Free CAS-003: CompTIA Advanced Security Practitioner (CASP) CAS-003 Exam Questions and Answers

Last updated: September 7, 2026

Exam code

CAS-003

Provider

CompTIA

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A company has entered into a business agreement with a business partner for managed human resources services. The Chief Information Security Officer (CISO) has been asked to provide documentation that is required to set up a business-to-business VPN between the two organizations. Which of the following is required in this scenario?

   • A. ISA
   • B. BIA
   • C. SLA
   • D. RA
   Reveal Answer

2. Question #2

   Given the following output from a local PC: Which of the following ACLs on a stateful host-based firewall would allow the PC to serve an intranet website?

   • A. Allow 172.30.0.28:80 -> ANY
   • B. Allow 172.30.0.28:80 -> 172.30.0.0/16
   • C. Allow 172.30.0.28:80 -> 172.30.0.28:443
   • D. Allow 172.30.0.28:80 -> 172.30.0.28:53
   Reveal Answer

3. Question #3

   A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the massages. After determining the alert was a true positive, which of the following represents OST likely cause?

   • A. Attackers are running reconnaissance on company resources.
   • B. An outside command and control system is attempting to reach an infected system.
   • C. An insider trying to exfiltrate information to a remote network.
   • D. Malware is running on a company system
   Reveal Answer

4. Question #4

   A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in the prediction of the malware?

   • A. The workstations should be isolated from the network.
   • B. The workstations should be donated for refuse.
   • C. The workstations should be reimaged
   • D. The workstations should be patched and scanne
   Reveal Answer

5. Question #5

   An organization is concerned with potential data loss in the event of a disaster, and created a backup datacenter as a mitigation strategy. The current storage method is a single NAS used by all servers in both datacenters. Which of the following options increases data availability in the event of a datacenter failure?

   • A. Replicate NAS changes to the tape backups at the other datacenter.
   • B. Ensure each server has two HBAs connected through two routes to the NAS.
   • C. Establish deduplication across diverse storage paths.
   • D. Establish a SAN that replicates between datacenters.
   Reveal Answer

6. Question #6

   A pentester must attempt to crack passwords on a windows domain that enforces strong complex passwords. Which of the following would crack the MOST passwords in the shortest time period?

   • A. Online password testing
   • B. Rainbow tables attack
   • C. Dictionary attack
   • D. Brute force attack
   Reveal Answer

7. Question #7

   A software project manager has been provided with a requirement from the customer to place limits on the types of transactions a given user can initiate without external interaction from another user with elevated privileges. This requirement is BEST described as an implementation of:

   • A. an administrative control
   • B. dual control
   • C. separation of duties
   • D. least privilege
   Reveal Answer

8. Question #8

   A company provides on-demand cloud computing resources for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for customer access to the administrative website. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data from customer A was found on a hidden directory within the VM of company B. Company B is not in the same industry as company A and the two are not competitors. Which of the following has MOST likely occurred?

   • A. Both VMs were left unsecured and an attacker was able to explogt network vulnerabilities to access each and move the data.
   • B. A stolen two factor token was used to move data from one virtual guest to another host on the same network segment.
   • C. A hypervisor server was left un-patched and an attacker was able to use a resource exhaustion attack to gain unauthorized access.
   • D. An employee with administrative access to the virtual guests was able to dump the guest memory onto a mapped disk.
   Reveal Answer

9. Question #9

   A security engineer is responsible for monitoring company applications for known vulnerabilities. Which of the following is a way to stay current on explogts and information security news?

   • A. Update company policies and procedures
   • B. Subscribe to security mailing lists
   • C. Implement security awareness training
   • D. Ensure that the organization vulnerability management plan is up-to-date
   Reveal Answer

10. Question #10

    An accountant at a small business is trying to understand the value of a server to determine if the business can afford to buy another server for DR. The risk manager only provided the accountant with the SLE of $24,000, ARO of 20% and the exposure factor of 25%. Which of the following is the correct asset value calculated by the accountant?

    • A. $4,800
    • B. $24,000
    • C. $96,000
    • D. $120,000
    Reveal Answer