CompTIA Advanced Security Practitioner (CASP+) CAS-004 — Questions and Answers

Question 1: What is the primary purpose of SCIM (System for Cross-domain Identity Management)?

To encrypt identity tokens during transmission
To manage certificate lifecycles in PKI
To provide multi-factor authentication services
To automate user provisioning and deprovisioning across systems (Correct answer)

Correct answer: To automate user provisioning and deprovisioning across systems

SCIM automates the exchange of user identity information between identity providers and service providers, streamlining provisioning and deprovisioning workflows.

Question 2: An enterprise needs quantum-resistant encryption for long-lived sensitive data. Which NIST-standardized post-quantum algorithm is appropriate for key encapsulation?

CRYSTALS-Kyber (ML-KEM) (Correct answer)
AES-256-GCM
RSA-4096
ECDSA P-384

Correct answer: CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber (standardized as ML-KEM in NIST FIPS 203) is NIST's approved post-quantum key encapsulation mechanism, resistant to attacks by quantum computers.

Question 3: Which compliance framework is MOST applicable to a US healthcare organization processing electronic protected health information (ePHI)?

GDPR
HIPAA Security Rule (Correct answer)
PCI DSS
SOC 2 Type II

Correct answer: HIPAA Security Rule

The HIPAA Security Rule mandates administrative, physical, and technical safeguards specifically for ePHI held by covered entities and business associates in the US.

Question 4: A keylogger is being operated by a Meterpreter shell on the CFO's laptop. What security principle is the keylogger most likely to violate?

Threats
Integrity
Confidentiality (Correct answer)
Availability

Correct answer: Confidentiality

Most likely, the CFO's laptop's keylogger violates the security principle of secrecy. The confidentiality of sensitive information relates to its defense against unauthorized access or disclosure. The keylogger on the CFO's laptop in this instance logs keystrokes, possibly sensitive data like passwords, login credentials, or private information entered by the CFO included. Keyloggers are designed to record information without the user's awareness or consent.

Question 5: An organization's security policy requires that all cryptographic keys be generated using a FIPS 140-2 Level 3 validated device. What distinguishes Level 3 from Level 2 validation?

Level 3 mandates the use of ECC keys over RSA for all cryptographic operations
Level 3 requires software-based key wrapping for key export operations
Level 3 requires tamper-evident coatings and physical identity-based authentication for operators (Correct answer)
Level 3 eliminates the requirement for role-based authentication

Correct answer: Level 3 requires tamper-evident coatings and physical identity-based authentication for operators

FIPS 140-2 Level 3 adds tamper-responsive mechanisms (active zeroization on tamper detection) and identity-based authentication for operators, beyond Level 2's tamper-evident coatings.

Question 6: An organization implements a bug bounty program. A researcher submits a finding demonstrating that an API endpoint returns sensitive PII of other users when the user ID parameter is manipulated. Which vulnerability class is this?

SQL injection allowing enumeration of the user database
Mass assignment vulnerability overwriting protected user attributes
Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (Correct answer)
Server-side request forgery (SSRF) accessing internal user data stores

Correct answer: Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization

Accessing another user's resources by manipulating an identifier without authorization checks is the definition of IDOR, categorized under Broken Object Level Authorization in OWASP.

Question 7: A security engineer is reviewing code and finds that an application logs full HTTP request bodies including authorization headers to a centralized SIEM. What is the PRIMARY security concern?

Excessive logging creating storage costs and SIEM performance degradation
Bearer tokens and session credentials in logs creating long-lived exposure of access material (Correct answer)
Violation of data minimization principles under GDPR for EU user data only
Log tampering by an insider with SIEM write access

Correct answer: Bearer tokens and session credentials in logs creating long-lived exposure of access material

Authorization headers containing bearer tokens or session credentials in logs create persistent, queryable copies of access material that outlive the intended session lifetime.

Question 8: An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Signing with the developer's personal certificate
Using a certificate with a short validity period
Detached signatures stored separately from the binary (Correct answer)
Storing the signed binary on an internet-accessible server

Correct answer: Detached signatures stored separately from the binary

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Question 9: Which cloud logging source MOST directly captures attempted privilege escalation in an AWS environment?

AWS CloudTrail with management event logging for IAM and STS API calls (Correct answer)
EC2 instance system logs
S3 access logs
VPC Flow Logs

Correct answer: AWS CloudTrail with management event logging for IAM and STS API calls

CloudTrail records every IAM and STS API call, including AssumeRole, CreatePolicy, and AttachUserPolicy, directly revealing privilege escalation attempts in the management plane.

Question 10: To ensure that users can only access the resources they need to complete specific tasks, permissions must be provided. Which security principle ought to be used to fulfill the requirement?

Need to know
Least privilege (Correct answer)
Separation of duties
Job rotation

Correct answer: Least privilege

To ensure that users can only access the resources they need to carry out certain tasks, the least privilege security concept should be used when granting permissions. According to the least privilege concept, users should only be given the minimal level of access required to carry out their planned tasks or fulfill their job-related duties. Users should only have access to the resources and rights necessary for them to complete their tasks successfully, and nothing more.

Question 11: A company's incident response team is handling a ransomware attack. Encrypted files have been confirmed on three servers. What should be the FIRST containment action?

Isolate the affected systems from the network to prevent further spread (Correct answer)
Pay the ransom to obtain the decryption key and minimize downtime
Perform forensic imaging of all affected systems before taking any action
Restore the affected servers from the most recent backup immediately

Correct answer: Isolate the affected systems from the network to prevent further spread

Network isolation is the first containment priority to stop ransomware propagation before it encrypts additional systems across the environment.

Question 12: A PKI administrator needs to revoke a certificate immediately due to a key compromise. Which mechanism provides the FASTEST revocation propagation?

CRL published on a daily schedule
Manual notification to all relying parties
Waiting for the certificate to expire naturally
OCSP stapling with short-validity responses (Correct answer)

Correct answer: OCSP stapling with short-validity responses

OCSP stapling embeds a recent, CA-signed revocation response directly in the TLS handshake, providing near-real-time revocation status without client round-trips.

Question 13: Which security architecture approach MOST effectively addresses insider threats?

Blocking all USB ports on endpoints
Deploying antivirus on all workstations
Requiring employees to sign acceptable use policies
User and Entity Behavior Analytics (UEBA) combined with least-privilege access (Correct answer)

Correct answer: User and Entity Behavior Analytics (UEBA) combined with least-privilege access

UEBA establishes behavioral baselines and alerts on anomalous activity, while least-privilege limits what insiders can access or exfiltrate.

Question 14: During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?

Notify law enforcement immediately
Immediately reimage the system
Isolate the system from the network while preserving volatile memory (Correct answer)
Delete all suspicious files

Correct answer: Isolate the system from the network while preserving volatile memory

Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.

Question 15: A CASP+ analyst applies threat modeling to a new application. Which methodology uses the mnemonic STRIDE to categorize threats?

PASTA (Process for Attack Simulation and Threat Analysis)
FAIR (Factor Analysis of Information Risk)
Microsoft STRIDE threat modeling (Correct answer)
OCTAVE Allegro

Correct answer: Microsoft STRIDE threat modeling

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 16: A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?

Scanning images only after they are deployed to production
Automated image scanning with deployment gates that block critical CVEs (Correct answer)
Requiring developers to sign a security checklist
Manual security review of all Dockerfiles

Correct answer: Automated image scanning with deployment gates that block critical CVEs

Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.

Question 17: Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?

Container escape
Side-channel attack
VM escape (hypervisor breakout) (Correct answer)
API injection

Correct answer: VM escape (hypervisor breakout)

A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.

Question 18: Which cryptographic algorithm provides BOTH confidentiality and data authentication in a single operation?

SHA-256 hashing
RSA-2048 encryption
AES-GCM (Galois/Counter Mode) (Correct answer)
AES-CBC with HMAC-SHA256 applied separately

Correct answer: AES-GCM (Galois/Counter Mode)

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR mode and integrity/authentication via the GHASH function.

Question 19: A company migrates a regulated workload to a public cloud. Which cloud deployment model MOST effectively addresses data sovereignty requirements?

Public multi-region cloud with data replication globally
Hybrid cloud with no data residency controls
Sovereign cloud or government cloud region with contractual data residency guarantees (Correct answer)
Public cloud with client-side encryption only

Correct answer: Sovereign cloud or government cloud region with contractual data residency guarantees

Sovereign or government cloud regions are physically and logically isolated, with contractual guarantees that data remains within a specific jurisdiction, satisfying data sovereignty regulations.

Question 20: Which log source is MOST valuable for detecting data exfiltration via DNS tunneling?

Antivirus scan results
DNS query and response logs with anomaly baselines (Correct answer)
Firewall allow/deny logs
Windows event logs from domain controllers

Correct answer: DNS query and response logs with anomaly baselines

DNS tunneling encodes data in DNS query strings; analysis of DNS logs for high-frequency queries, unusual record types, or large TXT responses reveals this technique.

Question 21: Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

Meet-in-the-middle attack
Padding oracle attack
BEAST (Browser Exploit Against SSL/TLS) (Correct answer)
Length extension attack

Correct answer: BEAST (Browser Exploit Against SSL/TLS)

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

Question 22: A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Conducting a proof of concept (PoC) against defined acceptance criteria (Correct answer)
Selecting the cheapest option that meets minimum compliance requirements
Choosing the solution from the most well-known vendor
Relying on analyst reports alone

Correct answer: Conducting a proof of concept (PoC) against defined acceptance criteria

A PoC tested against pre-defined, measurable acceptance criteria provides objective evidence of how each solution performs in the specific environment.

Question 23: A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Directly on the internet with no firewall
Inside the internal network but accessible via a reverse proxy in the DMZ
In the DMZ, behind the external firewall but before the internal firewall (Correct answer)
Inside the internal network with no additional segmentation

Correct answer: In the DMZ, behind the external firewall but before the internal firewall

Placing the web server in the DMZ isolates it from the internal network so that a compromise does not immediately expose internal systems.

Question 24: An organization identifies that a critical control is not cost-effective to implement. Which control type can be used to partially offset the risk without fully replacing the missing control?

Detective control
Preventive control
Compensating control (Correct answer)
Corrective control

Correct answer: Compensating control

Compensating controls are alternative measures that provide equivalent or partial risk reduction when the primary control cannot be implemented as specified.

Question 25: Which technique allows organizations to verify that a cloud provider's hardware and firmware have not been tampered with before trusting the environment?

Checking the provider's compliance certifications alone
Remote attestation using a Trusted Platform Module (TPM) and measured boot (Correct answer)
Conducting a physical site visit
Reviewing the provider's marketing materials

Correct answer: Remote attestation using a Trusted Platform Module (TPM) and measured boot

Remote attestation uses TPM-stored measurements of the boot process to cryptographically prove to a remote verifier that the platform booted trusted, unmodified firmware and software.

Question 26: A cloud storage company is Acme Cloud. A threat actor recently gained access to and successfully decrypted data from one of Acme Cloud's servers. However, the insufficient nature of the data prevented the threat actor from using it. Prior to the breach, Acme Cloud divided and re-encrypted the customer data among various servers. What phrase best defines the method Acme Cloud uses to divide the data in order to lessen the chance of data leakage?

Key escrow
Application wrapping
Bit splitting (Correct answer)
Stream ciphering

Correct answer: Bit splitting

Data is divided into smaller chunks, encrypted, and distributed across various storage locations using the bit splitting process. The data is meaningless if a threat actor compromises just one place. Key escrow is the process of keeping an encryption key with a third party so that it can be produced when requests for decryption are made. Data is encrypted using a stream cipher using a byte-by-byte or bit-by-bit approach. Building a management layer to help implement control over an app without really changing it is called "application wrapping."

Question 27: Which technique do attackers use to evade time-based detection by delaying malware execution until after security monitoring windows?

Time-of-check to time-of-use (TOCTOU) exploits
Polymorphic code
Scheduled task execution with time-based triggers (Correct answer)
SQL injection with SLEEP() commands

Correct answer: Scheduled task execution with time-based triggers

Attackers use scheduled tasks or sleep timers to delay execution until a period of reduced monitoring (e.g., nights, weekends), evading behavior-based detection that correlates events with deployment times.

Question 28: Which standard specifically defines requirements for payment card data security applicable to merchants and service providers?

NIST SP 800-171
PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)
SOC 2 Type I
FedRAMP

Correct answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS is the global security standard mandated by card brands (Visa, Mastercard, etc.) for any organization that stores, processes, or transmits cardholder data.

Question 29: A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

RSA key exchange (non-forward-secret) (Correct answer)
Digital signatures on the handshake
Certificate-based authentication
The use of asymmetric cryptography

Correct answer: RSA key exchange (non-forward-secret)

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

Question 30: Which quantitative risk analysis technique uses probability distributions and repeated simulations to model the range of possible outcomes?

DREAD model
STRIDE threat modeling
Monte Carlo simulation (Correct answer)
CVSS scoring

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs thousands of iterations with random values drawn from probability distributions to produce a range of risk outcomes and their likelihoods.

Question 31: An organization uses a cloud-native WAF to protect web applications. Which attack type is the WAF LEAST effective at preventing on its own?

Cross-site scripting (XSS) in request bodies
Remote file inclusion via URL parameters
Broken object-level authorization (BOLA/IDOR) (Correct answer)
SQL injection via HTTP parameters

Correct answer: Broken object-level authorization (BOLA/IDOR)

BOLA/IDOR is a business logic flaw where authenticated users access others' data using valid requests; WAFs cannot distinguish legitimate from malicious access to the same API endpoint.

Question 32: Which control MOST effectively protects against a cloud misconfiguration that exposes an internal metadata service to a server-side request forgery (SSRF) attack?

Disabling the metadata service entirely
Encrypting metadata service responses
IMDSv2 (requiring session tokens for metadata access) and network egress filtering (Correct answer)
Web Application Firewall blocking outbound traffic

Correct answer: IMDSv2 (requiring session tokens for metadata access) and network egress filtering

IMDSv2 requires a PUT request to obtain a session token before accessing metadata, preventing SSRF exploits that use simple GET requests to steal instance credentials.

Question 33: Which technique allows computation on encrypted data without decrypting it?

Envelope encryption
Tokenization
Homomorphic encryption (Correct answer)
Symmetric encryption with a shared key

Correct answer: Homomorphic encryption

Homomorphic encryption allows mathematical operations to be performed on ciphertext, producing an encrypted result that decrypts to the same value as operating on the plaintext.

Question 34: What is credential stuffing, and which IAM control most effectively mitigates it?

Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication (Correct answer)
Malware-based credential harvesting from endpoints; EDR solutions
Social engineering to obtain credentials; security awareness training
Brute-force guessing of passwords; strong password length requirements

Correct answer: Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication

Credential stuffing uses breached credentials from other sites to exploit password reuse; MFA stops the attack even when valid credentials are submitted by the attacker.

Question 35: An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

A single root CA used directly for all certificate issuance
An offline root CA with online intermediate/issuing CAs (Correct answer)
A flat PKI with no intermediate CAs
A root CA hosted on an internet-connected server for availability

Correct answer: An offline root CA with online intermediate/issuing CAs

An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

Question 36: What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?

It provides permanent elevated access for administrative efficiency
It allows users to self-assign privileges without administrator approval
It reduces the attack window by granting elevated privileges only when needed for a defined period (Correct answer)
It eliminates the need for multi-factor authentication on privileged accounts

Correct answer: It reduces the attack window by granting elevated privileges only when needed for a defined period

JIT access minimizes the time elevated privileges are active, significantly reducing the window of opportunity for credential theft and misuse.

Question 37: A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?

Runtime container security monitoring with syscall analysis (Correct answer)
Network-level firewall rules
Image scanning at build time only
Disabling all container networking

Correct answer: Runtime container security monitoring with syscall analysis

Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.

Question 38: A large enterprise wants to implement defense-in-depth. Which combination of controls BEST represents this strategy?

Redundant firewalls from the same vendor
A unified threat management appliance at the network edge
A single next-generation firewall at the perimeter
Network segmentation, endpoint detection, and application-layer controls working together (Correct answer)

Correct answer: Network segmentation, endpoint detection, and application-layer controls working together

Defense-in-depth layers multiple independent controls so that failure of any single layer does not result in a full compromise.

Question 39: Which solution provides centralized management, session monitoring, and credential vaulting for privileged accounts?

Identity Provider (IdP)
Access Control List Manager (ACLM)
Identity Governance and Administration (IGA)
Privileged Access Management (PAM) (Correct answer)

Correct answer: Privileged Access Management (PAM)

PAM solutions provide credential vaulting, session recording, just-in-time access, and centralized oversight specifically for privileged accounts and administrative access.

Question 40: Which security practice MOST reduces the risk of secrets sprawl in a cloud-native CI/CD environment?

Using a centralized secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic secret generation (Correct answer)
Storing secrets in plaintext in the source code repository
Emailing secrets to developers when needed
Storing secrets in environment variables hardcoded in container images

Correct answer: Using a centralized secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic secret generation

Centralized secrets managers with dynamic, short-lived credentials ensure secrets are never stored statically, are automatically rotated, and all access is audited.

Question 41: Which key management practice MOST reduces the risk of key compromise over time?

Implementing automated key rotation with defined cryptoperiods (Correct answer)
Using the same key indefinitely to avoid complexity
Storing all keys in a single encrypted key file
Deriving all keys from a single master password

Correct answer: Implementing automated key rotation with defined cryptoperiods

Defined cryptoperiods with automated rotation limit the exposure window if a key is compromised and reduce the data volume encrypted under any single key.

Question 42: In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?

Guest operating system and installed applications (Correct answer)
Network backbone infrastructure
Hypervisor patches
Physical data center security

Correct answer: Guest operating system and installed applications

In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.

Question 43: An organization subject to GDPR must respond to a personal data breach notification requirement within what timeframe?

30 days of discovery
90 days of the end of fiscal quarter
72 hours of becoming aware of the breach (if it poses a risk to individuals) (Correct answer)
7 business days

Correct answer: 72 hours of becoming aware of the breach (if it poses a risk to individuals)

Article 33 of the GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights.

Question 44: A red team successfully exfiltrates data by encoding it within DNS TXT record queries. Which security control would have BEST prevented this?

Requiring all DNS queries to use DNSSEC for record validation
Blocking all outbound UDP port 53 traffic at the perimeter firewall
Deploying a DNS firewall with DNS query rate limiting and anomaly detection (Correct answer)
Implementing split-horizon DNS to separate internal and external name resolution

Correct answer: Deploying a DNS firewall with DNS query rate limiting and anomaly detection

A DNS firewall with query rate limiting and anomaly detection identifies unusual TXT record query volumes and patterns characteristic of DNS tunneling exfiltration.

Question 45: Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Annualized Rate of Occurrence (ARO)
Single Loss Expectancy (SLE) (Correct answer)
Control gap score
Residual risk percentage

Correct answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor and represents the expected financial loss from a single occurrence of a specific threat event.

Question 46: Which key exchange protocol provides perfect forward secrecy (PFS)?

Static Diffie-Hellman (DH)
Pre-shared key (PSK) exchange
Ephemeral Diffie-Hellman (DHE) or ECDHE (Correct answer)
RSA key exchange

Correct answer: Ephemeral Diffie-Hellman (DHE) or ECDHE

Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

Question 47: What method allows for the creation of many, independent user-space instances that all share the same underlying operating system kernel?

Containerization (Correct answer)
DBMS
MPLS
Server virtualization

Correct answer: Containerization

Applications running on the same operating system are isolated by containerization. On a single operating system, it makes it possible to execute numerous isolated programs. Containerization does not offer kernel separation, in contrast to conventional server virtualization. Data storage and retrieval are made possible by a program known as a DBMS (database management system).

Question 48: An organization uses a hybrid cloud architecture and needs to enforce consistent security policy across on-premises and cloud environments. Which solution BEST meets this requirement?

Using a cloud-agnostic security policy platform with unified policy enforcement (Correct answer)
Implementing a cloud access security broker (CASB) in forward proxy mode
Deploying separate SIEM instances tuned for each environment independently
Replicating on-premises firewall rules to cloud security groups manually

Correct answer: Using a cloud-agnostic security policy platform with unified policy enforcement

A cloud-agnostic security policy platform provides single-pane-of-glass policy management and consistent enforcement across heterogeneous on-premises and cloud environments.

Question 49: Which network control MOST effectively limits the blast radius of a compromised container within a Kubernetes cluster?

Disabling all container networking
Running all pods in the default namespace
Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only (Correct answer)
Using NodePort services for all communications

Correct answer: Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only

NetworkPolicy objects define ingress and egress rules for pods; a compromised pod with restrictive policies cannot initiate connections to arbitrary pods in other namespaces.

Question 50: Which elliptic curve is RECOMMENDED by NIST for use in US federal systems at the 128-bit security level?

P-521
secp256k1
Curve25519
P-256 (secp256r1) (Correct answer)

Correct answer: P-256 (secp256r1)

NIST P-256 is the FIPS-approved curve at the 128-bit security level, recommended in NIST SP 800-186 for federal cryptographic applications.

Question 51: Which MITRE ATT&CK tactic describes an adversary's attempts to steal credentials from the target environment?

Exfiltration
Initial Access
Credential Access (Correct answer)
Persistence

Correct answer: Credential Access

The Credential Access tactic in MITRE ATT&CK covers techniques used to steal credentials such as account names and passwords, including credential dumping and keylogging.

Question 52: A CASP+ professional is designing an API gateway for microservices. Which control is MOST important for API security?

Allowing anonymous access to improve developer experience
Using HTTP instead of HTTPS to reduce latency
OAuth 2.0 with JWT tokens and rate limiting per client (Correct answer)
Embedding API keys directly in mobile application code

Correct answer: OAuth 2.0 with JWT tokens and rate limiting per client

OAuth 2.0 with short-lived JWT tokens provides delegated authorization, and rate limiting prevents abuse, together forming a strong API security baseline.

Question 53: An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?

Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key) (Correct answer)
Cloud provider-managed encryption (SSE with provider keys)
Server-side encryption with provider-generated keys
Client-side encryption with keys derived from passwords stored in the cloud

Correct answer: Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)

HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.

Question 54: As a security architect, you implemented two firewalls, an IPS, and ACLs. All of the files on this network are replicated to a tape backup once every 24 hours. Which security principle is this backup solution designed to address?

Confidentiality
Availability (Correct answer)
Distribution
None of the above

Correct answer: Availability

The availability security tenet is addressed by the backup system you built, which copies every file on the network to a tape backup once every 24 hours. The availability security principle relates to making sure that resources, systems, and data are available and functional when required. You are taking preventative efforts to safeguard against potential data loss or system failures by using a regular backup solution. Having a current backup enables the restoration of crucial files and systems in the case of an unforeseen occurrence, such as hardware failure, software corruption, or a security compromise, minimizing downtime and guaranteeing availability.

Question 55: An organization implements a SOAR platform. A playbook automatically blocks IP addresses flagged by threat intelligence feeds. What risk does this automation introduce?

Increased mean time to respond due to playbook execution overhead
Inability to correlate events across multiple security tools
Bypassing of the SOAR platform by sophisticated attackers using dynamic IPs
False positive blocking of legitimate IP addresses causing service disruption (Correct answer)

Correct answer: False positive blocking of legitimate IP addresses causing service disruption

Automated blocking based on threat intelligence without human review risks false positives that can block legitimate business traffic and cause service outages.

Question 56: Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?

Storing credentials in a plaintext config file on the server
Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles (Correct answer)
Hardcoding credentials in the application source code
Storing credentials in environment variables set at runtime

Correct answer: Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles

IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.

Question 57: Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?

Birthday attack
Factoring attack (e.g., using Pollard's rho or GNFS) (Correct answer)
Timing side-channel attack
Padding oracle attack

Correct answer: Factoring attack (e.g., using Pollard's rho or GNFS)

RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.

Question 58: An organization is merging with another company and needs to integrate their IT systems securely. Which approach BEST supports secure integration while minimizing risk?

Share all credentials between both organizations during transition
Immediately merge all systems into a single domain
Deploy a federated identity model with trust boundaries between organizations (Correct answer)
Disable all firewalls to allow unrestricted communication during migration

Correct answer: Deploy a federated identity model with trust boundaries between organizations

A federated identity model allows each organization to maintain its own identity store while establishing controlled trust, minimizing the attack surface during merger.

Question 59: Which design principle BEST limits privilege escalation within an enterprise architecture?

Giving all administrators a single shared admin account
Using long-lived service accounts with broad permissions
Storing admin credentials in a shared password spreadsheet
Implementing just-in-time (JIT) privileged access with approval workflows (Correct answer)

Correct answer: Implementing just-in-time (JIT) privileged access with approval workflows

JIT access grants elevated privileges only when needed and for a limited time, reducing the window of exposure for high-privilege accounts.

Question 60: Which risk management framework does NIST recommend for federal information systems and is widely adopted in the US private sector?

ITIL v4
COSO ERM
ISO 31000
NIST Risk Management Framework (RMF) (Correct answer)

Correct answer: NIST Risk Management Framework (RMF)

NIST RMF (SP 800-37) provides a structured, six-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing information system risk.

Question 61: An organization wants to ensure that digital signatures on contracts remain legally valid even if the signing algorithm is later deprecated. Which mechanism BEST addresses this?

Storing documents in encrypted archives
Trusted timestamping combined with long-term validation (LTV) signatures (Correct answer)
Re-signing all documents with a new algorithm immediately
Using symmetric encryption for document storage

Correct answer: Trusted timestamping combined with long-term validation (LTV) signatures

LTV signatures embed the certificate chain and revocation data at signing time, and a trusted timestamp proves the signature existed before algorithm deprecation.

Question 62: Which access control model uses security labels and clearance levels to enforce access, commonly found in government environments?

Mandatory Access Control (MAC) (Correct answer)
Attribute-Based Access Control (ABAC)
Role-Based Access Control (RBAC)
Discretionary Access Control (DAC)

Correct answer: Mandatory Access Control (MAC)

MAC enforces access using system-assigned sensitivity labels and user clearance levels, making it non-discretionary and common in high-security government systems.

Question 63: Which control BEST enforces separation of duties in a financial application's architecture?

Encrypting the database at rest
Requiring two-factor authentication for all users
Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions (Correct answer)
Using audit logging for all transactions

Correct answer: Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

RBAC that separates initiator and approver roles enforces separation of duties, preventing a single user from completing a fraudulent transaction alone.

Question 64: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Second preimage resistance
Collision resistance (Correct answer)
One-way property
Preimage resistance

Correct answer: Collision resistance

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

Question 65: An organization performs a gap analysis against ISO 27001. Which output BEST prioritizes remediation efforts?

A full network diagram
A risk-ranked list of control gaps with associated residual risk levels (Correct answer)
The organization's existing security policies
A list of all ISO 27001 controls

Correct answer: A risk-ranked list of control gaps with associated residual risk levels

Risk-ranking gaps by residual risk ensures that the most dangerous deficiencies are remediated first, optimizing the allocation of limited security resources.

Question 66: A security architect is evaluating a new SaaS application. Which document MOST effectively communicates security requirements to the vendor?

Memorandum of Understanding (MOU)
Non-Disclosure Agreement (NDA)
Service Level Agreement (SLA) with uptime guarantees
Security Requirements Traceability Matrix (SRTM) (Correct answer)

Correct answer: Security Requirements Traceability Matrix (SRTM)

An SRTM maps each security requirement to specific controls, acceptance criteria, and verification methods, making vendor compliance measurable.

Question 67: Which protocol is primarily used for federated identity management and single sign-on across different organizations?

LDAP
SAML (Correct answer)
RADIUS
Kerberos

Correct answer: SAML

SAML (Security Assertion Markup Language) is the primary protocol for federated identity, enabling SSO across organizational boundaries via XML-based assertions.

Question 68: Which technology allows a SOC to automatically respond to low-confidence alerts by enriching them with threat intelligence before escalation?

Intrusion Prevention System (IPS)
Security Orchestration, Automation, and Response (SOAR) (Correct answer)
Vulnerability scanner
Next-generation antivirus

Correct answer: Security Orchestration, Automation, and Response (SOAR)

SOAR platforms automate alert triage workflows, enriching events with threat intelligence lookups, asset data, and historical context before presenting them to analysts.

Question 69: An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

PCI DSS (only applicable if payment data is involved)
NIST SP 800-53 (Correct answer)
ISO 27001 alone
TOGAF with security extensions

Correct answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Question 70: A security architect is designing controls for a multi-tenant cloud platform. Which approach BEST ensures cryptographic isolation between tenants?

Using separate VLANs for each tenant with inter-VLAN routing disabled
Assigning each tenant a unique encryption key managed in a dedicated HSM partition (Correct answer)
Enforcing tenant-specific IAM policies that restrict cross-tenant resource access
Deploying separate virtual machines for each tenant workload

Correct answer: Assigning each tenant a unique encryption key managed in a dedicated HSM partition

Tenant-unique encryption keys stored in dedicated HSM partitions ensure that even if one tenant's data is accessed, it cannot be decrypted using another tenant's key material.

Question 71: Which cryptographic primitive is used to derive multiple keys from a single shared secret in TLS?

Elliptic curve point multiplication alone
RSA-OAEP
HMAC-based Key Derivation Function (HKDF) (Correct answer)
Block cipher in ECB mode

Correct answer: HMAC-based Key Derivation Function (HKDF)

HKDF uses HMAC to extract entropy from the shared secret and then expand it into keying material for multiple purposes (encryption, MAC, IV) within the TLS session.

Question 72: Which approach BEST ensures that security architecture decisions remain aligned with business objectives over time?

Delegating all security decisions to the IT operations team
Conducting a one-time security assessment at system launch
Establishing a security governance committee with regular architecture review boards (Correct answer)
Updating security policies only when a breach occurs

Correct answer: Establishing a security governance committee with regular architecture review boards

A governance committee with scheduled architecture reviews ensures security controls evolve with the business, technology, and threat landscape.

Question 73: A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

bcrypt with an appropriate work factor (Correct answer)
MD5 with a random salt
SHA-256 with no salt
SHA-3 without stretching

Correct answer: bcrypt with an appropriate work factor

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

Question 74: A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

www.example.com
api.example.com
sub.mail.example.com (Correct answer)
mail.example.com

Correct answer: sub.mail.example.com

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

Question 75: An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?

Accept the risk and document the decision (Correct answer)
Avoid the risk by discontinuing the activity
Mitigate by implementing compensating controls
Transfer via cyber liability insurance

Correct answer: Accept the risk and document the decision

When mitigation cost exceeds potential loss for a low-likelihood, low-impact risk, accepting the risk with documented rationale is the most cost-effective decision.

Question 76: Which cloud identity and access management practice MOST effectively enforces least privilege for serverless functions?

Creating a unique, minimal IAM execution role per function with only required permissions (Correct answer)
Disabling IAM for serverless functions to simplify deployment
Assigning administrator roles to all Lambda/Cloud Function execution roles
Using the same shared execution role for all functions

Correct answer: Creating a unique, minimal IAM execution role per function with only required permissions

Each function gets only the permissions it needs to perform its specific task; a compromise of one function cannot be used to access resources needed only by other functions.

Question 77: A CASP+ professional is building a vendor risk management program. Which assessment type provides the MOST assurance about a cloud provider's security controls?

SOC 2 Type II report from an independent auditor (Correct answer)
A phone interview with the vendor's CISO
Marketing materials and compliance badges
Vendor-completed self-assessment questionnaire

Correct answer: SOC 2 Type II report from an independent auditor

A SOC 2 Type II report documents testing of controls over a period (typically 6–12 months) by an independent auditor, providing high-confidence evidence of operational effectiveness.

Question 78: Which document formally authorizes an information system to operate and accepts residual risk on behalf of the organization?

Authority to Operate (ATO) (Correct answer)
Plan of Action and Milestones (POA&M)
System Security Plan (SSP)
Risk Assessment Report (RAR)

Correct answer: Authority to Operate (ATO)

An ATO is the official management decision by an authorizing official (AO) accepting the residual risk and granting permission for the system to operate.

Question 79: Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

NIST SP 800-63 (Correct answer)
NIST SP 800-137
NIST SP 800-53
NIST SP 800-171

Correct answer: NIST SP 800-63

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

Question 80: Your business spent three months at its hot site following a natural disaster before moving back to the main location. Which processes at the main site ought to be reinstated first?

Communication with the outside world
The least important aspect of the business (Correct answer)
Department of Finance
The mission is crucial

Correct answer: The least important aspect of the business

When describing the sequence of restoration between the hot site and the primary site in the context of business recovery from a natural disaster, it is inaccurate to argue that any part of the business is "least significant." Based on the importance and dependencies of various business operations and processes, the restoration priorities should be set. The restoration process often entails evaluating the effect of the natural disaster on various business aspects and allocating restoration activities according to priority. Although the primary site is crucial, it might not necessarily be restored first if other vital operations need to be attended to.

Question 81: A CASP+ professional conducts a BIA. Which output is MOST critical for defining recovery objectives?

The organization's annual IT budget
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process (Correct answer)
A list of all IT assets
A full network topology diagram

Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for each critical process

RTO (maximum tolerable downtime) and RPO (maximum acceptable data loss) are the primary outputs of a BIA that drive continuity and recovery planning.

Question 82: A security engineer reviewing cloud infrastructure finds that developer IAM roles have 'AdministratorAccess' attached to enable rapid development. What risk does this MOST directly represent?

Inability to audit developer actions due to overly broad permission sets
Non-compliance with HIPAA due to excessive PHI access permissions
Increased cloud costs from unrestricted resource provisioning by developers
Violation of the principle of least privilege increasing blast radius of a compromise (Correct answer)

Correct answer: Violation of the principle of least privilege increasing blast radius of a compromise

Overly permissive IAM roles violate least privilege, meaning a compromised developer credential grants an attacker full administrative control over the cloud environment.

Question 83: An organization encrypts cloud storage with customer-managed keys (CMK). Which action allows the cloud provider to render the data inaccessible without deleting it?

Deleting the storage bucket
Changing the storage class to archive
Removing the object ACL
Disabling or scheduling deletion of the CMK in the KMS (Correct answer)

Correct answer: Disabling or scheduling deletion of the CMK in the KMS

Disabling or scheduling deletion of the CMK prevents the cloud provider's encryption service from decrypting data; the ciphertext remains but is cryptographically inaccessible without the key.

Question 84: An organization wants to assess the maturity of its information security program. Which framework provides a structured maturity model for this purpose?

CVE/NVD database
CMMC (Cybersecurity Maturity Model Certification) (Correct answer)
MITRE ATT&CK framework
OWASP Top 10

Correct answer: CMMC (Cybersecurity Maturity Model Certification)

CMMC defines progressive maturity levels (1–3) with specific practice requirements, enabling organizations to benchmark and improve their cybersecurity posture.

Question 85: Which technique most effectively prevents token replay attacks in an OAuth 2.0 implementation?

Requiring full re-authentication every hour regardless of token validity
Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens (Correct answer)
Using longer token expiration times to reduce re-authentication friction
Storing access tokens in browser local storage for persistence

Correct answer: Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens

Short-lived access tokens limit exposure windows, and refresh token rotation invalidates a refresh token after each use, ensuring stolen refresh tokens cannot be replayed by attackers.

Question 86: An enterprise deploys a SIEM. Which integration provides the MOST actionable threat intelligence for the architecture?

Syslog feeds from all endpoints
Threat intelligence platform (TIP) with indicator enrichment (Correct answer)
Manual log review by the SOC team
Email alerts from antivirus vendors

Correct answer: Threat intelligence platform (TIP) with indicator enrichment

A TIP enriches SIEM events with curated indicators of compromise (IOCs) and context, enabling faster, higher-fidelity alerting.

Question 87: A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?

Network bandwidth utilization graphs
Vulnerability scanner output
Antivirus signature scan results
Process creation and command-line logging (Sysmon Event ID 1) (Correct answer)

Correct answer: Process creation and command-line logging (Sysmon Event ID 1)

LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.

Question 88: During a purple team exercise, defenders fail to detect a pass-the-hash attack that successfully authenticated to a domain controller. Which control would MOST effectively prevent this?

Deploying a PAM solution to manage privileged account passwords
Enabling Protected Users Security Group and disabling NTLM authentication (Correct answer)
Enforcing complex password policies with minimum 16-character requirements
Implementing multi-factor authentication for all domain user accounts

Correct answer: Enabling Protected Users Security Group and disabling NTLM authentication

The Protected Users Security Group prevents NTLM authentication and disabling NTLM eliminates the hash reuse attack vector that pass-the-hash exploits.

Question 89: What is the purpose of step-up authentication in a risk-adaptive IAM system?

To automatically increase password complexity requirements over time
To require stronger authentication when accessing higher-risk resources or performing sensitive operations (Correct answer)
To upgrade legacy authentication protocols to modern standards
To escalate authentication failures to the security operations center

Correct answer: To require stronger authentication when accessing higher-risk resources or performing sensitive operations

Step-up authentication triggers additional verification factors when users attempt high-value or sensitive operations, matching authentication strength to the risk of the specific action.

Question 90: Which architecture control MOST effectively protects sensitive data from compromised application code?

Encrypting data only during transmission
Hardware security modules (HSMs) for key management with application-layer encryption (Correct answer)
Storing encryption keys in the same database as the data
Using application-level password hashing only

Correct answer: Hardware security modules (HSMs) for key management with application-layer encryption

HSMs store cryptographic keys in tamper-resistant hardware, so even fully compromised application code cannot extract the raw keys.

CompTIA Advanced Security Practitioner (CASP+) CAS-004

The CASP+ (CAS-004) is an advanced-level cybersecurity certification validating enterprise security architecture, security operations, cryptography, and governance, risk, and compliance skills for IT professionals with 10+ years of experience.

Questions

165 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds