CompTIA SecurityX CAS-005 Exam Practice Test 5

The scenario describes a legacy authentication protocol generally lacking modern MFA integration capability, a common IAM troubleshooting friction point when modernizing authentication. Kerberos, EAP, IEEE 802.1X, and OAuth are all specific named protocols listed in this objective, but the scenario as described is intentionally generic about which legacy protocol is involved, making the general gap itself the best answer rather than any one specific named protocol.

Automatically filtering out routine, low-value log entries before they reach analysts is audit log reduction. Correlation links related events together, trends track directional change over time, prioritization ranks which findings matter most, and event parsing breaks raw logs into structured fields rather than filtering out low-value noise specifically.

Reviewing an employee's own access patterns against normal behavior to assess anomalous internal activity is an insider threat investigation, while determining the actual underlying reason an incident was possible is root cause analysis. Timeline reconstruction sequences events chronologically, threat response concerns active containment actions, and preparedness exercises test response capability proactively rather than describing either of these two specific investigative activities.

Specifically monitoring underground forums and marketplaces for organization-relevant mentions is dark web monitoring. OSINT generically covers publicly available information more broadly, information sharing and analysis centers are industry collaboration bodies, reliability factors assess a source's trustworthiness, and counterintelligence concerns detecting adversary intelligence-gathering against the organization rather than proactively scanning underground marketplaces.

Making the server itself fetch content from an attacker-specified URL, potentially reaching internal-only resources, is server-side request forgery. Cross-site request forgery tricks a victim's browser into making unwanted requests using their own session, cross-site scripting injects malicious scripts, insecure configuration concerns misconfigured settings generally, and directory service misconfiguration concerns misconfigured directory services rather than a server making attacker-directed outbound requests.

Comparing current activity against an established normal pattern for that host, and flagging a significant deviation, is behavior baselines and analytics. Aggregate data analysis generically correlates and prioritizes data broadly, reporting and metrics visualize results, incorporating diverse data sources concerns pulling in varied log types, and alert failures concern alerts not firing correctly rather than describing the baseline-deviation detection itself.

Tokenization substitutes a non-sensitive value for sensitive data, code signing verifies software hasn't been tampered with, cryptographic erase destroys data by discarding its key, digital signatures prove authenticity and integrity using a private key, and hashing produces a one-way digest for integrity verification, each serving a distinct cryptographic purpose.

Evaluating resistance to quantum computing attacks and piloting newer resistant algorithms is post-quantum cryptography. Forward secrecy protects past sessions from future key compromise through an unrelated mechanism.

Automatically initiating a workflow the moment a new CVE is published, rather than waiting for a scheduled cycle, is an event-based trigger. Cron/scheduled tasks run at fixed time intervals regardless of new publications, auto-containment isolates an active threat, SCAP generically standardizes vulnerability and configuration checking, and container security concerns securing containerized workloads rather than this specific publication-triggered automation.

Public safety implications of a cyberattack against traffic control systems is specifically a transportation industry-specific challenge. Financial, healthcare, manufacturing, and government/defense sectors each face their own distinct specialized and legacy system challenges rather than this specific traffic-signal public safety concern.

Measured boot records cryptographic measurements of each boot stage for later remote verification, without necessarily halting the boot process itself. Secure Boot, by contrast, actively halts the boot process on a signature mismatch.

An overly restrictive access control list blocking legitimate traffic is an ACL issue. Routing errors concern incorrect path selection, switching errors concern Layer 2 forwarding issues, VPN/tunnel errors concern encrypted tunnel connectivity, and resource exhaustion concerns capacity being overwhelmed rather than a misconfigured permission list blocking legitimate traffic.

Gaining full administrative control from initial low-privileged access on the same machine is privilege escalation. Lateral movement concerns spreading to other systems rather than escalating on the same host, credential dumping extracts stored credentials, defensive evasion avoids detection, and unauthorized execution runs code without authorization, none of which specifically describe escalating from low to full privilege on one machine.

A database tracking systems, ownership, configuration, and relationships to support change management is a CMDB. Asset management life cycle is the broader process CMDB data supports, and inventory alone lists what exists without this relationship and configuration detail.

A highly restricted network zone housing the most sensitive systems, with only specifically authorized traffic permitted, is a secure zone. Data perimeters define boundaries around specific sensitive data rather than a network zone broadly, microsegmentation generically restricts lateral movement between workloads, system components refers to the assets within a boundary rather than the boundary itself, and always-on VPN provides persistent encrypted remote connectivity rather than defining a restricted internal zone.

CSPM continuously and automatically assesses cloud configuration against best practices, flagging drift like a newly created public storage bucket. A CASB focuses on cloud application usage visibility and policy enforcement rather than infrastructure configuration posture, container orchestration manages containerized workloads, an API gateway manages API traffic, and Terraform provisions infrastructure as code rather than continuously auditing existing configuration for drift.

Splitting identity verification from certificate issuance between separate entities is CA/RA separation, providing separation of duties. OCSP stapling optimizes real-time revocation checking, certificate templates standardize issuance profiles, certificate extensions add metadata fields, and deployment/integration approach concerns broader PKI rollout strategy rather than this specific division of verification and issuance responsibility.

Running periodic tests and tracking specific metrics over time to measure real-world control performance is assessments combined with metrics tracking. Classification models and labeling concern data sensitivity tagging, vulnerability management and hardening concern reducing weaknesses directly, sensor placement and alerting concern detection infrastructure, and DLP concerns preventing data loss rather than measuring how well existing controls are performing.

Runtime application self-protection is embedded within the application itself, using internal context to detect and block attacks in production. A WAF and IPS are external network-layer or perimeter defenses rather than embedded within the application, DAST tests a running application from the outside before production, and SAST analyzes source code statically rather than protecting the application at runtime from within.

Ensuring an application runs correctly across different provider environments without relying on proprietary features unique to one is interoperability. Persistence vs. non-persistence concerns state retention across sessions, vertical vs. horizontal scaling concerns capacity growth approach, geographical considerations concern physical resource placement, and recoverability only concerns restoring service after failure rather than cross-platform compatibility itself.

Shielding backend servers from direct exposure while forwarding inbound requests is a reverse proxy, while passively duplicating traffic without sitting inline is a tap. A forward proxy instead sits in front of clients rather than servers, a collector aggregates already-captured data, and an IPS sits inline and can actively block traffic rather than passively duplicating it.

Crafted input that bypasses a model's content policy entirely to produce explicitly prohibited output is a threat to the model, specifically circumventing its guardrails, closely related to jailbreaking. Overreliance describes human trust in AI output, legal and privacy implications generically covers broader ethical and policy concerns, excessive agency concerns an AI system acting beyond its intended scope, and model theft copies the model itself rather than bypassing its content restrictions.

Documenting a chained sequence of steps from initial foothold to final objective is an attack tree or graph. Abuse cases describe how a system could be misused from a user-interaction perspective, antipatterns document known bad design practices to avoid, enumeration/discovery identifies assets and accounts, and actor characteristics profile adversary motivation and capability rather than mapping a specific multi-step compromise path.

Legal restrictions on transferring encryption technology across borders are export controls. Due care concerns reasonable ongoing protective action, legal holds suspend data destruction for litigation purposes, contractual obligations concern agreement-based requirements, and e-discovery concerns identifying and producing electronic evidence for litigation rather than cross-border technology transfer restrictions.

Coordinating notification timelines, forensic scope, and remediation after unauthorized access to sensitive records is breach response specifically. Crisis management addresses broader organizational disruption beyond just a data breach, impact analysis models potential scenarios before they occur, third-party risk management addresses vendor and supply chain risk, and confidentiality risk considerations generically is the broader category breach response is a specific activity within.