Welcome to the CompTIA SecurityX Certification (CAS-005) exam questions-and-answers listing page. Here, you will find a comprehensive collection of 540 real practice questions designed to help you prepare effectively for the certification exam. This resource is intended to give you insight into the types of questions you might encounter, allowing you to test your knowledge and familiarize yourself with the exam’s subject matter.
To make the best use of this page, you can dive into the questions, attempt to answer them, and then check the provided explanations and correct answers. This self-assessment can help identify areas where you may need further study. It’s also beneficial to take note of recurring themes and topics across multiple questions, as these can highlight key areas that warrant additional review.
Here are a few study approach tips that may enhance your chances of passing the CompTIA SecurityX Certification exam:
1. **Create a Study Schedule:** Set a consistent study plan that allows you to cover all the relevant topics without cramming. Allocate time for both learning new material and revising what you've already studied.
2. **Engage in Active Learning:** Rather than passively reading or watching videos, engage with the material by taking practice tests, participating in study groups, and discussing concepts with peers.
3. **Focus on Understanding Concepts:** Strive to understand the underlying principles behind security practices rather than just memorizing facts. This deeper understanding will help you tackle scenario-based questions more effectively.
With dedicated study and use of these resources, you're on your way to successfully earning your CompTIA SecurityX Certification. Good luck!
Which of the following will an adversary do during the reconnaissance phase of the Lockheed Martin kill chain? (SELECT THREE)
OBJ 1.4: Passively harvesting information from a target is the main purpose of the reconnaissance phase. Harvesting email addresses from the public internet, identifying employees on social media (particularly LinkedIn profiles), discovering public-facing servers, and gathering other publicly available information can allow an attacker to develop a more thorough understanding of a targeted organization. Acquiring or developing zero-day exploits, selecting backdoor implants, and choosing command and control (C2) mechanisms will require the information gathered during reconnaissance to be effective. Still, these activities will occur during the weaponization phase. For support or reporting issues, include Question ID: 63fe07943b7322449ddbcfa7 in your ticket. Thank you.
A company is implementing a Zero Trust architecture with continuous authorization for its remote workforce. To enhance security, the organization wants to monitor user activity and dynamically adjust access permissions based on detected risks during a session. Which of the following components is most critical for enabling this functionality?
OBJ 2.6: Continuous authorization relies on behavior analytics to monitor user actions, device compliance, and other contextual factors during a session. This allows dynamic adjustments to access permissions if anomalous or risky activity is detected. Static Access Control Lists (ACLs) cannot adapt dynamically to changes in user behavior. Predefined role-based access control (RBAC) settings provide initial access control but do not support dynamic monitoring or adjustments. Multi-factor authentication (MFA) at the start of a session enhances initial authentication but does not address mid-session risks or changes. For support or reporting issues, include Question ID: 6751001a23df37e1b5ec5ff7 in your ticket. Thank you.
Judith is conducting a vulnerability scan of her data center. She notices that a management interface for a virtualization platform is exposed to her vulnerability scanner. Which of the following networks should the hypervisor's management interface be exposed to ensure the best security of the virtualization platform?
OBJ 2.3: The management interface should only be exposed to an isolated or dedicated network used for the management and configuration of the network device and platforms only. This would also help reduce the likelihood of an attack against the virtualization platform or the hypervisor itself. The external zone (internet), internal zone (LAN), or screened subnet (formerly called a DMZ) should not have the management interface exposed to them. For support or reporting issues, include Question ID: 63fe07043b7322449ddbc8a6 in your ticket. Thank you.
An organization is deploying a critical software application and wants to ensure the integrity and authenticity of its code. Which of the following practices best supports the verification of software provenance?
OBJ 3.8 - Software provenance refers to verifying the origin, authenticity, and integrity of software. Requiring developers to sign software packages with digital certificates ensures that the software comes from a trusted source and has not been tampered with. Testing in sandbox environments and scanning for vulnerabilities are important practices but do not verify software provenance. Monitoring performance post-deployment helps detect issues but does not establish the software’s integrity or authenticity. For support or reporting issues, include Question ID: 67508577f86f3d695e9ad0dc in your ticket. Thank you.
XYZ Training wants to ensure that the operating system’s kernel has not been changed by malware. Which of the following endpoint security controls would ensure that the workstations perform a check of the operating system boot loader and kernel using stored digital certificates before loading up the installed operating system?
OBJ 3.4: Secure boot is a feature of UEFI that prevents unwanted processes from executing during the boot operation by checking a list of digital certificates from valid operating system vendors before the system booting up. A self-encrypting drive (SED) is a type of solid state device (SSD) or hard disk drive (HDD) that conducts transparent encryption of all data as it is written to the device using an embedded hardware cryptographic processor. Shell restrictions are configurations that limit an end user’s ability to access the command prompt in Windows or the shell in Linux to prevent their ability to interact directly with the operating system. Attestation services are used to ensure the integrity of the computer’s startup and runtime operations. Hardware-based attestation is designed to protect against threats and malicious code that could be loaded before the operating system is loaded. For support or reporting issues, include Question ID: 63fe07ca3b7322449ddbd255 in your ticket. Thank you.
You are notified by an external organization that an IP address associated with your company's email server has been sending spam emails requesting funds as part of a lottery collection scam. An investigation into the incident reveals the email account used was Connor from the sales department and that Connor's email account was only used from one workstation. You analyze Connor's workstation and discover several unknown processes running, but netflow analysis reveals no attempted lateral movement to other workstations on the network. Which containment strategy would be most effective to use in this scenario?
OBJ 4.2: Isolation of Connor’s computer by deactivating the port on the switch should be performed instead of just unplugging the computer. This would guarantee that Connor won’t just plug the computer back into the network as soon as you leave his desk. While Connor won’t be able to work without his workstation, it is essential to isolate the issue quickly to prevent future attempts at lateral movement from occurring and protect the company’s data needed for continued business operations. While we are unsure of the issue's initial root cause, we know it is currently isolated to Connor’s machine. He should receive remedial cybersecurity training, his workstation’s hard drive forensically imaged for later analysis, and then his workstation should be remediated or reimaged. It is better to isolate just Connor’s machine instead of the entire network segment in this scenario. Isolating the network segment, without evidence indicating the need to do so, would have been overkill and overly disruptive to the business. Reimaging Connor’s device may destroy data that could have otherwise been recovered and led to a successful root cause analysis. There is also insufficient evidence in this scenario to warrant disciplinary action against Connor, as he may have clicked on a malicious link by mistake. For support or reporting issues, include Question ID: 63fe07263b7322449ddbca48 in your ticket. Thank you.
You are working as a network administrator and are worried about the possibility of an insider threat. You want to enable a security feature that would remember the Layer 2 address first connected to a particular switch port to prevent someone from unplugging a workstation from the switch port and connecting their laptop to that same switch port. Which of the following security features would BEST accomplish this goal?
OBJ 2.4: Port security, also known as persistent MAC learning or Sticky MAC, is a security feature that enables an interface to retain dynamically learned MAC addresses when the switch is restarted or if the interface goes down and is brought back online. This is a security feature that can be used to prevent someone from unplugging their office computer and connecting their laptop to the network jack without permission since the switch port connected to that network jack would only allow the computer with the original MAC address to gain connectivity. For support or reporting issues, include Question ID: 63fe06de3b7322449ddbc6d0 in your ticket. Thank you.
XYZ Training is concerned with the possibility of employees accessing another user's workstation in secured areas without their permission. Which of the following would BEST be able to prevent this from happening?
OBJ 2.4: The BEST choice is to implement biometric identification for user logins, such as a fingerprint reader or a retina scanner. This would ensure that even if an employee could discover another employee's username and password, they would be prevented from logging into the workstation without the employee's finger or eye to scan. Enforcing short password retention can limit the possible damage when a password is disclosed, but it won't prevent a login during the valid period. Security cameras may act as a deterrent or detective control, but they cannot prevent an employee from logging into the workstation as another employee. Security cameras could be used to determine who logged in after the fact, though. For support or reporting issues, include Question ID: 63fe06c33b7322449ddbc57f in your ticket. Thank you.
A third-party vendor has just released patches to resolve a major vulnerability. There are over 100 critical devices that need to be updated. What action should be taken to ensure the patch is installed with minimal downtime?
OBJ 3.6: Patches should always be tested first. Once successfully tested, deployment to the production environment can then be accomplished. For support or reporting issues, include Question ID: 63fe07753b7322449ddbce1c in your ticket. Thank you.
You are planning an engagement with a new client. The client wants your penetration testers to target their web and email servers that are hosted in a screened subnet and are accessible to visitors over the Internet. Which target type best describes these targets?
OBJ 1.4: An external target type best describes these targets since the question doesn’t clearly describe if the servers are first-party or third-party hosted. An external target type is an asset that can be accessed from outside of the organization. For example, if the webserver is visible on the Internet, it is considered an external target. An internal target type means that assets can be accessed from within the organization. This can either be physically or logically from within the network, and it best simulates an insider threat. This target type can also be used to simulate an external hacker who has gained credentials on the network, such as using a spear phishing attack. First-party hosted targets are assets hosted by the client organization themselves. Third-party hosted targets are assets hosted by a vendor, partner, or cloud service provider. For support or reporting issues, include Question ID: 63fe078f3b7322449ddbcf61 in your ticket. Thank you.
Frequently Asked Questions
How realistic are the practice questions for the CompTIA SecurityX Certification exam?
The practice questions are designed to closely simulate the types of questions you may encounter on the actual CompTIA SecurityX exam, helping you to familiarize yourself with the exam format and difficulty.
How should I use the practice questions to prepare for the exam?
It's recommended to take the practice questions in timed conditions, review your responses, and focus on the explanations for any questions you answered incorrectly to enhance your understanding.
How many practice questions should I complete before taking the real exam?
While there's no set number, completing a substantial portion, such as 300-400 questions, helps reinforce your knowledge and identify areas needing improvement before the actual exam.
Can I track my progress using the practice questions?
Yes, many practice exam platforms provide tracking features that allow you to monitor your scores, progress over time, and areas where you may need additional study.
Are the practice questions updated regularly to reflect changes in the CompTIA SecurityX exam?
Yes, the practice questions are regularly updated to align with the latest exam objectives and trends in cybersecurity, ensuring your preparation is current.
