CompTIA SecurityX CAS-005 Exam Practice Test 1

PAM specifically brokers and manages temporary, time-limited elevated credential checkout rather than standing privileges. SSO consolidates authentication across applications, federation extends identity across organizational boundaries, MFA adds a second authentication factor, and conditional access applies contextual policies rather than managing privileged credential lifecycle specifically.

JTAG is a standardized hardware debugging interface allowing direct extraction of data from a device's memory chip at the hardware level, used when normal software-based extraction is not possible. Code stylometry analyzes coding style for malware attribution, byte code analysis examines compiled intermediate code, sandboxing safely executes suspicious code in isolation, and timeline reconstruction sequences events chronologically rather than describing hardware-level extraction.

STIX is the standardized format for structuring threat intelligence data, while TAXII is the protocol used to transmit that structured data between platforms. YARA and Snort are rule-based languages for identifying malware and network patterns respectively, and Sigma is a rule-based language for SIEM detection rules, none of which describe the data format or transmission protocol itself.

TOCTOU is the specific vulnerability where a gap between checking a condition and acting on it allows an attacker to change state in between, exactly as described. A race condition is the broader category TOCTOU is a specific instance of, a confused deputy tricks a privileged program into misusing its authority, deserialization exploits unsafe object reconstruction, and directory service misconfiguration concerns misconfigured directory services rather than this timing gap.

The asset type and criticality factor accounts for the same vulnerability carrying far more organizational risk on a primary customer database than a non-critical test server. Data classification concerns data sensitivity specifically, residual risk concerns risk remaining after controls, impact alone doesn't fully explain prioritization without factoring in which asset is affected, and alert failure rate concerns whether alerts fire correctly rather than which asset matters more.

A rule consistently flagging benign, legitimate activity as malicious is a false positive. Event duplication refers to the same event being logged multiple times, a non-reporting device has stopped sending logs, retention gap concerns log storage duration, and audit log reduction filters low-value log noise rather than describing an inaccurate correlation rule.

Tokenization replaces sensitive data with a non-sensitive substitute while keeping the real value in a separate secured vault. Hashing produces a one-way irreversible digest rather than a reversible vault-linked substitute, obfuscation makes data harder to interpret without this vault structure, data anonymization removes identifying characteristics permanently, and cryptographic erase destroys data by discarding its encryption key.

Forward secrecy ensures session keys are derived so a future compromise of the long-term private key cannot retroactively decrypt previously captured sessions. Key stretching strengthens weak passwords, envelope encryption wraps a data key with a key-encrypting key, homomorphic encryption allows computation on encrypted data, and secure multiparty computation lets parties jointly compute without revealing inputs, none of which protect past sessions from a future key compromise.

A runbook is a fully automated, scripted sequence executed without human intervention, while a playbook documents recommended steps for a human analyst to follow manually. Workflow automation is the broader enabling capability, event-based triggers initiate either type of response, and infrastructure as code concerns provisioning infrastructure rather than incident handling procedures.

SCADA specifically describes the centralized supervisory system collecting real-time telemetry and enabling centralized remote monitoring and control, a specific type of ICS. ICS is the broader umbrella category, OT is an even broader category covering all operational technology, HVAC refers specifically to climate control systems, and IoT refers to broadly networked smart devices rather than this specific centralized grid supervisory system.

An HSM is a dedicated, tamper-resistant hardware device separate from individual endpoints, built for high-volume enterprise cryptographic operations like a certificate authority. A TPM is embedded in a single endpoint, a vTPM is a virtualized software emulation, a secure enclave is an isolated execution environment within a single processor, and CPU security extensions provide processor-level features rather than standalone high-volume hardware.

DNSSEC cryptographically signs DNS records so resolvers can verify authenticity and detect tampering, directly preventing forged response injection. DNS sinkholing redirects malicious traffic, zone transfers replicate DNS data between servers, DNS poisoning is the attack this defends against, and DMARC concerns email authentication rather than DNS record integrity.

EDR continuously monitors endpoint behavior, retains detailed telemetry, and can actively respond, such as isolating a compromised host. HIDS primarily detects rather than actively responds, a host-based firewall filters traffic to and from the host, anti-malware focuses on known malicious signatures, and SELinux enforces mandatory access control policies on Linux rather than providing this broader detection-and-response capability.

A RACI matrix specifically documents who is Responsible, Accountable, Consulted, and Informed for a given process or decision, exactly matching the need to clarify decision ownership and consultation. COBIT and ITIL are broader governance frameworks, a CMDB inventories configuration items, and a GRC tool is a platform category rather than the specific role-clarification technique itself.

Microsegmentation creates fine-grained, workload-level policies restricting lateral movement between individual servers, well beyond traditional subnet or VLAN-level segmentation. Macrosegmentation is not the standard term here, always-on VPN concerns persistent encrypted remote connectivity, SASE is a broader converged framework, and deperimeterization concerns removing reliance on a fixed perimeter rather than fine-grained internal policy.

A CASB sits between users and cloud services to provide visibility into cloud usage, including shadow IT detection, and enforces data security policies on that traffic. SASE is a broader converged framework, SD-WAN optimizes WAN connectivity, a container orchestration platform manages containerized workloads, and an API gateway manages API traffic rather than broad cloud application visibility.

Attribute-based access control evaluates a combination of dynamic attributes together at the moment of access. Role-based access control assigns permissions strictly by role, mandatory access control enforces fixed centralized labels without this dynamic multi-attribute evaluation, discretionary access control lets owners assign permissions directly, and rule-based access control applies static predefined rules rather than combining multiple contextual attributes dynamically.

Defense-in-depth layers multiple independent controls so defeating any single one does not grant full access. Attack surface reduction minimizes exposed entry points rather than layering controls, hardening secures individual systems, legacy component isolation addresses outdated systems specifically, and control effectiveness measures existing control performance rather than describing the layered design.

An SBoM is the formal, itemized inventory of every component in a piece of software, provided for independent supply chain risk assessment. SAST/DAST identify vulnerabilities through testing rather than inventorying components, and formal methods documentation concerns mathematical verification of correctness rather than component inventory.

Horizontal scaling adds more instances to distribute load, exactly as described. Vertical scaling instead increases resources of a single existing server, persistence concerns whether state is retained across sessions, geographical considerations concern physical resource location, and interoperability concerns compatibility between systems.

A web application firewall specifically inspects and filters HTTP/HTTPS traffic for application-layer attacks like SQL injection and XSS. An IPS operates more broadly across network traffic, NAC controls device network admission, a VPN provides encrypted tunneling, and a reverse proxy forwards requests without itself specializing in application-layer attack filtering.

Corrupting data used for future training is training data poisoning, while reconstructing approximations of original training data through repeated queries is model inversion. Model theft copies the model itself, model denial of service exhausts availability, and insecure output handling fails to validate output before downstream use rather than describing either threat here.

The Diamond Model explicitly maps relationships between adversary, capability, infrastructure, and victim, while STRIDE categorizes software threats into six named categories including spoofing and tampering. The Cyber Kill Chain models sequential attack stages, MITRE ATT&CK catalogs real-world adversary techniques, and CAPEC catalogs common attack patterns rather than describing either the four-element intrusion model or the six-category threat taxonomy.

GDPR protects EU residents' data, CCPA protects California residents specifically, LGPD is Brazil's counterpart data protection law, and COPPA specifically protects children's online privacy in the US, each operating within a distinct jurisdictional or demographic scope.

Quantitative analysis expresses risk in concrete numerical terms, such as an annualized loss expectancy in dollars, allowing direct comparison across risks. Qualitative analysis instead uses relative categories like high/medium/low, risk appetite setting defines tolerable risk levels rather than calculating cost, and severity impact scoring and third-party risk management are different, narrower risk activities.