CAS-005 CompTIA SecurityX Certification Exam Free Practice Exam Questions (2025 Updated)

Malware that does not execute in a sandbox environment often contains anti-analysis techniques, such as anti-virtualization code. This code detects when the malware is running in a virtualized environment and alters its behavior to avoid detection. Checking for anti-virtualization code is a logical next step because:

It helps determine if the malware is designed to evade analysis tools.

Identifying such code can provide insights into themalware's behavior and intent.

This step can also inform further analysis methods, such as running the malware on physical hardware.

The logs show the device checking in from two distant locations (USA and Qatar) at nearly the same time, which indicatesimpossible travel— a strong indicator that either the device has been cloned, compromised, or credentials stolen. The best immediate action is todisable the device's account and accessto prevent potential misuse while an investigation is conducted. Malicious application installation or resource issues are possible but secondary concerns here compared to account compromise.

Zero Trust security is based on the principle of “never trust, always verify.” For a mobile and frequently traveling workforce, enforcing rigid access models without adaptability creates friction and hampers productivity. The first priority in Zero Trust design for such a workforce is to deploy context-aware reauthentication combined with User Behavior Analytics (UBA). This ensures that deviations from baseline user behavior—such as unusual geographic access, time of day anomalies, or device changes—trigger additional authentication or session restrictions.

Option A (hardware OTPs) enhances authentication security but does not provide adaptive, risk-based controls for varying user behavior. Option B (TLS decryption) focuses on network traffic inspection, which is important but secondary to ensuring identity and access enforcement in a Zero Trust model. Option C (posture compliance checks) is necessary but typically part of ongoing device security enforcement rather than the initial step.

By starting with context-aware reauthentication, the organization ensures its Zero Trust strategy adapts dynamically to user behavior, providing both stronger security and a smoother experience for a global, remote workforce.

SecurityX CAS-005 cloud architecture guidance emphasizes horizontal scaling for workloads that need to handle both predictable and fluctuating growth over time. Horizontal scaling allows the infrastructure to add nodes for both compute and storage dynamically, providing elasticity to meet fluctuating computational demands while accommodating exponential storage growth.

Vertical scaling (B) has hardware limits and is not as flexible for large, sustained growth.

CDN (A) is optimized for content distribution, not intensive compute workloads.

Load balancing (C) distributes workloads but does not address scaling for data growth.

The first action is to implement continuous and context-based authentication and authorization (A). Traditional authentication validates users only at login, which creates gaps during active sessions. Continuous authentication ensures validation throughout the data access workflow, incorporating contextual factors like device state, geolocation, and behavioral analysis. This directly aligns with audit findings requiring protection by role, identity validation, and action tracking.

Option B improves onboarding and monitoring but does not enforce continuous access control. Option C improves identity federation but does not provide session-by-session validation. Option D secures APIs but is too narrow for organization-wide identity workflows.

CAS-005 stresses Zero Trust and context-aware IAM, making continuous authentication and authorization the top priority.

The best approach is to use Terraform scripts while creating golden images (A). Terraform is an Infrastructure as Code (IaC) tool that allows organizations to automate infrastructure deployment consistently across environments. A golden image is a pre-configured, patched, and hardened system image used as a standard baseline. By creating golden images via Terraform scripts, the company ensures that every microservice instance is deployed on an already-updated and secure OS. This eliminates the need for repeatedly patching the base OS before code deployment.

Option B (cron job with apt-update) applies patches but introduces delays (every 30 days) and lacks consistency across new deployments. Option C (snapshots) saves deployment states but risks replicating outdated or unpatched images. Option D (centralized update server) is useful but still requires updates post-deployment, which slows the rollout of microservices.

By automating golden image creation through Terraform, the company gains efficiency, repeatability, and security assurance, aligning with DevSecOps principles and CAS-005 cloud-native best practices.

Incident response follows a standard process (e.g., NIST 800-61): Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. After identifying the attack (file and origin), the next step isContainment—limiting the spread or impact (e.g., isolating systems) before remediation or recovery.

Option A:Remediation (fixing the root cause) follows containment.

Option B:Correct—containment prevents further damage post-identification.

Option C:“Response” is too vague; it encompasses all steps.

Option D:Recovery (restoring systems) comes after containment and eradication.

Vendor lock-in occurs when a client is overly dependent on a vendor, limiting flexibility. Risks include:

Option B:Vendors changing offerings (e.g., features, pricing) can disrupt the client, a key lock-in risk.

Option D:Decreased quality of service may result from reliance on a single vendor without alternatives.

Option A:Seamless data movement is a benefit, not a risk.

Option C:Sufficient service is neutral or positive, not a risk.

Option E:Multicloud is hindered by lock-in, not a risk of it.

Option F:Increased interoperability contradicts lock-in’s limitations.

A risk register is atool commonly used in risk management to document all identified risks, their assessment in terms of likelihood and impact, and the actions steps to manage them. By adding the newly identified risks to the risk register and assigning an owner and severity, the organization ensures that each risk is visible to stakeholders and has a designated individual responsible for its management. This aligns with the company's requirements for transparency and accountability in risk management.​

A computer screen shot of a diagram Description automatically generated

A screenshot of a computer error Description automatically generated

The organization is most concerned about Generative AI improving phishing and social engineering attacks. Tools like ChatGPT can generate highly convincing phishing emails, fake websites, and human-like interactions that bypass traditional detection methods. Employees who were trained to spot poor grammar or obvious scams may now struggle to detect AI-crafted exploits.

Option A relates to compliance but not AI-driven threats. Option B (overreliance on AI bots) is operational risk, not phishing. Option D (differential analysis) applies to AI privacy issues, not phishing.

CAS-005 emphasizes adapting training to emerging threats, including AI-enabled social engineering. This ensures users remain resilient against modern attacks, making C the correct answer.

The provided code snippet shows a script that captures the user's cookies and sends them to a remote server. This type of attack is characteristic of Cross-Site Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who visit the infected web page.

A. XSRF (Cross-Site Request Forgery) attack: This involves tricking the user into performing actions on a different site without their knowledge but does not involve stealing cookies via script injection.

B. Command injection: This involves executing arbitrary commands on the host operating system, which is not relevant to the given JavaScript code.

C. Stored XSS: The provided code snippet matches the pattern of a stored XSS attack, where the script is injected into a web page, and when users visit the page, the script executes and sends theuser's cookies to the attacker's server.

D. SQL injection: This involves injecting malicious SQL queries into the database and is unrelated to the given JavaScript code.

A. Implementing allow lists: Allow lists (whitelisting) restrict network communication to only authorized devices and applications, significantly reducing the attack surface by ensuring that only pre-approved traffic is permitted.

F. Implementing a site-to-site IPSec VPN: A site-to-site VPN provides a secure, encrypted tunnel for data transmission between the OT systems and the vendor, protecting the data from interception and tampering during transit.

Other options:

B. Monitoring network behavior: While useful for detecting anomalies, it does not proactively reduce the risk of compromise or sabotage.

C. Encrypting data at rest: Important for protecting data stored on devices, but does not address network communication risks.

D. Performing boot integrity checks: Ensures the integrity of the system at startup but does not protect ongoing network communications.

E. Executing daily health checks: Useful for maintaining system health but does not directly reduce the risk of network-based compromise or sabotage.

Useruser-cis showinganomalous behavior across multiple machines, attempting to run administrative tools such as cmd.exe and appwiz.CPL, which are commonly used by attackers for system modification. The activity pattern suggests a lateral movement attempt, potentially indicating a compromised account.

user-a (A)anduser-b (B)attempted to run applications but only on one machine, suggesting less likelihood of compromise.

user-d (D)was blocked running cmd.com, but user-c’s pattern is more consistent with an attack technique.

The logs show that the user connected fromToronto (104.18.16.29)andLos Angeles (95.67.137.12)within minutes. The sudden location change is a typical trigger forgeoblocking in a Next-Generation Firewall (NGFW), leading to theHR System being denied.

A compromised account (B)would show failed login attempts or unusual activities, but all other access attempts were allowed.

Business hours restriction (C)is unlikely since the user was granted access earlier.

Approved subnet issues (D)would affect all applications, not just HR System access.

Creatingsecure baseline imagesensuresconsistent, repeatabledeployment aligned with hardening standards. These images can be used acrosson-premises and cloud environments, ensuring compliance and reducing misconfigurations.

Vulnerability alerts (A)are reactive, not preventive.

Building images from scratch (C)is time-consuming and unnecessary if baselines exist.

Scripts for cleanup (D)are useful but do not prevent initial insecure configurations.

DomainKeys Identified Mail (DKIM) digitally signs outbound messages with the organization’s private key, enabling recipients to verify integrity and authenticity using the corresponding public key in DNS.

SPF validates sending server IPs, not message integrity.

DMARC builds policy enforcement on top of SPF and DKIM results.

TLS secures the transport channel, not the message content itself.

To secure the Operational Technology (OT) environment based on the given requirements, the best approach is to implement a bastion host inthe OT network. The bastion host serves as a secure entry point for remote access, allowing third-party vendors to connect while being monitored by security tools. Using a dedicated update server for workstations ensures that security updates are applied in a controlled manner without direct internet access.

To ensure that logs from a legacy platform are properly retained beyond the default retention period, configuring the SIEM to aggregate the logs is the best approach. SIEM solutions are designed to collect, aggregate, and store logs from various sources, providing centralized log management and retention. This setup ensures that logs are retained according to policy and can be easily accessed for analysis and compliance purposes.