CAS-005 exam questions for practice in 2025 Updated 219 Questions [Q98-Q112]

Rate this post

CAS-005 exam questions for practice in 2025 Updated 219 Questions

Updated Sep-2025 Premium CAS-005 Exam Engine pdf – Download Free Updated 219 Questions

CompTIA CAS-005 Exam Syllabus Topics:

Topic	Details
Topic 1	Governance, Risk, and Compliance: This section of the exam measures the skills of CompTIA security architects that cover the implementation of governance components based on organizational security requirements, including developing policies, procedures, and standards. Candidates will learn about managing security programs, including awareness training on phishing and social engineering.
Topic 2	Security Operations: This domain is designed for CompTIA security architects and covers analyzing data to support monitoring and response activities, as well as assessing vulnerabilities and recommending solutions to reduce attack surfaces. Candidates will apply threat-hunting techniques and utilize threat intelligence concepts to enhance operational security.
Topic 3	Security Architecture: This domain focuses on analyzing requirements to design resilient systems, including the configuration of firewalls and intrusion detection systems.
Topic 4	Security Engineering: This section measures the skills of CompTIA security architects that involve troubleshooting common issues related to identity and access management (IAM) components within an enterprise environment. Candidates will analyze requirements to enhance endpoint and server security while implementing hardware security technologies. This domain also emphasizes the importance of advanced cryptographic concepts in securing systems.

NO.98 A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems. Which of the following should the security engineer modify?

The /etc/openssl.conf file, updating the virtual site parameter

The /etc/nsswith.conf file, updating the name server

The /etc/hosts file, updating the IP parameter

The /etc/etc/sshd, configure file updating the ciphers

NO.99 A compliance officer is reviewing the data sovereignty laws in several countries where the organization has no presence Which of the following is the most likely reason for reviewing these laws?

The organization is performing due diligence of potential tax issues.

The organization has been subject to legal proceedings in countries where it has a presence.

The organization is concerned with new regulatory enforcement in other countries

The organization has suffered brand reputation damage from incorrect media coverage

NO.100 A security engineer wants to reduce the attack surface of a public-facing containerized application. Which of the following will best reduce the application’s privilege escalation attack surface?

Implementing the following commands in the Dockerfile:
RUN echo user:x:1000:1000:user:/home/user:/dev/null > /etc/passwd

Installing an EDR on the container’s host, with reporting configured to log to a centralized SIEM, and implementing the following alerting rule:
IF PROCESS_USER==root ALERT_TYPE==critical

Designing a muiticontainer solution, with one set of containers that runs the mam application, and another set oi containers that perform automatic remediation by replacing compromised containers or disabling compromised accounts

Running the container in an isolated network and placing a load balancer in a public-facing network. Adding the following ACL to the load balancer:
PERMIT HTTPS from 0.0.0.0.0/0 port 443

NO.101 A web application server that provides services to hybrid modern and legacy financial applications recently underwent a scheduled upgrade to update common libraries, including OpenSSL. Multiple users are now reporting failed connection attempts to the server. The technician performing initial triage identified the following:
– Client applications more than five years old appear to be the most
affected.
– Web server logs show initial connection attempts by affected hosts.
– For the failed connections, logs indicate “cipher unavailable.”
Which of the following is most likely to safely remediate this situation?

The server needs to be configured for backward compatibility to SSL 3.0 applications.

The client applications need to be modified to support AES in Galois/Counter Mode or equivalent.

The client TLS configuration must be set to enforce electronic codebook modes of operation.

The server-side digital signature algorithm needs to be modified to support elliptic curve cryptography.

NO.102 Which of the following best describes the reason PQC preparation is important?

To protect data against decryption due to increases in computational resource availability

To have larger key lengths available through key stretching

To improve encryption performance and speed using lightweight cryptography

To leverage asymmetric encryption for large amounts of data

NO.103 A vulnerability can on a web server identified the following:

Which of the following actions would most likely eliminate on path decryption attacks? (Select two).

Disallowing cipher suites that use ephemeral modes of operation for key agreement

Removing support for CBC-based key exchange and signing algorithms

Adding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256

Implementing HIPS rules to identify and block BEAST attack attempts

Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA

Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA

NO.104 Which of the following best describes the reason PQC preparation is important?

To protect data against decryption due to increases in computational resource availability

To have larger key lengths available through key stretching

To improve encryption performance and speed using lightweight cryptography

To leverage asymmetric encryption for large amounts of data

NO.105 A software development team requires valid data for internal tests. Company regulations, however do not allow the use of this data in cleartext. Which of the following solutions best meet these requirements?

Configuring data hashing

Deploying tokenization

Replacing data with null record

Implementing data obfuscation

NO.106 A security analyst notices a number of SIEM events that show the following activity:
10/30/2020 – 8:01 UTC – 192.168.1.1 – sc stop HinDctend
10/30/2020 – 8:05 UTC – 192.168.1.2 – c:program filesgamescomptidcasp.exe
10/30/2020 – 8:07 UTC – 192.168.1.1 – c:windowssystem32cmd.exe /c powershell
10/30/2020 – 8:07 UTC – 192.168.1.1 – powershell -> 40.90.23.154:443
Which of the following response actions should the analyst take first?

Disable powershell.exe on all Microsoft Windows endpoints

Restart Microsoft Windows Defender

Configure the forward proxy to block 40.90.23.154

Disable local administrator privileges on the endpoints

NO.107 SIMULATION
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

NO.108 A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?

Executing a script that deletes and overwrites all data on the SSD three times

Wiping the SSD through degaussing

Securely deleting the encryption keys used by the SSD

Writing non-zero, random data to all cells of the SSD

NO.109 SIMULATION
You are a security analyst tasked with interpreting an Nmap scan output from company’s privileged network.
The company’s hardening guidelines indicate the following:
There should be one primary server or service per device.
Only default ports should be used.
Non-secure protocols should be disabled.
INSTRUCTIONS
Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.
For each device found by Nmap, add a device entry to the Devices Discovered list, with the following information:
The IP address of the device
The primary server or service of the device (Note that each IP should by associated with one service/port only) The protocol(s) that should be disabled based on the hardening guidelines (Note that multiple ports may need to be closed to comply with the hardening guidelines) If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

NO.110 A security architect for a global organization with a distributed workforce recently received funding lo deploy a CASB solution Which of the following most likely explains the choice to use a proxy-based CASB?

The capability to block unapproved applications and services is possible

Privacy compliance obligations are bypassed when using a user-based deployment.

Protecting and regularly rotating API secret keys requires a significant time commitment

Corporate devices cannot receive certificates when not connected to on-premises devices

NO.111 A company needs to increase the maturity level for the cybersecurity department’s governance structure.
To achieve this goal, the company wants to implement a set of controls that can be used as part of the standard operational procedures and policies within the department and the company.
Which of the following frameworks best aligns with this goal?

ITIL

CIS

COSO

COBIT

NO.112 A company that uses several cloud applications wants to properly identify:
All the devices potentially affected by a given vulnerability.
All the internal servers utilizing the same physical switch.
The number of endpoints using a particular operating system.Which of the following is the best way to meet the requirements?

SBoM

CASB

GRC

CMDB