CAS-005 Exam Questions and Answers | Exam-Dumps (Page: 6)

QUESTION: 41

A web application server is running a legacy operating system with an unpatched RCE vulnerability. The server cannot be upgraded until the corresponding application code is changed.
Which of the following compensating controls would best prevent successful exploitation?

Segmentation
CASB
HIPS
UEBA

Answer(s): A

Explanation:

Segmentation is a compensating control that helps mitigate risks by isolating critical systems or vulnerable systems from the rest of the network. In this case, the web application server running a legacy operating system with an unpatched remote code execution (RCE) vulnerability can be isolated through network segmentation. This limits the potential for attackers to exploit the vulnerability by restricting access to the server and preventing lateral movement within the network. By segmenting the server, the attack surface is reduced, and the risk of successful exploitation is minimized until the system can be properly patched.

Reveal Solution Next Question

QUESTION: 42

Which of the following is the reason why security engineers often cannot upgrade the security of embedded facility automation systems?

They are constrained by available compute.
They lack x86-64 processors.
They lack EEPROM.
They are not logic-bearing devices.

Answer(s): A

Explanation:

Embedded facility automation systems, such as those used for controlling HVAC, lighting, or security, are often constrained by limited computational resources. These systems are designed to be low-cost and energy- efficient, which means they typically have limited processing power, memory, and storage capacity. As a result, security engineers often face difficulties when trying to upgrade or implement additional security measures, such as more sophisticated encryption or security patches, because these systems lack the necessary compute resources to handle such upgrades.

Reveal Solution Next Question

QUESTION: 43

A security analyst identified a vulnerable and deprecated runtime engine that Is supporting a public-facing banking application. The developers anticipate the transition to modern development environments will take at least a month.
Which of the following controls would best mitigate the risk without interrupting the service during the transition?

Shutting down the systems until the code is ready
Uninstalling the impacted runtime engine
Selectively blocking traffic on the affected port
Configuring IPS and WAF with signatures

Answer(s): D

Explanation:

To mitigate the risk of the vulnerable and deprecated runtime engine while the developers transition to a more modern environment, configuring an Intrusion Prevention System (IPS) and a Web Application Firewall (WAF) with appropriate signatures would provide protection without disrupting the service. These security controls can help detect and block known exploits targeting the vulnerable runtime engine. By applying these measures, the application can continue running while minimizing the risk of exploitation from external threats.

Reveal Solution Next Question

QUESTION: 44

A security architect wants to ensure a remote host's identity and decides that pinning the X.509 certificate to the device is the most effective solution.
Which of the following must happen first?

Use Distinguished Encoding Rules (DER) for the certificate.
Extract the private key from the certificate.
Use an out-of-band method to obtain the certificate.
Compare the retrieved certificate with the embedded certificate.

Answer(s): C

Explanation:

When implementing certificate pinning, the first step is to securely obtain the remote host's X.509 certificate through an out-of-band method. This ensures that the certificate is trusted and verified outside of the regular communication channel (e.g., via a secure channel or pre-distribution), preventing any potential man-in-the- middle attacks. Once the certificate is securely obtained and verified, it can then be pinned to the device so that future connections to that host will only be accepted if the certificate matches the pinned one.

Reveal Solution Next Question

QUESTION: 45

A company hired a third-party consultant to run a cybersecurity incident simulation in order to identify security gaps and prepare stakeholders for a potential incident.
Which of the following best describes this activity?

Tabletop exercise
Walk-through review
Lessons learned
Business impact analysis

Answer(s): A

Explanation:

A tabletop exercise is a discussion-based simulation where key stakeholders, including management and technical teams, gather to walk through a hypothetical cybersecurity incident. The goal is to identify security gaps, assess response strategies, and prepare for real-world incidents. During this exercise, participants typically discuss their roles and decisions in handling the incident, but no actual systems are impacted.

Reveal Solution Next Question

QUESTION: 46

A security officer is requiring all personnel working on a special project to obtain a security clearance requisite with the level of all information being accessed. Data on this network must be protected at the same level of each clearance holder. The need to know must be verified by the data owner.
Which of the following should the security officer do to meet these requirements?

Create a rule to authorize personnel only from certain IPs to access the files.
Assign labels to the files and require formal access authorization.
Assign attributes to each file and allow authorized users to share the files.
Assign roles to users and authorize access to files based on the roles.

Answer(s): B

Explanation:

To meet the requirement of ensuring that data is protected at the clearance level of each personnel member and that access is based on the need to know, labeling the files according to their classification level is an effective method. Labels indicate the sensitivity of the data and ensure that only individuals with the appropriate clearance and need-to-know access are authorized to view or modify the files.
By requiring formal access authorization from the data owner, the security officer ensures that access is explicitly verified before any personnel can access data at a given classification level.

Reveal Solution Next Question

QUESTION: 47

A security team receives alerts regarding impossible travel and possible brute-force attacks after normal business hours. After reviewing more logs, the team determines that specific users were targeted and attempts were made to transfer data to an unknown site.
Which of the following should the team do to help mitigate these issues?

Create a firewall rule to prevent those users from accessing sensitive data.
Restrict uploading activity to only authorized sites.
Enable packet captures to continue to run for the source and destination related to the file transfer.
Disable login activity for those users after business hours.

Answer(s): B

Explanation:

The security team has identified that certain users are being targeted by what appears to be impossible travel and brute-force attacks, followed by attempts to transfer data to an unknown site. To mitigate this, the best approach is to restrict uploading activity to only authorized sites. This ensures that even if the attackers gain access to the user accounts, they will not be able to exfiltrate data to unknown or unauthorized locations.
This control directly addresses the data exfiltration risk by preventing unauthorized file uploads, regardless of whether the attacker successfully compromises user credentials.

Reveal Solution Next Question

QUESTION: 48

A company recently acquired a SaaS company and performed a gap analysis. The results of the gap analysis Indicate security controls are absent throughout the SDLC and have led to several vulnerable production releases.
Which of the following security tools best reduces the risk of vulnerable code being pushed to production in the future?

Static application security testing
Regression testing
Code signing
Sandboxing

Answer(s): A

Explanation:

Static application security testing (SAST) is the best tool for identifying security vulnerabilities in code early in the Software Development Life Cycle (SDLC). SAST tools analyze source code or binaries for vulnerabilities without executing the program, allowing teams to catch and address security issues before the code is pushed to production. This aligns with reducing the risk of vulnerable code being released.

Reveal Solution Next Question

CompTIA CAS-005 Exam (page: 6) CompTIA SecurityX Updated on: 25-Dec-2025

QUESTION: 41

Explanation:

QUESTION: 42

Explanation:

QUESTION: 43

Explanation:

QUESTION: 44

Explanation:

QUESTION: 45

Explanation:

QUESTION: 46

Explanation:

QUESTION: 47

Explanation:

QUESTION: 48

Explanation:

CompTIA CAS-005 Exam (page: 6)
CompTIA SecurityX
Updated on: 25-Dec-2025