CompTIA SecurityX (CAS-005, formerly CASP+) Practice Exam

What the CompTIA SecurityX (CAS-005, formerly CASP+) exam covers

• Governance, Risk, and Compliance220 questions
• Security Architecture289 questions
• Security Engineering321 questions
• Security Operations238 questions

Free CompTIA SecurityX (CAS-005, formerly CASP+) practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,068.

1. Question 1Governance, Risk, and Compliance

   What is the primary goal of an enterprise risk management program?

   • ATo catalog every asset and its owner so audits can be completed without security involvement
   • BTo eliminate all identified risk completely regardless of cost, feasibility, or business value
   • CTo deploy the maximum number of security controls possible independent of their measurable benefit
   • DTo identify, assess, prioritize, and treat risks in alignment with business objectives and risk appetiteCorrect
   ✓ Correct answer: D

   Enterprise risk management (ERM) is a structured, organization-wide process for identifying risks, assessing their likelihood and impact, prioritizing them, and selecting treatments (accept, avoid, transfer, or mitigate) that align with the business's objectives and stated risk appetite. The aim is informed, cost-effective decisions about which risks to address first, not blanket control coverage, so resources flow to the threats that matter most while residual risk stays within tolerance.

   Why the other options are wrong

   • AAsset cataloging supports risk management but is only an input, not the program's goal of assessing and treating risk against business objectives.
   • BEliminating all risk is neither achievable nor cost-effective; ERM manages risk to an accepted appetite rather than removing it entirely.
   • CMaximizing control count ignores cost-benefit and risk appetite, which is the opposite of prioritized, business-aligned risk treatment.
2. Question 2Security Engineering

   Which sshd_config directives best harden an SSH server against credential attacks?

   • AUsePAM no and ChallengeResponseAuthentication yes
   • BPermitEmptyPasswords yes and Protocol 1
   • CPasswordAuthentication yes and PermitRootLogin yes
   • DPasswordAuthentication no and PermitRootLogin noCorrect
   ✓ Correct answer: D

   Disabling password authentication forces key-based (or other non-password) authentication, eliminating brute-force and credential-stuffing attacks against SSH. PermitRootLogin no blocks direct root logins so an attacker must compromise a named account and then escalate privilege, adding an audit trail and a barrier. Together these directives close the two most common SSH credential-attack vectors. The other option pairs either enable weaker legacy behavior or leave password/root login fully open.

   Why the other options are wrong

   • A"UsePAM no" disables the PAM stack used for account lockout, MFA modules, and password policy enforcement, while "ChallengeResponseAuthentication yes" re-enables keyboard-interactive prompts that can still be brute-forced like passwords.
   • B"PermitEmptyPasswords yes" allows accounts with blank passwords to authenticate, and "Protocol 1" forces the obsolete SSH-1 protocol, which has broken cryptography and known man-in-the-middle vulnerabilities.
   • C"PasswordAuthentication yes" leaves the server open to brute-force and credential-stuffing attacks, and "PermitRootLogin yes" lets an attacker target the highest-privilege account directly instead of requiring privilege escalation.
3. Question 3Governance, Risk, and Compliance

   Before migrating regulated PII to a third-party SaaS platform, which document MUST define how the provider processes and protects that data?

   • AA service-level agreement that specifies platform uptime and response-time targets
   • BAn acceptable use policy governing how employees may use company systems
   • CA business continuity plan describing recovery of the SaaS platform after an outage
   • DA data processing agreement (DPA) with the processorCorrect
   ✓ Correct answer: D

   A data processing agreement (DPA) is the contractual instrument required under regimes like GDPR that specifically defines how a processor must handle, protect, and use personal data on the controller's behalf, including permitted processing purposes, subprocessor terms, breach-notification obligations, and data-return or deletion requirements. SLAs, AUPs, and BCPs govern performance, employee conduct, and outage recovery respectively, none of which address data protection obligations.

   Why the other options are wrong

   • AAn SLA covers uptime and response-time commitments, not how personal data is processed or protected.
   • BAn AUP governs employee use of internal systems, not a third-party processor's handling of customer data.
   • CA BCP addresses recovering platform availability after an outage, not data processing terms.
4. Question 4Governance, Risk, and ComplianceSelect all that apply

   A risk manager is preparing for a board presentation on cyber risk quantification. Select TWO inputs that are REQUIRED to calculate Single Loss Expectancy (SLE).

   • AAsset value (AV)Correct
   • BExposure factor (EF)Correct
   • CAnnual rate of occurrence (ARO)
   • DControl cost (CC)
   ✓ Correct answer: A, B

   SLE is calculated as SLE = AV x EF. Asset value represents the monetary worth of the asset, and the exposure factor represents the percentage of the asset's value expected to be lost in a single incident. ARO is used to calculate ALE (ALE = SLE x ARO), and control cost is an input to cost-benefit analysis, not to SLE itself.

   Why the other options are wrong

   • CAnnual rate of occurrence (ARO) is used to calculate ALE from SLE, not to calculate SLE itself.
   • DControl cost is used in cost-benefit analysis to compare the cost of a safeguard against the ALE it reduces; it is not an input to the SLE formula.
5. Question 5Security Architecture

   A security architect is asked to design a governance process for Shadow IT discovery and risk management. Which approach BEST addresses both discovery and ongoing risk governance?

   • ABlock all unapproved cloud services at the firewall and mandate that employees use only a fixed pre-approved tool list, reviewed just once at the start of each fiscal year regardless of any newly discovered business need
   • BDeploy a Cloud Access Security Broker (CASB) for discovery, integrate findings into the risk register, and establish a fast-track approval process for low-risk toolsCorrect
   • CSurvey department heads once a year and ask them to voluntarily self-report any unauthorized tool usage in their teams
   • DTerminate employees found using shadow IT applications so that the penalty deters any future policy violations
   ✓ Correct answer: B

   Shadow IT governance requires both technical discovery and process-level management. A CASB provides continuous, automated discovery of cloud service usage across the organization by inspecting network traffic, identifying sanctioned and unsanctioned services, and assessing risk scores based on vendor security posture. Integrating CASB findings into the risk register creates visibility for governance stakeholders. A fast-track approval process reduces the business pressure driving shadow IT adoption by giving teams a legitimate path to adopt low-risk tools quickly while maintaining governance oversight. This balanced approach is more sustainable than pure blocking, which drives usage underground.

   Why the other options are wrong

   • ABlanket blocking with only an annual list review drives shadow IT further underground and provides no ongoing discovery or fast-track path to approve legitimate new tools.
   • CAnnual self-reporting surveys are incomplete and quickly stale, so they fail to continuously discover shadow IT or govern its risk.
   • DPunitive termination discourages reporting and does nothing to discover unknown tools or manage their risk on an ongoing basis.
6. Question 6Security Engineering

   An engineer is choosing a post-quantum key-establishment approach to protect data with a long confidentiality lifetime against 'harvest now, decrypt later' attacks while remaining safe if either algorithm is later broken. Which design is BEST?

   • AA hybrid key exchange combining a classical ECDHE with a NIST-selected post-quantum KEM (e.g., ML-KEM)Correct
   • BMigrate the key exchange to 4096-bit RSA with OAEP padding and yearly certificate reissuance
   • CIncrease symmetric keys to AES-512 and rekey each session with a longer nonce
   • DRely solely on classical ECDHE perfect forward secrecy with frequent ephemeral rekeying
   ✓ Correct answer: A

   Hybrid key establishment combines the shared secrets of a well-vetted classical algorithm and a post-quantum KEM (ML-KEM, formerly Kyber), so an attacker must break both. This protects long-lived secrets from future quantum decryption of harvested traffic while hedging against immature PQC implementations. It is the current recommended migration approach.

   Why the other options are wrong

   • BRSA is itself broken by Shor's algorithm on a sufficiently large quantum computer, so a larger classical RSA key provides no quantum resistance for long-lived data.
   • CAES-512 is not a standard key size and symmetric key length does not defend the key-establishment step against harvest-now-decrypt-later capture of the exchanged keys.
   • DClassical ECDHE keys are recoverable by a future quantum adversary, so forward secrecy alone does not protect captured traffic once the elliptic-curve exchange is broken.
7. Question 7Security Operations

   A responder must capture volatile memory from a running Windows host before shutting it down. Which approach BEST preserves this evidence?

   • AUse a trusted memory-acquisition tool to capture a full RAM image to external write-protected media, recording a hashCorrect
   • BImmediately power off the compromised host to stop the attacker before any evidence collection begins
   • CReboot the machine into safe mode first so that malicious processes are cleared before imaging memory
   • DRun a full on-demand antivirus scan to quarantine active threats before attempting the memory capture
   ✓ Correct answer: A

   Memory is the most volatile evidence and is lost on power-off, so it must be acquired from the live system with a validated tool, written to external/write-protected media, and hashed to prove integrity. Following order of volatility, RAM acquisition precedes shutdown and disk imaging.

   Why the other options are wrong

   • BPowering off wipes volatile RAM, destroying the exact evidence the responder needs to preserve before shutdown.
   • CRebooting into safe mode clears memory contents, eliminating the running-state evidence rather than preserving it.
   • DAn antivirus scan alters and may remove in-memory artifacts, contaminating the evidence before it is acquired.
8. Question 8Security Architecture

   An enterprise wants to eliminate shared and standing administrative credentials. Admins should check out time-bound access to privileged accounts, all sessions should be recorded, and the underlying passwords should be rotated automatically after each use. Which architectural component provides these controls?

   • AA Privileged Access Management (PAM) solution with credential vaulting, just-in-time checkout, session recording, and password rotationCorrect
   • BAn identity governance and administration (IGA) platform running periodic access-certification and entitlement-review campaigns for all admins
   • CA self-service password reset portal that lets all users unlock accounts and reset their own credentials without help-desk involvement
   • DAn OAuth 2.0 authorization server issuing refresh tokens and access tokens to delegated client applications on behalf of users
   ✓ Correct answer: A

   A PAM platform removes standing admin access by storing privileged credentials in a vault, granting just-in-time time-limited checkout, recording the resulting sessions, and rotating the secret after each use - exactly the listed requirements.

   Why the other options are wrong

   • BIGA certification confirms whether access is still appropriate but does not vault credentials, broker just-in-time checkout, or rotate passwords after use.
   • CA self-service reset portal manages ordinary user passwords and provides none of the vaulting, session recording, or just-in-time privileged controls required.
   • DAn OAuth authorization server issues application tokens for delegated access and has nothing to do with vaulting or rotating privileged account passwords.
9. Question 9Security OperationsSelect all that apply

   A SOC lead wants to operationalize the diamond model and ATT&CK together when analyzing campaigns. Which TWO of the following correctly describe useful properties for structuring detection and intelligence analysis? (Choose two.)

   • AThe Diamond Model relates adversary, capability, infrastructure, and victim, helping pivot from one known element to discover othersCorrect
   • BATT&CK techniques can be tracked over time to measure how detection coverage changes against relevant adversary behaviorCorrect
   • CThe Diamond Model is a compliance checklist that certifies a SOC as audit-ready
   • DATT&CK assigns a single numeric severity score that replaces all other prioritization data the SOC would otherwise use to triage alerts
   ✓ Correct answer: A, B

   Knowing one Diamond feature (such as infrastructure) lets analysts pivot to uncover adversary, capability, or victim links. Mapping detections to ATT&CK techniques produces a coverage view that can be trended as the threat landscape and detection content evolve.

   Why the other options are wrong

   • CThe Diamond Model is an analytic framework for intrusion analysis, not a compliance certification checklist.
   • DATT&CK is a behavioral knowledge base, not a single severity score that supplants other prioritization inputs.
10. Question 10Security Architecture

    An organization runs workloads across AWS, Azure, and GCP and wants a single identity source with no long-lived cloud-specific credentials duplicated across providers. Which identity architecture BEST achieves this?

    • AFederate one enterprise IdP to each cloud via SAML/OIDC with short-lived identity federationCorrect
    • BCreate matching local user accounts with static access keys in each cloud and sync passwords nightly
    • CIssue every application one long-lived API key that is shared across all three cloud providers
    • DMaintain a separate directory service in each cloud and reconcile user access every quarter
    ✓ Correct answer: A

    Federating one enterprise identity provider to each cloud through SAML or OIDC, combined with workload identity federation for short-lived, token-based service access, keeps one authoritative identity source while eliminating standing cloud-specific secrets. Local account syncing, shared static keys, and siloed per-cloud directories all recreate duplicate credential stores that increase leak risk and drift out of sync between reconciliation cycles.

    Why the other options are wrong

    • BStatic access keys synced across directories are long-lived secrets that must be rotated and secured in three places, exactly what this design tries to avoid.
    • CA single shared long-lived API key across providers is a high-value target; compromise in one cloud grants access everywhere with no per-cloud accountability.
    • DSeparate directories with quarterly reconciliation are not a single identity source and leave windows where access is inconsistent or stale across clouds.

Who this CompTIA SecurityX (CAS-005, formerly CASP+) practice exam is for

This practice set is for anyone preparing for the CompTIA SecurityX (CAS-005, formerly CASP+) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA SecurityX (CAS-005, formerly CASP+) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA SecurityX (CAS-005, formerly CASP+) exam.

Related Security resources

• CompTIA SecurityX (CAS-005, formerly CASP+) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• EC-Council CEH (Certified Ethical Hacker) practice examRelated
• Fortinet NSE 4 - FortiOS Administrator practice examRelated
• Fortinet Secure Networking (FortiGate) practice examRelated

CompTIA SecurityX (CAS-005, formerly CASP+) practice exam FAQ