CompTIA SecurityX CAS-005 Exam Practice Test 4

A missing or broken trust relationship between an identity provider and a specific service provider is a federation configuration issue. MFA concerns a second authentication factor, PAM manages privileged credential lifecycle, biometrics use physical characteristics for authentication, and conditional access applies contextual policies rather than describing a fundamentally missing trust relationship between the identity provider and a service provider.

Correlating timestamps across multiple sources to piece together the exact sequence of events is timeline reconstruction. Root cause analysis determines why the incident occurred rather than sequencing when events happened, threat response concerns active containment and remediation actions, preparedness exercises test response capability proactively, and data recovery and extraction retrieves lost or damaged data rather than sequencing the incident timeline.

Data that exists only in memory and would be lost on power-off is volatile storage, and analyzing it is volatile storage analysis. Non-volatile storage analysis examines persistent storage like disks, metadata analysis examines embedded file metadata, hardware analysis examines physical device components, and network analysis examines traffic patterns rather than memory-resident artifacts.

Proactively searching for evidence supporting or refuting a specific theory about adversary behavior is a hypothesis-based search. Honeypots are decoy systems for detection, user behavior analytics baselines normal behavior to flag anomalies, internal reconnaissance gathers information about the organization's own environment, and adversary emulation engagements actively simulate attacker techniques rather than proactively testing a specific theory without waiting for an alert.

A function officially marked unsafe and scheduled for removal is a deprecated function, while writing beyond a fixed-size buffer's bounds into adjacent memory is an overflow. Race conditions concern timing-dependent bugs, weak ciphers concern cryptographic algorithm strength, and insecure configuration concerns misconfigured settings generally rather than either of these two specific code-level flaws.

A persistent display summarizing key performance metrics like alert resolution rates over time is a dashboard. Visualization generically covers any graphical representation, audit log reduction filters low-value log noise, event parsing structures raw log data, and correlation links related events together rather than describing this ongoing performance-tracking display.

Using a hardware-backed private key to prove identity without a memorized password is certificate-based authentication, a passwordless approach. Software provenance verifies the origin and integrity of software artifacts, non-repudiation only concerns proving an action cannot be denied after the fact, data anonymization removes identifying characteristics, and immutable databases prevent record alteration rather than describing hardware-backed passwordless identity proof.

Authenticated encryption with associated data combines encryption and integrity verification in a single operation, detecting tampering at decryption without a separate hashing step. Forward secrecy and homomorphic encryption address different cryptographic goals entirely.

Using generative AI to help write code and generate documentation is code assist. Auto-containment automatically isolates a threat, SCAP standardizes vulnerability and configuration checking, workflow automation generically describes broader automated processes, and SOAR runbooks execute fully automated incident response sequences rather than assisting with code writing and documentation generation.

Each sector carries a distinct specialized-systems challenge: utilities must protect grid availability, transportation must prevent safety-critical failures, healthcare must balance patching against certification and patient safety, manufacturing must protect proprietary processes, and government/defense must manage classification and clearance requirements.

A USB device reprogrammed to impersonate a keyboard and execute malicious commands upon connection is specifically a USB-based attack. Firmware tampering modifies a device's own firmware more broadly rather than specifically weaponizing USB peripheral behavior, shimming inserts malicious code between a driver and hardware, memory attacks target RAM contents, and EMI concerns electromagnetic interference rather than USB peripheral impersonation.

Two systems having no cipher suite in common due to mismatched supported cipher lists is a cipher mismatch. PKI issues generically concern certificate and key infrastructure problems broadly, resource exhaustion concerns capacity being overwhelmed, ACL issues concern access control list misconfigurations, and DoS/DDoS concern availability attacks rather than a negotiation failure due to incompatible cipher suite support.

MDM specifically enforces policies like remote wipe, app whitelisting, and encryption on mobile devices, both corporate-owned and personally owned. EDR focuses on threat detection and response rather than policy enforcement specifically, a host-based firewall filters network traffic, browser isolation runs browsing sessions in an isolated environment, and SELinux enforces mandatory access control on Linux systems rather than managing mobile device policy broadly.

Automatically linking specific controls to the regulatory requirements they satisfy is mapping. Automation reduces manual GRC workflow effort generally, and compliance tracking monitors ongoing adherence status over time, both distinct capabilities.

Defining a security boundary around specific sensitive data, independent of physical network location, is a data perimeter. Microsegmentation restricts lateral movement between workloads at the network level, always-on VPN provides persistent encrypted remote connectivity, continuous authorization re-evaluates access based on context, and deperimeterization concerns removing reliance on a fixed network boundary rather than defining a data-specific security zone.

Running infrastructure code changes through the same reviewed, automated pipeline as application code is applying CI/CD practices to infrastructure as code. Package monitoring tracks software dependencies for vulnerabilities, shadow IT detection identifies unsanctioned tool use, container orchestration manages containerized workload deployment, and serverless workloads describes a compute execution model rather than a change management pipeline practice.

Pre-configured certificate profiles for different use cases like web servers, code signing, and email encryption are certificate templates. OCSP stapling optimizes real-time revocation status checking, CA/RA separation divides issuance and registration duties, certificate extensions generically add metadata fields, and certificate revocation only concerns invalidating certificates rather than the pre-configured issuance profiles used to create them consistently.

Deciding where to deploy sensors at network chokepoints is sensor placement, while configuring automated notifications when patterns are observed is alerting. Centralized logging and continuous monitoring concern log aggregation and ongoing observation rather than sensor location and notification specifically, classification models and tagging strategies concern data sensitivity, DLP concerns preventing data loss, and vulnerability management and hardening concern reducing weaknesses rather than describing sensor placement and alert triggering.

Automatically checking dependencies against known vulnerability databases is software composition analysis. SAST analyzes the organization's own source code, IAST combines static and dynamic analysis during runtime, RASP protects a running application at runtime, and formal methods use mathematical proofs to verify correctness rather than checking third-party dependencies for known vulnerabilities.

Seamlessly continuing operations from a secondary location without manual intervention after a primary failure is recoverability. Interoperability concerns compatibility between different systems, vertical vs. horizontal scaling concerns how capacity is added, persistence vs. non-persistence concerns whether state is retained across sessions, and load balancing only distributes traffic across already-available resources rather than describing failover to an entirely separate data center.

Routing and securing API traffic to backend microservices is an API gateway, while caching and serving static content from geographically distributed edge locations is a CDN. A reverse proxy forwards requests more generally without a CDN's edge-caching focus, a WAF filters web application attacks specifically, and a load balancer distributes traffic across servers rather than describing either of these two specialized components.

Detecting use beyond the AI's sanctioned purpose relates to access/permissions scoping, while requiring clear notification that users are interacting with an AI is disclosure of AI usage. Guardrails constrain output content and DLP prevents data loss, overreliance and excessive agency describe human trust and AI autonomy risks respectively, prompt injection and model theft are attacks against the model itself, and sensitive information disclosure and model inversion concern data exposure and reconstruction rather than describing scope monitoring and usage transparency.

Considering how an acquisition changes the attack surface by bringing in a new subsidiary's environment is organizational change. Trust boundaries concern where differing trust levels meet within an architecture, code reviews examine source code for flaws, data flows map how information moves through a system, and user factors concern human behavior rather than describing organizational restructuring events like mergers or acquisitions.

A review conducted by the organization's own team is an internal audit, distinct from an external audit performed by an outside firm for independent assessment. Certification is a formal attestation of meeting a specific standard, a third-party compliance evaluation specifically assesses vendors, and cross-jurisdictional assessment concerns compliance across multiple legal jurisdictions rather than distinguishing who performs the review.

Formally agreeing on how much risk, such as a specific number of tolerable minor incidents, the organization will accept is risk appetite and tolerance. Risk prioritization ranks risks by importance, severity impact rates the consequences of a specific finding, risk assessment frameworks provide structured methodologies for evaluating risk, and validation confirms that remediation was effective rather than describing this formally agreed tolerance threshold.