approach BEST meets these goals?

Accepted Answer

Adopt a signing service backed by an HSM that issues short-lived, per-release signing certificates from an offline root, with timestamping so signatures remain valid after certificate expiry

Answer

Move the long-lived signing key into an HSM and require the build server to authenticate to the HSM for each signing operation, keeping the same key for all releases

Answer

Encrypt the signing key at rest on the build server with a passphrase entered by an engineer at each build and rotate the passphrase quarterly

Answer

Generate a new self-signed key for every release and publish each public key on the vendor's website for customers to trust manually

Question 40

A business unit at a financial services firm needs to deploy a legacy application that cannot support the company's mandatory 15-character password standard; the vendor confirms the platform is limited to 8 characters and will not be updated for 18 months. The business unit wants to proceed to meet a regulatory reporting deadline. As the security governance lead, what is the MOST appropriate way to handle this deviation from the established standard?

Accepted Answer

Document a formal policy exception with a defined scope, compensating controls, risk owner sign-off, and a time-bound expiration tied to the 18-month remediation window

Answer

Permanently update the enterprise password standard to an 8-character minimum so the application remains compliant with internal policy

Answer

Deny the deployment outright because it violates the mandatory standard, regardless of the regulatory deadline

Answer

Allow the deployment informally and revisit the configuration during the next annual policy review cycle

Question 41

During enterprise-scale incident response, a forensic analyst has collected disk images from five compromised hosts. Investigators need to reconstruct the exact sequence of attacker actions across filesystem metadata, registry hives, event logs, and browser artifacts to determine the initial access vector. Which approach best supports this reconstruction?

Accepted Answer

Generate a super timeline by parsing artifacts from each image into normalized time-based events, then correlate across hosts using a common time reference

Answer

Run an antivirus scan against each mounted image and record the detection timestamps as the authoritative event sequence

Answer

Compare current file hashes against a known-good gold image and treat all mismatches as chronologically ordered attacker activity

Answer

Extract only the Windows Security event log from each host and rely on logon events to establish the full attack chain

Question 42

A multinational retailer headquartered in the EU is expanding its customer analytics platform by contracting a cloud-based marketing processor located in a country that does not have a European Commission adequacy decision. The retailer's Data Protection Officer must ensure that personal data of EU customers can lawfully be transferred to this processor while providing enforceable rights and effective legal remedies for data subjects. Which mechanism is the MOST appropriate to authorize this international data transfer under the GDPR?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) with the processor and conduct a transfer impact assessment

Answer

Rely on the customer's implied consent granted when they created their account

Answer

Encrypt all data in transit with TLS 1.3 and document it as a compensating control

Answer

Register the processor with the EU supervisory authority to obtain an adequacy decision

Question 43

A multinational retailer operating in the EU receives a GDPR Article 17 (right to erasure) request from a former customer. However, the company's legal team has placed a litigation hold on all records related to a pending class-action lawsuit, and this customer's transaction records are within the scope of that hold. The Data Protection Officer (DPO) must respond within the regulatory timeframe. What is the MOST appropriate action?

Accepted Answer

Inform the data subject that the erasure will be delayed for data subject to the litigation hold, invoking the legal claims exemption under Article 17(3), while erasing any data not covered by the hold

Answer

Immediately delete all of the customer's personal data to comply with the erasure request and avoid GDPR penalties

Answer

Deny the erasure request without explanation, since the litigation hold automatically overrides all data subject rights

Answer

Forward the request to the legal team and take no further action until the lawsuit is fully resolved

Question 44

A security architect is preparing a cryptographic inventory ahead of the organization's post-quantum migration. Leadership asks which currently deployed algorithms require the least urgent action because they remain adequately secure against quantum attacks with modest parameter adjustments, versus those that are fundamentally broken by a cryptographically relevant quantum computer. Which recommendation is technically correct?

Accepted Answer

AES-128 should be upgraded to AES-256 to preserve security margin, while RSA and ECC must be replaced entirely with quantum-resistant algorithms because they are fundamentally broken by Shor's algorithm.

Answer

RSA-2048 and AES-128 are equally vulnerable to Shor's algorithm and both must be replaced with lattice-based schemes immediately.

Answer

AES-256 must be replaced because Grover's algorithm fully breaks all symmetric ciphers, while RSA can simply be extended to 4096-bit keys for quantum resistance.

Answer

SHA-256 and RSA are quantum-safe as-is, while AES requires migration to a post-quantum symmetric standard published by NIST.

Question 45

A security engineer is designing a mobile field-inspection application that must store a per-device private key used to sign inspection records. The organization requires that the private key never be exportable, that key operations be gated by biometric user presence, and that the backend be able to cryptographically verify the key was generated and is stored inside the device's hardware security module rather than in software. Which approach best satisfies all of these requirements?

Accepted Answer

Generate the key inside the device's Secure Enclave/TPM-backed keystore with a non-exportable attribute and biometric-gated usage, then send a hardware key attestation certificate chain to the backend for validation

Answer

Generate the key in the app's memory, encrypt it with a passphrase-derived AES key, store the ciphertext in the OS keychain, and require the passphrase before each signing operation

Answer

Provision a shared organizational private key to all devices via MDM and require biometric unlock before the app loads the key into memory for signing

Answer

Generate the key on the backend HSM, wrap it with the device's public key, and push it to the device where it is decrypted and cached in secure application storage

Question 46

A financial services company is deploying a new hardware security module (HSM) to generate and protect the root signing key for its internal code-signing PKI. The security architect must ensure that no single administrator can export, back up, or use the key material unilaterally, while still allowing recovery if some custodians are unavailable. Which control should the architect require during the key ceremony?

Accepted Answer

Configure M-of-N quorum authentication so that key backup and activation require a threshold of custodian smart cards

Answer

Store a full encrypted backup of the root key on an air-gapped USB drive held by the PKI administrator

Answer

Enable role-based access control so the senior PKI administrator has sole authority over key operations

Answer

Generate the key with a longer RSA modulus and rotate it monthly to reduce exposure

Question 47

A financial services company federates its on-premises Active Directory to a cloud SaaS suite using SAML through an on-premises identity provider (IdP). The security architect learns that a compromised token-signing certificate could allow an attacker to forge assertions for any user, including administrators, without triggering authentication logs at the IdP. Which design change most directly reduces the impact of a forged-assertion (golden SAML) attack against the SaaS environment?

Accepted Answer

Enforce conditional access policies at the SaaS service provider that require compliant, managed devices and re-evaluate risk signals independently of the incoming assertion

Answer

Increase the SAML assertion lifetime so tokens are reissued less frequently, reducing exposure of the signing operation

Answer

Migrate all users to longer, complex passwords and enforce 90-day rotation on the AD accounts

Answer

Enable verbose SAML request logging on the on-premises IdP and forward it to the SIEM

Question 48

A cloud security architect discovers that developers frequently apply manual hotfixes directly to production resources during incidents, causing the running infrastructure to diverge from the Terraform state stored in the pipeline. This creates unpredictable security posture across the environment. Which approach BEST addresses the root cause while maintaining resilient, secure infrastructure?

Accepted Answer

Deploy a CSPM tool to continuously detect configuration drift and remediate it by reconciling live resources back to the approved IaC baseline through the pipeline

Answer

Grant developers standing administrative access to production so manual fixes can be applied faster and documented afterward

Answer

Disable the Terraform state file and manage all production infrastructure exclusively through the cloud console going forward

Answer

Increase the frequency of vulnerability scans on production workloads to catch misconfigurations sooner

Question 49

During an active incident, a SecurityX analyst confirms that a threat actor has compromised a domain-joined workstation and is using stolen Kerberos tickets to authenticate laterally to file servers. The finance department is actively closing quarter-end books and their file share resides on one of the targeted servers. Leadership has authorized aggressive containment but wants business disruption minimized. Which containment action BEST limits lateral movement while preserving evidence and critical business function?

Accepted Answer

Isolate the compromised workstation at the network layer, reset the affected accounts and force a KRBTGT double-reset, and apply firewall rules restricting the file servers to known-good subnets

Answer

Immediately power off the compromised workstation and all targeted file servers to halt the attack completely

Answer

Rebuild the compromised workstation from a golden image immediately and monitor the file servers for further activity

Answer

Disable all Active Directory accounts domain-wide and require every user to re-enroll before restoring access

Question 50

During a busy shift, a SOC receives four concurrent alerts. The incident response plan requires analysts to triage based on business impact and containment urgency before assigning resources. Which alert should be classified as the highest severity and worked first?

Accepted Answer

An EDR alert showing active credential dumping (LSASS access) on a domain controller, with outbound connections to an unfamiliar IP already established

Answer

A single phishing email reported by one user who did not click the link, quarantined automatically by the mail gateway

Answer

A vulnerability scanner flagging a missing OS patch on three internal workstations rated CVSS 7.5

Answer

A firewall log showing repeated blocked inbound scans from an external IP against the DMZ perimeter

Question 51

A manufacturer is hardening a fleet of industrial IoT sensors that push telemetry to a cloud platform. Threat modeling identifies persistent malware surviving reboots and unauthorized firmware modifications as the highest risks. The devices have constrained TPMs, limited compute, and must remain in the field for a decade with over-the-air (OTA) updates. Which control combination BEST addresses the identified risks while remaining feasible on the constrained hardware?

Accepted Answer

Enforce a hardware root-of-trust with measured secure boot and require cryptographically signed firmware images validated before any OTA update is applied

Answer

Deploy a host-based EDR agent on each sensor and forward endpoint logs to the cloud SIEM for behavioral analysis

Answer

Encrypt all telemetry with TLS 1.3 and rotate the device symmetric keys weekly via the OTA channel

Answer

Segment the sensors onto an isolated VLAN and require a jump host for any administrative access to the fleet

Question 52

A DevSecOps engineer is hardening a production Kubernetes cluster after an audit found that several application pods run with privileged security contexts, mount the host filesystem, and use the default service account with cluster-wide RBAC bindings. The applications are standard stateless web APIs that do not require host-level access. The engineer must reduce the container breakout and lateral movement risk with the least disruption to legitimate workloads. Which combination of controls MOST directly addresses the identified weaknesses?

Accepted Answer

Enforce a restricted Pod Security Standard admission policy that disallows privileged containers and hostPath mounts, and bind each workload to a dedicated least-privilege service account

Answer

Enable network policies to isolate namespaces and deploy a service mesh with mutual TLS between pods

Answer

Rotate the cluster's certificate authority, re-issue all node kubelet certificates, and enable audit logging to the SIEM

Answer

Scan all container images for CVEs in the CI pipeline and enforce image signing with an admission controller before deployment

Question 53

After a major ransomware incident, a security operations manager is asked to establish measurable improvements for the incident response program. During the lessons-learned review, the team notes that although the malware was contained quickly, three days passed between the initial phishing compromise and the first analyst alert. The manager wants to select a single metric that most directly targets this specific weakness so improvement can be tracked over future incidents. Which metric should the manager prioritize?

Accepted Answer

Mean time to detect (MTTD)

Answer

Mean time to respond (MTTR)

Answer

Mean time to contain (MTTC)

Answer

Mean time between failures (MTBF)

Question 54

A company is deploying an internal LLM-based assistant that uses a tool/function-calling framework, allowing the model to invoke backend APIs (ticketing, HR lookups, database queries) on behalf of employees. Security testing shows that a crafted prompt can coax the model into chaining tool calls to retrieve data the requesting user is not authorized to see. Which control most directly reduces the impact of this attack?

Accepted Answer

Enforce authorization at each tool/API endpoint using the requesting user's identity and scope, rather than relying on a single service account for all model tool calls

Answer

Increase the model's context window so it can retain the full conversation history and better track prior authorization decisions

Answer

Add a system prompt instructing the model to refuse requests for unauthorized data and to only return information the user is permitted to access

Answer

Fine-tune the model on a curated dataset of approved queries so it learns to avoid generating unauthorized tool calls

Question 55

A company deploys an internal customer-support chatbot built on a large language model (LLM) with a retrieval-augmented generation (RAG) pipeline that pulls from an indexed knowledge base of uploaded documents. During testing, a security engineer discovers that a document uploaded by an untrusted third party contained hidden instructions that, when retrieved and passed into the model context, caused the assistant to reveal system prompt contents and ignore its content-filtering rules. Which mitigation MOST directly addresses this indirect prompt injection risk?

Accepted Answer

Sanitize and validate ingested content, enforce strict separation between trusted system instructions and untrusted retrieved data, and apply output filtering before responses reach users

Answer

Enable TLS 1.3 with forward secrecy on the API endpoint serving the chatbot

Answer

Increase the model's context window size so more of the system prompt can be retained across turns

Answer

Rotate the API keys used by the RAG service account on a 30-day schedule

Question 56

During an active incident on a Linux production database server, the responder confirms suspicious outbound connections from a process with no matching binary on disk (fileless malware indicator). The server cannot be immediately taken offline due to business impact, and legal has requested court-admissible evidence. Which action should the responder take FIRST to preserve the most probative evidence?

Accepted Answer

Capture a full volatile memory (RAM) image of the running system before any other collection steps

Answer

Shut down the server cleanly and create a bit-for-bit forensic image of the disk

Answer

Export the SIEM logs correlated to the suspicious connections and hash the export

Answer

Kill the suspicious process and quarantine the parent binary for malware analysis

Question 57

A financial services company deploys a production image-classification model that approves or rejects check deposits based on scanned images. A red team demonstrates that by adding carefully crafted, human-imperceptible pixel noise to fraudulent check images, they can reliably force the model to misclassify forged checks as legitimate at inference time. The training pipeline and model weights were never accessed. Which mitigation most directly addresses this specific attack?

Accepted Answer

Implement adversarial training and input preprocessing (e.g., feature squeezing/randomized transformations) combined with confidence-threshold rejection at inference

Answer

Enforce data provenance validation and cryptographic signing of the training dataset before each retraining cycle

Answer

Restrict API access with OAuth scopes and add per-client rate limiting to the inference endpoint

Answer

Encrypt the model weights at rest in an HSM and enable full-disk encryption on the inference servers

Question 58

A financial firm deploys machine-learning models into production through an automated MLOps pipeline. A recent incident revealed that an attacker with access to the shared model registry replaced a fraud-detection model binary with a modified version, and the pipeline promoted it to production without detecting the swap. The security team must ensure that only authentic, unmodified model artifacts produced by the approved training pipeline can be deployed. Which control most directly addresses this gap?

Accepted Answer

Cryptographically sign model artifacts at the end of the training pipeline and require deployment tooling to verify the signature and provenance metadata before promotion

Answer

Encrypt the model registry storage at rest using an HSM-backed key and restrict decryption to the deployment service account

Answer

Add adversarial-input detection at the inference API to flag anomalous prediction requests against the fraud model

Answer

Enable membership-inference protections and differential privacy during model training to reduce data leakage

Question 59

A financial services company deploys an internal LLM-based chatbot that summarizes customer support tickets. Analysts noticed that when a ticket contains embedded HTML and JavaScript, the summarized output rendered in the agent's browser-based dashboard executes the script, exposing session tokens. The model itself is behaving as designed, faithfully reproducing ticket content. Which control most directly addresses this vulnerability?

Accepted Answer

Apply context-aware output encoding/sanitization on the model's response before it is rendered in the dashboard

Answer

Retrain the model with adversarial examples so it learns to ignore malicious ticket content

Answer

Add a system prompt instructing the model never to include scripts in its summaries

Answer

Enforce mutual TLS between the chatbot service and the dashboard front end

Question 60

A financial services company deploys a machine learning model via a public prediction API that returns detailed confidence scores for each classification. Security testing reveals that an external researcher was able to reconstruct attributes of individuals in the training set and determine whether specific customer records were used to train the model. Which combination of controls best mitigates these model inversion and membership inference attacks while preserving the API's usefulness?

Accepted Answer

Return only the top predicted label without confidence scores, apply rate limiting per API key, and incorporate differential privacy during model training

Answer

Encrypt the model file at rest with an HSM-backed key and require mutual TLS for all API clients

Answer

Retrain the model more frequently and add a web application firewall in front of the prediction API

Answer

Increase the size of the training dataset and disable logging of inbound prediction requests

Question 61

A financial services company trains a fraud-detection ML model on transaction data continuously ingested from multiple partner banks. A security engineer discovers that an attacker with access to one partner's feed has been submitting subtly mislabeled transactions over several months, gradually degrading the model's ability to flag a specific fraud pattern. Which control would most effectively mitigate this type of attack against the training pipeline?

Accepted Answer

Implement data provenance tracking with statistical anomaly detection and validation of incoming training samples before ingestion

Answer

Encrypt the training dataset at rest using an HSM-backed key hierarchy

Answer

Deploy a web application firewall in front of the model's inference API endpoint

Answer

Require multi-factor authentication for all data scientists accessing the model registry

Question 62

A company exposes a proprietary image-classification model through a public REST API. Security monitoring reveals that a single API consumer has submitted millions of systematically varied inputs over several weeks, recording each prediction and confidence score. Analysts suspect the client is attempting to reconstruct a functionally equivalent copy of the model. Which control most directly mitigates this model-extraction (model theft) threat while keeping the API usable for legitimate customers?

Accepted Answer

Return only the top-1 label without confidence scores and enforce per-account query rate limiting with anomaly-based throttling on high-volume systematic querying

Answer

Encrypt all API traffic with mutual TLS and require client certificates for every request

Answer

Retrain the model weekly using differential privacy to protect the underlying training records

Answer

Deploy a web application firewall with signatures for SQL injection and cross-site scripting on the API endpoint

Question 63

A healthcare analytics team is training a machine learning model on patient records to predict readmission risk. Compliance requires that the trained model must not allow an attacker with query access to reconstruct or confirm whether any specific patient's record was in the training set, even if the attacker submits crafted queries. The team already signs model artifacts and restricts endpoint access. Which additional control most directly satisfies this requirement?

Accepted Answer

Apply differential privacy during training by adding calibrated noise to gradients so individual records cannot be inferred from the model

Answer

Encrypt the training dataset at rest with an HSM-backed key hierarchy before training begins

Answer

Enable mutual TLS on the inference endpoint and rotate the serving certificate quarterly

Answer

Add output encoding and input validation to sanitize responses returned by the model endpoint

Question 64

A manufacturing company runs a fleet of programmable logic controllers (PLCs) on a legacy SCADA network that communicates using Modbus/TCP. A security assessment found that any host on the OT segment can issue write commands to the PLCs, and the protocol offers no authentication or integrity checking. The controllers cannot be patched or replaced for at least three years due to warranty and safety-certification constraints. Which approach BEST reduces the risk of unauthorized command injection while respecting these operational limitations?

Accepted Answer

Deploy a protocol-aware industrial firewall (Modbus deep-packet inspection) that enforces read/write function-code allowlists and restricts write commands to specific engineering-workstation source addresses

Answer

Enable TLS 1.3 with mutual certificate authentication directly on the PLCs to encrypt and authenticate all Modbus/TCP sessions

Answer

Install endpoint detection and response (EDR) agents on each PLC to monitor for anomalous command execution

Answer

Require operators to authenticate to the PLCs with multifactor authentication before issuing write commands

Exam domain	Exam weight	Practice
Governance, Risk, and Compliance	20%	Practice this topic
Security Architecture	27%	Practice this topic
Security Engineering	31%	Practice this topic
Security Operations	22%	Practice this topic

CompTIA SecurityX (CAS-005) (CAS-005) practice exam & study guide

Start studying CAS-005

All CAS-005 study resources

CAS-005 exam domains

Sample CAS-005 questions

Key CAS-005 terms

CAS-005 frequently asked questions

Governance, Risk, and Compliance (20%)

Security Architecture (27%)

Security Engineering (31%)

Security Operations (22%)