CompTIA Advanced Security Practitioner (CASP+) CAS-004 — Questions and Answers

Question 1: Which indicator MOST strongly suggests that a web server has been compromised rather than experiencing legitimate high traffic?

Outbound connections from the web server to unknown external IPs on port 443 (Correct answer)
Increased HTTP GET requests for the homepage
Increased CPU usage during a scheduled batch job
A spike in authenticated user sessions during business hours

Correct answer: Outbound connections from the web server to unknown external IPs on port 443

Outbound connections from a web server to unknown external hosts suggest C2 communication or data exfiltration — web servers should receive requests, not initiate external sessions.

Question 2: Which risk management framework does NIST recommend for federal information systems and is widely adopted in the US private sector?

COSO ERM
NIST Risk Management Framework (RMF) (Correct answer)
ISO 31000
ITIL v4

Correct answer: NIST Risk Management Framework (RMF)

NIST RMF (SP 800-37) provides a structured, six-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing information system risk.

Question 3: Which control MOST effectively protects against a cloud misconfiguration that exposes an internal metadata service to a server-side request forgery (SSRF) attack?

Web Application Firewall blocking outbound traffic
IMDSv2 (requiring session tokens for metadata access) and network egress filtering (Correct answer)
Disabling the metadata service entirely
Encrypting metadata service responses

Correct answer: IMDSv2 (requiring session tokens for metadata access) and network egress filtering

IMDSv2 requires a PUT request to obtain a session token before accessing metadata, preventing SSRF exploits that use simple GET requests to steal instance credentials.

Question 4: An organization uses a cloud-native WAF to protect web applications. Which attack type is the WAF LEAST effective at preventing on its own?

Broken object-level authorization (BOLA/IDOR) (Correct answer)
Cross-site scripting (XSS) in request bodies
Remote file inclusion via URL parameters
SQL injection via HTTP parameters

Correct answer: Broken object-level authorization (BOLA/IDOR)

BOLA/IDOR is a business logic flaw where authenticated users access others' data using valid requests; WAFs cannot distinguish legitimate from malicious access to the same API endpoint.

Question 5: Which risk treatment option is demonstrated when an organization purchases cyber liability insurance?

Risk avoidance
Risk acceptance
Risk transference (Correct answer)
Risk mitigation

Correct answer: Risk transference

Cyber liability insurance transfers the financial consequences of a risk to an insurance provider, though the operational risk remains with the organization.

Question 6: A security architect is designing a zero-trust network for a financial institution. Which control BEST enforces the 'never trust, always verify' principle for internal east-west traffic?

Microsegmentation with continuous identity verification per session (Correct answer)
VLAN-based network segregation with ACLs
IDS sensors deployed at each subnet boundary
Perimeter firewall with deep packet inspection

Correct answer: Microsegmentation with continuous identity verification per session

Microsegmentation combined with continuous per-session identity verification directly enforces zero-trust by treating every lateral connection as untrusted.

Question 7: Which elliptic curve is RECOMMENDED by NIST for use in US federal systems at the 128-bit security level?

P-521
secp256k1
Curve25519
P-256 (secp256r1) (Correct answer)

Correct answer: P-256 (secp256r1)

NIST P-256 is the FIPS-approved curve at the 128-bit security level, recommended in NIST SP 800-186 for federal cryptographic applications.

Question 8: Which network control MOST effectively limits the blast radius of a compromised container within a Kubernetes cluster?

Using NodePort services for all communications
Running all pods in the default namespace
Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only (Correct answer)
Disabling all container networking

Correct answer: Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only

NetworkPolicy objects define ingress and egress rules for pods; a compromised pod with restrictive policies cannot initiate connections to arbitrary pods in other namespaces.

Question 9: Which cryptographic algorithm provides BOTH confidentiality and data authentication in a single operation?

AES-GCM (Galois/Counter Mode) (Correct answer)
AES-CBC with HMAC-SHA256 applied separately
RSA-2048 encryption
SHA-256 hashing

Correct answer: AES-GCM (Galois/Counter Mode)

AES-GCM is an authenticated encryption mode that simultaneously provides confidentiality via CTR mode and integrity/authentication via the GHASH function.

Question 10: An organization wants to ensure that digital signatures on contracts remain legally valid even if the signing algorithm is later deprecated. Which mechanism BEST addresses this?

Using symmetric encryption for document storage
Re-signing all documents with a new algorithm immediately
Storing documents in encrypted archives
Trusted timestamping combined with long-term validation (LTV) signatures (Correct answer)

Correct answer: Trusted timestamping combined with long-term validation (LTV) signatures

LTV signatures embed the certificate chain and revocation data at signing time, and a trusted timestamp proves the signature existed before algorithm deprecation.

Question 11: An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?

Server-side encryption with provider-generated keys
Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key) (Correct answer)
Client-side encryption with keys derived from passwords stored in the cloud
Cloud provider-managed encryption (SSE with provider keys)

Correct answer: Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)

HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.

Question 12: An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

ISO 27001 alone
PCI DSS (only applicable if payment data is involved)
NIST SP 800-53 (Correct answer)
TOGAF with security extensions

Correct answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Question 13: Which technology allows a SOC to automatically respond to low-confidence alerts by enriching them with threat intelligence before escalation?

Security Orchestration, Automation, and Response (SOAR) (Correct answer)
Next-generation antivirus
Intrusion Prevention System (IPS)
Vulnerability scanner

Correct answer: Security Orchestration, Automation, and Response (SOAR)

SOAR platforms automate alert triage workflows, enriching events with threat intelligence lookups, asset data, and historical context before presenting them to analysts.

Question 14: To ensure that users can only access the resources they need to complete specific tasks, permissions must be provided. Which security principle ought to be used to fulfill the requirement?

Job rotation
Least privilege (Correct answer)
Separation of duties
Need to know

Correct answer: Least privilege

To ensure that users can only access the resources they need to carry out certain tasks, the least privilege security concept should be used when granting permissions. According to the least privilege concept, users should only be given the minimal level of access required to carry out their planned tasks or fulfill their job-related duties. Users should only have access to the resources and rights necessary for them to complete their tasks successfully, and nothing more.

Question 15: An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Detached signatures stored separately from the binary (Correct answer)
Signing with the developer's personal certificate
Using a certificate with a short validity period
Storing the signed binary on an internet-accessible server

Correct answer: Detached signatures stored separately from the binary

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Question 16: Which access control model uses security labels and clearance levels to enforce access, commonly found in government environments?

Role-Based Access Control (RBAC)
Mandatory Access Control (MAC) (Correct answer)
Attribute-Based Access Control (ABAC)
Discretionary Access Control (DAC)

Correct answer: Mandatory Access Control (MAC)

MAC enforces access using system-assigned sensitivity labels and user clearance levels, making it non-discretionary and common in high-security government systems.

Question 17: During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?

Immediately reimage the system
Delete all suspicious files
Notify law enforcement immediately
Isolate the system from the network while preserving volatile memory (Correct answer)

Correct answer: Isolate the system from the network while preserving volatile memory

Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.

Question 18: An enterprise wants to implement deception technology to detect lateral movement. Which solution BEST fits this goal?

Deploying a DMZ with a bastion host to attract external attackers
Enabling enhanced audit logging on all Active Directory domain controllers
Placing honeytokens and honeypots throughout internal network segments (Correct answer)
Installing a UEBA solution to baseline and alert on user behavior anomalies

Correct answer: Placing honeytokens and honeypots throughout internal network segments

Honeytokens and honeypots distributed across internal segments attract and detect attackers engaged in lateral movement without alerting legitimate users.

Question 19: Which cloud logging source MOST directly captures attempted privilege escalation in an AWS environment?

AWS CloudTrail with management event logging for IAM and STS API calls (Correct answer)
S3 access logs
VPC Flow Logs
EC2 instance system logs

Correct answer: AWS CloudTrail with management event logging for IAM and STS API calls

CloudTrail records every IAM and STS API call, including AssumeRole, CreatePolicy, and AttachUserPolicy, directly revealing privilege escalation attempts in the management plane.

Question 20: Which cloud security control prevents accidental public exposure of storage buckets containing sensitive data?

Enabling versioning on all buckets
Encrypting bucket contents with customer-managed keys
Tagging buckets with the data classification level
AWS S3 Block Public Access or equivalent provider-level public access prevention (Correct answer)

Correct answer: AWS S3 Block Public Access or equivalent provider-level public access prevention

Block Public Access settings override any bucket or object ACLs that would grant public access, providing an account-level guardrail against accidental data exposure.

Question 21: A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?

Automated image scanning with deployment gates that block critical CVEs (Correct answer)
Requiring developers to sign a security checklist
Manual security review of all Dockerfiles
Scanning images only after they are deployed to production

Correct answer: Automated image scanning with deployment gates that block critical CVEs

Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.

Question 22: A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

mail.example.com
sub.mail.example.com (Correct answer)
www.example.com
api.example.com

Correct answer: sub.mail.example.com

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

Question 23: What among the following DOES NOT constitute an open-source intelligence (OSINT) source?

Social Media
DNS record
Ping scan (Correct answer)
Whois

Correct answer: Ping scan

Data used in open-source intelligence (OSINT) is obtained from open sources. Potential sources of OSINT data include social media, the deep web, WHOIS and DNS records, as well as other open data sources. A ping scan takes place exclusively within a local area network (LAN) and is not disclosed to the general public. Consequently, a ping scan is not an OSINT source.

Question 24: Which security architecture approach MOST effectively addresses insider threats?

Blocking all USB ports on endpoints
Requiring employees to sign acceptable use policies
User and Entity Behavior Analytics (UEBA) combined with least-privilege access (Correct answer)
Deploying antivirus on all workstations

Correct answer: User and Entity Behavior Analytics (UEBA) combined with least-privilege access

UEBA establishes behavioral baselines and alerts on anomalous activity, while least-privilege limits what insiders can access or exfiltrate.

Question 25: Which control BEST enforces separation of duties in a financial application's architecture?

Requiring two-factor authentication for all users
Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions (Correct answer)
Encrypting the database at rest
Using audit logging for all transactions

Correct answer: Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

RBAC that separates initiator and approver roles enforces separation of duties, preventing a single user from completing a fraudulent transaction alone.

Question 26: A CASP+ analyst applies threat modeling to a new application. Which methodology uses the mnemonic STRIDE to categorize threats?

OCTAVE Allegro
Microsoft STRIDE threat modeling (Correct answer)
PASTA (Process for Attack Simulation and Threat Analysis)
FAIR (Factor Analysis of Information Risk)

Correct answer: Microsoft STRIDE threat modeling

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 27: What method allows for the creation of many, independent user-space instances that all share the same underlying operating system kernel?

MPLS
DBMS
Server virtualization
Containerization (Correct answer)

Correct answer: Containerization

Applications running on the same operating system are isolated by containerization. On a single operating system, it makes it possible to execute numerous isolated programs. Containerization does not offer kernel separation, in contrast to conventional server virtualization. Data storage and retrieval are made possible by a program known as a DBMS (database management system).

Question 28: As a security engineer at Acme Inc., you proactively look for and uncover security threats and process problems in your production environment by using a variety of automated tools, parsing logs, analyzing configurations, and carrying out manual testing. Which phrase does BEST capture these activities?

Malware scanning
Threat hunting (Correct answer)
Port scanning
Threat emulation

Correct answer: Threat hunting

The process of finding dangers and problems that less proactive security tools and processes do not is known as threat hunting. Threat hunting aids in the discovery of threats that instruments such as signature-based scanners may overlook. The technique of checking an endpoint for dangerous software is known as malware scanning. Not all of the activities listed in the question are covered by it. Port scanning is the process of looking through an endpoint's open network ports. Not all of the activities listed in the question are covered by it. Understanding a threat's intricate workings will help you reduce its potential impact and exposure.

Question 29: Which protocol is primarily used for federated identity management and single sign-on across different organizations?

SAML (Correct answer)
Kerberos
LDAP
RADIUS

Correct answer: SAML

SAML (Security Assertion Markup Language) is the primary protocol for federated identity, enabling SSO across organizational boundaries via XML-based assertions.

Question 30: Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

NIST SP 800-171
NIST SP 800-63 (Correct answer)
NIST SP 800-137
NIST SP 800-53

Correct answer: NIST SP 800-63

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

Question 31: Which employs the necessary keys and examines the trust paths and revocation status before enabling the certificate to be utilized when a browser views a website?

Root CA
RA
Browser (Correct answer)
Web server

Correct answer: Browser

Vendors will build a PKI standard to enable the exchange of keys via certificates, which is a need for an application to use a digital certificate. Before enabling the application to utilize the certificate, the browser uses the necessary keys and verifies the trust paths and revocation status. The certificate is provided by the web server to the browser for verification. The PKI certificate's root of trust is the Root CA (certificate authority). Requests for digital certificates are verified by the RA (registration authority).

Question 32: Which key exchange protocol provides perfect forward secrecy (PFS)?

RSA key exchange
Pre-shared key (PSK) exchange
Static Diffie-Hellman (DH)
Ephemeral Diffie-Hellman (DHE) or ECDHE (Correct answer)

Correct answer: Ephemeral Diffie-Hellman (DHE) or ECDHE

Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

Question 33: Which technique allows computation on encrypted data without decrypting it?

Envelope encryption
Tokenization
Homomorphic encryption (Correct answer)
Symmetric encryption with a shared key

Correct answer: Homomorphic encryption

Homomorphic encryption allows mathematical operations to be performed on ciphertext, producing an encrypted result that decrypts to the same value as operating on the plaintext.

Question 34: An architect must ensure high availability for a critical authentication service. Which approach BEST balances resilience and security?

Single server with nightly backups
Geographically distributed active-active cluster with health checks and session replication (Correct answer)
DNS round-robin with no session persistence
Active-passive cluster with manual failover

Correct answer: Geographically distributed active-active cluster with health checks and session replication

An active-active cluster across geographic regions provides automatic failover and load distribution while replicating session state for continuity.

Question 35: Which quantitative risk analysis technique uses probability distributions and repeated simulations to model the range of possible outcomes?

DREAD model
CVSS scoring
Monte Carlo simulation (Correct answer)
STRIDE threat modeling

Correct answer: Monte Carlo simulation

Monte Carlo simulation runs thousands of iterations with random values drawn from probability distributions to produce a range of risk outcomes and their likelihoods.

Question 36: A PKI administrator needs to revoke a certificate immediately due to a key compromise. Which mechanism provides the FASTEST revocation propagation?

Waiting for the certificate to expire naturally
Manual notification to all relying parties
CRL published on a daily schedule
OCSP stapling with short-validity responses (Correct answer)

Correct answer: OCSP stapling with short-validity responses

OCSP stapling embeds a recent, CA-signed revocation response directly in the TLS handshake, providing near-real-time revocation status without client round-trips.

Question 37: An enterprise needs quantum-resistant encryption for long-lived sensitive data. Which NIST-standardized post-quantum algorithm is appropriate for key encapsulation?

ECDSA P-384
AES-256-GCM
CRYSTALS-Kyber (ML-KEM) (Correct answer)
RSA-4096

Correct answer: CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber (standardized as ML-KEM in NIST FIPS 203) is NIST's approved post-quantum key encapsulation mechanism, resistant to attacks by quantum computers.

Question 38: Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Annualized Rate of Occurrence (ARO)
Residual risk percentage
Control gap score
Single Loss Expectancy (SLE) (Correct answer)

Correct answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor and represents the expected financial loss from a single occurrence of a specific threat event.

Question 39: Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

BEAST (Browser Exploit Against SSL/TLS) (Correct answer)
Meet-in-the-middle attack
Padding oracle attack
Length extension attack

Correct answer: BEAST (Browser Exploit Against SSL/TLS)

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

Question 40: Which cryptographic primitive is used to derive multiple keys from a single shared secret in TLS?

RSA-OAEP
Block cipher in ECB mode
Elliptic curve point multiplication alone
HMAC-based Key Derivation Function (HKDF) (Correct answer)

Correct answer: HMAC-based Key Derivation Function (HKDF)

HKDF uses HMAC to extract entropy from the shared secret and then expand it into keying material for multiple purposes (encryption, MAC, IV) within the TLS session.

Question 41: In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?

Hypervisor patches
Network backbone infrastructure
Guest operating system and installed applications (Correct answer)
Physical data center security

Correct answer: Guest operating system and installed applications

In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.

Question 42: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Preimage resistance
Collision resistance (Correct answer)
One-way property
Second preimage resistance

Correct answer: Collision resistance

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

Question 43: A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?

Network-level firewall rules
Disabling all container networking
Image scanning at build time only
Runtime container security monitoring with syscall analysis (Correct answer)

Correct answer: Runtime container security monitoring with syscall analysis

Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.

Question 44: Your business spent three months at its hot site following a natural disaster before moving back to the main location. Which processes at the main site ought to be reinstated first?

The least important aspect of the business (Correct answer)
The mission is crucial
Department of Finance
Communication with the outside world

Correct answer: The least important aspect of the business

When describing the sequence of restoration between the hot site and the primary site in the context of business recovery from a natural disaster, it is inaccurate to argue that any part of the business is "least significant." Based on the importance and dependencies of various business operations and processes, the restoration priorities should be set. The restoration process often entails evaluating the effect of the natural disaster on various business aspects and allocating restoration activities according to priority. Although the primary site is crucial, it might not necessarily be restored first if other vital operations need to be attended to.

Question 45: A SOC analyst receives an alert for a possible SQL injection attack. Which evidence BEST confirms successful exploitation?

A port scan originating from the web server IP
A single 400 Bad Request response in web server logs
Database error messages followed by unexpected data in HTTP responses (Correct answer)
A spike in failed login attempts

Correct answer: Database error messages followed by unexpected data in HTTP responses

Database error messages in responses indicate the application is processing injected SQL, and unexpected data in the response confirms the attacker retrieved data from the database.

Question 46: Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?

Factoring attack (e.g., using Pollard's rho or GNFS) (Correct answer)
Padding oracle attack
Birthday attack
Timing side-channel attack

Correct answer: Factoring attack (e.g., using Pollard's rho or GNFS)

RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.

Question 47: Which standard specifically defines requirements for payment card data security applicable to merchants and service providers?

NIST SP 800-171
SOC 2 Type I
FedRAMP
PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)

Correct answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS is the global security standard mandated by card brands (Visa, Mastercard, etc.) for any organization that stores, processes, or transmits cardholder data.

Question 48: Which document formally authorizes an information system to operate and accepts residual risk on behalf of the organization?

Risk Assessment Report (RAR)
System Security Plan (SSP)
Authority to Operate (ATO) (Correct answer)
Plan of Action and Milestones (POA&M)

Correct answer: Authority to Operate (ATO)

An ATO is the official management decision by an authorizing official (AO) accepting the residual risk and granting permission for the system to operate.

Question 49: Which incident response phase involves identifying lessons learned and updating security controls to prevent recurrence?

Eradication and Recovery
Containment
Detection and Analysis
Post-Incident Activity (Correct answer)

Correct answer: Post-Incident Activity

The Post-Incident Activity phase (NIST SP 800-61) includes a lessons-learned meeting, updating incident response plans, and implementing improvements to prevent similar incidents.

Question 50: A cloud security engineer reviews a multi-account AWS environment. Which service provides centralized, automated security findings aggregation across all accounts?

AWS Trusted Advisor
AWS Security Hub (Correct answer)
AWS Config
AWS CloudTrail

Correct answer: AWS Security Hub

AWS Security Hub aggregates findings from GuardDuty, Inspector, Majestic, and third-party tools across all accounts in an organization, providing a single security posture dashboard.

Question 51: Which architecture control MOST effectively protects sensitive data from compromised application code?

Using application-level password hashing only
Hardware security modules (HSMs) for key management with application-layer encryption (Correct answer)
Encrypting data only during transmission
Storing encryption keys in the same database as the data

Correct answer: Hardware security modules (HSMs) for key management with application-layer encryption

HSMs store cryptographic keys in tamper-resistant hardware, so even fully compromised application code cannot extract the raw keys.

Question 52: A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?

DHCP server logs
Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts (Correct answer)
DNS server query logs
Web proxy access logs

Correct answer: Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts

Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.

Question 53: An organization performs a gap analysis against ISO 27001. Which output BEST prioritizes remediation efforts?

A list of all ISO 27001 controls
A full network diagram
The organization's existing security policies
A risk-ranked list of control gaps with associated residual risk levels (Correct answer)

Correct answer: A risk-ranked list of control gaps with associated residual risk levels

Risk-ranking gaps by residual risk ensures that the most dangerous deficiencies are remediated first, optimizing the allocation of limited security resources.

Question 54: Which technique most effectively prevents token replay attacks in an OAuth 2.0 implementation?

Requiring full re-authentication every hour regardless of token validity
Using longer token expiration times to reduce re-authentication friction
Storing access tokens in browser local storage for persistence
Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens (Correct answer)

Correct answer: Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens

Short-lived access tokens limit exposure windows, and refresh token rotation invalidates a refresh token after each use, ensuring stolen refresh tokens cannot be replayed by attackers.

Question 55: A penetration tester successfully performs a SQL injection attack but the application returns only true/false responses with no error messages. Which SQL injection technique applies?

Out-of-band SQL injection
Error-based SQL injection
Union-based SQL injection
Blind boolean-based SQL injection (Correct answer)

Correct answer: Blind boolean-based SQL injection

Blind boolean-based SQL injection infers database information from the application's true/false behavioral responses when no data is directly returned.

Question 56: A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Selecting the cheapest option that meets minimum compliance requirements
Choosing the solution from the most well-known vendor
Conducting a proof of concept (PoC) against defined acceptance criteria (Correct answer)
Relying on analyst reports alone

Correct answer: Conducting a proof of concept (PoC) against defined acceptance criteria

A PoC tested against pre-defined, measurable acceptance criteria provides objective evidence of how each solution performs in the specific environment.

Question 57: An organization encrypts cloud storage with customer-managed keys (CMK). Which action allows the cloud provider to render the data inaccessible without deleting it?

Disabling or scheduling deletion of the CMK in the KMS (Correct answer)
Removing the object ACL
Deleting the storage bucket
Changing the storage class to archive

Correct answer: Disabling or scheduling deletion of the CMK in the KMS

Disabling or scheduling deletion of the CMK prevents the cloud provider's encryption service from decrypting data; the ciphertext remains but is cryptographically inaccessible without the key.

Question 58: Which cloud security architecture pattern uses a dedicated security account/subscription to centralize logging, monitoring, and security tooling?

Direct peering between all workload accounts
Hub-and-spoke (landing zone) with a dedicated security hub account (Correct answer)
Multi-tenant shared services model
Single account with all workloads

Correct answer: Hub-and-spoke (landing zone) with a dedicated security hub account

A hub-and-spoke landing zone architecture centralizes security services (SIEM, logging, network inspection) in a dedicated hub account, providing centralized visibility without mixing workloads.

Question 59: An organization identifies that a critical control is not cost-effective to implement. Which control type can be used to partially offset the risk without fully replacing the missing control?

Detective control
Corrective control
Preventive control
Compensating control (Correct answer)

Correct answer: Compensating control

Compensating controls are alternative measures that provide equivalent or partial risk reduction when the primary control cannot be implemented as specified.

Question 60: Which compliance framework is MOST applicable to a US healthcare organization processing electronic protected health information (ePHI)?

SOC 2 Type II
HIPAA Security Rule (Correct answer)
PCI DSS
GDPR

Correct answer: HIPAA Security Rule

The HIPAA Security Rule mandates administrative, physical, and technical safeguards specifically for ePHI held by covered entities and business associates in the US.

Question 61: A large enterprise wants to implement defense-in-depth. Which combination of controls BEST represents this strategy?

A single next-generation firewall at the perimeter
Redundant firewalls from the same vendor
Network segmentation, endpoint detection, and application-layer controls working together (Correct answer)
A unified threat management appliance at the network edge

Correct answer: Network segmentation, endpoint detection, and application-layer controls working together

Defense-in-depth layers multiple independent controls so that failure of any single layer does not result in a full compromise.

Question 62: An organization is merging with another company and needs to integrate their IT systems securely. Which approach BEST supports secure integration while minimizing risk?

Deploy a federated identity model with trust boundaries between organizations (Correct answer)
Share all credentials between both organizations during transition
Disable all firewalls to allow unrestricted communication during migration
Immediately merge all systems into a single domain

Correct answer: Deploy a federated identity model with trust boundaries between organizations

A federated identity model allows each organization to maintain its own identity store while establishing controlled trust, minimizing the attack surface during merger.

Question 63: An organization subject to GDPR must respond to a personal data breach notification requirement within what timeframe?

90 days of the end of fiscal quarter
7 business days
30 days of discovery
72 hours of becoming aware of the breach (if it poses a risk to individuals) (Correct answer)

Correct answer: 72 hours of becoming aware of the breach (if it poses a risk to individuals)

Article 33 of the GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights.

Question 64: A vendor assessment reveals that a critical third-party provider has no incident response plan. Which contractual mechanism BEST addresses this risk?

Terminating the contract immediately
Accepting the risk as an inherent part of outsourcing
Including security requirements and audit rights in the contract (right-to-audit clause) (Correct answer)
Requiring the vendor to self-certify compliance

Correct answer: Including security requirements and audit rights in the contract (right-to-audit clause)

Contract clauses that specify security requirements and grant audit rights enable the organization to verify compliance and mandate remediation, providing enforceable protection.

Question 65: As a security architect, you implemented two firewalls, an IPS, and ACLs. All of the files on this network are replicated to a tape backup once every 24 hours. Which security principle is this backup solution designed to address?

Distribution
Availability (Correct answer)
Confidentiality
None of the above

Correct answer: Availability

The availability security tenet is addressed by the backup system you built, which copies every file on the network to a tape backup once every 24 hours. The availability security principle relates to making sure that resources, systems, and data are available and functional when required. You are taking preventative efforts to safeguard against potential data loss or system failures by using a regular backup solution. Having a current backup enables the restoration of crucial files and systems in the case of an unforeseen occurrence, such as hardware failure, software corruption, or a security compromise, minimizing downtime and guaranteeing availability.

Question 66: Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?

VM escape (hypervisor breakout) (Correct answer)
Container escape
API injection
Side-channel attack

Correct answer: VM escape (hypervisor breakout)

A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.

Question 67: Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

Audit Report
Plan of Action and Milestones (POA&M) (Correct answer)
Risk Register
System Security Plan (SSP)

Correct answer: Plan of Action and Milestones (POA&M)

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

Question 68: A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

The use of asymmetric cryptography
Certificate-based authentication
Digital signatures on the handshake
RSA key exchange (non-forward-secret) (Correct answer)

Correct answer: RSA key exchange (non-forward-secret)

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

Question 69: Which artifact should be collected FIRST when responding to a Linux system compromise, given the order of volatility?

Backup tapes from the previous night
Hard drive forensic image
Running process list and network connections (Correct answer)
Contents of /var/log/auth.log

Correct answer: Running process list and network connections

Running processes and active network connections are the most volatile artifacts, existing only in memory and disappearing on reboot — they must be captured before any other action.

Question 70: A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Inside the internal network but accessible via a reverse proxy in the DMZ
In the DMZ, behind the external firewall but before the internal firewall (Correct answer)
Inside the internal network with no additional segmentation
Directly on the internet with no firewall

Correct answer: In the DMZ, behind the external firewall but before the internal firewall

Placing the web server in the DMZ isolates it from the internal network so that a compromise does not immediately expose internal systems.

Question 71: Which Kubernetes security control prevents containers from running as the root user within a cluster?

Role-based access control (RBAC) for the API server
TLS between kubelets
Pod Security Admission (PSA) with restricted policy (Correct answer)
Network policies

Correct answer: Pod Security Admission (PSA) with restricted policy

Pod Security Admission enforces security profiles on pods; the 'restricted' policy prohibits running as root, disallows privilege escalation, and requires read-only root filesystems.

Question 72: A CASP+ architect must design a zero-trust network for a financial institution. Which control is MOST critical to enforce zero-trust principles?

Static ACLs on all network switches
Continuous verification of identity and device posture for every request (Correct answer)
VPN tunnels for all remote users
Perimeter firewall with stateful inspection

Correct answer: Continuous verification of identity and device posture for every request

Zero trust requires continuous verification of identity and device health for every access request, regardless of network location.

Question 73: Which security architecture pattern BEST reduces the blast radius of a compromised internal service?

Microsegmentation with per-service access controls (Correct answer)
Flat network with shared authentication
Network address translation (NAT) at the perimeter
Single sign-on across all services

Correct answer: Microsegmentation with per-service access controls

Microsegmentation isolates services so that a compromised component cannot laterally move to other services without explicit authorization.

Question 74: An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

A flat PKI with no intermediate CAs
A root CA hosted on an internet-connected server for availability
A single root CA used directly for all certificate issuance
An offline root CA with online intermediate/issuing CAs (Correct answer)

Correct answer: An offline root CA with online intermediate/issuing CAs

An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

Question 75: A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?

Process creation and command-line logging (Sysmon Event ID 1) (Correct answer)
Antivirus signature scan results
Vulnerability scanner output
Network bandwidth utilization graphs

Correct answer: Process creation and command-line logging (Sysmon Event ID 1)

LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.

Question 76: An organization wants to assess the maturity of its information security program. Which framework provides a structured maturity model for this purpose?

OWASP Top 10
MITRE ATT&CK framework
CMMC (Cybersecurity Maturity Model Certification) (Correct answer)
CVE/NVD database

Correct answer: CMMC (Cybersecurity Maturity Model Certification)

CMMC defines progressive maturity levels (1–3) with specific practice requirements, enabling organizations to benchmark and improve their cybersecurity posture.

Question 77: A security architect is evaluating a new SaaS application. Which document MOST effectively communicates security requirements to the vendor?

Security Requirements Traceability Matrix (SRTM) (Correct answer)
Non-Disclosure Agreement (NDA)
Memorandum of Understanding (MOU)
Service Level Agreement (SLA) with uptime guarantees

Correct answer: Security Requirements Traceability Matrix (SRTM)

An SRTM maps each security requirement to specific controls, acceptance criteria, and verification methods, making vendor compliance measurable.

Question 78: An enterprise deploys a SIEM. Which integration provides the MOST actionable threat intelligence for the architecture?

Email alerts from antivirus vendors
Syslog feeds from all endpoints
Threat intelligence platform (TIP) with indicator enrichment (Correct answer)
Manual log review by the SOC team

Correct answer: Threat intelligence platform (TIP) with indicator enrichment

A TIP enriches SIEM events with curated indicators of compromise (IOCs) and context, enabling faster, higher-fidelity alerting.

Question 79: You oversee the security of a network that uses Fibre Channel over Ethernet (FCoE). The network administrator wishes to restore raw data to a separate host by removing it from the storage array. Which one of the following might affect availability?

Deduplication will result in data mistakes.
It's possible that the data isn't in a suitable format (Correct answer)
The procedure may result in bottlenecks.
It's possible that the new host won't work with FCoE.

Correct answer: It's possible that the data isn't in a suitable format

It may affect availability if the raw data that is obtained from the storage array is not in an appropriate format. The ability of systems, resources, and data to be usable and available at any time is referred to as availability in a network. Assuring data availability in the context of data storage and retrieval entails having it in a format that can be quickly recovered, accessible, and used by the target host or system.

Question 80: Which key management practice MOST reduces the risk of key compromise over time?

Using the same key indefinitely to avoid complexity
Implementing automated key rotation with defined cryptoperiods (Correct answer)
Storing all keys in a single encrypted key file
Deriving all keys from a single master password

Correct answer: Implementing automated key rotation with defined cryptoperiods

Defined cryptoperiods with automated rotation limit the exposure window if a key is compromised and reduce the data volume encrypted under any single key.

Question 81: Which hierarchical type of the following, which uses certificate authorities (CAs), registration authorities (RAs), and central directory/distribution management to build their trust model, is used by MOST organizations when implementing PKI?

Symmetric encryption
PGP
Chain of trust (Correct answer)
Control mode

Correct answer: Chain of trust

A hierarchical chain of trust model, which includes a minimum of three key elements, is often the foundation of PKI infrastructure. To bind a public key to a particular entity, certificate authorities (CAs), at the top of the model, issue certificates. User requests for digital certificates are checked by registration authorities (RAs). Management of central directories and distribution - Maintains and manages the issued certificates.

Question 82: A company must comply with both GDPR and CCPA. Their cloud provider stores data in the US and EU. Which data governance control addresses both regulations' residency and subject rights requirements?

Deploy a CASB to monitor all cloud access and generate compliance reports
Use a CDN to serve data from the nearest region to reduce latency
Implement data classification with geo-tagged metadata and automated deletion workflows (Correct answer)
Encrypt all data with AES-256 and store encryption keys on-premises

Correct answer: Implement data classification with geo-tagged metadata and automated deletion workflows

Data classification with geo-tagged metadata enables both residency enforcement and automated workflows for subject rights like deletion under GDPR/CCPA.

Question 83: What is the primary security risk of using shared accounts in an enterprise environment?

Reduced system performance due to concurrent logins
Inability to perform individual accountability and non-repudiation (Correct answer)
Higher software licensing costs
Increased network bandwidth consumption

Correct answer: Inability to perform individual accountability and non-repudiation

Shared accounts prevent attribution of actions to specific individuals, undermining non-repudiation and making forensic investigations unreliable.

Question 84: The database server is operated by Acme Inc. The server and its data are valued at $10,000. The operating system on the server is outdated and cannot be patched. According to your calculations, there is a 20% risk that the server would be compromised in the upcoming year, and that compromise would result in the loss of 50% of the server's value (i.e., all of the data). What is the SLE from the standpoint of a quantitative risk assessment?

$10,000
100%
50%
$5,000 (Correct answer)

Correct answer: $5,000

The quantity of loss anticipated in the event of a single loss is known as SLE. The SLE equation is: EF x AV = SLE The value of an asset is its AV (asset value). The answer informs us that AV is $10,000. The EF (exposure factor) measures the percentage likelihood that a specific threat will have an effect on a given asset. According to the question, a compromise would result in a 50% reduction in value. EF thus equals 50%. The question's SLE formula is as follows: SLE = $10,000 x 0.50 SLE = $5,000

Question 85: You'll require a contract that enables your business to create a comprehensive risk allocation strategy and offers indemnity, a tactic for shielding one party from present or future losses. On which contract should you attempt to come to an understanding?

Memorandum of Agreement
Service Master Agreement (Correct answer)
Agreement on the economic impact
Security agreement for interconnection

Correct answer: Service Master Agreement

You should strive to come to an agreement on a Service Master Agreement (SMA) contract in order to build a comprehensive risk allocation strategy and offer indemnity. The rules and conditions governing the supply of services between two parties are spelled out in detail in a Service Master Agreement. It acts as a general contract that covers numerous services, undertakings, or engagements for a predetermined time. In order to streamline the contracting process for upcoming services or projects, a SMA offers flexibility and efficiency.

Question 86: Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?

Storing credentials in a plaintext config file on the server
Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles (Correct answer)
Hardcoding credentials in the application source code
Storing credentials in environment variables set at runtime

Correct answer: Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles

IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.

Question 87: Which of the following DOES NOT fall under a GDPR data classification?

Symmetric (Correct answer)
Internal only
Confidential
Public

Correct answer: Symmetric

An EU (European Union) data privacy regulation known as GDPR (General Data Protection Regulation) gives data subjects a number of rights and enforces privacy and data security standards relating to how enterprises handle data belonging to EU individuals. The four data classifications under GDPR are as follows: Internal only Public Restricted Confidential

Question 88: A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

SHA-3 without stretching
bcrypt with an appropriate work factor (Correct answer)
SHA-256 with no salt
MD5 with a random salt

Correct answer: bcrypt with an appropriate work factor

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

Question 89: Which method among the following modifies routing tables to filter out undesired traffic before it reaches a destination network?

Multihoming
Reverse proxy
Port security
RTBH filtering (Correct answer)

Correct answer: RTBH filtering

A router security method called RTBH (remotely triggered black hole) filtering modifies routing tables to block undesirable traffic before it reaches a destination network. DDoS (distributed denial of service) assaults on network devices can be avoided with the use of RTBH filtering. Many Cisco devices have a feature called port security that restricts ingress traffic on a port to a certain MAC address. The layer 2 (data link layer) feature has no immediate effect on routing tables. Connections are received by a reverse proxy, which then passes them to the origin server. Multiple network connections can be implemented using the multihoming approach on a single endpoint or network device.

Question 90: During a threat hunt, an analyst discovers beaconing traffic to an external IP at regular 60-second intervals using HTTPS. The process responsible is svchost.exe. What is the MOST likely threat?

Command-and-control communication from malware using process hollowing (Correct answer)
A rootkit disguising itself as a kernel driver
Legitimate Windows Update service communicating with Microsoft
DNS tunneling exfiltrating data over HTTPS

Correct answer: Command-and-control communication from malware using process hollowing

Regular beaconing from svchost.exe over HTTPS is a hallmark of process hollowing where malware injects into a legitimate process to establish C2 communication.

CompTIA Advanced Security Practitioner (CASP+) CAS-004

The CASP+ (CAS-004) is an advanced-level cybersecurity certification validating enterprise security architecture, security operations, cryptography, and governance, risk, and compliance skills for IT professionals with 10+ years of experience.

Questions

165 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

comptia.org — Score release, renewal, retake fee, retake policy, score validity, eligibility, exam format, passing score, time limit, fees · verified Oct 2026