Free CompTIA SecurityX (formerly CASP+) (CAS-005) Practice Questions

Sample CAS-005 Practice Questions

Browse all 10 free CompTIA SecurityX (formerly CASP+) practice questions below.

1. A security architect is designing a Zero Trust architecture for a global enterprise with hybrid cloud infrastructure. The solution must enforce least-privilege access, continuously verify user identity and device health, and eliminate implicit trust. Which combination of controls should the architect implement? (Select TWO)

   • Configure VPN with split-tunneling to reduce latency for cloud applications
   • Implement microsegmentation with software-defined perimeters to enforce granular network access controls
   • Implement perimeter firewall with DMZ for external-facing services
   • Deploy identity-aware proxy with continuous authentication and adaptive access policies
   • Deploy network access control (NAC) with 802.1X authentication at the edge

2. A security architect is designing a PKI infrastructure for a multinational organization that requires certificate issuance across multiple geographic regions. The solution must support certificate lifecycle management, automated renewal, hardware security module (HSM) integration for root CA protection, and OCSP for real-time revocation checking. Which PKI architecture best meets these requirements?

   • Two-tier PKI with offline root CA protected by HSM, online issuing CAs in each region, OCSP responders for each issuing CA, and automated certificate management via ACME protocol
   • Single-tier PKI with one root CA performing all issuance functions, CRL distribution via CDN, and manual certificate renewal processes
   • Cloud-based PKI as a Service with certificates stored in cloud HSM and DNS-based revocation checking
   • Three-tier PKI with offline root CA, intermediate policy CAs, and issuing CAs, using only CRL for revocation checking

3. An organization is implementing a SOAR platform to automate incident response workflows. The security operations team needs to integrate the SOAR solution with existing SIEM, EDR, firewall, and ticketing systems. Which capabilities should the security architect prioritize when selecting a SOAR platform? (Select TWO)

   • RESTful APIs and extensive integration library supporting common security tools and IT systems
   • Pre-built playbooks for common incident types and threat scenarios with customization capabilities
   • Proprietary scripting language exclusive to the SOAR vendor
   • On-premises deployment only to prevent cloud data exposure
   • Built-in machine learning for automatically generating new playbooks without human input

4. A DevSecOps team is implementing container security for a Kubernetes cluster running microservices in production. The security architect needs to implement defense-in-depth controls throughout the container lifecycle. Which combination of security controls provides the most comprehensive protection? (Select TWO)

   • Disabling all network policies to improve application performance and eliminate connectivity issues
   • Storing container image secrets and API keys in container environment variables without encryption
   • Running all containers as root user to ensure administrative access for debugging and troubleshooting
   • Image scanning in CI/CD pipeline with policy enforcement blocking vulnerable images, runtime security monitoring for anomalous container behavior, and regular image updates
   • Pod Security Standards enforcing restricted policy, network policies implementing microsegmentation, and read-only root filesystems for containers

5. A security engineer is implementing cryptographic controls for a healthcare application that must comply with HIPAA requirements. The application stores protected health information (PHI) in a database and transmits data to external partners. Which cryptographic implementation best meets regulatory and security requirements?

   • Symmetric encryption with shared keys distributed via email, HTTP for partner data exchange, and database-level encryption only
   • MD5 hashing for passwords, SSL 3.0 for data transmission, and DES encryption for database fields
   • Custom encryption algorithm developed in-house, proprietary key exchange protocol, and encryption only for backups
   • AES-256-GCM for data at rest with HSM-managed keys, TLS 1.3 with Perfect Forward Secrecy for data in transit, and field-level encryption for particularly sensitive PHI elements

6. An organization is implementing Infrastructure as Code (IaC) using Terraform for cloud resource provisioning. The security team needs to integrate security controls into the IaC workflow. Which security practices should be implemented? (Select TWO)

   • Grant all developers full administrative access to cloud accounts to enable faster troubleshooting
   • Hardcode cloud credentials directly in Terraform configuration files to simplify deployment processes
   • Implement policy as code using tools like Open Policy Agent (OPA) or HashiCorp Sentinel to enforce security policies before infrastructure deployment
   • Disable all pre-deployment validation checks to speed up infrastructure provisioning
   • Store Terraform state files in version control with encryption, use remote state backends with state locking, and implement state file access controls

7. A security architect is designing an automated security testing strategy for a CI/CD pipeline. The development team releases code multiple times per day, and the security team needs to identify vulnerabilities without blocking development velocity. Which combination of automated security testing tools should be integrated into the pipeline? (Select TWO)

   • Software Composition Analysis (SCA) to identify known vulnerabilities in third-party dependencies and open source libraries
   • Disabling all security testing during development and performing comprehensive testing only in production
   • Manual penetration testing performed by security consultants for every code commit
   • Comprehensive security review meetings requiring all stakeholders to approve each deployment
   • Static Application Security Testing (SAST) integrated into the build phase to analyze source code for security vulnerabilities

8. An enterprise security team is implementing a hardware security module (HSM) cluster for cryptographic key management across multiple applications. The HSM solution must provide high availability, support for various cryptographic operations, and compliance with FIPS 140-2 Level 3. What architectural considerations are most important for this implementation?

   • Deploy HSMs in high-availability cluster configuration with N+1 redundancy, implement load balancing across HSMs, establish secure key backup and recovery procedures, and integrate with applications via PKCS#11 or cryptographic APIs
   • Use software-based key management with database storage to avoid HSM cost and complexity
   • Deploy a single HSM appliance, store all cryptographic keys on the HSM, and provide direct network access to all applications
   • Export all private keys from HSM to application servers for better performance, use HSM only for initial key generation

9. A cloud security architect is designing secure API authentication and authorization for microservices running in Kubernetes. The architecture must support service-to-service authentication, fine-grained access control, and zero-trust networking principles. Which approach best implements these requirements?

   • Use shared API keys distributed to all microservices via environment variables, implement IP-based access control lists, and store user credentials in a shared database
   • Implement VPN for all service communication, use session-based authentication with sticky sessions, and centralize all authorization logic in a monolithic gateway
   • Allow all internal service-to-service communication without authentication, use basic authentication for user access, and implement role-based access control in each application
   • Implement service mesh (Istio/Linkerd) with mutual TLS (mTLS) for service-to-service encryption and authentication, use JSON Web Tokens (JWT) for user authentication, integrate with external identity provider via OAuth 2.0/OIDC, and implement policy-based authorization with OPA

10. A security engineer needs to implement automated vulnerability patching for a fleet of 5,000+ servers across multiple cloud regions. The solution must minimize downtime, support rollback capabilities, and provide compliance reporting. Which strategy should be implemented?

    • Deploy all patches immediately to all servers simultaneously without testing, disable rollback mechanisms to prevent users from reverting changes
    • Manually patch servers one at a time, schedule all patching during business hours for maximum visibility, skip backups to save time, and document patching in spreadsheets
    • Wait for vendors to notify the organization about required patches, apply only critical patches while ignoring moderate severity issues
    • Implement patch management automation using AWS Systems Manager Patch Manager or Azure Update Management, deploy patches using maintenance windows with rolling deployment strategy, implement automated pre-patch snapshots for rollback, and integrate with SIEM for compliance reporting