CompTIA SecurityX CAS-005 Exam Practice Test 3

SAML assertions include time-bound validity windows, so clock skew between identity provider and service provider commonly causes assertions to be rejected as expired even when freshly issued. OAuth concerns authorization delegation rather than SAML's specific assertion timing, Kerberos uses its own separate ticket timing mechanism, PAM manages privileged credential lifecycle, and EAP is a broader authentication framework rather than the specific SAML assertion timing issue described.

An ISAC is a sector-specific organization facilitating threat indicator and best-practice sharing exclusively among member organizations within an industry, such as financial services. OSINT refers to publicly available information broadly, dark web monitoring watches underground forums, a threat intelligence platform is a tool for managing intelligence data rather than the sharing community itself, and reliability factors assess a source's trustworthiness rather than describing this sector-specific sharing body.

Disassembling a binary into assembly instructions to understand its behavior without executing it is reverse engineering. Sandboxing executes the sample in an isolated environment, which this scenario specifically avoids due to suspected sandbox evasion, metadata analysis examines embedded file metadata, volatile storage analysis examines memory, and network analysis examines traffic patterns rather than static code disassembly.

Weighing a feed's historical timeliness, accuracy, and corroboration is assessing reliability factors, while actively detecting and preventing adversary intelligence-gathering against the organization is counterintelligence and operational security. OSINT refers to publicly available information broadly, dark web monitoring watches underground forums, and threat intelligence platforms manage intelligence data rather than describing either of these two specific practices.

Directly embedding untrusted input into a query string without sanitization, allowing an attacker to alter query logic, is an injection vulnerability. Cross-site scripting injects malicious scripts into content viewed by other users rather than database queries, a race condition is a timing-dependent bug, insecure configuration concerns misconfigured settings generally, and weak ciphers concern cryptographic algorithm strength rather than unsanitized query construction.

Ingesting bounty submissions, third-party reports, and CSPM data alongside internal logs is incorporating diverse data sources. Behavior baselines and analytics establish normal patterns to flag deviations, aggregate data analysis correlates and prioritizes already-collected data, alerting prioritization factors rank which alerts matter most, and reporting and metrics visualize results rather than describing the act of pulling in varied external and internal data sources.

Cryptographic erase destroys data by irrecoverably discarding the encryption key, rendering the encrypted data permanently unreadable without physically destroying the drive. Data sanitization generically covers a broader range of destruction methods, data anonymization removes identifying characteristics rather than destroying data entirely, serialization converts data structures into a storable format, and obfuscation makes data harder to interpret rather than cryptographically rendering it permanently unreadable.

Homomorphic encryption computes on still-encrypted data, key splitting divides a key among multiple holders, secure multiparty computation lets parties jointly compute without revealing inputs, forward secrecy protects past sessions from a future key compromise, and envelope encryption wraps a data key with a separate key-encrypting key, each addressing a distinct cryptographic goal.

Using a tool like Ansible to automatically apply a standard configuration baseline to new infrastructure is infrastructure as code. Cron/scheduled tasks run at fixed time intervals rather than on provisioning events, generative AI code assist helps write code interactively, SCAP standardizes vulnerability and configuration checking rather than provisioning configuration itself, and workflow automation generically describes the broader capability rather than this specific configuration-as-code approach.

Isolating OT networks from corporate IT specifically to prevent cross-contamination is segmentation. Aggregation concerns combining data from multiple sources, hardening reduces a system's attack surface directly, data analytics concerns analyzing collected data, and environmental considerations concern physical conditions like temperature rather than network isolation specifically.

A TPM is embedded directly in a device's motherboard and securely generates and stores disk encryption keys while supporting boot integrity verification for that specific device. An HSM, by contrast, is a separate dedicated device typically serving multiple servers.

SPF publishes a DNS record listing which mail servers are authorized to send email on a domain's behalf, and a missing or incorrect entry causes legitimate mail to fail authentication. DKIM cryptographically signs message content rather than listing authorized servers, DMARC builds policy on top of SPF and DKIM results, S/MIME encrypts and signs individual email content, and DNSSEC secures DNS record integrity generally rather than authorized-sender lists specifically.

Modifying or clearing logs specifically to hinder forensic investigation is defensive evasion. Lateral movement concerns spreading to other systems, privilege escalation gains higher-level access, unauthorized execution runs code without authorization, and credential dumping extracts stored credentials, none of which describe tampering with logs to cover tracks.

Running phishing simulations, social media safety reminders, and tracking training completion is specifically the awareness and training component of security program management. Management commitment concerns leadership's visible support, communication and reporting are broader program elements, and a RACI matrix clarifies roles rather than describing the training and awareness activities themselves.

Requiring every API call, including internal ones, to be authenticated, authorized, and validated without implicit network-based trust is API integration and validation. Deperimeterization, continuous authorization, and microsegmentation are related but distinct zero trust concepts addressing perimeter reliance, session re-verification, and network-level workload isolation respectively, and security boundaries define zones rather than describing this specific call-by-call API validation requirement.

A CWPP continuously monitors running cloud workloads, including containers, for exploits, malware, and misconfigurations. A CASB provides visibility and policy enforcement over cloud application usage rather than workload-level runtime protection, an API gateway manages API traffic, SD-WAN optimizes wide area network connectivity, and Terraform provisions infrastructure as code rather than continuously monitoring runtime workload security.

Trusting an identity across separate external organizations is federation, while granting access across multiple internal applications after one login is single sign-on. Attestation verifies device or system state, conditional access applies contextual policies, and provisioning concerns account creation rather than describing either of these two trust-extension mechanisms.

Defining sensitivity categories like public, internal, confidential, and restricted is a classification model, while applying automated tags reflecting those categories is data labeling. DLP concerns preventing data loss at various states, vulnerability management and hardening concern reducing weaknesses, assessments and scanning concern control effectiveness testing, and legacy components and defense-in-depth concern architecture design rather than sensitivity classification and tagging specifically.

A specific measurable performance target like transactions per second is a non-functional requirement, describing how well the system performs rather than what it does. A functional requirement describes specific features or behaviors the system must have, a security vs. usability trade-off weighs competing priorities, a formal method mathematically verifies correctness, and a coding standard governs code style rather than describing a performance target.

Serving users from geographically proximate infrastructure to reduce latency and address data residency is geographical considerations. Vertical scaling concerns single-server resource upgrades, persistence concerns state retention across sessions, interoperability concerns compatibility between systems, and recoverability concerns restoring service after failure rather than geographic placement of infrastructure.

A network tap passively duplicates traffic for monitoring without sitting inline in the traffic path, so its failure does not disrupt flow. A reverse proxy and IPS both sit inline and can disrupt traffic if they fail, NAC controls device network admission, and a collector aggregates already-captured data rather than passively duplicating live traffic at the wire level.

A structural flaw in a plug-in's own construction allowing arbitrary command execution is insecure plug-in design. Prompt injection manipulates the model's instructions through crafted input rather than exploiting a plug-in's code flaw directly.

Reviewing architecture, data flows, and code specifically to identify every potential attacker interaction point is attack surface determination. Actor characteristics profiling assesses adversary motivation and capability, enumeration/discovery is one specific technique within attack surface determination rather than the whole activity, modeling applicability applies threats to a specific environment, and abuse case development is a threat modeling method distinct from surface determination itself.

A legal hold suspends normal data destruction schedules for records that may be relevant to ongoing or anticipated litigation. Due diligence concerns reasonable investigation before a decision, due care concerns reasonable ongoing protective action, export controls restrict cross-border transfer of controlled technology, and contractual obligations concern agreement-based requirements rather than litigation-driven retention specifically.

Risk introduced by a vendor's own downstream subcontractor is specifically subprocessor risk. Supply chain risk is the broader category covering the full chain of suppliers, vendor risk concerns the primary vendor relationship directly, and availability and confidentiality risk concern different risk dimensions rather than this specific subcontractor relationship.