CompTIA CASP+ Practice Test

1. Which framework is most appropriate for conducting a comprehensive risk assessment across an enterprise infrastructure?

NIST Risk Management Framework (RMF)

ISO 27001 only

COBIT 5 exclusively

ITIL v3 Service Design

2. In asymmetric cryptography, what is the primary advantage of using a digital certificate?

Faster encryption speed than symmetric algorithms

Verifies the identity of the public key owner and ensures authenticity

Eliminates the need for key management

Reduces computational overhead on servers

3. Which of the following best describes the principle of least privilege in access control?

Granting all users administrative rights by default

Users receive only the minimum permissions necessary to perform their job functions

Allowing unrestricted access to critical systems

Implementing biometric authentication for all users

4. What is the primary purpose of a Security Information and Event Management (SIEM) system?

To encrypt all network traffic

To collect, correlate, and analyze security logs and events in real time

To replace firewalls in network defense

To manage user password resets

5. In the context of threat modeling, what does the STRIDE methodology stand for?

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Security, Threats, Risk, Implementation, Detection, Enforcement

Scanning, Testing, Reconnaissance, Intrusion, Detection, Exploitation

Standards, Techniques, Requirements, Implementation, Deployment, Evaluation

6. Which authentication method combines something you know, something you have, and something you are?

Single-factor authentication

Two-factor authentication

Multi-factor authentication

Biometric authentication

7. What is the main benefit of implementing defense in depth in enterprise security architecture?

Reduces the need for security training

Ensures no single point of failure compromises the entire system

Eliminates the need for incident response plans

Provides cost savings through consolidated security tools

8. In Public Key Infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?

Encrypts all network traffic automatically

Issues, validates, and revokes digital certificates

Manages firewall rules

Monitors user activity logs

9. Which control type is designed to detect and respond to security incidents after they occur?

Preventive control

Detective control

Corrective control

Compensating control

10. What is the primary objective of security baseline configuration in enterprise environments?

To maximize system performance

To establish a consistent, hardened starting point for all systems

To simplify user access requests

To reduce software licensing costs

11. In cryptographic key management, what does key rotation refer to?

Physically moving encryption keys between storage locations

Periodically replacing old keys with new ones to reduce exposure risk

Rotating backup tapes containing encrypted data

Changing the encryption algorithm used

12. Which framework provides guidance on secure software development practices?

OWASP Top 10 and NIST Secure Software Development Framework (SSDF)

ISO 9001 only

ITIL Service Transition exclusively

COBIT Governance Framework

13. What is the purpose of a Business Continuity Plan (BCP) in enterprise security?

To prevent all security breaches

To ensure critical business functions continue during and after disruptions

To replace disaster recovery planning

To manage employee training programs

14. In identity and access management, what does SSO (Single Sign-On) enable?

Users authenticate once to access multiple systems or applications

Multiple users share a single account

Passwords are stored in plaintext for convenience

Administrative access is granted to all employees

15. Which of the following is a key consideration when designing a secure cloud architecture?

Storing all data in a single cloud region

Implementing encryption, access controls, and shared responsibility model understanding

Disabling all logging and monitoring

Granting unlimited permissions to cloud administrators