CompTIA SecurityX CAS-005 Exam Practice Test 2

Restricting authentication based on the geographic region the request originates from is the geographic location conditional access factor. User-to-device binding ties an identity to a specific approved device, time-based access restricts login to certain hours, configuration-based access considers device or system settings, and biometrics use physical characteristics for authentication rather than geographic origin.

Allow listing permits only pre-approved applications to execute and blocks everything else by default. Defense-in-depth layers multiple independent controls rather than a single execution-control list, least privilege limits granted permissions to the minimum needed, input validation checks incoming data for correctness, and output encoding prevents injection by encoding outgoing data rather than controlling which applications may run.

Examining embedded metadata within a file, such as GPS coordinates and device model in an image, is metadata analysis. Malware analysis examines malicious code behavior, hardware analysis examines physical device components, network analysis examines traffic patterns, and volatile storage analysis examines data in memory rather than embedded file metadata.

A honeynet is a decoy network segment populated with fabricated assets specifically to detect and study attacker behavior. Adversary emulation engagements actively simulate real attacker techniques against production systems, hypothesis-based searches proactively test specific theories about compromise, user behavior analytics baseline normal behavior to flag anomalies, and internal reconnaissance gathers information about the organization's own environment rather than deploying a decoy segment.

A confused deputy vulnerability occurs when a privileged program is tricked by untrusted input into misusing its own legitimate authority on the attacker's behalf. TOCTOU concerns a timing gap between checking and using a resource, and deserialization exploits unsafe object reconstruction, both distinct mechanisms.

Visually correlating multiple data trends together for quick at-a-glance insight is visualization, a reporting and metrics concept. Audit log reduction filters out low-value log noise, retention concerns how long data is stored, event parsing concerns how raw logs are broken down into structured fields, and non-reporting devices refers to sources that have stopped sending logs rather than describing this visual correlation dashboard.

Code signing cryptographically signs software releases so recipients can verify integrity and authenticity before installation. Tokenization substitutes sensitive data values, serialization converts data structures into a storable or transmittable format, a one-time pad is a theoretically unbreakable symmetric cipher using a single-use key, and lightweight cryptography is designed for resource-constrained devices rather than describing software release integrity verification specifically.

Envelope encryption wraps a data encryption key with a separate key-encrypting key, allowing the data key to be safely stored with the encrypted data while the key-encrypting key stays protected separately. Key stretching strengthens weak passwords, homomorphic encryption allows computation on encrypted data, forward secrecy protects past sessions from future key compromise, and secure multiparty computation allows joint computation without revealing individual inputs, none of which describe this layered key-wrapping structure.

Triggering automatically whenever new data is published, rather than on a fixed schedule, is an event-based trigger. Cron/scheduled tasks run at fixed time intervals regardless of new data, infrastructure as code provisions infrastructure through code, configuration files store settings in formats like YAML or JSON, and workflow automation generically describes the broader automated process rather than this specific event-driven activation mechanism.

A system that cannot be patched because the vendor no longer exists is specifically unsupported. Highly constrained refers to limited processing or memory resources, obsolete refers to outdated technology generally, unable to secure is a broader characteristic that unsupported status is one specific cause of, and regulatory refers to compliance-driven challenges rather than vendor discontinuation specifically.

Secure Boot cryptographically verifies each boot stage and halts the process if a signature does not match, preventing unauthorized code from executing during startup. Measured boot instead records boot stage measurements for later attestation without necessarily halting the boot itself, self-healing hardware automatically recovers from faults, tamper detection identifies physical interference, and virtual hardware describes emulated hardware components rather than this signature-verification boot process.

A configuration gradually diverging from its documented baseline due to undocumented manual changes over time is configuration drift. Routing errors refer to specific incorrect routing decisions, switching errors concern Layer 2 switching issues, insecure routing concerns routing protocols lacking proper security, and VPN/tunnel errors concern encrypted tunnel connectivity issues rather than this gradual baseline divergence.

These five TTPs represent distinct techniques threat actors use across a compromised endpoint: injections insert malicious input, credential dumping extracts stored secrets, unauthorized execution runs code without permission, lateral movement spreads across the network, and defensive evasion specifically avoids detection.

Standards define specific, measurable requirements, such as exact password complexity rules, distinct from high-level policy statements. Policies set broad intent, procedures document step-by-step execution, and guidelines offer recommended but non-mandatory practices.

Continuous authorization re-evaluates whether access should still be granted based on current context, even for an already-authenticated session, exactly as described. Deperimeterization concerns removing reliance on a fixed network boundary, microsegmentation restricts lateral movement between workloads, asset attestation verifies device identity and state, and API integration and validation concerns securing API-level interactions rather than this ongoing re-verification of an active session.

Serverless computing runs short-lived, event-driven functions that automatically scale to zero without the customer managing underlying servers. Containerization still involves managing container images and often underlying orchestration, infrastructure as code provisions infrastructure through code rather than describing the execution model itself, a CASB provides cloud visibility and policy enforcement, and package monitoring tracks software dependencies rather than describing this specific compute execution model.

OCSP stapling allows a server to attach proof of current certificate validity to the TLS handshake, avoiding separate revocation list downloads, while certificate extensions add metadata fields specifying permitted key usages and validation details. CA/RA separation divides issuance and registration duties, certificate templates standardize issuance profiles, and deployment/integration approach concerns broader rollout strategy rather than these two specific certificate mechanics.

Sending all logs to a single location is centralized logging, while automatically flagging unusual spikes or gaps is continuous monitoring, together forming a core detection and threat-hunting enabler pairing. Sensor placement and alerting concern where monitoring points are physically or logically placed and how detected issues are surfaced, classification models and labeling concern data sensitivity tagging, vulnerability management and hardening concern reducing weaknesses, and DLP concerns preventing data loss rather than describing centralized log aggregation and anomaly flagging.

Blocking direct merges to a protected branch without required review and passing tests is branch protection. Canary testing gradually rolls out changes to a small subset of users, regression testing checks that changes don't break existing functionality, coding standards and linting enforce style consistency, and continuous improvement is a broader ongoing practice rather than this specific merge-gating mechanism.

DAST tests a running application from the outside by sending crafted requests and observing responses, without needing source code access. SAST analyzes source code directly without running the application, IAST combines static and dynamic analysis during runtime with instrumentation, RASP protects an application at runtime rather than testing it during development, and formal methods use mathematical proofs to verify correctness rather than sending test requests.

A forward proxy sits between internal clients and external destinations, forwarding requests on the client's behalf while hiding their identity and enabling centralized filtering and caching. A reverse proxy instead sits in front of servers to protect them from external clients, an API gateway manages API traffic specifically, a CDN caches and distributes content geographically, and a tap passively captures traffic for monitoring rather than actively forwarding client requests.

An AI system taking autonomous action far beyond its intended function, such as forwarding a confidential document, is excessive agency. Overreliance describes humans trusting AI output too much rather than the AI acting beyond its scope, sensitive information disclosure to the model concerns data being fed into the model rather than autonomous action taken by it, model denial of service targets availability, and insecure plug-in design concerns architectural flaws in an integrated plug-in rather than over-permissioned autonomous capability.

Stealing intellectual property to benefit a foreign government's interests is espionage, a distinct motivation from direct financial gain. Financial motivation seeks direct monetary benefit, geopolitical motivation concerns broader state-level political objectives, activism concerns ideological causes, and notoriety concerns seeking recognition or fame rather than covert intelligence gathering for a foreign government.

Accounting for requirements unique to a specific sector like healthcare is awareness of industry-specific compliance. Industry standards and security/reporting frameworks apply more broadly across sectors, privacy regulations generically cover personal data protection rather than sector-specific rules, and cross-jurisdictional compliance concerns operating across multiple legal jurisdictions rather than sector-specific requirements.

Applying the technical fix is remediation, while the follow-up scan confirming the fix actually worked is validation. Risk prioritization ranks which risks to address first, severity impact rates a finding's consequences, and risk assessment frameworks provide structured evaluation methodologies, none of which describe these two sequential closing-out steps.