Get instant access to CAS-005 Practice Tests 2026 Free Updated Today!
Welcome to download the newest PassLeader CAS-005 PDF dumps ( 530 Q&As)
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 204
A senior security engineer flags the following log file snippet as having likely facilitated an attacker's lateral movement in a recent breach:
qry_source: 19.27.214.22 TCP/53
qry_dest: 199.105.22.13 TCP/53
qry_type: AXFR
| in comptia.org
------------ directoryserver1 A 10.80.8.10
------------directoryserver2 A 10.80.8.11
------------ directoryserver3 A 10.80.8.12
------------ internal-dns A 10.80.9.1
----------- www-int A 10.80.9.3
------------ fshare A 10.80.9.4
------------ sip A 10.80.9.5
------------ msn-crit-apcs A 10.81.22.33
Which of the following solutions, if implemented, would mitigate the risk of this issue reoccurring?
- A. Restricting DNS traffic to UDP/53
- B. Disabling DNS zone transfers
- C. Permitting only clients from internal networks to query DNS
- D. Implementing DNS masking on internal servers
Answer: B
Explanation:
The log shows an AXFR (zone transfer) query, which exposed internal DNS records, aiding lateral movement. Let's evaluate:
A . Disabling DNS zone transfers:AXFR allows full DNS zone data to be transferred. Disabling it externally prevents attackers from mapping internal networks, directly mitigating this issue per CAS-005's security operations focus.
B . Restricting to UDP/53:AXFR uses TCP/53, so this wouldn't stop it.
C . DNSmasking:Obscures records but isn't a standard term for this fix.
NEW QUESTION # 205
A security team determines that the most significant risks within the pipeline are:
* Unauthorized code changes
* The current inability to perform independent verification of software modules Which of the following best addresses these concerns?
- A. Code signing
- B. Digital signatures
- C. Lightweight cryptography
- D. Non-repudiation
Answer: A
Explanation:
Unauthorized code changesand lack ofindependent verificationare directly mitigated bycode signing, which ensures that code is from a trusted source and has not been altered.
While digital signatures are part of code signing, the broader practice of code signing encompasses signature management, version integrity, and trusted sources.
Lightweight cryptography is irrelevant in this context; it's more about efficiency in constrained devices.
Non-repudiation is a benefit of digital signatures but doesn't directly solve the verification/integrity concerns alone.
FromCAS-005 Guide, Domain 4: Security Architecture, Tools, and Technologies:
"Code signing ensures that the code has not been tampered with and originates from a trusted developer."
NEW QUESTION # 206
A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?
- A. Load
- B. Smoke
- C. Canary
- D. Regression
Answer: D
Explanation:
Step-by-Step
Regression testing ensures that new changes do not break existing functionality. It would have identified the memory leak before deployment, preventing downtime.
NEW QUESTION # 207
Which of the following best describes the challengesassociated with widespread adoption of homomorphic encryption techniques?
- A. Quantum computers not yet capable
- B. No use cases to drive adoption
- C. Incomplete mathematical primitives
- D. Insufficient coprocessor support
Answer: D
Explanation:
Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, preserving confidentiality. However, its adoption faces significant challenges due to performance overhead.
According to the CompTIA SecurityX CAS-005 study materials (Domain 3: Cybersecurity Technology, 3.3), homomorphic encryption requires substantial computational resources, which standard processors struggle to provide efficiently. Specialized hardware, such as coprocessors (e.g., GPUs or TPUs), is oftenneeded to handle the complex mathematical operations involved. The lack of widespread, optimized coprocessor support in existing infrastructure is a primary barrier to adoption.
* Option A (Incomplete mathematical primitives):While early homomorphic encryption schemes had limitations, modern schemes (e.g., CKKS, BFV) have mature mathematical foundations, making this less of a challenge today.
* Option B (No use cases):Use cases exist, such as secure cloud computing and privacy-preserving data analytics, so this is not accurate.
* Option C (Quantum computers):Homomorphic encryption is not dependent on quantum computing, and quantum computers are unrelated to its current challenges.
* Option D (Insufficient coprocessor support):This is the most accurate, as performance bottlenecks require specialized hardware that is not yet widely available or integrated.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide, Domain 3: Cybersecurity Technology, Section 3.3:
"Evaluate emerging cryptographic technologies, including homomorphic encryption challenges." CAS-005 Exam Objectives, 3.3: "Analyze barriers to adopting advanced encryption techniques."
NEW QUESTION # 208
PKI can be used to support security requirements in the change management process. Which of the following capabilities does PKI provide for messages?
- A. Confidentiality
- B. Delivery receipts
- C. Non-repudiation
- D. Attestation
Answer: C
Explanation:
Public Key Infrastructure (PKI) supports change management by securing messages (e.g., approvals, updates). Non-repudiation, provided via digital signatures, ensures a sender cannot deny sending a message, critical for auditability in change processes.
Option A: Correct-PKI's digital signatures ensure non-repudiation.
Option B: Confidentiality (via encryption) is a PKI feature but less tied to change management's focus on accountability.
Option C: Delivery receipts are not a PKI function; they're protocol-specific (e.g., SMTP).
Option D: Attestation relates to verifying attributes, not a direct PKI message capability.
NEW QUESTION # 209
Based on the results of a SAST report on a legacy application, a security engineer is reviewing the following snippet of code flagged as vulnerable:
Which of the following is the vulnerable line of code that must be changed?
- A. Line 108]
- B. Line [07]
- C. Line [04]
- D. Line [10]
- E. Line (02]
Answer: D
Explanation:
The vulnerability lies in line [10], where the function strcpy(transmit, input) is used. The strcpy function does not perform boundary checking when copying strings. Since input is defined with a size of 256 characters and transmit only has 20 characters allocated, the strcpy operation will cause a buffer overflow when the contents of input exceed the allocated size of transmit. This creates a significant security vulnerability, as attackers can overwrite adjacent memory, potentially injecting malicious code or altering program execution.
Lines [02], [04], [07], and [08] are not inherently vulnerable by themselves. Line [04] defines the oversized input, but the vulnerability only materializes when combined with the unsafe copy in line [10]. Secure coding practices recommend using safer alternatives like strncpy, which includes a length parameter, or implementing runtime checks to ensure the destination buffer size is not exceeded.
Thus, the vulnerable line that must be changed is line [10], where strcpy is used.
NEW QUESTION # 210
A user from the sales department opened a suspicious file attachment. The sales department then contacted the SOC to investigate a number of unresponsive systems, and the team successfully identified the file and the origin of the attack. Which of the following is the next step of the incident response plan?
- A. Recovery
- B. Containment
- C. Remediation
- D. Response
Answer: B
Explanation:
Incident response follows a standard process (e.g., NIST 800-61): Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. After identifying the attack (file and origin), the next step is Containment--limiting the spread or impact (e.g., isolating systems) before remediation or recovery.
NEW QUESTION # 211
While reviewing recent incident reports a security officer discovers that several employees were contacted by the same individual who impersonated a recruiter. Which of the following best describes this type of correlation?
- A. Attack pattern analysis
- B. Spear-phishing campaign
- C. Threat modeling
- D. Red team assessment
Answer: A
Explanation:
Attack pattern analysis involves identifying recurring techniques or behaviors used by threat actors - such as impersonating a recruiter - to correlate incidents and uncover broader campaigns. The security officer is recognizing a consistent method across multiple reports, which defines this as attack pattern analysis.
NEW QUESTION # 212
A company hosts a platform-as-a-service solution with a web-based front end, through which customer interact with data sets. A security administrator needs to deploy controls to prevent application-focused attacks. Which of the following most directly supports the administrator's objective'
- A. Rotating API access and authorization keys every two months
- B. Implementing application toad balancing and cross-region availability
- C. improving security dashboard visualization on SIEM
- D. Creating WAF policies for relevant programming languages
Answer: D
Explanation:
The best way to prevent application-focused attacks for a platform-as-a-service solution with a web-based front end is to create Web Application Firewall (WAF) policies for relevant programming languages. Here's why:
* Application-Focused Attack Prevention: WAFs are designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. They help prevent attacks such as SQL injection, cross-site scripting (XSS), and other application-layer attacks.
* Customizable Rules: WAF policies can be tailored to the specific programming languages and frameworks used by the web application, providing targeted protection based on known vulnerabilities and attack patterns.
* Real-Time Protection: WAFs provide real-time protection, blocking malicious requests before they reach the application, thereby enhancing the security posture of the platform.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* OWASP Top Ten: Web Application Security Risks
* NIST Special Publication 800-95: Guide to Secure Web Services
NEW QUESTION # 213
A security engineer needs to ensure production containers are automatically scanned for vulnerabilities before they are accepted into the production environment. Which of the following should the engineer use to automatically incorporate vulnerability scanning on every commit?
- A. Container orchestrator
- B. Integrated development environment
- C. CI/CD pipeline
- D. Code repository
Answer: C
Explanation:
The best solution for automatically scanning containers for vulnerabilities before they are accepted into the production environment is to incorporate vulnerability scanning into the CI/CD pipeline. Continuous Integration (CI) and Continuous Deployment (CD) pipelines can be configured to automatically trigger security scans, including container vulnerability assessments, every time code is committed or changes are pushed. This ensures that vulnerabilities are detected early in the development cycle before the containers are deployed to production.
NEW QUESTION # 214
Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique?
- A. It enables processing on data while remaining in an encrypted state.
- B. It is computationally efficient and provides perfect forward secrecy.
- C. It supports ephemeral key exchange and digital signatures.
- D. It is currently considered a robust PQC technique.
- E. It is more resilient to brute-force attacks than ECC.
Answer: D
Explanation:
Lattice-based schemes, such as Learning With Errors (LWE) or Ring-LWE, are among the leading candidates in NIST's post-quantum cryptography standardization process because their underlying hard problems resist known quantum-algorithm speedups. Replacing ECC with a lattice-based algorithm directly addresses the threat posed by future quantum computers, making it the preferred choice for long-term cryptographic agility.
NEW QUESTION # 215 
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.
Answer:
Explanation:
Explanation:
A computer screen shot of a diagram Description automatically generated
A screenshot of a computer error Description automatically generated
NEW QUESTION # 216
During DAST scanning, applications are consistently reporting code defects in open-source libraries that were used to build web applications. Most of the code defects are from using libraries with known vulnerabilities. The code defects are causing product deployment delays. Which of the following is the best way to uncover these issues earlier in the life cycle?
- A. Directing application logs to the SIEM for continuous monitoring
- B. Modifying the WAF policies to block against known vulnerabilities
- C. Completing an IAST scan against the web application
- D. Using a software dependency management solution
Answer: D
Explanation:
Comprehensive and Detailed
SecurityX CAS-005 exam content emphasizes integrating security into the SDLC and using automated tools to identify vulnerabilities early.
Software dependency management solutions track and analyze libraries and components for known vulnerabilities before deployment, using vulnerability databases such as NVD or OSS Index.
IAST scanning still requires the application to be running and may detect issues later.
WAF policies help block attacks in production but do not prevent vulnerable code from being deployed.
NEW QUESTION # 217
A security analyst isreviewing the following event timeline from an COR solution:
Which of the following most likely has occurred and needs to be fixed?
- A. An EDRbypass was utilized by a threat actor and updates must be installed by the administrator.
- B. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor
- C. A potential insider threat is being investigated and will be addressed by the senior management team.
- D. The Dl P has failed to block malicious exfiltration and data tagging is not being utilized property
Answer: B
Explanation:
The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed. This suggests a Time-Of-Check to Time-Of-Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.
References:
CompTIA SecurityX Study Guide: Discusses TOCTOU vulnerabilities as a timing attack where the state of a resource changes after it has been validated.
NIST Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations": Recommends addressing TOCTOU vulnerabilities to ensure the integrity of security operations.
"The Art of Software Security Assessment" by Mark Dowd, John McDonald, and Justin Schuh: Covers logic flaws and timing vulnerabilities, including TOCTOU issues.
NEW QUESTION # 218
Users must accept the terms presented in a captive petal when connecting to a guest network. Recently, users have reported that they are unable to access the Internet after joining the network A network engineer observes the following:
* Users should be redirected to the captive portal.
* The Motive portal runs Tl. S 1 2
* Newer browser versions encounter security errors that cannot be bypassed
* Certain websites cause unexpected re directs
Which of the following mow likely explains this behavior?
- A. An attacker is redirecting supplicants to an evil twin WLAN.
- B. Allowed traffic rules are causing the NIPS to drop legitimate traffic
- C. The TLS ciphers supported by the captive portal ate deprecated
- D. Employment of the HSTS setting is proliferating rapidly.
Answer: C
Explanation:
The most likely explanation for the issues encountered with the captive portal is that the TLS ciphers supported by the captive portal are deprecated. Here's why:
TLS Cipher Suites: Modern browsers are continuously updated to support the latest security standards and often drop support for deprecated and insecure cipher suites. If the captive portal uses outdated TLS ciphers, newer browsers may refuse to connect, causing security errors.
HSTS and Browser Security: Browsers with HTTP Strict Transport Security (HSTS) enabled will not allow connections to sites with weak security configurations. Deprecated TLS ciphers would cause these browsers to block the connection.
NEW QUESTION # 219
Which of the following AI concerns is most adequately addressed by input sanitation?
- A. Model inversion
- B. Non-explainable model
- C. Data poisoning
- D. Prompt Injection
Answer: D
Explanation:
Input sanitation is a critical process in cybersecurity that involves validating and cleaning data provided by users to prevent malicious inputs from causing harm. In the context of AI concerns:
A . Model inversion involves an attacker inferring sensitive data from model outputs, typically requiring sophisticated methods beyond just manipulating input data.
B . Prompt Injection is a form of attack where an adversary provides malicious input to manipulate the behavior of AI models, particularly those dealing with natural language processing (NLP). Input sanitation directly addresses this by ensuring that inputs are cleaned and validated to remove potentially harmful commands or instructions that could alter the AI's behavior.
C . Data poisoning involves injecting malicious data into the training set to compromise the model. While input sanitation can help by filtering out bad data, data poisoning is typically addressed through robust data validation and monitoring during the model training phase, rather than real-time input sanitation.
D . Non-explainable model refers to the lack of transparency in how AI models make decisions. This concern is not addressed by input sanitation, as it relates more to model design and interpretability techniques.
Input sanitation is most relevant and effective for preventing Prompt Injection attacks, where the integrity of user inputs directly impacts the performance and security of AI models.
Reference:
CompTIA Security+ Study Guide
"Security of Machine Learning" by Battista Biggio, Blaine Nelson, and Pavel Laskov OWASP (Open Web Application Security Project) guidelines on input validation and injection attacks Top of Form Bottom of Form
NEW QUESTION # 220
A company that operates in different countries has local email infrastructure for each of its business units. A breach occurred in which email communications were intercepted between the headquarters and one of the overseas business units.
During an investigation, the security analyst finds the following email log:
Which of the following actions should the security analyst take to best address the issue?
- A. Change the TLS configuration from opportunistic to enforced
- B. Disable the NTLM authentication and replace it with TLS 1.2
- C. Revoke the expired TLS certificate and replace it with a valid one
- D. Create a new TLS certificate using a stronger algorithm and larger key
Answer: A
Explanation:
The log shows a STARTTLS negotiation failure followed by email transmission without encryption. This indicates the mail server is using opportunistic TLS, which falls back to plaintext if encryption fails - leaving email vulnerable to interception. Enforcing TLS ensures communication only proceeds if encryption is successful, effectively mitigating this risk.
NEW QUESTION # 221
A security architect is mitigating a vulnerability that previously led to a web application data breach. An analysis into the root cause of the issue finds the following:
* An administrator's account was hijacked and used on several Autonomous System Numbers within 30 minutes.
* All administrators use named accounts that require multifactor authentication.
* Single sign-on is used for all company applications.Which of the following should the security architect do to mitigate the issue?
- A. Configure token theft detection on the single sign-on system with automatic account lockouts.
- B. Enable context-based authentication when network locations change on administrator login attempts.
- C. Enforce biometric authentication requirements for the administrator's named accounts.
- D. Decentralize administrator accounts and force unique passwords for each application.
Answer: B
Explanation:
Comprehensive and Detailed Explanation:
The hijacked administrator account was used across multiple ASNs (indicating different network locations) in a short time, despite MFA and SSO. This suggests a stolen session or token misuse. Let's analyze:
* A. Token theft detection with lockouts:Useful for detecting stolen SSO tokens, but it's reactive and may not prevent initial misuse across networks.
* B. Context-based authentication:This adds real-time checks (e.g., geolocation, IP changes) to verify login attempts. Given the rapid ASN changes, this proactively mitigates the issue by challenging suspicious logins, aligning with CAS-005's focus on adaptive security.
* C. Decentralize accounts:This removes SSO, increasing complexity and weakening MFA enforcement, which isn't practical or secure.
Reference:CompTIA SecurityX (CAS-005) objectives, Domain 2: Security Operations, emphasizing context- aware authentication for SSO environments.
NEW QUESTION # 222
A security analyst is troubleshooting the reason a specific user is having difficulty accessing company resources The analyst reviews the following information:
Which of the following is most likely the cause of the issue?
- A. Several users have not configured their mobile devices to receive OTP codes
- B. A network geolocation is being misidentified by the authentication server
- C. The local network access has been configured to bypass MFA requirements.
- D. Administrator access from an alternate location is blocked by company policy
Answer: B
Explanation:
The table shows that the user "SALES1" is consistently blocked despite having met the MFA requirements. The common factor in these blocked attempts is the source IP address (8.11.4.16) being identified as from Germany while the user is assigned to France. This discrepancy suggests that the network geolocation is being misidentified by the authentication server, causing legitimate access attempts to be blocked.
Why Network Geolocation Misidentification?
Geolocation Accuracy: Authentication systems often use IP geolocation to verify the location of access attempts. Incorrect geolocation data can lead to legitimate requests being denied if they appear to come from unexpected locations.
Security Policies: Company security policies might block access attempts from certain locations to prevent unauthorized access. If the geolocation is wrong, legitimate users can be inadvertently blocked.
Consistent Pattern: The user "SALES1" from the IP address 8.11.4.16 is always blocked, indicating a consistent issue with geolocation.
Other options do not align with the pattern observed:
A . Bypass MFA requirements: MFA is satisfied, so bypassing MFA is not the issue.
C . Administrator access policy: This is about user access, not specific administrator access.
D . OTP codes: The user has satisfied MFA, so OTP code configuration is not the issue.
Reference:
CompTIA SecurityX Study Guide
"Geolocation and Authentication," NIST Special Publication 800-63B
"IP Geolocation Accuracy," Cisco Documentation
NEW QUESTION # 223
Third parties notified a company's security team about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best addresses the reported vulnerabilities?
- A. Implementing a continuous security assessment program
- B. Creating a bug bounty program
- C. Using laC to include the newest dependencies
- D. Integrating a SASI tool as part of the pipeline
Answer: D
Explanation:
The best solution to address reported vulnerabilities in third-party libraries is integrating a Static Application Security Testing (SAST) tool as part of the development pipeline. Here's why:
Early Detection: SAST tools analyze source code for vulnerabilities before the code is compiled. This allows developers to identify and fix security issues early in the development process.
Continuous Security: By integrating SAST tools into the CI/CD pipeline, the organization ensures continuous security assessment of the codebase, including third-party libraries, with each code commit and build.
Comprehensive Analysis: SAST tools provide a detailed analysis of the code, identifying potential vulnerabilities in both proprietary code and third-party dependencies, ensuring that known issues in libraries are addressed promptly.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
OWASP Static Analysis Security Testing (SAST) Cheat Sheet
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 224
......
Jun-2026 Latest ActualTestsQuiz CAS-005 Exam Dumps with PDF and Exam Engine: https://www.actualtestsquiz.com/CAS-005-test-torrent.html
Premium Quality CompTIA CAS-005 Online dumps: https://drive.google.com/open?id=1hWGHXQXcVtwf1OWjA4nRsr9Iug9fF8vp
