CompTIA SecurityX (V5) (CAS-005) practice questions

Domain coverage 4 domains

• Governance, Risk, and Compliance (20%)
• Security Architecture (27%)
• Security Engineering (31%)
• Security Operations (22%)

Sample questions 14 of 135 shown

1. Q1 Governance, Risk, and Compliance

   A compliance officer is reviewing data sovereignty laws in several countries where the organization does not have a business presence. What is the most likely reason for reviewing these laws?

   1. The organization is performing due diligence for potential tax issues
   2. The organization has been subject to legal action in countries where it does have a presence
   3. The organization is concerned about new regulatory enforcement in other countries
   4. The organization is suffering brand reputational damage due to incorrect media reports

   Data sovereignty laws define how data must be stored and processed within specific countries. Even without a local business presence, organizations may need to comply if they process data from citizens of those countries (e.g., GDPR's extraterritorial applicability). Reviewing these laws proactively prepares the organization for new regulatory requirements.
2. Q2 Governance, Risk, and Compliance

   A company's load balancer has reached end-of-life (EOL) and is scheduled for replacement. A new critical vulnerability is discovered that affects an unused feature of the load balancer. Which two options best address the organization's risk? (Select TWO)

   1. Disable the vulnerable service
   2. Request indefinite risk acceptance for the vulnerability
   3. Exclude these devices from vulnerability scans
   4. Immediately decommission the hardware
   5. Disallow any network traffic to or from the hardware
   6. Request a 90-day risk acceptance for the vulnerability

   Since the device is EOL and the vulnerability affects an "unused feature," the most effective immediate mitigation is to disable the vulnerable service, which eliminates the risk entirely. Since the device is already scheduled for replacement, management can request a 90-day risk acceptance as a transitional measure while the replacement is deployed.
3. Q3 Governance, Risk, and Compliance

   When operating with a constrained budget, which of the following best explains the importance of determining organizational risk appetite?

   1. Risk appetite directly impacts acceptance of high-impact, low-likelihood events
   2. Organizational risk appetite varies from organization to organization
   3. Budgetary pressure drives risk mitigation planning in all companies
   4. Risk appetite directly influences which breaches are disclosed publicly

   Risk appetite defines the amount and type of risk an organization is willing to accept. With a constrained budget, not all risks can be mitigated. A well-defined risk appetite allows leadership to consciously accept certain high-impact, low-likelihood events where the cost of mitigation exceeds the potential loss, enabling focused spending on higher-priority risks.
4. Q4 Governance, Risk, and Compliance

   An organization receives an OSINT report indicating increased ransomware attacks targeting file shares at peer companies. The organization wants to deploy hardening policies to its servers and workstations to contain potential ransomware. How should the engineer best achieve this?

   1. Enable biometric authentication mechanisms on user workstations and block traffic on port 53
   2. Only allow interactive logon by users on workstations and restrict traffic on port 445 to file shares
   3. Instruct users to use password managers to generate new credentials and protect traffic on port 443
   4. Grant users permission to rotate admin passwords and deny traffic on port 80

   Ransomware often spreads laterally using the SMB protocol (port 445) to encrypt file shares. Restricting interactive logon reduces the risk of credential theft being used for remote logins. Restricting port 445 traffic limits the ransomware's ability to spread and attack file shares across the network.
5. Q5 Governance, Risk, and Compliance

   Compliance audit findings indicate employee role or department changes have led to privilege creep. Which two are the best solutions to mitigate this problem? (Select TWO)

   1. Implement role-based access policies
   2. Design least privilege policies
   3. Establish mandatory vacation policies
   4. Perform periodic access reviews
   5. Require regular job rotation

   RBAC ensures that when employees change roles, they are assigned new roles and removed from old ones, preventing privilege accumulation. Periodic access reviews serve as a detective control to identify and remove privileges that may have been missed during role transitions.
6. Q6 Governance, Risk, and Compliance

   A compliance officer is facilitating a Business Impact Analysis (BIA). What are the primary outputs that directly inform the risk management strategy? (Select TWO)

   1. Maximum Tolerable Downtime (MTD) for key business functions
   2. A complete inventory of all hardware and software assets
   3. A list of identified threats and vulnerabilities
   4. The Annualized Rate of Occurrence (ARO) for system failures
   5. Recovery Time Objectives (RTOs) for critical processes

   The BIA identifies critical business functions and their recovery requirements. MTD defines the maximum downtime a function can tolerate before causing significant business harm. RTO specifies the target time for restoring a function after disruption. Both directly inform continuity planning and risk management prioritization.
7. Q7 Governance, Risk, and Compliance

   A mature security organization wants to leverage its GRC platform to automate the risk management lifecycle. Which two automated workflows best represent this goal? (Select TWO)

   1. Automatically generating a plan of action and milestones (POA&M) when a control test fails
   2. Deploying patches to vulnerable systems identified by a scanner
   3. Pushing security awareness training modules to new employees
   4. Triggering a third-party risk assessment when a new vendor is added to the procurement system
   5. Correlating SIEM alerts to build a timeline of a security incident

   GRC platforms excel at automating risk governance workflows. Automatically generating a POA&M when a control fails streamlines remediation tracking. Triggering a third-party risk assessment when a vendor is added embeds risk management into business processes. These are core GRC automation functions.
8. Q8 Governance, Risk, and Compliance

   A multinational manufacturing firm wants to mandate specific configuration settings such as disabling unnecessary services and enforcing minimum password complexity. Which document type is most appropriate for enforcing these mandatory technical controls?

   1. Guideline
   2. Standard
   3. Policy
   4. Procedure

   A standard defines specific, mandatory technical requirements that must be followed. Standards sit between high-level policies (which state objectives) and procedures (which give step-by-step instructions). Standards like server hardening baselines enforce specific configuration settings.
9. Q9 Governance, Risk, and Compliance

   A security officer performs due diligence before implementing a third-party solution. During the assessment, the vendor cannot provide SOC 2 Type II reports and offers self-attestation questionnaires instead. The vendor processes PII covered by GDPR. What risk treatment is most appropriate?

   1. Accept the risk and proceed given business need
   2. Require a compensating controls framework audit within 90 days with right-to-audit clauses and SLA penalties
   3. Terminate the vendor relationship immediately
   4. Perform a manual penetration test as equivalent to SOC 2

   When a critical vendor cannot provide independent assurance (SOC 2 Type II), the appropriate response is to contractually require a path to independent validation with right-to-audit provisions and financial penalties. This addresses GDPR Article 28 requirements for appropriate technical and organizational measures while maintaining the business relationship under a defined remediation timeline.
10. Q10 Governance, Risk, and Compliance

    An organization wants to create a threat model to identify vulnerabilities in its infrastructure. Which framework is most appropriate for evaluating threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability?

    1. STRIDE
    2. DREAD
    3. OCTAVE
    4. PASTA

    DREAD is a risk assessment model used for classifying and prioritizing threats. The acronym stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. It helps security professionals rank threats by assigning numerical values to each category.
11. Q11 Governance, Risk, and Compliance

    A security officer received complaints from users about excessive MFA push notifications at night. After investigation, the officer determines this is an MFA fatigue attack. What is the most effective mitigation?

    1. Reduce the MFA timeout window
    2. Implement number matching for MFA push notifications
    3. Disable MFA for non-administrative users
    4. Increase password complexity requirements

    MFA fatigue attacks bombard users with push notifications until they accept one out of annoyance. Number matching requires users to enter a displayed number into the authenticator app, preventing accidental approvals. This is Microsoft's recommended mitigation for MFA fatigue attacks.
12. Q12 Governance, Risk, and Compliance

    A company wants to implement a platform to better identify which specific assets are affected by a given vulnerability. Which component provides the best foundation?

    1. SASE
    2. CMDB
    3. SBoM
    4. SLM

    A Configuration Management Database (CMDB) is a centralized repository that tracks IT assets, their configurations, and relationships. When a new vulnerability is published, the security team can query the CMDB to identify all assets with the affected software, enabling precise impact assessment and targeted remediation.
13. Q13 Governance, Risk, and Compliance

    An organization determines existing business continuity practices are inadequate. Which risk management strategy involves transferring the financial impact of potential losses to a third party?

    1. Risk avoidance
    2. Risk mitigation
    3. Risk acceptance
    4. Risk transfer

    Risk transfer shifts the financial burden of a risk event to another party, typically through insurance or contractual agreements. When the cost of mitigation exceeds the asset value, risk transfer via insurance is an appropriate strategy.
14. Q14 Governance, Risk, and Compliance

    An organization wants to ensure its security program addresses the complete asset management lifecycle from procurement to decommissioning. Which framework is most relevant for this requirement?

    1. COBIT
    2. ITIL
    3. NIST CSF
    4. OWASP

    ITIL (Information Technology Infrastructure Library) provides a comprehensive framework for IT service management, including detailed processes for asset management throughout the lifecycle. COBIT focuses on governance, NIST CSF on cybersecurity, and OWASP on application security.

Answer all 135 questions with instant feedback →

Reader reviews 151 ratings

• The progress tracking feature for CAS-005 really motivated me. Seeing my improvement over time was incredibly satisfying.

  ★★★★★★ Daniel H.

• The way the CAS-005 questions are broken down by domain is great. Let me focus on my weak spots without wasting time.

  ★★★★★★ Olivia H.

• Got 856 out of 900 on the CAS-005 exam. This question bank was my primary study resource. Highly recommend.

  ★★★★★ Alyssa D.

• Straightforward and effective. No fluff in the CAS-005 practice set, just relevant questions with solid answer keys.

  ★★★★★★ Owen P.

• I work full time and study at night. The CAS-005 question bank allowed me to learn efficiently without wasting precious time.

  ★★★★★★ Harper S.

• Honestly, I wouldn’t have passed CAS-005 without these. The explanations actually teach you instead of just giving the answer.

  ★★★★★★ Jordan P.

Frequently asked questions

Free study resources

Community-verified analysis of 13 questions from real test-taker discussions — 4 deep analyses and 0 FAQs.

More CompTIA exams