CASP+ (CASP+) CAS-004 3

Question 1

A cloud-native application uses microservices that communicate via an internal API gateway. Which authentication mechanism is MOST appropriate for service-to-service communication in this environment?

Accepted Answer

Mutual TLS (mTLS) with short-lived certificates issued by a service mesh

Answer

mTLS with short-lived certificates in a service mesh provides strong mutual authentication and encryption for service-to-service communication without human credentials.

Question 2

A security engineer is analyzing a firmware image for an embedded IoT device. They suspect a hardcoded backdoor exists. Which analysis technique is MOST efficient for finding hardcoded credentials?

Accepted Answer

Static binary analysis using entropy analysis and string extraction

Answer

Static binary analysis with string extraction and entropy analysis efficiently surfaces hardcoded credentials and cryptographic material without executing the firmware.

Question 3

An organization implements a SOAR platform. A playbook automatically blocks IP addresses flagged by threat intelligence feeds. What risk does this automation introduce?

Accepted Answer

False positive blocking of legitimate IP addresses causing service disruption

Answer

Automated blocking based on threat intelligence without human review risks false positives that can block legitimate business traffic and cause service outages.

Question 4

A security architect must select an encryption mode for a database that stores fixed-length credit card numbers. Which mode is MOST appropriate considering the data characteristics?

Accepted Answer

AES-GCM to provide authenticated encryption with integrity verification

Answer

AES-GCM provides both confidentiality and integrity verification, and with a unique nonce per record, prevents the pattern leakage that makes ECB insecure for structured data.

Question 5

An attacker uses a supply chain attack to insert malicious code into a widely used open-source library. What defensive control BEST detects this before the code reaches production?

Accepted Answer

Implementing a software composition analysis (SCA) tool in the CI/CD pipeline

Answer

SCA tools integrated into CI/CD pipelines scan dependencies for known vulnerabilities and unexpected changes, detecting supply chain compromises before deployment.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ (CASP+) CAS-004 3