CompTIA Advanced Security Practitioner (CASP+) CAS-004 — Questions and Answers

Question 1: Which elliptic curve is RECOMMENDED by NIST for use in US federal systems at the 128-bit security level?

P-521
secp256k1
P-256 (secp256r1) (Correct answer)
Curve25519

Correct answer: P-256 (secp256r1)

NIST P-256 is the FIPS-approved curve at the 128-bit security level, recommended in NIST SP 800-186 for federal cryptographic applications.

Question 2: An organization encrypts cloud storage with customer-managed keys (CMK). Which action allows the cloud provider to render the data inaccessible without deleting it?

Disabling or scheduling deletion of the CMK in the KMS (Correct answer)
Changing the storage class to archive
Removing the object ACL
Deleting the storage bucket

Correct answer: Disabling or scheduling deletion of the CMK in the KMS

Disabling or scheduling deletion of the CMK prevents the cloud provider's encryption service from decrypting data; the ciphertext remains but is cryptographically inaccessible without the key.

Question 3: A web application undergoes a security review and is found to serialize user-supplied objects without validation. Which vulnerability class does this MOST likely introduce?

Server-side request forgery (SSRF) accessing internal services
Cross-site request forgery (CSRF) allowing unauthorized state changes
XML external entity (XXE) injection extracting server files
Insecure deserialization enabling remote code execution (Correct answer)

Correct answer: Insecure deserialization enabling remote code execution

Deserializing untrusted user-supplied objects without validation is the definition of insecure deserialization, which can lead to remote code execution when gadget chains exist.

Question 4: An enterprise is designing a PKI hierarchy. Which structure BEST protects the root CA while maintaining operational flexibility?

An offline root CA with online intermediate/issuing CAs (Correct answer)
A flat PKI with no intermediate CAs
A single root CA used directly for all certificate issuance
A root CA hosted on an internet-connected server for availability

Correct answer: An offline root CA with online intermediate/issuing CAs

An offline root CA is never exposed to network attack; intermediate CAs handle day-to-day issuance, and if an intermediate is compromised only that subtree needs replacement.

Question 5: A security team discovers that an attacker maintained persistence in their environment for 9 months using a web shell. Which log source would MOST likely have revealed this activity earliest?

Active Directory authentication logs showing failed login attempts
Endpoint antivirus logs from the web server
Network flow data showing large outbound data transfers
Web server access logs showing unusual POST requests to the web shell path (Correct answer)

Correct answer: Web server access logs showing unusual POST requests to the web shell path

Web server access logs record every HTTP request including POST requests to web shells, making them the earliest and most direct indicator of web shell interaction.

Question 6: A company's incident response team is handling a ransomware attack. Encrypted files have been confirmed on three servers. What should be the FIRST containment action?

Perform forensic imaging of all affected systems before taking any action
Restore the affected servers from the most recent backup immediately
Pay the ransom to obtain the decryption key and minimize downtime
Isolate the affected systems from the network to prevent further spread (Correct answer)

Correct answer: Isolate the affected systems from the network to prevent further spread

Network isolation is the first containment priority to stop ransomware propagation before it encrypts additional systems across the environment.

Question 7: Which control MOST effectively protects against a cloud misconfiguration that exposes an internal metadata service to a server-side request forgery (SSRF) attack?

Encrypting metadata service responses
Disabling the metadata service entirely
IMDSv2 (requiring session tokens for metadata access) and network egress filtering (Correct answer)
Web Application Firewall blocking outbound traffic

Correct answer: IMDSv2 (requiring session tokens for metadata access) and network egress filtering

IMDSv2 requires a PUT request to obtain a session token before accessing metadata, preventing SSRF exploits that use simple GET requests to steal instance credentials.

Question 8: What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?

It reduces the attack window by granting elevated privileges only when needed for a defined period (Correct answer)
It provides permanent elevated access for administrative efficiency
It eliminates the need for multi-factor authentication on privileged accounts
It allows users to self-assign privileges without administrator approval

Correct answer: It reduces the attack window by granting elevated privileges only when needed for a defined period

JIT access minimizes the time elevated privileges are active, significantly reducing the window of opportunity for credential theft and misuse.

Question 9: A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

Certificate-based authentication
Digital signatures on the handshake
RSA key exchange (non-forward-secret) (Correct answer)
The use of asymmetric cryptography

Correct answer: RSA key exchange (non-forward-secret)

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

Question 10: Which key exchange protocol provides perfect forward secrecy (PFS)?

Static Diffie-Hellman (DH)
Pre-shared key (PSK) exchange
Ephemeral Diffie-Hellman (DHE) or ECDHE (Correct answer)
RSA key exchange

Correct answer: Ephemeral Diffie-Hellman (DHE) or ECDHE

Ephemeral DH/ECDHE generates a new key pair for each session, so past session keys cannot be derived even if the server's long-term private key is later compromised.

Question 11: Which incident response phase involves identifying lessons learned and updating security controls to prevent recurrence?

Eradication and Recovery
Containment
Post-Incident Activity (Correct answer)
Detection and Analysis

Correct answer: Post-Incident Activity

The Post-Incident Activity phase (NIST SP 800-61) includes a lessons-learned meeting, updating incident response plans, and implementing improvements to prevent similar incidents.

Question 12: What is credential stuffing, and which IAM control most effectively mitigates it?

Malware-based credential harvesting from endpoints; EDR solutions
Social engineering to obtain credentials; security awareness training
Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication (Correct answer)
Brute-force guessing of passwords; strong password length requirements

Correct answer: Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication

Credential stuffing uses breached credentials from other sites to exploit password reuse; MFA stops the attack even when valid credentials are submitted by the attacker.

Question 13: Which security architecture pattern BEST reduces the blast radius of a compromised internal service?

Single sign-on across all services
Flat network with shared authentication
Network address translation (NAT) at the perimeter
Microsegmentation with per-service access controls (Correct answer)

Correct answer: Microsegmentation with per-service access controls

Microsegmentation isolates services so that a compromised component cannot laterally move to other services without explicit authorization.

Question 14: Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

Meet-in-the-middle attack
BEAST (Browser Exploit Against SSL/TLS) (Correct answer)
Padding oracle attack
Length extension attack

Correct answer: BEAST (Browser Exploit Against SSL/TLS)

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

Question 15: An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

TOGAF with security extensions
ISO 27001 alone
PCI DSS (only applicable if payment data is involved)
NIST SP 800-53 (Correct answer)

Correct answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Question 16: An organization identifies that a critical control is not cost-effective to implement. Which control type can be used to partially offset the risk without fully replacing the missing control?

Preventive control
Detective control
Compensating control (Correct answer)
Corrective control

Correct answer: Compensating control

Compensating controls are alternative measures that provide equivalent or partial risk reduction when the primary control cannot be implemented as specified.

Question 17: Which cloud security control prevents accidental public exposure of storage buckets containing sensitive data?

Enabling versioning on all buckets
AWS S3 Block Public Access or equivalent provider-level public access prevention (Correct answer)
Tagging buckets with the data classification level
Encrypting bucket contents with customer-managed keys

Correct answer: AWS S3 Block Public Access or equivalent provider-level public access prevention

Block Public Access settings override any bucket or object ACLs that would grant public access, providing an account-level guardrail against accidental data exposure.

Question 18: A company migrates a regulated workload to a public cloud. Which cloud deployment model MOST effectively addresses data sovereignty requirements?

Sovereign cloud or government cloud region with contractual data residency guarantees (Correct answer)
Hybrid cloud with no data residency controls
Public cloud with client-side encryption only
Public multi-region cloud with data replication globally

Correct answer: Sovereign cloud or government cloud region with contractual data residency guarantees

Sovereign or government cloud regions are physically and logically isolated, with contractual guarantees that data remains within a specific jurisdiction, satisfying data sovereignty regulations.

Question 19: An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?

Transfer via cyber liability insurance
Accept the risk and document the decision (Correct answer)
Avoid the risk by discontinuing the activity
Mitigate by implementing compensating controls

Correct answer: Accept the risk and document the decision

When mitigation cost exceeds potential loss for a low-likelihood, low-impact risk, accepting the risk with documented rationale is the most cost-effective decision.

Question 20: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Collision resistance (Correct answer)
One-way property
Preimage resistance
Second preimage resistance

Correct answer: Collision resistance

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

Question 21: An enterprise needs quantum-resistant encryption for long-lived sensitive data. Which NIST-standardized post-quantum algorithm is appropriate for key encapsulation?

CRYSTALS-Kyber (ML-KEM) (Correct answer)
ECDSA P-384
AES-256-GCM
RSA-4096

Correct answer: CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber (standardized as ML-KEM in NIST FIPS 203) is NIST's approved post-quantum key encapsulation mechanism, resistant to attacks by quantum computers.

Question 22: During a threat hunt, an analyst discovers beaconing traffic to an external IP at regular 60-second intervals using HTTPS. The process responsible is svchost.exe. What is the MOST likely threat?

DNS tunneling exfiltrating data over HTTPS
Legitimate Windows Update service communicating with Microsoft
A rootkit disguising itself as a kernel driver
Command-and-control communication from malware using process hollowing (Correct answer)

Correct answer: Command-and-control communication from malware using process hollowing

Regular beaconing from svchost.exe over HTTPS is a hallmark of process hollowing where malware injects into a legitimate process to establish C2 communication.

Question 23: Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

System Security Plan (SSP)
Plan of Action and Milestones (POA&M) (Correct answer)
Audit Report
Risk Register

Correct answer: Plan of Action and Milestones (POA&M)

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

Question 24: A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?

DNS server query logs
Web proxy access logs
Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts (Correct answer)
DHCP server logs

Correct answer: Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts

Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.

Question 25: A vendor assessment reveals that a critical third-party provider has no incident response plan. Which contractual mechanism BEST addresses this risk?

Requiring the vendor to self-certify compliance
Terminating the contract immediately
Accepting the risk as an inherent part of outsourcing
Including security requirements and audit rights in the contract (right-to-audit clause) (Correct answer)

Correct answer: Including security requirements and audit rights in the contract (right-to-audit clause)

Contract clauses that specify security requirements and grant audit rights enable the organization to verify compliance and mandate remediation, providing enforceable protection.

Question 26: An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Using a certificate with a short validity period
Signing with the developer's personal certificate
Storing the signed binary on an internet-accessible server
Detached signatures stored separately from the binary (Correct answer)

Correct answer: Detached signatures stored separately from the binary

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Question 27: Which network control MOST effectively limits the blast radius of a compromised container within a Kubernetes cluster?

Disabling all container networking
Using NodePort services for all communications
Running all pods in the default namespace
Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only (Correct answer)

Correct answer: Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only

NetworkPolicy objects define ingress and egress rules for pods; a compromised pod with restrictive policies cannot initiate connections to arbitrary pods in other namespaces.

Question 28: Which metric BEST quantifies the financial impact of a single security incident for risk calculation purposes?

Residual risk percentage
Annualized Rate of Occurrence (ARO)
Single Loss Expectancy (SLE) (Correct answer)
Control gap score

Correct answer: Single Loss Expectancy (SLE)

SLE = Asset Value × Exposure Factor and represents the expected financial loss from a single occurrence of a specific threat event.

Question 29: Which of the following is an improvement on Electronic Code Book (ECB) block cipher mode that connects each block together before being applied to the following block?

CBC (Correct answer)
CTR
CFB
AES

Correct answer: CBC

Blocks are chained together in cipher block chaining (CBC) because every resultant 64-bit ciphertext block is applied to the following block. CBC is thought to be an improvement to ECB, in part because it addresses the issues brought on by the ECB's requirement to individually encrypt each block of plaintext (which can leak information about the underlying data to eavesdroppers). <br> CBC is one of the cipher modes that can be used with the Advanced Encryption Standard (AES), a sort of block cipher, however, AES is not a cipher mode in and of itself. <br> Block ciphering and stream ciphering are both used in cipher feedback (CFB). <br> Output feedback (OFB): Employs stream ciphering and block ciphering with 8-bit or smaller blocks, and uses the key from the previous keystream to construct the next keystream. <br> Similar to OFB, counter mode (CTR) uses an incrementing IV counter to make sure that every block is encrypted with a different keystream.

Question 30: Which security architecture approach MOST effectively addresses insider threats?

Requiring employees to sign acceptable use policies
Deploying antivirus on all workstations
Blocking all USB ports on endpoints
User and Entity Behavior Analytics (UEBA) combined with least-privilege access (Correct answer)

Correct answer: User and Entity Behavior Analytics (UEBA) combined with least-privilege access

UEBA establishes behavioral baselines and alerts on anomalous activity, while least-privilege limits what insiders can access or exfiltrate.

Question 31: Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?

Container escape
Side-channel attack
API injection
VM escape (hypervisor breakout) (Correct answer)

Correct answer: VM escape (hypervisor breakout)

A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.

CompTIA Advanced Security Practitioner (CASP+) CAS-004

The CASP+ (CAS-004) is an advanced-level cybersecurity certification validating enterprise security architecture, security operations, cryptography, and governance, risk, and compliance skills for IT professionals with 10+ years of experience.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds