CompTIA SecurityX (CAS-005, formerly CASP+) Practice Exam

What the CompTIA SecurityX (CAS-005, formerly CASP+) exam covers

• Governance, Risk, and Compliance225 questions
• Security Architecture211 questions
• Security Engineering220 questions
• Security Operations236 questions

Free CompTIA SecurityX (CAS-005, formerly CASP+) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 892.

1. Question 1Governance, Risk, and Compliance

   What is the primary goal of an enterprise risk management program?

   • ATo catalog every asset and its owner so audits can be completed without security involvement
   • BTo eliminate all identified risk completely regardless of cost, feasibility, or business value
   • CTo deploy the maximum number of security controls possible independent of their measurable benefit
   • DTo identify, assess, prioritize, and treat risks in alignment with business objectives and risk appetiteCorrect
   ✓ Correct answer: D

   Enterprise risk management (ERM) is a structured, organization-wide process for identifying risks, assessing their likelihood and impact, prioritizing them, and selecting treatments (accept, avoid, transfer, or mitigate) that align with the business's objectives and stated risk appetite. The aim is informed, cost-effective decisions about which risks to address first, not blanket control coverage, so resources flow to the threats that matter most while residual risk stays within tolerance.

   Why the other options are wrong

   • AAsset cataloging supports risk management but is only an input, not the program's goal of assessing and treating risk against business objectives.
   • BEliminating all risk is neither achievable nor cost-effective; ERM manages risk to an accepted appetite rather than removing it entirely.
   • CMaximizing control count ignores cost-benefit and risk appetite, which is the opposite of prioritized, business-aligned risk treatment.
2. Question 2Security Engineering

   A data lake stores sensitive data that must be encrypted, but the team wants to minimize storage cost from redundant copies. Which approach BEST balances security and cost efficiency?

   • AReplicate full plaintext copies to every processing zone and keep them indefinitely for fast local access
   • BEncrypt at rest with managed keys and use deduplication/compression plus lifecycle tiering to reduce redundant storage costCorrect
   • CEncrypt at rest but pin every copy to the highest-performance storage tier permanently for consistent reads
   • DEncrypt only the derived analytics outputs while leaving the raw source data in the lake unencrypted
   ✓ Correct answer: B

   This answer directly addresses the key concept tested in this security certification question. Understanding this topic is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • AIndefinite full plaintext replicas leave sensitive data unencrypted and multiply storage, violating both the security and cost goals.
   • CPinning every copy to the most expensive tier forever maximizes cost, the opposite of the storage-efficiency objective.
   • DEncrypting only derived outputs leaves the sensitive raw data in the lake exposed, so the confidentiality requirement is not met.
3. Question 3Governance, Risk, and Compliance

   A company encrypts a database and states that, under most breach-notification safe-harbor provisions, encryption may exempt them from notifying. What is the critical condition that often voids the safe harbor?

   • ABreach notification is required only for unencrypted backup copies, never for encrypted live production data
   • BEncryption always exempts an organization from notification regardless of how the encryption keys were handled
   • CThe safe harbor applies only in cases where the affected data was never encrypted in the first place
   • DIf the encryption keys were also compromised in the breach, the data is considered exposed and the safe harbor does not applyCorrect
   ✓ Correct answer: D

   Encryption protects data confidentiality by making it unreadable to unauthorized parties. Symmetric encryption uses a single shared key (fast but requires secure key exchange); asymmetric encryption uses public/private key pairs (slower but enables secure key exchange). Encryption in transit (using TLS/SSL) protects data crossing networks. Encryption at rest protects stored data from unauthorized access. Key management is critical; encryption is only effective if keys are protected and rotated regularly.

   Why the other options are wrong

   • ASafe-harbor provisions turn on whether data was rendered unreadable, not on a distinction between backups and live data.
   • BEncryption only supports safe harbor when the keys remain protected; unconditional exemption regardless of key handling is incorrect.
   • CThe safe harbor rewards effective encryption; it does not apply specifically to data that was never encrypted.
4. Question 4Security Architecture

   A SaaS provider must protect highly sensitive data while it is being processed, beyond encrypting it at rest and in transit, because a hostile insider with host access is part of the threat model. Which approach addresses data in use?

   • AConfidential computing using hardware-based trusted execution environments (enclaves)Correct
   • BApplication-layer field encryption with keys stored in the same host memory
   • CHomomorphic-style masking applied only after data leaves the processing node
   • DTokenization of records performed by a service running on the same host OS
   ✓ Correct answer: A

   This answer directly addresses the key concept tested in this security certification question. Understanding access is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • BField encryption whose keys live in the same host memory is readable by an insider with host access, so data in use is not protected.
   • CMasking applied after data leaves the node does nothing for the plaintext being actively processed on the compromised host.
   • DA tokenization service on the same host is within the insider's reach, so it cannot shield data while it is being processed in memory.
5. Question 5Security Engineering

   Which OpenSSL command verifies that a private key file key.pem matches a certificate file cert.pem by comparing their public key moduli?

   • Aopenssl verify -CAfile ca.pem cert.pem to confirm the certificate chains to the trusted CA
   • Bopenssl x509 -noout -modulus -in cert.pem | openssl md5 compared with openssl rsa -noout -modulus -in key.pem | openssl md5Correct
   • Copenssl pkcs12 -in cert.pem -inkey key.pem -export -out bundle.p12 to bundle the pair together
   • Dopenssl req -new -key key.pem -out csr.pem to generate a signing request from the key
   ✓ Correct answer: B

   openssl x509 -noout -modulus prints the public key modulus from a certificate and openssl rsa -noout -modulus prints the modulus from a private key. Piping both through openssl md5 produces a short fingerprint; if they match the certificate and key correspond to the same key pair. This technique is used during certificate deployment to confirm the correct key was submitted with the CSR.

   Why the other options are wrong

   • Averify checks the certificate against a CA trust chain; it does not compare the certificate's public key modulus to the private key.
   • Cpkcs12 -export packages a cert and key into a .p12 bundle but performs no modulus comparison to confirm they actually match.
   • Dreq -new creates a new certificate signing request from the key and does not compare an existing certificate and key.
6. Question 6Governance, Risk, and Compliance

   An organization wants a structured way to identify threats during architecture design by walking through Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Which threat-modeling methodology are they describing?

   • ASTRIDECorrect
   • BDREAD
   • CPASTA
   • DOCTAVE
   ✓ Correct answer: A

   STRIDE is a mnemonic-based threat-modeling approach that maps each letter to a threat category to systematically uncover design weaknesses. DREAD is a risk-rating scheme, PASTA is a seven-stage risk-centric process, and OCTAVE is an organizational risk assessment method, none of which use the STRIDE categories.

   Why the other options are wrong

   • BDREAD scores Damage, Reproducibility, Exploitability, Affected users, and Discoverability; it rates risk rather than enumerating these threat categories.
   • CPASTA is a seven-stage attacker-centric process, not the STRIDE category list.
   • DOCTAVE is an asset- and organization-focused risk assessment method, not a per-threat enumeration like STRIDE.
7. Question 7Security Engineering

   A workload running in a confidential-computing enclave must prove to a remote relying party that it is genuine, unmodified, and running expected code before receiving secrets. Which mechanism provides this assurance?

   • ARemote attestation producing a signed measurement of the enclave that the relying party verifiesCorrect
   • BA self-signed TLS certificate generated inside the enclave and presented at connection time
   • CAn IP allowlist and mutual firewall rules restricting which hosts may reach the enclave
   • DA shared static API key embedded in the enclave image and rotated on each deployment
   ✓ Correct answer: A

   Confidential-computing platforms generate an attestation quote signed by the hardware root of trust, containing measurements of the enclave's code and configuration. The relying party validates the signature and measurements against expected values, then provisions secrets only to a verified enclave. This proves genuineness and integrity, which the other options cannot.

   Why the other options are wrong

   • BA self-signed certificate proves control of a key but says nothing about whether the enclave is genuine hardware running unmodified, expected code.
   • CAn IP allowlist controls which network endpoints may connect but cannot prove the integrity or identity of the code executing inside the enclave.
   • DA static embedded secret proves knowledge of a key that could be extracted, not that the running enclave is measured, genuine, and unmodified.
8. Question 8Security Operations

   An investigator must verify that a forensic disk image has not changed since acquisition. Which step provides cryptographic proof of integrity?

   • BCompute a cryptographic hash (e.g., SHA-256) at acquisition and recompute it later to confirm the values matchCorrect
   • ACompress the disk image with gzip at acquisition and record the resulting compressed file size for later comparison
   • CRename the image file to embed the acquisition date and examiner initials for chain-of-custody tracking
   • DStore the disk image on a full-disk-encrypted external drive kept in a locked evidence cabinet
   ✓ Correct answer: B

   A hash captured at acquisition serves as a fingerprint; if the recomputed hash matches, the image is provably unaltered, which underpins evidentiary integrity and admissibility. This is recorded in the chain-of-custody documentation alongside the acquisition tool and write-blocker details.

   Why the other options are wrong

   • AFile size is not a cryptographic property; different content can share a size, so it cannot prove the image is unchanged.
   • CA filename is metadata that any editor can alter and provides no cryptographic proof that the image content is intact.
   • DEncryption protects confidentiality of the stored image but does not detect whether its contents changed since acquisition.
9. Question 9Security Architecture

   A retailer runs an SD-WAN across hundreds of branches. The architect wants branches to break out trusted SaaS traffic directly to the internet for performance, while ensuring that all such direct-breakout traffic is still subjected to consistent threat inspection and policy. Which combination best meets both goals?

   • ALocal internet breakout at the branch steered into a cloud-delivered security service (SSE)Correct
   • BBackhaul all branch traffic to the data center over the SD-WAN overlay
   • CAllow uninspected direct breakout for any destination flagged as SaaS
   • DDisable direct breakout and rely solely on endpoint antivirus
   ✓ Correct answer: A

   SD-WAN can identify applications and break out trusted SaaS locally for low latency, then tunnel that breakout to a cloud-delivered SSE (SWG, CASB, FWaaS) so policy and threat inspection still apply everywhere. This is the security pairing that makes branch direct breakout safe.

   Why the other options are wrong

   • BBackhauling everything to the data center reintroduces the latency and centralized chokepoint the breakout was meant to avoid.
   • CUninspected breakout abandons threat inspection and policy, which violates the stated requirement.
   • DDisabling breakout sacrifices performance, and endpoint antivirus alone is not equivalent to network-level inspection and policy.
10. Question 10Security Engineering

    A security review of a Java service finds it calls ObjectInputStream.readObject on data received from untrusted clients. An attacker can craft a serialized object graph that triggers gadget chains during deserialization. Which remediation is the MOST robust engineering fix?

    • AReplace native object deserialization with a data-only format and a strict schema, accepting only expected fields and typesCorrect
    • BEncrypt the serialized blob in transit with TLS before it reaches readObject so attackers cannot see the object graph
    • CAdd a length check that rejects any serialized payload over a fixed maximum size before it is handed to readObject
    • DRun the vulnerable service as a non-root operating-system user to limit the impact if a gadget chain does execute
    ✓ Correct answer: A

    Insecure deserialization exploits the act of reconstructing arbitrary object types and invoking their lifecycle methods. Parsing a data-only format such as JSON into known fields with a strict allowlist of expected types means no attacker-chosen classes are instantiated, so gadget chains have nothing to latch onto. If native serialization must stay, a strict class allowlist filter is the fallback.

    Why the other options are wrong

    • BTLS only protects data in transit; the attacker still supplies a validly encrypted malicious object that readObject deserializes on arrival.
    • CA size limit does not stop a compact gadget chain, since dangerous deserialization payloads can be well under any reasonable length cap.
    • DRunning as non-root reduces blast radius but leaves the code-execution deserialization flaw fully exploitable within the service context.

Related Security resources

• CompTIA SecurityX (CAS-005, formerly CASP+) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

CompTIA SecurityX (CAS-005, formerly CASP+) practice exam FAQ