CompTIA Advanced Security Practitioner (CASP+) CAS-004 — Questions and Answers

Question 1: A security engineer is analyzing a firmware image for an embedded IoT device. They suspect a hardcoded backdoor exists. Which analysis technique is MOST efficient for finding hardcoded credentials?

Fuzzing the device's network interface with malformed packets
Static binary analysis using entropy analysis and string extraction (Correct answer)
Reviewing the manufacturer's published CVE disclosures
Dynamic analysis by running the firmware in a production device

Correct answer: Static binary analysis using entropy analysis and string extraction

Static binary analysis with string extraction and entropy analysis efficiently surfaces hardcoded credentials and cryptographic material without executing the firmware.

Question 2: Which elliptic curve is RECOMMENDED by NIST for use in US federal systems at the 128-bit security level?

P-256 (secp256r1) (Correct answer)
secp256k1
P-521
Curve25519

Correct answer: P-256 (secp256r1)

NIST P-256 is the FIPS-approved curve at the 128-bit security level, recommended in NIST SP 800-186 for federal cryptographic applications.

Question 3: An attacker uses a supply chain attack to insert malicious code into a widely used open-source library. What defensive control BEST detects this before the code reaches production?

Manually reviewing all third-party library changelogs before updates
Implementing a software composition analysis (SCA) tool in the CI/CD pipeline (Correct answer)
Blocking all outbound internet access from production build servers
Subscribing to the library vendor's security mailing list

Correct answer: Implementing a software composition analysis (SCA) tool in the CI/CD pipeline

SCA tools integrated into CI/CD pipelines scan dependencies for known vulnerabilities and unexpected changes, detecting supply chain compromises before deployment.

Question 4: An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?

Transfer via cyber liability insurance
Avoid the risk by discontinuing the activity
Mitigate by implementing compensating controls
Accept the risk and document the decision (Correct answer)

Correct answer: Accept the risk and document the decision

When mitigation cost exceeds potential loss for a low-likelihood, low-impact risk, accepting the risk with documented rationale is the most cost-effective decision.

Question 5: Which standard specifically defines requirements for payment card data security applicable to merchants and service providers?

FedRAMP
NIST SP 800-171
PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)
SOC 2 Type I

Correct answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS is the global security standard mandated by card brands (Visa, Mastercard, etc.) for any organization that stores, processes, or transmits cardholder data.

Question 6: A CASP+ professional is building a vendor risk management program. Which assessment type provides the MOST assurance about a cloud provider's security controls?

Vendor-completed self-assessment questionnaire
SOC 2 Type II report from an independent auditor (Correct answer)
A phone interview with the vendor's CISO
Marketing materials and compliance badges

Correct answer: SOC 2 Type II report from an independent auditor

A SOC 2 Type II report documents testing of controls over a period (typically 6–12 months) by an independent auditor, providing high-confidence evidence of operational effectiveness.

Question 7: Which Kubernetes security control prevents containers from running as the root user within a cluster?

Network policies
Role-based access control (RBAC) for the API server
TLS between kubelets
Pod Security Admission (PSA) with restricted policy (Correct answer)

Correct answer: Pod Security Admission (PSA) with restricted policy

Pod Security Admission enforces security profiles on pods; the 'restricted' policy prohibits running as root, disallows privilege escalation, and requires read-only root filesystems.

Question 8: In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?

Guest operating system and installed applications (Correct answer)
Physical data center security
Network backbone infrastructure
Hypervisor patches

Correct answer: Guest operating system and installed applications

In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.

Question 9: A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

Digital signatures on the handshake
RSA key exchange (non-forward-secret) (Correct answer)
The use of asymmetric cryptography
Certificate-based authentication

Correct answer: RSA key exchange (non-forward-secret)

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

Question 10: A compromised server is communicating with a C2 server using HTTPS on port 443. Which detection method is MOST effective?

TLS inspection with certificate validation and JA3 fingerprinting for anomalous clients (Correct answer)
Blocking all HTTPS traffic at the firewall
Blocking all traffic to IP ranges outside the US
Signature-based IDS rules on port 443

Correct answer: TLS inspection with certificate validation and JA3 fingerprinting for anomalous clients

TLS inspection decrypts traffic for analysis, and JA3 fingerprinting identifies malicious client TLS configurations used by specific malware families even over encrypted channels.

Question 11: An enterprise needs quantum-resistant encryption for long-lived sensitive data. Which NIST-standardized post-quantum algorithm is appropriate for key encapsulation?

AES-256-GCM
ECDSA P-384
RSA-4096
CRYSTALS-Kyber (ML-KEM) (Correct answer)

Correct answer: CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber (standardized as ML-KEM in NIST FIPS 203) is NIST's approved post-quantum key encapsulation mechanism, resistant to attacks by quantum computers.

Question 12: A CASP+ professional is designing an API gateway for microservices. Which control is MOST important for API security?

Using HTTP instead of HTTPS to reduce latency
OAuth 2.0 with JWT tokens and rate limiting per client (Correct answer)
Allowing anonymous access to improve developer experience
Embedding API keys directly in mobile application code

Correct answer: OAuth 2.0 with JWT tokens and rate limiting per client

OAuth 2.0 with short-lived JWT tokens provides delegated authorization, and rate limiting prevents abuse, together forming a strong API security baseline.

Question 13: An organization wants to assess the maturity of its information security program. Which framework provides a structured maturity model for this purpose?

MITRE ATT&CK framework
CVE/NVD database
CMMC (Cybersecurity Maturity Model Certification) (Correct answer)
OWASP Top 10

Correct answer: CMMC (Cybersecurity Maturity Model Certification)

CMMC defines progressive maturity levels (1–3) with specific practice requirements, enabling organizations to benchmark and improve their cybersecurity posture.

Question 14: Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

Audit Report
Risk Register
System Security Plan (SSP)
Plan of Action and Milestones (POA&M) (Correct answer)

Correct answer: Plan of Action and Milestones (POA&M)

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

Question 15: Which architectural control BEST protects against supply chain attacks on third-party software libraries?

Blocking all internet access from build servers
Requiring vendors to sign NDAs
Software composition analysis (SCA) integrated into the CI/CD pipeline (Correct answer)
Using only open-source libraries

Correct answer: Software composition analysis (SCA) integrated into the CI/CD pipeline

SCA tools scan dependencies for known vulnerabilities and license issues at build time, catching supply chain risks before deployment.

Question 16: A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

SHA-3 without stretching
SHA-256 with no salt
MD5 with a random salt
bcrypt with an appropriate work factor (Correct answer)

Correct answer: bcrypt with an appropriate work factor

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

Question 17: Which cloud security architecture pattern uses a dedicated security account/subscription to centralize logging, monitoring, and security tooling?

Single account with all workloads
Multi-tenant shared services model
Direct peering between all workload accounts
Hub-and-spoke (landing zone) with a dedicated security hub account (Correct answer)

Correct answer: Hub-and-spoke (landing zone) with a dedicated security hub account

A hub-and-spoke landing zone architecture centralizes security services (SIEM, logging, network inspection) in a dedicated hub account, providing centralized visibility without mixing workloads.

Question 18: An architect must ensure high availability for a critical authentication service. Which approach BEST balances resilience and security?

Geographically distributed active-active cluster with health checks and session replication (Correct answer)
Single server with nightly backups
Active-passive cluster with manual failover
DNS round-robin with no session persistence

Correct answer: Geographically distributed active-active cluster with health checks and session replication

An active-active cluster across geographic regions provides automatic failover and load distribution while replicating session state for continuity.

Question 19: A company must comply with both GDPR and CCPA. Their cloud provider stores data in the US and EU. Which data governance control addresses both regulations' residency and subject rights requirements?

Use a CDN to serve data from the nearest region to reduce latency
Deploy a CASB to monitor all cloud access and generate compliance reports
Encrypt all data with AES-256 and store encryption keys on-premises
Implement data classification with geo-tagged metadata and automated deletion workflows (Correct answer)

Correct answer: Implement data classification with geo-tagged metadata and automated deletion workflows

Data classification with geo-tagged metadata enables both residency enforcement and automated workflows for subject rights like deletion under GDPR/CCPA.

Question 20: An organization subject to GDPR must respond to a personal data breach notification requirement within what timeframe?

72 hours of becoming aware of the breach (if it poses a risk to individuals) (Correct answer)
7 business days
30 days of discovery
90 days of the end of fiscal quarter

Correct answer: 72 hours of becoming aware of the breach (if it poses a risk to individuals)

Article 33 of the GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights.

Question 21: A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?

Scanning images only after they are deployed to production
Manual security review of all Dockerfiles
Automated image scanning with deployment gates that block critical CVEs (Correct answer)
Requiring developers to sign a security checklist

Correct answer: Automated image scanning with deployment gates that block critical CVEs

Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.

Question 22: Which security practice MOST reduces the risk of secrets sprawl in a cloud-native CI/CD environment?

Emailing secrets to developers when needed
Storing secrets in plaintext in the source code repository
Using a centralized secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic secret generation (Correct answer)
Storing secrets in environment variables hardcoded in container images

Correct answer: Using a centralized secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic secret generation

Centralized secrets managers with dynamic, short-lived credentials ensure secrets are never stored statically, are automatically rotated, and all access is audited.

Question 23: Which document formally authorizes an information system to operate and accepts residual risk on behalf of the organization?

Authority to Operate (ATO) (Correct answer)
Plan of Action and Milestones (POA&M)
System Security Plan (SSP)
Risk Assessment Report (RAR)

Correct answer: Authority to Operate (ATO)

An ATO is the official management decision by an authorizing official (AO) accepting the residual risk and granting permission for the system to operate.

Question 24: An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?

Server-side encryption with provider-generated keys
Cloud provider-managed encryption (SSE with provider keys)
Client-side encryption with keys derived from passwords stored in the cloud
Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key) (Correct answer)

Correct answer: Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)

HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.

Question 25: An organization wants to ensure that digital signatures on contracts remain legally valid even if the signing algorithm is later deprecated. Which mechanism BEST addresses this?

Storing documents in encrypted archives
Trusted timestamping combined with long-term validation (LTV) signatures (Correct answer)
Using symmetric encryption for document storage
Re-signing all documents with a new algorithm immediately

Correct answer: Trusted timestamping combined with long-term validation (LTV) signatures

LTV signatures embed the certificate chain and revocation data at signing time, and a trusted timestamp proves the signature existed before algorithm deprecation.

Question 26: A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?

Antivirus signature scan results
Vulnerability scanner output
Process creation and command-line logging (Sysmon Event ID 1) (Correct answer)
Network bandwidth utilization graphs

Correct answer: Process creation and command-line logging (Sysmon Event ID 1)

LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.

Question 27: Which risk management framework does NIST recommend for federal information systems and is widely adopted in the US private sector?

COSO ERM
ISO 31000
NIST Risk Management Framework (RMF) (Correct answer)
ITIL v4

Correct answer: NIST Risk Management Framework (RMF)

NIST RMF (SP 800-37) provides a structured, six-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing information system risk.

Question 28: A CASP+ analyst applies threat modeling to a new application. Which methodology uses the mnemonic STRIDE to categorize threats?

FAIR (Factor Analysis of Information Risk)
Microsoft STRIDE threat modeling (Correct answer)
PASTA (Process for Attack Simulation and Threat Analysis)
OCTAVE Allegro

Correct answer: Microsoft STRIDE threat modeling

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 29: A CASP+ professional conducts a BIA. Which output is MOST critical for defining recovery objectives?

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process (Correct answer)
A full network topology diagram
The organization's annual IT budget
A list of all IT assets

Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process

RTO (maximum tolerable downtime) and RPO (maximum acceptable data loss) are the primary outputs of a BIA that drive continuity and recovery planning.

Question 30: An organization is merging with another company and needs to integrate their IT systems securely. Which approach BEST supports secure integration while minimizing risk?

Immediately merge all systems into a single domain
Disable all firewalls to allow unrestricted communication during migration
Share all credentials between both organizations during transition
Deploy a federated identity model with trust boundaries between organizations (Correct answer)

Correct answer: Deploy a federated identity model with trust boundaries between organizations

A federated identity model allows each organization to maintain its own identity store while establishing controlled trust, minimizing the attack surface during merger.

Question 31: An organization performs a gap analysis against ISO 27001. Which output BEST prioritizes remediation efforts?

A list of all ISO 27001 controls
The organization's existing security policies
A risk-ranked list of control gaps with associated residual risk levels (Correct answer)
A full network diagram

Correct answer: A risk-ranked list of control gaps with associated residual risk levels

Risk-ranking gaps by residual risk ensures that the most dangerous deficiencies are remediated first, optimizing the allocation of limited security resources.

Question 32: Which cryptographic algorithm provides BOTH confidentiality and data authentication in a single operation?

RSA-2048 encryption
AES-GCM (Galois/Counter Mode) (Correct answer)
SHA-256 hashing
AES-CBC with HMAC-SHA256 applied separately

Correct answer: AES-GCM (Galois/Counter Mode)

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR mode and integrity/authentication via the GHASH function.

Question 33: Which key management practice MOST reduces the risk of key compromise over time?

Storing all keys in a single encrypted key file
Implementing automated key rotation with defined cryptoperiods (Correct answer)
Using the same key indefinitely to avoid complexity
Deriving all keys from a single master password

Correct answer: Implementing automated key rotation with defined cryptoperiods

Defined cryptoperiods with automated rotation limit the exposure window if a key is compromised and reduce the data volume encrypted under any single key.

Question 34: Which cloud identity and access management practice MOST effectively enforces least privilege for serverless functions?

Assigning administrator roles to all Lambda/Cloud Function execution roles
Creating a unique, minimal IAM execution role per function with only required permissions (Correct answer)
Disabling IAM for serverless functions to simplify deployment
Using the same shared execution role for all functions

Correct answer: Creating a unique, minimal IAM execution role per function with only required permissions

Each function gets only the permissions it needs to perform its specific task; a compromise of one function cannot be used to access resources needed only by other functions.

Question 35: Which architecture control MOST effectively protects sensitive data from compromised application code?

Storing encryption keys in the same database as the data
Hardware security modules (HSMs) for key management with application-layer encryption (Correct answer)
Using application-level password hashing only
Encrypting data only during transmission

Correct answer: Hardware security modules (HSMs) for key management with application-layer encryption

HSMs store cryptographic keys in tamper-resistant hardware, so even fully compromised application code cannot extract the raw keys.

Question 36: A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?

Image scanning at build time only
Network-level firewall rules
Disabling all container networking
Runtime container security monitoring with syscall analysis (Correct answer)

Correct answer: Runtime container security monitoring with syscall analysis

Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.

Question 37: A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?

DHCP server logs
DNS server query logs
Web proxy access logs
Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts (Correct answer)

Correct answer: Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts

Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.

Question 38: A CISO is implementing a vendor risk management program. A critical SaaS vendor refuses to allow third-party security audits. What is the MOST appropriate response?

Immediately terminate the vendor relationship due to non-compliance
Perform a remote vulnerability scan of the vendor's externally facing infrastructure
Require the vendor to provide SOC 2 Type II reports and contractual security commitments (Correct answer)
Accept the risk if the vendor provides a completed security questionnaire

Correct answer: Require the vendor to provide SOC 2 Type II reports and contractual security commitments

SOC 2 Type II reports provide third-party validated evidence of security controls, and contractual commitments provide legal recourse, offering reasonable assurance when direct audits are refused.

Question 39: A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Inside the internal network but accessible via a reverse proxy in the DMZ
In the DMZ, behind the external firewall but before the internal firewall (Correct answer)
Inside the internal network with no additional segmentation
Directly on the internet with no firewall

Correct answer: In the DMZ, behind the external firewall but before the internal firewall

Placing the web server in the DMZ isolates it from the internal network so that a compromise does not immediately expose internal systems.

Question 40: In OAuth 2.0, what is the security advantage of the authorization code flow over the implicit flow?

It encrypts all user data stored at the authorization server
It provides persistent authentication without requiring token refresh
It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser (Correct answer)
It allows client applications to directly access user credentials for efficiency

Correct answer: It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser

The authorization code flow exchanges a temporary code for tokens over a secure back channel, preventing tokens from being exposed in browser history or redirects.

Question 41: A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Choosing the solution from the most well-known vendor
Selecting the cheapest option that meets minimum compliance requirements
Relying on analyst reports alone
Conducting a proof of concept (PoC) against defined acceptance criteria (Correct answer)

Correct answer: Conducting a proof of concept (PoC) against defined acceptance criteria

A PoC tested against pre-defined, measurable acceptance criteria provides objective evidence of how each solution performs in the specific environment.

Question 42: A PKI administrator needs to revoke a certificate immediately due to a key compromise. Which mechanism provides the FASTEST revocation propagation?

Manual notification to all relying parties
CRL published on a daily schedule
OCSP stapling with short-validity responses (Correct answer)
Waiting for the certificate to expire naturally

Correct answer: OCSP stapling with short-validity responses

OCSP stapling embeds a recent, CA-signed revocation response directly in the TLS handshake, providing near-real-time revocation status without client round-trips.

Question 43: Security testing must have a low risk of influencing system stability because the company is in production. According to the board of directors, a third party won't have the development team's knowledge. Which of the subsequent tests is the ideal choice?

A prominent external consulting firm conducted black-box testing.
A large consulting firm conducted gray-box testing.
Development and security assurance teams do white-box testing. (Correct answer)
Development and security assurance teams do gray-box testing.

Correct answer: Development and security assurance teams do white-box testing.

The best course of action would be to combine white-box testing with involving the development and security assurance teams, given the need to conduct security testing with little risk of affecting system stability and the board of directors' concern about a third party lacking the development team's expertise. Potential security flaws can be found through white-box testing, which necessitates understanding the system's underlying workings and source code. The risk of stability problems can be reduced by utilizing the development and security assurance teams' knowledge of the system and experience in the testing process to conduct extensive assessments.

Question 44: Which employs the necessary keys and examines the trust paths and revocation status before enabling the certificate to be utilized when a browser views a website?

Root CA
Browser (Correct answer)
RA
Web server

Correct answer: Browser

Vendors will build a PKI standard to enable the exchange of keys via certificates, which is a need for an application to use a digital certificate. Before enabling the application to utilize the certificate, the browser uses the necessary keys and verifies the trust paths and revocation status. The certificate is provided by the web server to the browser for verification. The PKI certificate's root of trust is the Root CA (certificate authority). Requests for digital certificates are verified by the RA (registration authority).

Question 45: A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

api.example.com
mail.example.com
sub.mail.example.com (Correct answer)
www.example.com

Correct answer: sub.mail.example.com

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

Question 46: A cloud-native application uses microservices that communicate via an internal API gateway. Which authentication mechanism is MOST appropriate for service-to-service communication in this environment?

Mutual TLS (mTLS) with short-lived certificates issued by a service mesh (Correct answer)
OAuth 2.0 authorization code flow with user consent
Kerberos tickets issued by an on-premises Active Directory domain controller
Username and password credentials stored in environment variables

Correct answer: Mutual TLS (mTLS) with short-lived certificates issued by a service mesh

mTLS with short-lived certificates in a service mesh provides strong mutual authentication and encryption for service-to-service communication without human credentials.

Question 47: Which network control MOST effectively limits the blast radius of a compromised container within a Kubernetes cluster?

Using NodePort services for all communications
Disabling all container networking
Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only (Correct answer)
Running all pods in the default namespace

Correct answer: Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only

NetworkPolicy objects define ingress and egress rules for pods; a compromised pod with restrictive policies cannot initiate connections to arbitrary pods in other namespaces.

Question 48: Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?

Storing credentials in environment variables set at runtime
Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles (Correct answer)
Storing credentials in a plaintext config file on the server
Hardcoding credentials in the application source code

Correct answer: Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles

IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.

Question 49: What is the primary risk mitigated by implementing rigorous account lifecycle management?

Password complexity requirements becoming too restrictive
Network bandwidth overuse by active users
Orphaned accounts retaining access after employees leave or change roles (Correct answer)
Excessive storage consumption from authentication logs

Correct answer: Orphaned accounts retaining access after employees leave or change roles

Without account lifecycle management, former employees or role-changers retain access through orphaned accounts, creating unauthorized access risks that may go undetected for extended periods.

Question 50: A web application undergoes a security review and is found to serialize user-supplied objects without validation. Which vulnerability class does this MOST likely introduce?

Insecure deserialization enabling remote code execution (Correct answer)
Cross-site request forgery (CSRF) allowing unauthorized state changes
XML external entity (XXE) injection extracting server files
Server-side request forgery (SSRF) accessing internal services

Correct answer: Insecure deserialization enabling remote code execution

Deserializing untrusted user-supplied objects without validation is the definition of insecure deserialization, which can lead to remote code execution when gadget chains exist.

Question 51: An organization acquires a company and must assess the security posture of the acquired entity's systems before integrating them into the corporate network. What is the BEST first step?

Deploying corporate endpoint protection software on all acquired systems
Requiring the acquired company to pass a SOC 2 Type II audit within 90 days
Conducting an independent security assessment of the acquired environment before integration (Correct answer)
Immediately connecting acquired systems to the corporate network with firewall rules controlling access

Correct answer: Conducting an independent security assessment of the acquired environment before integration

An independent security assessment of the acquired environment identifies unknown vulnerabilities and risks before integration, preventing the introduction of compromised systems into the corporate network.

Question 52: Which artifact should be collected FIRST when responding to a Linux system compromise, given the order of volatility?

Running process list and network connections (Correct answer)
Hard drive forensic image
Contents of /var/log/auth.log
Backup tapes from the previous night

Correct answer: Running process list and network connections

Running processes and active network connections are the most volatile artifacts, existing only in memory and disappearing on reboot — they must be captured before any other action.

Question 53: An enterprise deploys a SIEM. Which integration provides the MOST actionable threat intelligence for the architecture?

Manual log review by the SOC team
Syslog feeds from all endpoints
Threat intelligence platform (TIP) with indicator enrichment (Correct answer)
Email alerts from antivirus vendors

Correct answer: Threat intelligence platform (TIP) with indicator enrichment

A TIP enriches SIEM events with curated indicators of compromise (IOCs) and context, enabling faster, higher-fidelity alerting.

Question 54: Which compliance framework is MOST applicable to a US healthcare organization processing electronic protected health information (ePHI)?

PCI DSS
HIPAA Security Rule (Correct answer)
SOC 2 Type II
GDPR

Correct answer: HIPAA Security Rule

The HIPAA Security Rule mandates administrative, physical, and technical safeguards specifically for ePHI held by covered entities and business associates in the US.

Question 55: Which log source is MOST valuable for detecting data exfiltration via DNS tunneling?

Antivirus scan results
Windows event logs from domain controllers
Firewall allow/deny logs
DNS query and response logs with anomaly baselines (Correct answer)

Correct answer: DNS query and response logs with anomaly baselines

DNS tunneling encodes data in DNS query strings; analysis of DNS logs for high-frequency queries, unusual record types, or large TXT responses reveals this technique.

Question 56: Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

BEAST (Browser Exploit Against SSL/TLS) (Correct answer)
Meet-in-the-middle attack
Length extension attack
Padding oracle attack

Correct answer: BEAST (Browser Exploit Against SSL/TLS)

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

Question 57: An organization uses a cloud-native WAF to protect web applications. Which attack type is the WAF LEAST effective at preventing on its own?

Broken object-level authorization (BOLA/IDOR) (Correct answer)
Remote file inclusion via URL parameters
SQL injection via HTTP parameters
Cross-site scripting (XSS) in request bodies

Correct answer: Broken object-level authorization (BOLA/IDOR)

BOLA/IDOR is a business logic flaw where authenticated users access others' data using valid requests; WAFs cannot distinguish legitimate from malicious access to the same API endpoint.

Question 58: Which forensic principle ensures that evidence is protected from alteration from the moment of collection through legal proceedings?

Order of volatility
Data minimization
Chain of custody (Correct answer)
Non-repudiation

Correct answer: Chain of custody

Chain of custody documents every person who handles evidence, timestamps all transfers, and verifies integrity, ensuring evidence is admissible and untampered in legal proceedings.

Question 59: The database server is operated by Acme Inc. The server and its data are valued at $10,000. The operating system on the server is outdated and cannot be patched. According to your calculations, there is a 20% risk that the server would be compromised in the upcoming year, and that compromise would result in the loss of 50% of the server's value (i.e., all of the data). What is the SLE from the standpoint of a quantitative risk assessment?

$5,000 (Correct answer)
100%
$10,000
50%

Correct answer: $5,000

The quantity of loss anticipated in the event of a single loss is known as SLE. The SLE equation is: EF x AV = SLE The value of an asset is its AV (asset value). The answer informs us that AV is $10,000. The EF (exposure factor) measures the percentage likelihood that a specific threat will have an effect on a given asset. According to the question, a compromise would result in a 50% reduction in value. EF thus equals 50%. The question's SLE formula is as follows: SLE = $10,000 x 0.50 SLE = $5,000

Question 60: What among the following DOES NOT constitute an open-source intelligence (OSINT) source?

Social Media
Whois
DNS record
Ping scan (Correct answer)

Correct answer: Ping scan

Data used in open-source intelligence (OSINT) is obtained from open sources. Potential sources of OSINT data include social media, the deep web, WHOIS and DNS records, as well as other open data sources. A ping scan takes place exclusively within a local area network (LAN) and is not disclosed to the general public. Consequently, a ping scan is not an OSINT source.

Question 61: During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?

Immediately reimage the system
Isolate the system from the network while preserving volatile memory (Correct answer)
Notify law enforcement immediately
Delete all suspicious files

Correct answer: Isolate the system from the network while preserving volatile memory

Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.

Question 62: An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

A flat PKI with no intermediate CAs
A single root CA used directly for all certificate issuance
An offline root CA with online intermediate/issuing CAs (Correct answer)
A root CA hosted on an internet-connected server for availability

Correct answer: An offline root CA with online intermediate/issuing CAs

An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

Question 63: Which technique allows organizations to verify that a cloud provider's hardware and firmware have not been tampered with before trusting the environment?

Reviewing the provider's marketing materials
Remote attestation using a Trusted Platform Module (TPM) and measured boot (Correct answer)
Conducting a physical site visit
Checking the provider's compliance certifications alone

Correct answer: Remote attestation using a Trusted Platform Module (TPM) and measured boot

Remote attestation uses TPM-stored measurements of the boot process to cryptographically prove to a remote verifier that the platform booted trusted, unmodified firmware and software.

Question 64: Which hashing algorithm among the following is the most powerful?

AES
SHA-256 (Correct answer)
MD5
DES

Correct answer: SHA-256

SHA-256 and MD5 are hashing algorithms, among the listed algorithms. A more powerful hashing method than MD5 is SHA-256. MD5 is prone to collisions during hashing. Block cipher algorithms AES and DES.

Question 65: Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?

Birthday attack
Timing side-channel attack
Factoring attack (e.g., using Pollard's rho or GNFS) (Correct answer)
Padding oracle attack

Correct answer: Factoring attack (e.g., using Pollard's rho or GNFS)

RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.

Question 66: Which approach BEST ensures that security architecture decisions remain aligned with business objectives over time?

Delegating all security decisions to the IT operations team
Establishing a security governance committee with regular architecture review boards (Correct answer)
Updating security policies only when a breach occurs
Conducting a one-time security assessment at system launch

Correct answer: Establishing a security governance committee with regular architecture review boards

A governance committee with scheduled architecture reviews ensures security controls evolve with the business, technology, and threat landscape.

Question 67: Which hierarchical type of the following, which uses certificate authorities (CAs), registration authorities (RAs), and central directory/distribution management to build their trust model, is used by MOST organizations when implementing PKI?

Symmetric encryption
Chain of trust (Correct answer)
Control mode
PGP

Correct answer: Chain of trust

A hierarchical chain of trust model, which includes a minimum of three key elements, is often the foundation of PKI infrastructure. To bind a public key to a particular entity, certificate authorities (CAs), at the top of the model, issue certificates. User requests for digital certificates are checked by registration authorities (RAs). Management of central directories and distribution - Maintains and manages the issued certificates.

Question 68: Which cryptographic primitive is used to derive multiple keys from a single shared secret in TLS?

Block cipher in ECB mode
HMAC-based Key Derivation Function (HKDF) (Correct answer)
RSA-OAEP
Elliptic curve point multiplication alone

Correct answer: HMAC-based Key Derivation Function (HKDF)

HKDF uses HMAC to extract entropy from the shared secret and then expand it into keying material for multiple purposes (encryption, MAC, IV) within the TLS session.

Question 69: Which key exchange protocol provides perfect forward secrecy (PFS)?

Ephemeral Diffie-Hellman (DHE) or ECDHE (Correct answer)
Static Diffie-Hellman (DH)
RSA key exchange
Pre-shared key (PSK) exchange

Correct answer: Ephemeral Diffie-Hellman (DHE) or ECDHE

Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

Question 70: To ensure that users can only access the resources they need to complete specific tasks, permissions must be provided. Which security principle ought to be used to fulfill the requirement?

Need to know
Separation of duties
Job rotation
Least privilege (Correct answer)

Correct answer: Least privilege

To ensure that users can only access the resources they need to carry out certain tasks, the least privilege security concept should be used when granting permissions. According to the least privilege concept, users should only be given the minimal level of access required to carry out their planned tasks or fulfill their job-related duties. Users should only have access to the resources and rights necessary for them to complete their tasks successfully, and nothing more.

Question 71: A large enterprise wants to implement defense-in-depth. Which combination of controls BEST represents this strategy?

Network segmentation, endpoint detection, and application-layer controls working together (Correct answer)
A single next-generation firewall at the perimeter
Redundant firewalls from the same vendor
A unified threat management appliance at the network edge

Correct answer: Network segmentation, endpoint detection, and application-layer controls working together

Defense-in-depth layers multiple independent controls so that failure of any single layer does not result in a full compromise.

Question 72: Which risk treatment option is demonstrated when an organization purchases cyber liability insurance?

Risk acceptance
Risk transference (Correct answer)
Risk mitigation
Risk avoidance

Correct answer: Risk transference

Cyber liability insurance transfers the financial consequences of a risk to an insurance provider, though the operational risk remains with the organization.

Question 73: A cloud security engineer reviews a multi-account AWS environment. Which service provides centralized, automated security findings aggregation across all accounts?

AWS Security Hub (Correct answer)
AWS Trusted Advisor
AWS CloudTrail
AWS Config

Correct answer: AWS Security Hub

AWS Security Hub aggregates findings from GuardDuty, Inspector, Majestic, and third-party tools across all accounts in an organization, providing a single security posture dashboard.

Question 74: A red team successfully exfiltrates data by encoding it within DNS TXT record queries. Which security control would have BEST prevented this?

Implementing split-horizon DNS to separate internal and external name resolution
Requiring all DNS queries to use DNSSEC for record validation
Blocking all outbound UDP port 53 traffic at the perimeter firewall
Deploying a DNS firewall with DNS query rate limiting and anomaly detection (Correct answer)

Correct answer: Deploying a DNS firewall with DNS query rate limiting and anomaly detection

A DNS firewall with query rate limiting and anomaly detection identifies unusual TXT record query volumes and patterns characteristic of DNS tunneling exfiltration.

Question 75: A penetration tester is assessing a target that uses certificate pinning in its mobile application. Which technique allows the tester to intercept the application's TLS traffic?

Performing an ARP spoofing attack on the device's network gateway
Downgrading the TLS version to SSLv3 using a POODLE-style attack
Using Frida or similar tools to hook and bypass the pinning validation logic at runtime (Correct answer)
Installing a custom CA certificate in the device's trusted store

Correct answer: Using Frida or similar tools to hook and bypass the pinning validation logic at runtime

Certificate pinning ignores the device's trust store, so runtime instrumentation tools like Frida must hook the validation function directly to bypass it.

Question 76: Which solution provides centralized management, session monitoring, and credential vaulting for privileged accounts?

Identity Provider (IdP)
Access Control List Manager (ACLM)
Privileged Access Management (PAM) (Correct answer)
Identity Governance and Administration (IGA)

Correct answer: Privileged Access Management (PAM)

PAM solutions provide credential vaulting, session recording, just-in-time access, and centralized oversight specifically for privileged accounts and administrative access.

Question 77: During a threat hunt, an analyst discovers beaconing traffic to an external IP at regular 60-second intervals using HTTPS. The process responsible is svchost.exe. What is the MOST likely threat?

Legitimate Windows Update service communicating with Microsoft
A rootkit disguising itself as a kernel driver
Command-and-control communication from malware using process hollowing (Correct answer)
DNS tunneling exfiltrating data over HTTPS

Correct answer: Command-and-control communication from malware using process hollowing

Regular beaconing from svchost.exe over HTTPS is a hallmark of process hollowing where malware injects into a legitimate process to establish C2 communication.

Question 78: Which technique allows computation on encrypted data without decrypting it?

Homomorphic encryption (Correct answer)
Symmetric encryption with a shared key
Tokenization
Envelope encryption

Correct answer: Homomorphic encryption

Homomorphic encryption allows mathematical operations to be performed on ciphertext, producing an encrypted result that decrypts to the same value as operating on the plaintext.

Question 79: A CASP+ architect must design a zero-trust network for a financial institution. Which control is MOST critical to enforce zero-trust principles?

VPN tunnels for all remote users
Static ACLs on all network switches
Continuous verification of identity and device posture for every request (Correct answer)
Perimeter firewall with stateful inspection

Correct answer: Continuous verification of identity and device posture for every request

Zero trust requires continuous verification of identity and device health for every access request, regardless of network location.

Question 80: Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

NIST SP 800-171
NIST SP 800-137
NIST SP 800-53
NIST SP 800-63 (Correct answer)

Correct answer: NIST SP 800-63

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

Question 81: Which control BEST enforces separation of duties in a financial application's architecture?

Requiring two-factor authentication for all users
Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions (Correct answer)
Using audit logging for all transactions
Encrypting the database at rest

Correct answer: Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

RBAC that separates initiator and approver roles enforces separation of duties, preventing a single user from completing a fraudulent transaction alone.

Question 82: An incident responder acquires a forensic image of a suspect hard drive. Which tool and format combination is the industry standard for maintaining forensic integrity?

FTK Imager or dc3dd to an E01 image with SHA-256 hash verification (Correct answer)
dd to a raw image without hashing
xcopy with the /s flag
rsync copy of the file system

Correct answer: FTK Imager or dc3dd to an E01 image with SHA-256 hash verification

E01 (Expert Witness Format) images include embedded hash values that can be verified at any time, and tools like FTK Imager record acquisition metadata for chain-of-custody documentation.

Question 83: Which control MOST effectively protects against a cloud misconfiguration that exposes an internal metadata service to a server-side request forgery (SSRF) attack?

Disabling the metadata service entirely
Encrypting metadata service responses
Web Application Firewall blocking outbound traffic
IMDSv2 (requiring session tokens for metadata access) and network egress filtering (Correct answer)

Correct answer: IMDSv2 (requiring session tokens for metadata access) and network egress filtering

IMDSv2 requires a PUT request to obtain a session token before accessing metadata, preventing SSRF exploits that use simple GET requests to steal instance credentials.

Question 84: Which quantitative risk analysis technique uses probability distributions and repeated simulations to model the range of possible outcomes?

DREAD model
CVSS scoring
Monte Carlo simulation (Correct answer)
STRIDE threat modeling

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs thousands of iterations with random values drawn from probability distributions to produce a range of risk outcomes and their likelihoods.

Question 85: A penetration tester successfully performs a SQL injection attack but the application returns only true/false responses with no error messages. Which SQL injection technique applies?

Error-based SQL injection
Out-of-band SQL injection
Blind boolean-based SQL injection (Correct answer)
Union-based SQL injection

Correct answer: Blind boolean-based SQL injection

Blind boolean-based SQL injection infers database information from the application's true/false behavioral responses when no data is directly returned.

Question 86: An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Signing with the developer's personal certificate
Detached signatures stored separately from the binary (Correct answer)
Storing the signed binary on an internet-accessible server
Using a certificate with a short validity period

Correct answer: Detached signatures stored separately from the binary

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Question 87: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Preimage resistance
One-way property
Second preimage resistance
Collision resistance (Correct answer)

Correct answer: Collision resistance

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

Question 88: Which design principle BEST limits privilege escalation within an enterprise architecture?

Storing admin credentials in a shared password spreadsheet
Using long-lived service accounts with broad permissions
Implementing just-in-time (JIT) privileged access with approval workflows (Correct answer)
Giving all administrators a single shared admin account

Correct answer: Implementing just-in-time (JIT) privileged access with approval workflows

JIT access grants elevated privileges only when needed and for a limited time, reducing the window of exposure for high-privilege accounts.

Question 89: Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Control gap score
Single Loss Expectancy (SLE) (Correct answer)
Residual risk percentage
Annualized Rate of Occurrence (ARO)

Correct answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor and represents the expected financial loss from a single occurrence of a specific threat event.

Question 90: Which security architecture approach MOST effectively addresses insider threats?

Requiring employees to sign acceptable use policies
Blocking all USB ports on endpoints
Deploying antivirus on all workstations
User and Entity Behavior Analytics (UEBA) combined with least-privilege access (Correct answer)

Correct answer: User and Entity Behavior Analytics (UEBA) combined with least-privilege access

UEBA establishes behavioral baselines and alerts on anomalous activity, while least-privilege limits what insiders can access or exfiltrate.

CompTIA Advanced Security Practitioner (CASP+) CAS-004

The CASP+ (CAS-004) is an advanced-level cybersecurity certification validating enterprise security architecture, security operations, cryptography, and governance, risk, and compliance skills for IT professionals with 10+ years of experience.

Questions

165 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds