Free CAS-005: CompTIA SecurityX Exam Questions and Answers
96 verified practice questions for CAS-005.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Exam code
- CAS-005
- Provider
- CompTIA
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
An organization wants to implement a platform to better identify which specific assets are affected by a given vulnerability. Which of the following components provides the best foundation to achieve this goal?
Please select an optionIncorrectCorrect answer: B
A Configuration Management Database (CMDB) provides the best foundation for identifying which specific assets are affected by a given vulnerability. A CMDB maintains detailed information about the IT environment, including hardware, software, configurations, and relationships between assets. This comprehensive view allows organizations to quickly identify and address vulnerabilities affecting specific assets. References: • CompTIA SecurityX Study Guide: Discusses the role of CMDBs in asset management and vulnerability identification. • ITIL (Information Technology Infrastructure Library) Framework: Recommends the use of CMDBs for effective configuration and asset management. • "Configuration Management Best Practices" by Bob Aiello and Leslie Sachs: Covers the importance of CMDBs in managing IT assets and addressing vulnerabilities.
Was this answer correct?Question #2
The identity and access management team is sending logs to the SIEM for continuous monitoring. The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated. Which of the following is the most likely reason for the inaccurate alerts?
Please select an optionIncorrectCorrect answer: C
Proper parsing of data is crucial for the SIEM to accurately interpret and analyze the logs being forwarded by the log collector. If the data is not parsed correctly, the SIEM may misinterpret the logs, leading to false positives and inaccurate alerts. Ensuring that the log data is correctly parsed allows the SIEM to correlate and analyze the logs effectively, which is essential for accurate alerting and monitoring.
Was this answer correct?Question #3
A security analyst discovered requests associated with IP addresses known for born legitimate 3nd bot-related traffic. Which of the following should the analyst use to determine whether the requests are malicious?
Please select an optionIncorrectCorrect answer: A
The user-agent string can provide valuable information to distinguish between legitimate and bot-related traffic. It contains details about the browser, device, and sometimes the operating system of the client making the request. Why Use User-Agent String? • Identify Patterns: User-agent strings can help identify patterns that are typical of bots or legitimate users. • Block Malicious Bots: Many bots use known user-agent strings, and identifying these can help block malicious requests. • Anomalies Detection: Anomalous user-agent strings can indicate spoofing attempts or malicious activity. Other options provide useful information but may not be as effective for initial determination of the nature of the request: • B. Byte length of the request: This can indicate anomalies but does not provide detailed information about the client. • C. Web application headers: While useful, they may not provide enough distinction between legitimate and bot traffic. • D. HTML encoding field: This is not typically used for identifying the nature of the request. References: • CompTIA SecurityX Study Guide • "User-Agent Analysis for Security," OWASP • NIST Special Publication 800-94, "Guide to Intrusion Detection and Prevention Systems (IDPS)"
Was this answer correct?Question #4
Within a SCADA a business needs access to the historian server in order together metric about the functionality of the environment. Which of the following actions should be taken to address this requirement?
Please select an optionIncorrectCorrect answer: C
The best action to address the requirement of accessing the historian server within a SCADA system is to isolate the historian server for connections only from the SCADA environment. Here's why: • Security and Isolation: Isolating the historian server ensures that only authorized devices within the SCADA environment can connect to it. This minimizes the attack surface and protects sensitive data from unauthorized access. • Access Control: By restricting access to the historian server to only SCADA devices, the organization can better control and monitor interactions, ensuring that only legitimate queries and data retrievals occur. • Best Practices for Critical Infrastructure: Following the principle of least privilege, isolating critical components like the historian server is a standard practice in securing SCADA systems, reducing the risk of cyberattacks. • References:
Was this answer correct?Question #5
A global manufacturing company has an internal application mat is critical to making products This application cannot be updated and must Be available in the production area A security architect is implementing security for the application. Which of the following best describes the action the architect should take-?
Please select an optionIncorrectCorrect answer: D
Creating a separate network for users who need access to the application is the best action to secure an internal application that is critical to the production area and cannot be updated. Why Separate Network? • Network Segmentation: Isolates the critical application from the rest of the network, reducing the risk of compromise and limiting the potential impact of any security incidents. • Controlled Access: Ensures that only authorized users have access to the application, enhancing security and reducing the attack surface. • Minimized Risk: Segmentation helps in protecting the application from vulnerabilities that could be exploited from other parts of the network. Other options, while beneficial, do not provide the same level of security for a critical application: • A. Disallow wireless access: Useful but does not provide comprehensive protection. • B. Deploy intrusion detection capabilities using a network tap: Enhances monitoring but does not provide the same level of isolation and control. • C. Create an acceptable use policy: Important for governance but does not provide technical security controls. References: • CompTIA SecurityX Study Guide • NIST Special Publication 800-125, "Guide to Security for Full Virtualization Technologies" • "Network Segmentation Best Practices," Cisco Documentation
Was this answer correct?Question #6
A security officer received several complaints from users about excessive MPA push notifications at night The security team investigates and suspects malicious activities regarding user account authentication Which of the following is the best way for the security officer to restrict MI~A notifications''
Please select an optionIncorrectCorrect answer: D
Excessive MFA push notifications can be a sign of an attempted push notification attack, where attackers repeatedly send MFA prompts hoping the user will eventually approve one by mistake. To mitigate this: • A. Provisioning FIDO2 devices: While FIDO2 devices offer strong authentication, they may not be practical for all users and do not directly address the issue of excessive push notifications. • B. Deploying a text message-based MFA: SMS-based MFA can still be vulnerable to similar spamming attacks and phishing. • C. Enabling OTP via email: Email-based OTPs add another layer of security but do not directly solve the issue of excessive notifications. • D. Configuring prompt-driven MFA: This option allows users to respond to prompts in a secure manner, often including features like time-limited approval windows, additional verification steps, or requiring specific actions to approve. This can help prevent users from accidentally approving malicious attempts. Configuring prompt-driven MFA is the best solution to restrict unnecessary MFA notifications and improve security. References: • CompTIA Security+ Study Guide • NIST SP 800-63B, "Digital Identity Guidelines" • "Multi-Factor Authentication: Best Practices" by Microsoft
Was this answer correct?Question #7
A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems. Which of the following should the security engineer modify?
Please select an optionIncorrectCorrect answer: D
The sshd_config file is the main configuration file for the OpenSSH server. To disable weak CBC (Cipher Block Chaining) ciphers for SSH connections, the security engineer should modify the sshd_config file to update the list of allowed ciphers. This file typically contains settings for the SSH daemon, including which encryption algorithms are allowed. By editing the /etc/ssh/sshd_config file and updating the Ciphers directive, weak ciphers can be removed, and only strong ciphers can be allowed. This change ensures that the SSH server does not use insecure encryption methods. References: • CompTIA Security+ Study Guide • OpenSSH manual pages (man sshd_config) • CIS Benchmarks for Linux
Was this answer correct?Question #8
An audit finding reveals that a legacy platform has not retained loos for more than 30 days The platform has been segmented due to its interoperability with newer technology. As a temporary solution, the IT department changed the log retention to 120 days. Which of the following should the security engineer do to ensure the logs are being properly retained?
Please select an optionIncorrectCorrect answer: C
To ensure that logs from a legacy platform are properly retained beyond the default retention period, configuring the SIEM to aggregate the logs is the best approach. SIEM solutions are designed to collect, aggregate, and store logs from various sources, providing centralized log management and retention. This setup ensures that logs are retained according to policy and can be easily accessed for analysis and compliance purposes. References: • CompTIA SecurityX Study Guide: Discusses the role of SIEM in log management and retention. • NIST Special Publication 800-92, "Guide to Computer Security Log Management": Recommends the use of centralized log management solutions, such as SIEM, for effective log retention and analysis. • "Security Information and Event Management (SIEM) Implementation" by David Miller: Covers best practices for configuring SIEM systems to aggregate and retain logs from various sources.
Was this answer correct?Question #9
Which of the following is the security engineer most likely doing?
Please select an optionIncorrectCorrect answer: A
In the given scenario, the security engineer is likely examining login activities and their associated geolocations. This type of analysis is aimed at identifying unusual login patterns that might indicate an impossible travel scenario. An impossible travel scenario is when a single user account logs in from geographically distant locations in a short time, which is physically impossible. By assessing login activities using geolocation, the engineer can tune alerts to identify and respond to potential security breaches more effectively.
Was this answer correct?Question #10
An organization is looking for gaps in its detection capabilities based on the APTs that may target the industry Which of the following should the security analyst use to perform threat modeling?
Please select an optionIncorrectCorrect answer: A
The ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is the best tool for a security analyst to use for threat modeling when looking for gaps in detection capabilities based on Advanced Persistent Threats (APTs) that may target the industry. Here's why: • Comprehensive Framework: ATT&CK provides a detailed and structured repository of known adversary tactics and techniques based on real-world observations. It helps organizations understand how attackers operate and what techniques they might use. • Gap Analysis: By mapping existing security controls against the ATT&CK matrix, analysts can identify which tactics and techniques are not adequately covered by current detection and mitigation measures. • Industry Relevance: The ATT&CK framework is continuously updated with the latest threat intelligence, making it highly relevant for industries facing APT threats. It provides insights into specific APT groups and their preferred methods of attack. • References:
Was this answer correct?
Continue with CAS-005: CompTIA SecurityX Exam
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in CAS-005: CompTIA SecurityX Exam, the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Other CompTIA certifications
- SK0-004: CompTIA Server (opens in a new tab)
- SY0-701: CompTIA Security 2023 (opens in a new tab)
- N10-008: CompTIA Network (opens in a new tab)
- CS0-002: CompTIA CySA Certification Exam (CS0-002) (opens in a new tab)
- SY0-601: CompTIA Security 2021 (opens in a new tab)
- N10-009: CompTIA Network+ Exam (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://www.comptia.org/certifications
- Q1: What are CompTIA Certification Exams?
- A: CompTIA Certification Exams validate your expertise in various IT disciplines, including networking, security, cloud computing, and IT support. These certifications demonstrate your proficiency in applying best practices and industry standards to manage and troubleshoot IT environments.
- Q2: Why should I pursue CompTIA Certification?
- A: CompTIA Certification enhances your professional credibility, showcasing your skills and knowledge in essential IT areas. This can lead to better job opportunities, higher salaries, and career advancement in IT support, networking, cybersecurity, and cloud computing fields.
- Q3: What are the benefits of CompTIA Certification?
- A: Benefits include recognition as a certified IT professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest IT industry trends and best practices.
- Q4: Who should take CompTIA Certification Exams?
- A: IT professionals, network administrators, cybersecurity experts, cloud engineers, and anyone involved in managing and supporting IT infrastructure should consider these certifications to validate their expertise and advance their careers.
- Q5: What types of CompTIA Certification Exams are available?
- A: CompTIA offers various certification paths, including:
- Q6: How do I prepare for CompTIA Certification Exams?
- A: Preparation can include official CompTIA training courses, study guides, practice exams, online tutorials, and hands-on experience in relevant IT disciplines.
- Q7: Where can I take CompTIA Certification Exams?
- A: CompTIA Certification Exams can be taken at authorized Pearson VUE testing centers worldwide or online, providing flexibility to fit your schedule and location.
- Q8: How do CompTIA Certifications impact my career?
- A: CompTIA Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in IT support, networking, cybersecurity, and cloud computing.
- Q9: Are there any prerequisites for CompTIA Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior certifications. Check the specific requirements for each certification path on the CompTIA website.
- Q10: How often do I need to recertify for CompTIA Certifications?
- A: CompTIA Certifications typically require recertification every three years to ensure that certified professionals stay updated with the latest IT technologies and industry practices.