CAS-005 practice questions

Q: Is this CAS-005 practice test free?

Yes. All 15 CAS-005 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real CAS-005 exam cost?

The official price is $544. Cyber VK sells the same official CAS-005 voucher for $224.99 — a saving of $319.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real CAS-005 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

Which of the following BEST describes the primary purpose of a Software Bill of Materials (SBOM) in an enterprise software supply chain program?

Accepted Answer

An SBOM is an inventory of software components and their dependencies, which lets an organization map its deployed software against vulnerability feeds. Build attestations, DAST results, and patch SLAs are separate supply chain artifacts or contract terms.

Question 2

An organization must retain transaction records for seven years to satisfy a financial regulation, but its privacy policy commits to deleting customer data after two years. Which governance concept describes the situation the security architect must resolve?

Accepted Answer

Two binding obligations impose incompatible retention periods, so the architect must document the conflict and formally reconcile it through an exception or scoped carve-out. Sovereignty concerns geography, classification drift concerns labeling accuracy, and separation of duties concerns role assignment.

Question 3

A multinational company processes EU resident data in a US-hosted SaaS platform. Regulators require that the company demonstrate ongoing accountability for the processor's controls, not merely a one-time contractual clause. Which combination MOST directly satisfies this requirement?

Accepted Answer

Ongoing accountability for a processor is demonstrated through transfer mechanisms combined with recurring assurance activities such as audits and continuously refreshed attestation reports. Encryption, CMDB entries, and point-in-time tests are controls or artifacts but do not evidence continuous oversight of the processor.

Question 4

Which architectural control is MOST effective at preventing lateral movement between workloads inside a single data center subnet?

Accepted Answer

Microsegmentation applies policy between workloads regardless of shared subnet, blocking east-west traffic that never crosses a perimeter device. Perimeter firewalls only see north-south flows, 802.1X governs port admission, and disk encryption protects data at rest.

Question 5

An architect is designing a zero trust access model for contractor access to an internal application. Access must be evaluated continuously rather than only at login, and device posture must influence the decision. Which component is responsible for making the allow/deny determination at each request?

Accepted Answer

In a zero trust architecture, the PDP evaluates identity, device posture, and context signals to render the access decision, while the PEP simply enforces that decision on the traffic path. The IdP supplies authentication assertions as one input, and the SWG is a specific enforcement product.

Question 6

A financial services firm runs a latency-sensitive trading application across two availability zones. Security requires that all inter-service traffic be mutually authenticated and encrypted, and that certificates rotate hourly without application code changes. Which design BEST meets these requirements?

Accepted Answer

A service mesh offloads mTLS and automated short-lived certificate rotation to sidecar proxies, so identity and encryption change without touching application code. The other options either terminate encryption before the workload, require disruptive restarts, or still push certificate lifecycle into the application and its config pipeline.

Question 7

During triage, an analyst observes a scheduled task on a Windows host that launches PowerShell with an encoded command and connects to a rarely used external IP over port 443. Which MITRE ATT&CK tactic is MOST directly represented by the scheduled task itself?

Accepted Answer

A scheduled task that relaunches attacker code is a classic persistence mechanism that survives reboots and logoffs. The encoded command reflects defense evasion, but the question asks specifically about the scheduled task.

Question 8

A SOC wants to reduce mean time to respond for a high-volume, low-complexity alert: user reports of phishing emails. Which automation approach delivers the GREATEST reduction in analyst effort while preserving decision quality?

Accepted Answer

A SOAR playbook automates the repetitive enrichment and containment steps end to end while keeping a human approval gate for the destructive action. Deduplication, a second gateway, and queue reassignment reduce volume or shift work but do not automate the investigative workflow.

Question 9

An incident responder must preserve evidence from a running Linux server suspected of hosting a memory-resident implant. The system cannot be taken offline for another six hours due to a business freeze. Which sequence BEST preserves evidentiary value?

Accepted Answer

The order of volatility dictates collecting the most ephemeral data — RAM, then network and process state — before less volatile disk contents. Imaging first, rebooting, or running a scan risks destroying or altering the memory-resident artifact that is the primary evidence.

Question 10

Which key management practice BEST limits the impact of a compromised data encryption key (DEK) in an envelope encryption scheme?

Accepted Answer

A unique DEK per object confines a key compromise to that single object, and protecting the KEK in an HSM prevents mass decryption of the wrapped keys. Longer keys do not limit blast radius, and deterministic derivation from one passphrase makes compromise systemic.

Question 11

An organization wants to allow a partner to compute aggregate statistics over its customer dataset without ever seeing individual records or transferring the raw data. Which technology MOST directly enables this?

Accepted Answer

Homomorphic encryption permits computation directly on ciphertext, so the partner can produce aggregate results without decrypting individual records. Format-preserving encryption, tokenization, and TDE protect data at rest or in transit but require decryption or detokenization before meaningful computation.

Question 12

Which certificate validation method allows a TLS client to check revocation status without contacting the certificate authority directly during the handshake?

Accepted Answer

With OCSP stapling the server presents a CA-signed, time-stamped status response during the handshake, so the client validates revocation without its own call to the CA. CRL downloads still require fetching from the issuer, pinning does not convey revocation, and CT logs record issuance rather than revocation.

Question 13

A security team is enabling an internally developed LLM assistant that queries corporate documents. Which control MOST directly mitigates the risk of the model returning data the requesting user is not authorized to see?

Accepted Answer

Authorization must be enforced when documents are retrieved, because anything placed in the model's context can surface in a response. Output filters are bypassable, fine-tuning does not govern retrieval-time access, and rate limits only slow extraction.

Question 14

Which secure development practice is MOST effective at preventing hardcoded credentials from reaching a production container image?

Accepted Answer

Pipeline secrets scanning blocks credentials before an image is built, and injecting secrets at runtime removes the need to embed them at all. Code review is inconsistent, registry access control does not remove the embedded secret, and CVE scanning does not detect credentials.

Question 15

An enterprise is planning migration to post-quantum cryptography for its externally facing TLS services but must maintain interoperability with legacy clients during a multi-year transition. Which approach BEST balances these constraints?

Accepted Answer

Hybrid key exchange provides post-quantum protection against harvest-now-decrypt-later attacks while remaining negotiable with clients that only support classical algorithms. A forced cutover breaks interoperability, larger RSA keys offer no quantum resistance, and deferring the migration leaves captured traffic exposed.

CAS-005 — CompTIA SecurityX CAS-005 Exam Voucher | CASP+ Successor Expert Certification Practice Test

Free Practice Test

CAS-005 practice test — common questions