CASP+ (CASP+) CAS-004 4

Question 1

An organization is evaluating cryptographic algorithms for a system that must remain secure for 30+ years. Which algorithm and key length combination provides the BEST long-term security?

Accepted Answer

AES-256 combined with CRYSTALS-Kyber for quantum-resistant key exchange

Answer

AES-256 combined with a NIST-approved post-quantum key encapsulation mechanism like CRYSTALS-Kyber provides security against both classical and quantum adversaries over decades.

Question 2

A security engineer reviewing cloud infrastructure finds that developer IAM roles have 'AdministratorAccess' attached to enable rapid development. What risk does this MOST directly represent?

Accepted Answer

Violation of the principle of least privilege increasing blast radius of a compromise

Answer

Overly permissive IAM roles violate least privilege, meaning a compromised developer credential grants an attacker full administrative control over the cloud environment.

Question 3

During a purple team exercise, defenders fail to detect a pass-the-hash attack that successfully authenticated to a domain controller. Which control would MOST effectively prevent this?

Accepted Answer

Enabling Protected Users Security Group and disabling NTLM authentication

Answer

The Protected Users Security Group prevents NTLM authentication and disabling NTLM eliminates the hash reuse attack vector that pass-the-hash exploits.

Question 4

An organization acquires a company and must assess the security posture of the acquired entity's systems before integrating them into the corporate network. What is the BEST first step?

Accepted Answer

Conducting an independent security assessment of the acquired environment before integration

Answer

An independent security assessment of the acquired environment identifies unknown vulnerabilities and risks before integration, preventing the introduction of compromised systems into the corporate network.

Question 5

A web application undergoes a security review and is found to serialize user-supplied objects without validation. Which vulnerability class does this MOST likely introduce?

Accepted Answer

Insecure deserialization enabling remote code execution

Answer

Deserializing untrusted user-supplied objects without validation is the definition of insecure deserialization, which can lead to remote code execution when gadget chains exist.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ (CASP+) CAS-004 4