SecurityX Practice Test: Can You Pass CAS-005?

1. In the context of data loss prevention (DLP), what is the primary objective?

To monitor all network traffic for malware

To prevent unauthorized access to and transmission of sensitive data

To encrypt all data at rest

To delete old files automatically

2. Which security principle ensures that no single individual can compromise a critical system or process?

Defense in depth

Separation of duties

Security through obscurity

Principle of least privilege

3. What is the primary purpose of security awareness training in an organization?

To replace technical security controls

To educate employees on security risks and best practices to reduce human error

To identify and terminate employees who fail training

To comply with marketing requirements

4. In security governance, what does a risk assessment determine?

Which employees should be hired

The likelihood and impact of potential threats to organizational assets

The cost of security tools

The physical location of data centers

5. Which type of vulnerability is exploited when an attacker tricks a user into revealing sensitive information?

Technical vulnerability

Social engineering vulnerability

Configuration vulnerability

Cryptographic vulnerability

6. What is the primary benefit of implementing a security operations center (SOC)?

To reduce IT hardware costs

To provide centralized monitoring, detection, and response to security incidents

To eliminate the need for firewalls

To train employees on password management

7. Which of the following is a primary characteristic of a distributed denial-of-service (DDoS) attack?

Uses a single source to overwhelm a target

Uses multiple compromised systems to flood a target with traffic

Targets only financial institutions

Requires physical access to network equipment

8. In multi-factor authentication (MFA), what does the 'factor' refer to?

The number of login attempts allowed

A distinct method or category of authentication credential

The time interval for session timeout

The encryption algorithm used

9. What is the primary function of a security baseline?

To document the minimum security standards for systems and applications

To eliminate all security risks

To assign security responsibilities

To measure employee security training effectiveness

10. Which security control type is designed to prevent a security incident from occurring?

Detective control

Preventive control

Corrective control

Compensating control

11. Which framework is most commonly used to manage and mitigate cybersecurity risk across an organization?

NIST Cybersecurity Framework

ISO 27001

COBIT

CIS Controls

12. What is a key difference between vulnerability assessment and penetration testing?

Vulnerability assessment is more invasive and exploits vulnerabilities

Penetration testing identifies weaknesses; vulnerability assessment exploits them

Vulnerability assessment identifies weaknesses; penetration testing attempts to exploit them

They are identical processes

13. Which cryptographic algorithm is primarily used for asymmetric encryption?

AES

RSA

SHA-256

DES

14. What does the principle of least privilege (PoLP) enforce?

Users receive maximum access rights

Users are granted only the minimum access necessary to perform their job

Administrators have unrestricted access

Access rights cannot be revoked

15. In incident response, what is the primary objective of the containment phase?

To restore systems to normal operation

To prevent the incident from spreading or worsening

To investigate the root cause

To communicate with law enforcement

16. Which access control model allows permissions based on user attributes or characteristics?

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

Mandatory Access Control (MAC)

17. What is the primary goal of threat modeling?

To eliminate all possible security threats

To identify, prioritize, and mitigate potential security vulnerabilities

To predict which threats will occur

To assign blame for security breaches

18. Which of the following best describes a supply chain attack?

An attack targeting a vendor to gain access to their customers

An attack on physical shipping infrastructure

An attack on retail point-of-sale systems

An attack on manufacturing equipment

19. In zero-trust security architecture, what is the foundational principle?

Trust all internal network traffic by default

Never trust, always verify—regardless of network location

Perimeter security is sufficient protection

Trust is based on user seniority

20. What is the primary purpose of a security information and event management (SIEM) system?

To encrypt all network traffic

To collect, correlate, and analyze security logs from multiple sources

To replace firewalls and intrusion detection systems

To manage user passwords and authentication