CompTIA SecurityX CAS-005 (formerly CASP+) · Updated 2026
Free CompTIA SecurityX (CAS-005) Practice Exam (2026)
Full-length SecurityX mock exams with the same number of questions and time as the real CAS-005 exam. Expert-level architecture, engineering, operations and GRC scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
90 questions · 2 hours 45 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 9
🏆
Question 1Security Engineering
Northwind Logistics enforces a conditional access policy that blocks sign-ins from outside named corporate locations. After the headquarters ISP circuit was replaced over the weekend, every HQ user is blocked on Monday, while remote users on the VPN sign in normally. What should the security engineer do FIRST?
Correct answer: C. Update the named location with the new ISP egress IP range
The policy evaluates the source IP against named locations, and the new circuit introduced egress addresses the policy does not recognize. Excluding the users would remove the control entirely instead of fixing the stale location data.
The policy evaluates the source IP against named locations, and the new circuit introduced egress addresses the policy does not recognize. Excluding the users would remove the control entirely instead of fixing the stale location data.
Question 2Security Architecture
Harbor Lane Outfitters encrypts all traffic from browsers to its web servers. The perimeter IPS sees only TLS ciphertext and has missed several SQL injection attempts against the checkout application. The architect must add Layer 7 inspection. Where should a WAF be placed?
Correct answer: B. At the TLS-terminating reverse proxy in front of the web servers
A WAF must see decrypted HTTP to inspect payloads, so it belongs at or directly behind the point where TLS is terminated, in front of the web tier. Placing it on the perimeter router ahead of termination leaves it with the same ciphertext blindness as the current IPS.
A WAF must see decrypted HTTP to inspect payloads, so it belongs at or directly behind the point where TLS is terminated, in front of the web tier. Placing it on the perimeter router ahead of termination leaves it with the same ciphertext blindness as the current IPS.
Question 3Security Operations
Harlow Freight's SIEM raises hundreds of brute-force alerts every Tuesday night. Investigation shows they all come from the company's authorized vulnerability scanner during its scheduled window. The SOC must cut the noise without losing coverage for real attacks. What is the BEST tuning action?
Correct answer: D. Add a scoped exception for the scanner's source IP and account during the scan window, with periodic review
A narrow exception tied to the known scanner source, account and schedule removes the false positives while the rule still fires for every other source. Raising the threshold globally is tempting but weakens detection for real attackers everywhere, not just for the scanner.
A narrow exception tied to the known scanner source, account and schedule removes the false positives while the rule still fires for every other source. Raising the threshold globally is tempting but weakens detection for real attackers everywhere, not just for the scanner.
Question 4Governance, Risk & Compliance
A financial services firm's security policy states that sensitive data must be protected at rest. The CISO now wants a document that requires AES-256 with keys held in a FIPS 140-3 validated HSM on every database platform. Which document type should contain this requirement?
Correct answer: A. A standard, since it mandates specific technical controls
Standards turn high-level policy statements into mandatory, specific technical requirements such as an algorithm and key storage method. A policy states intent and authority but should stay technology neutral, while a procedure gives step-by-step instructions rather than the requirement itself.
Standards turn high-level policy statements into mandatory, specific technical requirements such as an algorithm and key storage method. A policy states intent and authority but should stay technology neutral, while a procedure gives step-by-step instructions rather than the requirement itself.
Question 5Security Engineering
Users at Halvorsen Bank reached an intranet app by its old hostname with seamless Kerberos SSO. After the app moved to a new DNS name, browsers prompt for credentials and logs show NTLM being used instead. Time sync and the service account are unchanged. What is the MOST likely fix?
Correct answer: B. Register an SPN for the new hostname on the service account
Without an SPN that matches the new hostname, the KDC cannot issue a service ticket, so the client falls back to NTLM. Clock skew problems produce explicit skew errors and would affect every hostname, not just the renamed one.
Without an SPN that matches the new hostname, the KDC cannot issue a service ticket, so the client falls back to NTLM. Clock skew problems produce explicit skew errors and would affect every hostname, not just the renamed one.
Question 6Security Architecture
Cobalt Freight runs its customer portal active-active in two regions behind a global load balancer. During a regional failover test, every logged-in user was forced to sign in again and lost work in progress. Session data is held in the memory of each web server. Which design change BEST fixes this?
Correct answer: A. Externalize session state to a store replicated across both regions
When session state lives in server memory, it disappears with the region, so it must be externalized to a replicated store that the surviving region can read. Sticky sessions only pin users to a server and do nothing when that server or region is gone.
When session state lives in server memory, it disappears with the region, so it must be externalized to a replicated store that the surviving region can read. Sticky sessions only pin users to a server and do nothing when that server or region is gone.
Question 7Security Operations
A biotech firm is worried about insiders who use their own valid credentials and MFA to collect research data before resigning. Signature-based tools have never flagged these cases. Which capability is MOST likely to detect this activity?
Correct answer: D. User and entity behavior analytics that compares activity to individual and peer baselines
UEBA builds baselines for each user and their peer group, so unusual access volume, timing or data sources stand out even when credentials are valid. Keyword DLP is partly helpful but is easily bypassed and does not model what normal behavior looks like for each person.
UEBA builds baselines for each user and their peer group, so unusual access volume, timing or data sources stand out even when credentials are valid. Keyword DLP is partly helpful but is easily bypassed and does not model what normal behavior looks like for each person.
Question 8Governance, Risk & Compliance
During an active ransomware campaign, a network team must block a vulnerable SMB port on all perimeter firewalls within the hour. The change advisory board normally meets weekly. What is the MOST appropriate change management approach?
Correct answer: A. Use the emergency change process with a retroactive review
An emergency change process allows urgent changes with expedited approval, often by an emergency CAB, followed by documentation and a post-implementation review. Logging it as a standard change is wrong because standard changes are low-risk, pre-approved routine tasks, not novel firewall changes made under pressure.
An emergency change process allows urgent changes with expedited approval, often by an emergency CAB, followed by documentation and a post-implementation review. Logging it as a standard change is wrong because standard changes are low-risk, pre-approved routine tasks, not novel firewall changes made under pressure.
Question 9Security Engineering
Every user at Corvane Health suddenly fails SAML sign-in to a SaaS HR platform with a 'signature validation failed' error. Nothing changed on the SaaS side, but the internal IdP automatically rolled over its token-signing certificate the night before. What should the team do?
Correct answer: C. Give the SaaS provider the IdP's new signing certificate or metadata
The service provider still trusts only the old signing certificate, so assertions signed with the new key fail validation. Disabling signing would let anyone forge assertions, and user certificates play no part in SAML assertion signing.
The service provider still trusts only the old signing certificate, so assertions signed with the new key fail validation. Disabling signing would let anyone forge assertions, and user certificates play no part in SAML assertion signing.
Question 10Security Architecture
Velta Health exposes 30 microservices to partner apps. Each team built its own token validation, and a review found inconsistent JWT signature checks and no rate limiting on several services. A partner recently overwhelmed one service with requests. What is the MOST effective architectural fix?
Correct answer: A. Add an API gateway that centrally validates tokens and enforces quotas
An API gateway gives a single enforcement point for token validation, rate limiting and request schema checks, which removes inconsistent per-service implementations. A coding guide helps but still relies on 30 teams implementing controls correctly and provides no quota enforcement.
An API gateway gives a single enforcement point for token validation, rate limiting and request schema checks, which removes inconsistent per-service implementations. A coding guide helps but still relies on 30 teams implementing controls correctly and provides no quota enforcement.
Question 11Security Operations
Analysts at Corvane Bank find that a correlation rule linking VPN logins to file server access almost never fires, even in a test where both events clearly occurred. The VPN appliance logs in local time, and the file servers log in UTC with clock drift of several minutes. What should the architect fix FIRST?
Correct answer: D. Normalize all timestamps to UTC at ingestion and enforce NTP on every log source
Time-window correlation fails when sources disagree on time, so consistent time zones and synchronized clocks are the root fix. Field normalization also matters for correlation, but the scenario points to time mismatch as the cause, and matching field names would not fix events that land outside the window.
Time-window correlation fails when sources disagree on time, so consistent time zones and synchronized clocks are the root fix. Field normalization also matters for correlation, but the scenario points to time mismatch as the cause, and matching field names would not fix events that land outside the window.
Question 12Security Engineering
A security architect is comparing three fingerprint readers for a data center entrance. Each vendor publishes false acceptance and false rejection rates at different sensitivity settings. Which single metric gives the MOST fair accuracy comparison across the products?
Correct answer: B. Crossover error rate
The crossover error rate is the point where FAR and FRR are equal, so it compares devices independent of each vendor's chosen sensitivity. FAR alone can be made artificially low by raising sensitivity, which simply raises false rejections.
The crossover error rate is the point where FAR and FRR are equal, so it compares devices independent of each vendor's chosen sensitivity. FAR alone can be made artificially low by raising sensitivity, which simply raises false rejections.
Question 13Governance, Risk & Compliance
A widely used open-source logging library receives a critical CVE. A medical device maker must tell regulators within 24 hours which of its 40 shipped products contain the vulnerable component. Which practice would MOST directly enable this?
Correct answer: C. Maintaining a current SBOM for every product release
A software bill of materials lists every component and version in each release, so the company can query which products include the affected library in minutes. Penetration tests are point-in-time and would not reliably reveal every embedded dependency across 40 products.
A software bill of materials lists every component and version in each release, so the company can query which products include the affected library in minutes. Penetration tests are point-in-time and would not reliably reveal every embedded dependency across 40 products.
Question 14Security Architecture
A regional hospital wants to add an IPS between its clinical network and the data center. Clinical leadership states the device must never cause an outage of patient care systems, while security wants real-time blocking of attacks. Which design BEST meets both requirements?
Correct answer: B. Deploy an inline IPS HA pair with a hardware bypass that fails open
An inline high-availability pair keeps real-time blocking, and a hardware bypass that fails open preserves clinical traffic if both units fail, accepting a brief loss of inspection over a care outage. A passive tap avoids outage risk but cannot block attacks in real time, which fails the security requirement.
An inline high-availability pair keeps real-time blocking, and a hardware bypass that fails open preserves clinical traffic if both units fail, accepting a brief loss of inspection over a care outage. A passive tap avoids outage risk but cannot block attacks in real time, which fails the security requirement.
Question 15Security Engineering
A code review at Brightwell Media finds database passwords committed in several microservice repositories. The passwords have been rotated, and leadership wants to stop the problem from recurring while also limiting the damage if a credential leaks again. Which approach BEST meets both goals?
Correct answer: D. Issue short-lived dynamic credentials from a secrets vault at runtime
A vault that issues dynamic credentials removes secrets from code and makes any leaked credential expire quickly. A pre-commit hook helps catch mistakes but does nothing to limit the lifetime of a credential that slips through.
A vault that issues dynamic credentials removes secrets from code and makes any leaked credential expire quickly. A pre-commit hook helps catch mistakes but does nothing to limit the lifetime of a credential that slips through.
Question 16Security Operations
A SOC analyst at Pellin Health has four new alerts and can work only one right now. Which alert should be triaged FIRST?
Correct answer: B. A credential-dumping behavior detected on a domain controller
Credential access on a domain controller threatens the entire identity plane and suggests an attacker is already inside, so it carries the highest impact and urgency. The internet port scan is the most frequent distraction, but scans are routine background noise with no sign of compromise.
Credential access on a domain controller threatens the entire identity plane and suggests an attacker is already inside, so it carries the highest impact and urgency. The internet port scan is the most frequent distraction, but scans are routine background noise with no sign of compromise.
Question 17Security Architecture
In the NIST SP 800-207 zero trust model, which logical component makes the grant or deny decision for a subject's request to access a resource?
Correct answer: C. Policy engine
The policy engine evaluates enterprise policy and external inputs, such as threat intelligence and device state, to make the trust decision. The policy administrator acts on that decision by establishing or shutting down the session path, and the PEP enables, monitors and terminates the connection.
The policy engine evaluates enterprise policy and external inputs, such as threat intelligence and device state, to make the trust decision. The policy administrator acts on that decision by establishing or shutting down the session path, and the PEP enables, monitors and terminates the connection.
Question 18Governance, Risk & Compliance
A healthcare company is negotiating with a SaaS vendor that will process patient records. Legal wants the ability to examine the vendor's controls directly if an incident or a poor assessment result raises concerns. Which contract provision BEST meets this need?
Correct answer: A. A right-to-audit clause with defined notice terms
A right-to-audit clause gives the customer contractual permission to inspect or have a third party assess the vendor's controls. An SLA governs service performance and credits, so it does not grant any ability to verify security controls.
A right-to-audit clause gives the customer contractual permission to inspect or have a third party assess the vendor's controls. An SLA governs service performance and credits, so it does not grant any ability to verify security controls.
Question 19Security Engineering
Pellham Insurance has more than 600 roles because access depends on combinations of department, region, data classification and employment type. Auditors cannot tell who has what, and new hires often get the wrong role. Which access control model BEST addresses this?
Correct answer: D. Attribute-based access control driven by policy rules
ABAC evaluates attributes such as department, region and classification at request time, which removes the role explosion that comes from encoding every combination as a role. MAC uses fixed labels and clearances and does not handle many independent business attributes well.
ABAC evaluates attributes such as department, region and classification at request time, which removes the role explosion that comes from encoding every combination as a role. MAC uses fixed labels and clearances and does not handle many independent business attributes well.
Question 20Security Operations
Ostrander Utilities has patch capacity for one vulnerability this week. Finding A has CVSS 9.8, an EPSS score of 0.02, is not on the CISA KEV list, and affects an isolated test server. Finding B has CVSS 7.5, is on the KEV list, and affects the internet-facing VPN gateway. Which should be patched FIRST and why?
Correct answer: A. Finding B, because it is known to be exploited and sits on an exposed asset
KEV listing means the flaw is confirmed as exploited in the wild, and the VPN gateway is reachable from the internet, so real-world risk is far higher. CVSS measures technical severity, not likelihood or exposure, so a 9.8 on an isolated test box is a lower practical priority.
KEV listing means the flaw is confirmed as exploited in the wild, and the VPN gateway is reachable from the internet, so real-world risk is far higher. CVSS measures technical severity, not likelihood or exposure, so a 9.8 on an isolated test box is a lower practical priority.
Question 21Security Architecture
After a ransomware incident, Northbeam Insurance found the attacker moved from one compromised web VM to 200 other servers on the same data center VLAN. Workloads move between hosts daily, and the network team cannot keep up with ACL changes. Which control BEST limits this lateral movement?
Correct answer: C. Microsegmentation policies tied to workload tags, enforced at each host
Microsegmentation enforces east-west policy at each workload and follows workload identity or tags as VMs move, so it scales where static ACLs do not. Smaller subnets with ACLs still leave many servers in each subnet reachable and depend on manual rule changes.
Microsegmentation enforces east-west policy at each workload and follows workload identity or tags as VMs move, so it scales where static ACLs do not. Smaller subnets with ACLs still leave many servers in each subnet reachable and depend on manual rule changes.
Question 22Security Engineering
Fernhill Utilities runs fixed-function payment servers that should only ever execute a small, known set of signed binaries. The team wants to stop unknown executables, including new malware that has no signature in any threat feed. Which control is MOST effective?
Correct answer: D. Application allow listing using publisher and hash rules
Allow listing permits only approved code to run, so unknown malware is blocked whether or not anyone has seen it before. Signature-based antivirus depends on prior knowledge of the threat and misses novel samples.
Allow listing permits only approved code to run, so unknown malware is blocked whether or not anyone has seen it before. Signature-based antivirus depends on prior knowledge of the threat and misses novel samples.
Question 23Governance, Risk & Compliance
A server cluster is valued at $400,000. A flood would destroy 25% of its value, and floods are expected once every two years. A flood barrier costs $25,000 per year and would cut the expected rate to once every ten years. What is the annual net value of the barrier?
Correct answer: D. $15,000
SLE is $400,000 x 0.25 = $100,000. ALE before is $100,000 x 0.5 = $50,000 and ALE after is $100,000 x 0.1 = $10,000, so the barrier reduces loss by $40,000 and nets $40,000 - $25,000 = $15,000. Choosing $40,000 ignores the annual cost of the control.
SLE is $400,000 x 0.25 = $100,000. ALE before is $100,000 x 0.5 = $50,000 and ALE after is $100,000 x 0.1 = $10,000, so the barrier reduces loss by $40,000 and nets $40,000 - $25,000 = $15,000. Choosing $40,000 ignores the annual cost of the control.
Question 24Security Engineering
Kestrel Defense wants its network access control server to admit laptops only after verifying that the firmware, bootloader and kernel loaded during startup match known-good values. Which capability provides this evidence to the remote server?
Correct answer: B. Measured boot with TPM-based remote attestation
Measured boot records hashes of each boot component in TPM PCRs, and attestation sends a signed quote of those values to a remote verifier. Secure Boot blocks unsigned components locally but does not give a remote server a report of what actually loaded.
Measured boot records hashes of each boot component in TPM PCRs, and attestation sends a signed quote of those values to a remote verifier. Secure Boot blocks unsigned components locally but does not give a remote server a report of what actually loaded.
Question 25Security Architecture
Tamarind Foods has 60 branch offices that backhaul all internet traffic over MPLS to headquarters for inspection, causing poor SaaS performance. A growing remote workforce must also receive the same web filtering, DLP and private app access policies. Which architecture BEST meets these goals?
Correct answer: C. SASE combining SD-WAN with cloud-delivered SWG, CASB and ZTNA
SASE converges network services such as SD-WAN with cloud-delivered security, so branches break out locally and remote users get the same SWG, CASB and ZTNA policy from a nearby point of presence. SD-WAN alone fixes the routing but leaves security inconsistent and does not cover remote users.
SASE converges network services such as SD-WAN with cloud-delivered security, so branches break out locally and remote users get the same SWG, CASB and ZTNA policy from a nearby point of presence. SD-WAN alone fixes the routing but leaves security inconsistent and does not cover remote users.
Question 26Security Operations
An unauthenticated scan at Brightwater Insurance flags dozens of critical OpenSSH CVEs on Linux servers based on the version banner. The server team says the distribution vendor has already backported the fixes into those package builds. What is the BEST way to validate the findings?
Correct answer: D. Run a credentialed scan that checks installed package versions against vendor advisories
A credentialed scan reads the actual installed packages and compares them with the vendor's advisories, which correctly accounts for backported patches. Hiding the banner only blinds the scanner and fixes nothing, while building from source breaks the vendor support model.
A credentialed scan reads the actual installed packages and compares them with the vendor's advisories, which correctly accounts for backported patches. Hiding the banner only blinds the scanner and fixes nothing, while building from source breaks the vendor support model.
Question 27Governance, Risk & Compliance
The board of a retailer states it will accept moderate cyber risk to pursue rapid e-commerce growth. The CISO then sets a limit of no more than four hours of payment outage per quarter. What does the four-hour figure represent?
Correct answer: C. Risk tolerance, the allowed variance for one objective
Risk tolerance is a specific, measurable limit on acceptable deviation for a particular objective, derived from the broader appetite. The board's moderate-risk statement is the appetite, so labeling the four-hour metric as appetite confuses the strategic statement with its operational threshold.
Risk tolerance is a specific, measurable limit on acceptable deviation for a particular objective, derived from the broader appetite. The board's moderate-risk statement is the appetite, so labeling the four-hour metric as appetite confuses the strategic statement with its operational threshold.
Question 28Security Engineering
Ostrava Payments is building an internal root CA. Policy requires that the root private key be generated and stored in tamper-resistant hardware validated to FIPS 140-3 Level 3 and that it never exist in plaintext outside that hardware. Which solution meets this requirement?
Correct answer: B. A network or PCIe hardware security module
An HSM generates and stores keys inside a tamper-resistant boundary, performs signing internally, and is commonly validated at FIPS 140-3 Level 3. A TPM is built for platform integrity and device keys, not high-assurance CA key custody, and a key file exists in plaintext in memory whenever it is used.
An HSM generates and stores keys inside a tamper-resistant boundary, performs signing internally, and is commonly validated at FIPS 140-3 Level 3. A TPM is built for platform integrity and device keys, not high-assurance CA key custody, and a key file exists in plaintext in memory whenever it is used.
Question 29Security Architecture
A fintech's scanner flagged a critical deserialization vulnerability in a library that none of its developers added directly. The library is pulled in three levels deep by a logging package. The CISO wants these issues caught on every build. Which capability should be added to the pipeline?
Correct answer: C. Software composition analysis that resolves the full dependency tree
SCA inventories direct and transitive dependencies, matches them against known vulnerabilities and can produce an SBOM on every build. SAST analyzes the team's own code paths and does not reliably identify known CVEs in third-party packages.
SCA inventories direct and transitive dependencies, matches them against known vulnerabilities and can produce an SBOM on every build. SAST analyzes the team's own code paths and does not reliably identify known CVEs in third-party packages.
Question 30Security Operations
A code review at Tamsin Logistics finds that a Java API accepts native serialized objects from clients and reconstructs them on the server. The team wants to remove the weakness class, not just block known gadget chains. Which mitigation is MOST effective?
Correct answer: A. Replace native deserialization of client input with a data-only format and strict schema
Insecure deserialization exists because the runtime builds arbitrary objects from attacker-controlled data, so switching to a data-only format such as JSON with schema validation removes the class. A WAF signature only catches known patterns and is easy to evade, and TLS protects the channel but not against a malicious client.
Insecure deserialization exists because the runtime builds arbitrary objects from attacker-controlled data, so switching to a data-only format such as JSON with schema validation removes the class. A WAF signature only catches known patterns and is easy to evade, and TLS protects the channel but not against a malicious client.
Question 31Security Engineering
During a purple team exercise at Lindqvist Retail, the red team moved from one compromised web server to dozens of other servers in the same flat subnet using SMB and RDP. Network re-segmentation is a year away. Which control would MOST quickly reduce this lateral movement?
Correct answer: B. Host firewalls with default-deny inbound and admin ports open only to jump hosts
Host-based firewalls can be pushed by policy quickly and enforce segmentation at each server, so admin protocols are reachable only from controlled jump hosts. Disabling SMB and RDP everywhere would break legitimate file sharing and administration, and an IDS only alerts.
Host-based firewalls can be pushed by policy quickly and enforce segmentation at each server, so admin protocols are reachable only from controlled jump hosts. Disabling SMB and RDP everywhere would break legitimate file sharing and administration, and an IDS only alerts.
Question 32Security Architecture
Attackers who compromised a build agent at Orchid Software used the code signing private key stored on that agent to sign malware that customers trusted. The company is redesigning its signing process. Which change BEST prevents a repeat?
Correct answer: A. Keep the key in an HSM and sign only in a gated release stage
Holding the key in an HSM makes it non-exportable, and limiting signing to an isolated, approved release stage means a compromised build agent cannot obtain signatures. Encrypting the key file on the same agent fails because the agent must hold the passphrase to sign, so an attacker on that agent can use it.
Holding the key in an HSM makes it non-exportable, and limiting signing to an isolated, approved release stage means a compromised build agent cannot obtain signatures. Encrypting the key file on the same agent fails because the agent must hold the passphrase to sign, so an attacker on that agent can use it.
Question 33Governance, Risk & Compliance
A company already has strong ransomware controls but cannot absorb a seven-figure loss if an attack succeeds. Leadership buys a cyber insurance policy. Which statement BEST describes this decision?
Correct answer: C. Transference, with accountability for a breach still retained
Insurance transfers part of the financial impact to the insurer, but the organization remains accountable to regulators, customers and courts for the breach. The tempting distractor is wrong because legal and reputational accountability can never be transferred by contract.
Insurance transfers part of the financial impact to the insurer, but the organization remains accountable to regulators, customers and courts for the breach. The tempting distractor is wrong because legal and reputational accountability can never be transferred by contract.
Question 34Security Engineering
Incident responders at Marlow Engineering found that an attacker with local administrator rights stopped the EDR service and uninstalled the agent before deploying ransomware. No alert reached the console until the device went silent. Which EDR setting would BEST have prevented this?
Correct answer: D. Tamper protection that blocks agent changes without a console token
Tamper protection prevents local administrators from stopping, modifying or uninstalling the agent unless an authorized console action allows it. Prevention mode blocks malicious behavior, but a local admin could still disable an unprotected agent first.
Tamper protection prevents local administrators from stopping, modifying or uninstalling the agent unless an authorized console action allows it. Prevention mode blocks malicious behavior, but a local admin could still disable an unprotected agent first.
Question 35Security Operations
A privileged service at Marden Labs checks whether a user may write to a file path and then opens that path in a separate step. A tester shows the path can be swapped for a symbolic link between the two steps. Which mitigation BEST addresses this weakness?
Correct answer: D. Perform the check and the use atomically, such as validating the opened file handle
This is a time-of-check to time-of-use race condition, and the fix is to bind the check to the object actually used, for example by opening first and verifying the handle. Detective controls like integrity scans or logging may find abuse later but do not close the race window.
This is a time-of-check to time-of-use race condition, and the fix is to bind the check to the object actually used, for example by opening first and verifying the handle. Detective controls like integrity scans or logging may find abuse later but do not close the race window.
Question 36Security Architecture
A product security lead needs security requirements for a new online banking app that are specific, testable and tied to an assurance level suited to sensitive financial data. Which source is the BEST fit?
Correct answer: A. OWASP ASVS verification requirements at the appropriate level
The Application Security Verification Standard provides detailed, testable requirements grouped into levels, with higher levels intended for apps handling sensitive data such as financial transactions. The OWASP Top 10 is an awareness document of risk categories and is not designed to be a complete set of verifiable requirements.
The Application Security Verification Standard provides detailed, testable requirements grouped into levels, with higher levels intended for apps handling sensitive data such as financial transactions. The OWASP Top 10 is an awareness document of risk categories and is not designed to be a complete set of verifiable requirements.
Question 37Security Engineering
Quillon Legal lets attorneys use personal Android phones for email and document access. When an attorney leaves, the firm must remove all firm data without touching personal photos or apps. Which MDM capability BEST supports this?
Correct answer: B. A managed work profile that supports selective wipe
A work profile separates corporate apps and data into a managed container that can be wiped without affecting personal content. A factory reset removes firm data but also destroys the employee's personal data, which is unacceptable on BYOD devices.
A work profile separates corporate apps and data into a managed container that can be wiped without affecting personal content. A factory reset removes firm data but also destroys the employee's personal data, which is unacceptable on BYOD devices.
Question 38Governance, Risk & Compliance
An EU customer submits a GDPR erasure request. Last month the legal department placed that customer's records under a legal hold because of pending litigation involving the customer. What should the privacy team do?
Correct answer: D. Keep the records, restrict processing, and explain why
GDPR Article 17(3) allows a controller to retain data needed to establish, exercise or defend legal claims, so the legal hold takes priority. The team should preserve the data, limit its use and tell the data subject the reason; deleting it could amount to spoliation of evidence.
GDPR Article 17(3) allows a controller to retain data needed to establish, exercise or defend legal claims, so the legal hold takes priority. The team should preserve the data, limit its use and tell the data subject the reason; deleting it could amount to spoliation of evidence.
Question 39Security Operations
Which memory protection marks stack and heap regions as non-executable so that injected data in those regions cannot run as code?
Correct answer: C. Data execution prevention
Data execution prevention, also called NX or W^X, makes data pages non-executable so code placed in them will fault instead of running. ASLR is the common confusion, but it only randomizes where memory regions load, which makes targeting harder without preventing execution.
Data execution prevention, also called NX or W^X, makes data pages non-executable so code placed in them will fault instead of running. ASLR is the common confusion, but it only randomizes where memory regions load, which makes targeting harder without preventing execution.
Question 40Security Architecture
At Lumen Analytics, pipeline definitions live in the same repository as application code. A contractor opened a pull request that modified the pipeline file to print deployment credentials during the PR build. Which control BEST addresses this class of risk?
Correct answer: B. Require owner review of pipeline files and run PR builds without secrets
Untrusted changes to pipeline definitions should never run with access to secrets, and changes to those files should require approval from designated owners. Log scanning and rotation only reduce damage after credentials have already been exposed.
Untrusted changes to pipeline definitions should never run with access to secrets, and changes to those files should require approval from designated owners. Log scanning and rotation only reduce damage after credentials have already been exposed.
Question 41Security Engineering
A water treatment plant receives a critical security patch for the engineering workstation software that programs its PLCs. The plant runs continuously, and an unplanned control failure could affect public health. What is the MOST appropriate approach?
Correct answer: C. Test it in a staging setup with vendor approval, then install it in a planned outage
In OT, safety and availability come first, so patches are tested against the control environment and approved by the vendor before deployment in a planned window. Rushing an untested patch could disrupt the process and create a safety hazard worse than the vulnerability itself.
In OT, safety and availability come first, so patches are tested against the control environment and approved by the vendor before deployment in a planned window. Rushing an untested patch could disrupt the process and create a safety hazard worse than the vulnerability itself.
Question 42Governance, Risk & Compliance
An e-commerce company stores primary account numbers in its order database to support refunds, which places about 300 servers in PCI DSS scope. What is the MOST effective way to reduce scope while keeping refund capability?
Correct answer: A. Replace stored PANs with tokens from the processor's vault
Tokenization removes PANs from the merchant environment, and the processor can issue refunds against the token, which takes most systems out of scope. Transparent data encryption still leaves the PAN and the decryption capability inside the environment, so the systems stay in scope.
Tokenization removes PANs from the merchant environment, and the processor can issue refunds against the token, which takes most systems out of scope. Transparent data encryption still leaves the PAN and the decryption capability inside the environment, so the systems stay in scope.
Question 43Security Operations
A threat intelligence report says a group targeting Fenwick Aerospace's sector uses scheduled tasks for persistence. No alerts have fired internally. The threat hunting lead wants to act on this report. What is the BEST approach?
Correct answer: B. Form a hypothesis and query endpoint telemetry for unusual scheduled task creation
A hypothesis-driven hunt uses the intelligence to search existing telemetry, for example tasks created by odd parent processes or pointing to user-writable paths. Importing hashes is useful but brittle, since the actor can change files easily, and it does not look for the behavior the report describes.
A hypothesis-driven hunt uses the intelligence to search existing telemetry, for example tasks created by odd parent processes or pointing to user-writable paths. Importing hashes is useful but brittle, since the actor can change files easily, and it does not look for the behavior the report describes.
Question 44Security Architecture
A penetration test at Holloway Analytics showed that a web app feature which fetches images from user-supplied URLs could be tricked into calling the cloud instance metadata endpoint and returning temporary credentials. Developers will fix the code, but the architect wants a design-level control that limits damage from similar flaws in other apps. What should the architect require?
Correct answer: A. Session-token-based metadata access plus egress filtering from app servers
Requiring session tokens for metadata access (such as IMDSv2-style protection) and restricting outbound traffic from app servers blocks the common server-side request forgery path to credentials across all apps. Client-side validation is easily bypassed because the attacker controls the request.
Requiring session tokens for metadata access (such as IMDSv2-style protection) and restricting outbound traffic from app servers blocks the common server-side request forgery path to credentials across all apps. Client-side validation is easily bypassed because the attacker controls the request.
Question 45Security Engineering
A manufacturer runs an HMI on Windows XP because the vendor's software has no supported upgrade path, and replacement is three years away. The HMI only needs to talk to two PLCs and one historian. Which combination of compensating controls is MOST appropriate?
Correct answer: C. Put it on its own segment with strict ACLs and enforce allow listing
Network isolation limits who can reach the unpatchable host, and allow listing stops unapproved code from running on it. Current antivirus agents often do not support XP and still leave the unpatched OS exposed, and an in-place upgrade would break the unsupported HMI software.
Network isolation limits who can reach the unpatchable host, and allow listing stops unapproved code from running on it. Current antivirus agents often do not support XP and still leave the unpatched OS exposed, and an in-place upgrade would break the unsupported HMI software.
Question 46Security Engineering
An engineer proposes installing the corporate EDR agent on embedded controllers that run a real-time operating system and manage a high-speed packaging line. Why is this proposal MOST likely to be rejected?
Correct answer: B. Agent overhead could cause the controller to miss hard timing deadlines
An RTOS must complete tasks within strict deterministic deadlines, and the CPU and I/O load of a general-purpose agent can break that timing and disrupt the process. RTOS devices are not immune to malware, so network-based monitoring is the usual alternative to a host agent.
An RTOS must complete tasks within strict deterministic deadlines, and the CPU and I/O load of a general-purpose agent can break that timing and disrupt the process. RTOS devices are not immune to malware, so network-based monitoring is the usual alternative to a host agent.
Question 47Security Architecture
A bank's developers copy production customer tables into test environments to reproduce defects. Auditors flagged this because testers can see real names and account numbers. Developers still need realistic, consistent data. Which approach is MOST appropriate?
Correct answer: D. Apply static data masking when production data is copied to test
Static masking permanently replaces sensitive values in the non-production copy, so test environments never hold real data but keep realistic formats. Dynamic masking alters query results in production at read time, so a copied test database would still contain real values.
Static masking permanently replaces sensitive values in the non-production copy, so test environments never hold real data but keep realistic formats. Dynamic masking alters query results in production at read time, so a copied test database would still contain real values.
Question 48Security Operations
Which of the following is BEST classified as an indicator of attack rather than an indicator of compromise?
Correct answer: A. A word processor spawning a script interpreter with an encoded command
An indicator of attack describes behavior that signals an attack in progress, such as an office application launching an encoded script, regardless of the specific tools used. The C2 address is a tempting choice, but it is a static artifact that the attacker can change, which makes it an indicator of compromise.
An indicator of attack describes behavior that signals an attack in progress, such as an office application launching an encoded script, regardless of the specific tools used. The C2 address is a tempting choice, but it is a static artifact that the attacker can change, which makes it an indicator of compromise.
Question 49Governance, Risk & Compliance
A multinational is moving HR records to a public cloud. One subsidiary operates in a country whose law requires citizens' personal data to remain within national borders. Which control MOST directly addresses this requirement?
Correct answer: B. Pin that data to an in-country region and enforce it by policy
Data localization laws require physical storage within the country, so restricting storage and replicas to an in-country region with enforced policy meets the requirement. Standard contractual clauses legitimize cross-border transfers under GDPR but do not satisfy a law that forbids the data from leaving the country.
Data localization laws require physical storage within the country, so restricting storage and replicas to an in-country region with enforced policy meets the requirement. Standard contractual clauses legitimize cross-border transfers under GDPR but do not satisfy a law that forbids the data from leaving the country.
Question 50Security Engineering
A security engineer reviews this Python fragment from a scheduled job: h = hashlib.sha256(open(path, 'rb').read()).hexdigest(); if h != baseline[path]: alert(path). What is the script MOST likely doing?
Correct answer: D. Detecting unauthorized changes to monitored files
The script hashes each file and compares the result to a stored baseline, which is how file integrity monitoring detects changes. A plain SHA-256 hash shows that a file changed but does not verify a signature, because no key or certificate is involved.
The script hashes each file and compares the result to a stored baseline, which is how file integrity monitoring detects changes. A plain SHA-256 hash shows that a file changed but does not verify a signature, because no key or certificate is involved.
Question 51Security Architecture
A hospital released a research dataset with names and record numbers removed. A researcher showed that combining ZIP code, full birth date and sex re-identified many patients using public voter rolls. Which technique BEST addresses this weakness before the next release?
Correct answer: D. Generalize quasi-identifiers so each record matches several others
ZIP code, birth date and sex are quasi-identifiers, and generalizing them, for example to a three-digit ZIP and birth year, supports k-anonymity so each record is indistinguishable from at least k-1 others. Tokenizing names does nothing because names were already removed and the linkage uses the remaining attributes.
ZIP code, birth date and sex are quasi-identifiers, and generalizing them, for example to a three-digit ZIP and birth year, supports k-anonymity so each record is indistinguishable from at least k-1 others. Tokenizing names does nothing because names were already removed and the linkage uses the remaining attributes.
Question 52Security Operations
An energy-sector ISAC wants members to exchange threat intelligence automatically between their platforms in a machine-readable, standardized way. Which combination BEST meets this goal?
Correct answer: A. STIX for describing the intelligence and TAXII for exchanging it
STIX is the structured language that describes indicators, actors and relationships, and TAXII is the protocol that carries STIX content between systems. Swapping the two roles is the common mistake, and syslog or SNMP are not intelligence-sharing protocols.
STIX is the structured language that describes indicators, actors and relationships, and TAXII is the protocol that carries STIX content between systems. Swapping the two roles is the common mistake, and syslog or SNMP are not intelligence-sharing protocols.
Question 53Governance, Risk & Compliance
While threat modeling a trading platform, the team notes that traders could later deny submitting certain orders. Current transaction logs can be edited by application administrators. Which STRIDE category applies, and what control addresses it?
Correct answer: C. Repudiation, addressed by signed, tamper-evident audit logs
Repudiation is the threat that a user can deny an action, and nonrepudiation requires trustworthy, tamper-evident records tied to the actor. MFA helps prove identity at login, but if administrators can edit the logs, the record of who placed the order still cannot be trusted.
Repudiation is the threat that a user can deny an action, and nonrepudiation requires trustworthy, tamper-evident records tied to the actor. MFA helps prove identity at login, but if administrators can edit the logs, the record of who placed the order still cannot be trusted.
Question 54Security Engineering
During a Linux hardening review, an engineer runs find / -perm -4000 -type f 2>/dev/null on a server. What is the purpose of this command?
Correct answer: A. List files that run with the owner's privileges when executed
Permission bit 4000 is SUID, so the command finds executables that run with the file owner's privileges, often root, which are common privilege escalation paths. World-writable files would be found with -perm -0002, and the sticky bit is 1000.
Permission bit 4000 is SUID, so the command finds executables that run with the file owner's privileges, often root, which are common privilege escalation paths. World-writable files would be found with -perm -0002, and the sticky bit is 1000.
Question 55Security Architecture
Endpoint DLP is not allowed on Brightwater Labs' research workstations because it breaks lab instrument software. The company must detect uploads of genomic data files to personal web storage, and all web traffic uses HTTPS. Where should DLP inspection be placed?
Correct answer: B. On the forward proxy that performs TLS inspection of outbound traffic
Without an endpoint agent, the inspection point must see decrypted outbound traffic, which a TLS-inspecting forward proxy or secure web gateway provides. A SPAN-based network DLP sensor sees only encrypted HTTPS and cannot read file contents.
Without an endpoint agent, the inspection point must see decrypted outbound traffic, which a TLS-inspecting forward proxy or secure web gateway provides. A SPAN-based network DLP sensor sees only encrypted HTTPS and cannot read file contents.
Question 56Security Operations
Quillon Retail runs two different SIEM platforms after an acquisition. The detection engineering team wants to write each log-based detection once and convert it for both platforms. Which approach BEST fits this need?
Correct answer: B. Write Sigma rules and use converters to generate each platform's query syntax
Sigma is a generic, vendor-neutral format for log event detections that can be converted into many SIEM query languages. YARA is the tempting distractor, but it matches patterns in files and memory, not log events.
Sigma is a generic, vendor-neutral format for log event detections that can be converted into many SIEM query languages. YARA is the tempting distractor, but it matches patterns in files and memory, not log events.
Question 57Security Engineering
Tallis Corp is automating phishing response in its SOAR platform. Analysts want the playbook to quarantine emails and block sender domains automatically, but leadership worries about automatically disabling accounts, especially executive accounts. What is the BEST design?
Correct answer: C. Add a human approval step before account-disable actions
A human-in-the-loop step keeps the speed of automation for low-risk actions while requiring analyst approval for high-impact ones. Removing the action altogether gives up a useful containment step instead of controlling its risk.
A human-in-the-loop step keeps the speed of automation for low-risk actions while requiring analyst approval for high-impact ones. Removing the action altogether gives up a useful containment step instead of controlling its risk.
Question 58Governance, Risk & Compliance
A security architect wants a threat modeling method that begins with business objectives, includes attack simulation, and ends with risk and impact analysis across seven defined stages. Which method fits this description?
Correct answer: B. PASTA
PASTA (Process for Attack Simulation and Threat Analysis) is a seven-stage, risk-centric method that ties threats to business objectives and impact. STRIDE is a threat classification scheme and does not define staged business alignment or attack simulation.
PASTA (Process for Attack Simulation and Threat Analysis) is a seven-stage, risk-centric method that ties threats to business objectives and impact. STRIDE is a threat classification scheme and does not define staged business alignment or attack simulation.
Question 59Security Architecture
A team is building a single-page web app and a native mobile app that call an API on behalf of signed-in users through an OIDC provider. Neither client can keep a client secret confidential. Which flow should the design specify?
Correct answer: D. Authorization code flow with PKCE
Public clients that cannot hold a secret should use the authorization code flow with PKCE, which binds the code to a one-time verifier so an intercepted code cannot be redeemed. The implicit flow exposes tokens in the browser URL and is no longer recommended by current OAuth security guidance.
Public clients that cannot hold a secret should use the authorization code flow with PKCE, which binds the code to a one-time verifier so an intercepted code cannot be redeemed. The implicit flow exposes tokens in the browser URL and is no longer recommended by current OAuth security guidance.
Question 60Security Engineering
Arden Cloud deploys all AWS infrastructure with Terraform. Engineers occasionally make emergency changes in the console, and security groups no longer match the reviewed code. Which approach BEST detects this configuration drift on an ongoing basis?
Correct answer: A. Run scheduled plan jobs that compare live state to the code
A scheduled plan or drift detection job compares real infrastructure to the declared configuration and reports any differences. Static policy checks and pull request reviews only examine the code, so they cannot see changes made directly in the console.
A scheduled plan or drift detection job compares real infrastructure to the declared configuration and reports any differences. Static policy checks and pull request reviews only examine the code, so they cannot see changes made directly in the console.
Question 61Security Operations
Ransomware is actively encrypting file shares from several workstations on one floor at Delmont Credit Union. The IR team needs to stop spread while keeping evidence for investigation. What should the team do FIRST?
Correct answer: C. Use EDR network containment to isolate the affected hosts while they stay powered on
EDR network isolation cuts off spread and attacker access while keeping the hosts running, which preserves memory evidence such as keys and process data. Powering off also stops encryption, but it destroys volatile evidence and may leave files in a partly encrypted state.
EDR network isolation cuts off spread and attacker access while keeping the hosts running, which preserves memory evidence such as keys and process data. Powering off also stops encryption, but it destroys volatile evidence and may leave files in a partly encrypted state.
Question 62Security Architecture
During a federation review, testers took a valid SAML assertion that the corporate IdP had issued for a low-risk HR portal and replayed it to the finance application, which accepted it. Both apps trust the same IdP. Which validation is the finance application MOST likely missing?
Correct answer: A. Checking that the AudienceRestriction names the finance application
The AudienceRestriction condition states which service provider the assertion is intended for, and an SP must reject assertions issued to any other audience. The signature check would pass here because the assertion really was signed by the trusted IdP, just for a different application.
The AudienceRestriction condition states which service provider the assertion is intended for, and an SP must reject assertions issued to any other audience. The signature check would pass here because the assertion really was signed by the trusted IdP, just for a different application.
Question 63Governance, Risk & Compliance
A company deploys an LLM assistant that reads customer emails and can issue refunds through an internal API. Testers find that hidden text in an email can make the assistant issue unapproved refunds. Which control BEST reduces this risk?
Correct answer: D. Scope its API rights and require human approval of refunds
Indirect prompt injection cannot be fully prevented inside the model, so the safest design limits what the model can do and puts a human check on high-impact actions. A system prompt instruction is tempting but is easily overridden by crafted input and is not a reliable security boundary.
Indirect prompt injection cannot be fully prevented inside the model, so the safest design limits what the model can do and puts a human check on high-impact actions. A system prompt instruction is tempting but is easily overridden by crafted input and is not a reliable security boundary.
Question 64Security Engineering
Users of Harbor Ridge's public portal report slow page loads, and the privacy team objects that browsers contact the CA's OCSP responder on every visit, revealing which sites users access. Which change BEST addresses both concerns?
Correct answer: A. Enable OCSP stapling on the web servers
With stapling, the server fetches a signed OCSP response and attaches it during the TLS handshake, so clients do not contact the responder themselves. Publishing CRLs more often does not remove the client lookup and makes downloads larger.
With stapling, the server fetches a signed OCSP response and attaches it during the TLS handshake, so clients do not contact the responder themselves. Publishing CRLs more often does not remove the client lookup and makes downloads larger.
Question 65Security Operations
An investigator arrives at a compromised Linux server that is still running. Based on order of volatility, which evidence should be collected FIRST?
Correct answer: C. Contents of system memory
Memory is the most volatile source listed and is lost at shutdown, and it holds running processes, network connections and injected code. The disk image is important but persists across a reboot, so it is collected after memory.
Memory is the most volatile source listed and is lost at shutdown, and it holds running processes, network connections and injected code. The disk image is important but persists across a reboot, so it is collected after memory.
Question 66Security Architecture
Pinegate Utilities has 45 accounts with permanent domain admin rights that staff use for a few tasks per month. An audit recommends removing standing privilege without slowing emergency work. Which approach BEST meets this?
Correct answer: D. Grant time-bound elevation through PAM with approval and session logs
Just-in-time elevation through a PAM platform grants admin rights only when requested and approved, expires them automatically and records the session, which removes standing privilege. Quarterly reviews reduce the count but still leave accounts permanently privileged between reviews.
Just-in-time elevation through a PAM platform grants admin rights only when requested and approved, expires them automatically and records the session, which removes standing privilege. Quarterly reviews reduce the count but still leave accounts permanently privileged between reviews.
Question 67Security Engineering
A banking mobile app pins the leaf certificate of its API server. Last month, a routine certificate renewal caused the app to reject all connections until an emergency app update shipped. Which change BEST keeps the security benefit while avoiding this outage?
Correct answer: D. Pin the public key, and include a backup key for rotation
Pinning the subject public key, with at least one pre-generated backup key, lets the certificate be renewed without changing the pin. Removing pinning gives up protection against rogue or misissued certificates, and public CAs cannot issue five-year TLS certificates.
Pinning the subject public key, with at least one pre-generated backup key, lets the certificate be renewed without changing the pin. Removing pinning gives up protection against rogue or misissued certificates, and public CAs cannot issue five-year TLS certificates.
Question 68Governance, Risk & Compliance
Developers at a software firm have been pasting proprietary source code into a free public chatbot. Leadership does not want to ban AI tools outright. What should the security architect recommend FIRST?
Correct answer: B. Publish an AI acceptable use policy and an approved tool
A governance response starts with an acceptable use policy that defines allowed data and tools, paired with a sanctioned enterprise service whose contract covers data retention and training use. A full block conflicts with leadership's goal and tends to push usage to unmonitored personal devices.
A governance response starts with an acceptable use policy that defines allowed data and tools, paired with a sanctioned enterprise service whose contract covers data retention and training use. A full block conflicts with leadership's goal and tends to push usage to unmonitored personal devices.
Question 69Security Engineering
A developer at Vexley Software encrypts records with AES-256-GCM. Code review shows that the same 96-bit nonce is hard-coded and reused for every record encrypted under one key. What is the MOST serious consequence?
Correct answer: C. Confidentiality and authentication can both be broken
Reusing a nonce with the same key in GCM repeats the keystream, which exposes relationships between plaintexts, and it also exposes the authentication subkey so tags can be forged. Nonces must be unique per key, for example by using a counter.
Reusing a nonce with the same key in GCM repeats the keystream, which exposes relationships between plaintexts, and it also exposes the authentication subkey so tags can be forged. Nonces must be unique per key, for example by using a counter.
Question 70Security Architecture
Attackers phished several Corvane Media employees using an adversary-in-the-middle proxy that relayed passwords and push MFA approvals in real time. Number matching is already enabled. Which authentication change BEST stops this technique?
Correct answer: B. Deploy FIDO2 passkeys bound to the site origin
FIDO2 and WebAuthn credentials are cryptographically bound to the legitimate origin, so the authenticator will not produce a valid response for a look-alike proxy domain. Number matching prevents blind push approval but does not help when the user is actively signing in through the attacker's relay.
FIDO2 and WebAuthn credentials are cryptographically bound to the legitimate origin, so the authenticator will not produce a valid response for a look-alike proxy domain. Number matching prevents blind push approval but does not help when the user is actively signing in through the attacker's relay.
Question 71Security Operations
A cloud workload alert at Ivers Media shows an IaaS virtual machine making outbound connections to a known mining pool. The team must stop the activity and keep evidence. Which action is BEST?
Correct answer: C. Apply a deny-all security group to the instance and snapshot its volumes
Swapping to a restrictive security group isolates the instance without destroying it, and snapshots preserve disk evidence for analysis. Terminating the instance is the tempting fast fix, but it wipes volatile data and often the attached storage, which ruins the investigation.
Swapping to a restrictive security group isolates the instance without destroying it, and snapshots preserve disk evidence for analysis. Terminating the instance is the tempting fast fix, but it wipes volatile data and often the attached storage, which ruins the investigation.
Question 72Governance, Risk & Compliance
A US defense contractor plans to give an offshore team in a non-allied country access to a repository that holds technical data for a military guidance system. What is the PRIMARY compliance concern?
Correct answer: B. ITAR controls on defense-related technical data
Technical data for defense articles such as guidance systems falls under ITAR, and giving foreign persons access counts as an export that needs authorization. EAR covers dual-use and commercial items like mass-market encryption, so it is not the primary regime for military technical data.
Technical data for defense articles such as guidance systems falls under ITAR, and giving foreign persons access counts as an export that needs authorization. EAR covers dual-use and commercial items like mass-market encryption, so it is not the primary regime for military technical data.
Question 73Security Engineering
A research consortium wants a cloud provider to compute aggregate statistics on encrypted patient data. The provider must never see plaintext, not even in memory during computation, and the consortium does not want to trust the provider's hardware. Which technology BEST fits?
Correct answer: C. Fully homomorphic encryption
Homomorphic encryption allows computation directly on ciphertext, so the provider never decrypts the data. A trusted execution environment also protects data in use, but it requires trusting the hardware vendor's enclave, which the consortium wants to avoid.
Homomorphic encryption allows computation directly on ciphertext, so the provider never decrypts the data. A trusted execution environment also protects data in use, but it requires trusting the hardware vendor's enclave, which the consortium wants to avoid.
Question 74Security Architecture
A company is migrating its customer database to a cloud provider's managed PaaS database service. Under the shared responsibility model, which task remains the customer's responsibility?
Correct answer: A. Configuring database user permissions and network exposure
In PaaS the provider manages the platform, including OS and database engine patching, while the customer still owns its data, identities, access permissions and network exposure settings. Engine patching is a tempting choice because it is customer work in IaaS, but it is provider work in a managed service.
In PaaS the provider manages the platform, including OS and database engine patching, while the customer still owns its data, identities, access permissions and network exposure settings. Engine patching is a tempting choice because it is customer work in IaaS, but it is provider work in a managed service.
Question 75Security Operations
Malware analysts at Ridgeway Defense receive an unknown, heavily packed executable. String extraction shows almost nothing useful, and leadership wants a quick view of its behavior. What is the BEST next step?
Correct answer: D. Run the sample in an isolated sandbox that records process, file and network activity
An isolated sandbox lets the sample unpack and run safely while recording its behavior, which is the fastest way to understand a packed file. Manual disassembly gives deep detail but is slow against packing, and an unknown hash returning no result does not mean the file is benign.
An isolated sandbox lets the sample unpack and run safely while recording its behavior, which is the fastest way to understand a packed file. Manual disassembly gives deep detail but is slow against packing, and an unknown hash returning no result does not mean the file is benign.
Question 76Security Engineering
Solenne Telecom has hundreds of internal applications, each with its cipher choices hard-coded. Leadership expects to replace several algorithms over the next decade, including a post-quantum transition. Which design principle should new applications follow?
Correct answer: A. Crypto agility using shared, configurable crypto libraries
Crypto agility means algorithms and parameters can be swapped through configuration or a shared library without rewriting each application. Longer keys do not help against quantum attacks on RSA and ECC, which require entirely new algorithms.
Crypto agility means algorithms and parameters can be swapped through configuration or a shared library without rewriting each application. Longer keys do not help against quantum attacks on RSA and ECC, which require entirely new algorithms.
Question 77Security Architecture
A media company has 40 cloud accounts across two providers. Engineers regularly create storage buckets with public access and databases without encryption, and the security team finds them weeks later. Which tool BEST provides continuous detection of these misconfigurations?
Correct answer: C. Cloud security posture management across all of the accounts
CSPM continuously evaluates control plane configurations, such as bucket policies and encryption settings, against benchmarks across accounts and providers. A CWPP protects running workloads at the host or container level and does not assess control plane resource settings.
CSPM continuously evaluates control plane configurations, such as bucket policies and encryption settings, against benchmarks across accounts and providers. A CWPP protects running workloads at the host or container level and does not assess control plane resource settings.
Question 78Governance, Risk & Compliance
A bank is evaluating an IaaS provider and wants independent, third-party assurance mapped specifically to the Cloud Controls Matrix. Which evidence BEST meets this need?
Correct answer: D. A CSA STAR Level 2 certification or attestation
CSA STAR Level 2 involves an independent auditor assessing the provider against the Cloud Controls Matrix, through STAR Certification or STAR Attestation. Level 1 is only a self-assessment completed by the provider, so it lacks third-party validation.
CSA STAR Level 2 involves an independent auditor assessing the provider against the Cloud Controls Matrix, through STAR Certification or STAR Attestation. Level 1 is only a self-assessment completed by the provider, so it lacks third-party validation.
Question 79Security Engineering
Two internal microservices exchange webhook messages. They already share a secret key, and the receiver must confirm that each message is unchanged and came from a holder of that key. Non-repudiation is not required. Which mechanism is MOST efficient?
Correct answer: D. HMAC-SHA256 over each message
HMAC combines the shared key with a hash, giving integrity and origin authentication at low cost. A plain hash can be recalculated by anyone who alters the message, and a digital signature adds cost for non-repudiation that is not needed.
HMAC combines the shared key with a hash, giving integrity and origin authentication at low cost. A plain hash can be recalculated by anyone who alters the message, and a digital signature adds cost for non-repudiation that is not needed.
Question 80Security Operations
Kessler Manufacturing wiped and rebuilt compromised servers after an intrusion, but the same attacker regained access within two weeks. Which step was MOST likely skipped or done poorly?
Correct answer: B. Root cause analysis to identify and close the initial access vector
If the initial entry point, such as an unpatched service or stolen credentials, is never found and fixed, rebuilt systems are exposed to the same path. Updating antivirus signatures is a reasonable hygiene step, but it does not remove the weakness that let the attacker in.
If the initial entry point, such as an unpatched service or stolen credentials, is never found and fixed, rebuilt systems are exposed to the same path. Updating antivirus signatures is a reasonable hygiene step, but it does not remove the weakness that let the attacker in.
Question 81Security Architecture
Developers at Quill Logistics deploy containers to Kubernetes using images pulled directly from public registries, and several had critical vulnerabilities. The platform team wants to stop unapproved images from running at all. Which control is MOST effective?
Correct answer: B. Admit only signed, scanned images from the private registry at deploy
An admission controller enforces policy at deployment time, rejecting images that are unsigned, unscanned or from unapproved registries, so they never run. Weekly scans only find problems after vulnerable containers are already in production.
An admission controller enforces policy at deployment time, rejecting images that are unsigned, unscanned or from unapproved registries, so they never run. Weekly scans only find problems after vulnerable containers are already in production.
Question 82Security Engineering
Bramwell University is designing a new internal PKI. The root key must be protected from network compromise, but the PKI must still issue thousands of certificates each week. Which design is MOST appropriate?
Correct answer: D. An offline root CA that signs online issuing subordinate CAs
Keeping the root offline protects the trust anchor, while online subordinate CAs handle daily issuance and can be revoked if compromised. An offline root issuing every certificate would make routine issuance impractical.
Keeping the root offline protects the trust anchor, while online subordinate CAs handle daily issuance and can be revoked if compromised. An offline root issuing every certificate would make routine issuance impractical.
Question 83Governance, Risk & Compliance
A business impact analysis finds that order fulfillment triggers unrecoverable contract penalties if it is down for more than 12 hours. Recovery engineers propose a 16-hour RTO for the supporting systems. What should the analyst conclude?
Correct answer: C. The RTO must be cut to below the 12-hour MTD
The recovery time objective must be shorter than the maximum tolerable downtime, or the business suffers unacceptable harm before recovery finishes. RPO and backup frequency address how much data is lost, not how long the process is down.
The recovery time objective must be shorter than the maximum tolerable downtime, or the business suffers unacceptable harm before recovery finishes. RPO and backup frequency address how much data is lost, not how long the process is down.
Question 84Security Operations
Lantry Insurance wants an early warning if its customer database is ever copied and used outside the company. Which deception control BEST meets this goal?
Correct answer: B. Fake customer records with unique contact details that trigger alerts when used
Honeytokens planted as fake records have no legitimate use, so any contact to their unique email or phone values signals that the data left the company. A honeypot in the DMZ attracts attackers but does not tell you whether the real database was stolen.
Honeytokens planted as fake records have no legitimate use, so any contact to their unique email or phone values signals that the data left the company. A honeypot in the DMZ attracts attackers but does not tell you whether the real database was stolen.
Question 85Security Architecture
A water utility's operations team wants corporate analysts to view process data from the plant historian. The current proposal is to open a firewall rule from the corporate network directly to the historian in the control network. Which design is MOST appropriate?
Correct answer: C. Replicate historian data to a mirror in an industrial DMZ
An industrial DMZ, often called level 3.5 in the Purdue model, lets a replicated historian serve corporate users so no session crosses directly from IT into the control zone. Restricting the direct rule by source IP still creates a path from the corporate network into control systems.
An industrial DMZ, often called level 3.5 in the Purdue model, lets a replicated historian serve corporate users so no session crosses directly from IT into the control zone. Restricting the direct rule by source IP still creates a path from the corporate network into control systems.
Question 86Security Engineering
A defense contractor is concerned that servers could be altered with counterfeit or swapped components between the factory and its loading dock. Which control BEST lets the receiving team verify that the hardware matches what the manufacturer built?
Correct answer: A. Compare a signed manufacturer component manifest to the delivered system
A signed platform certificate or component manifest from the manufacturer lets the receiver check that serial numbers and parts match the factory build. Reimaging the OS does nothing about altered hardware or firmware, and tamper tape is easy to defeat.
A signed platform certificate or component manifest from the manufacturer lets the receiver check that serial numbers and parts match the factory build. Reimaging the OS does nothing about altered hardware or firmware, and tamper tape is easy to defeat.
Question 87Governance, Risk & Compliance
A finance clerk joined a video call with someone who looked and sounded like the CFO and urgently requested a confidential wire transfer. The clerk nearly sent the funds. What is the MOST effective awareness-driven control to add?
Correct answer: B. Train staff to confirm payments via a known separate channel
Out-of-band verification through a known phone number or approval workflow defeats impersonation no matter how convincing the fake is. Teaching people to spot glitches is unreliable because deepfake quality keeps improving.
Out-of-band verification through a known phone number or approval workflow defeats impersonation no matter how convincing the fake is. Teaching people to spot glitches is unreliable because deepfake quality keeps improving.
Question 88Security Operations
Reverse engineers at a managed security provider recover the domain generation algorithm and seed from a malware family affecting several clients. What is the PRIMARY defensive value of this work?
Correct answer: A. It lets defenders predict future C2 domains and block or sinkhole them early
With the algorithm and seed, defenders can generate the domains the malware will try ahead of time and block, monitor or sinkhole them. Attribution is tempting, but code analysis alone rarely proves who built a tool, and that is not the main operational benefit.
With the algorithm and seed, defenders can generate the domains the malware will try ahead of time and block, monitor or sinkhole them. Attribution is tempting, but code analysis alone rarely proves who built a tool, and that is not the main operational benefit.
Question 89Security Architecture
A hospital is installing 2,000 networked smart building sensors and controllers. The vendor's devices rely on a cloud management service, cannot run endpoint agents and receive firmware updates irregularly. Which network design is MOST appropriate?
Correct answer: C. Isolate them on a dedicated segment allowed only to the vendor cloud
Devices that cannot run agents or be patched reliably should be isolated in their own segment with allowlisted flows to only the services they need, such as the vendor's cloud endpoints. Guest Wi-Fi provides internet access but is shared with untrusted users and does not restrict what the devices can reach.
Devices that cannot run agents or be patched reliably should be isolated in their own segment with allowlisted flows to only the services they need, such as the vendor's cloud endpoints. Guest Wi-Fi provides internet access but is shared with untrusted users and does not restrict what the devices can reach.
Question 90Security Engineering
A security architect reviewing a custom cryptographic library notes that the time to verify a MAC varies depending on how many leading bytes of the tag are correct. Which remediation BEST addresses this?
Correct answer: D. Use a constant-time comparison function
A comparison that exits early leaks how many bytes matched, which creates a timing side channel. Constant-time comparison removes the leak, while random delays only add noise that can be averaged out with more samples.
A comparison that exits early leaks how many bytes matched, which creates a timing side channel. Constant-time comparison removes the leak, while random delays only add noise that can be averaged out with more samples.
The real SecurityX exam at a glance
90questions
2h 45mtime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CEH v13 Practice Test125 questions · 312-50CISSP Practice Test150 questions · 2024 outlineCompTIA Security+ Practice Test90 questions · SY0-701 & SY0-801CompTIA CySA+ Practice Test85 questions · CS0-004CHFI v11 Practice Test150 questions · 312-49CCISO Practice Test150 questions · Blueprint v3
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the SecurityX exam. They are not real exam questions. SecurityX and CompTIA are trademarks of their owners. Real exam format: up to 90 questions · 165 minutes · pass/fail result with no scaled score · the real exam also has performance-based questions.