01. Which of the following best describes the challenges associated with widespread adoption of homomorphic encryption techniques?
a) Incomplete mathematical primitives
b) No use cases to drive adoption
c) Quantum computers not yet capable
d) insufficient coprocessor support
02. A compliance officer is reviewing the data sovereignty laws in several countries where the organization has no presence. Which of the following is the most likely reason for reviewing these laws?
a) The organization is performing due diligence of potential tax issues.
b) The organization has been subject to legal proceedings in countries where it has a presence.
c) The organization is concerned with new regulatory enforcement in other countries.
d) The organization has suffered brand reputation damage from incorrect media coverage.
03. An organization's load balancers have reached EOL and are scheduled to be replaced. The organization identified a new, critical vulnerability that affects an unused function of the load balancers. Which of the following are the best ways to address the risk to the organization?
(Choose two.)
a) Disable the vulnerable service.
b) Request a risk acceptance for the vulnerability indefinitely.
c) Exclude the devices from vulnerability scans.
d) Immediately decommission the hardware.
e) Do not allow any network traffic to or from the hardware.
f) Request a risk acceptance for the vulnerability for 90 days.
04. A company detects suspicious activity associated with external connections. Security detection tools are unable to categorize this activity. Which of the following is the best solution to help the company overcome this challenge?
a) Implement an Interactive honeypot
b) Map network traffic to known loCs.
c) Monitor the dark web
d) implement UEBA
05. Which of the following best describes the advantage of homomorphic encryption when compared to other encryption methodologies?
a) The need for a pre-shared key is removed.
b) Resource utilization is lower.
c) Support for field-specific tokenization is added.
d) Data integrity is protected by advanced hashing routines.
06. An organization receives OSINT reports about an increase in ransomware targeting fileshares at peer companies. The organization wants to deploy hardening policies to its servers and workstations in order to contain potential ransomware. Which of the following should an engineer do to best achieve this goal?
a) Enable biometric authentication mechanisms on user workstations and block port 53 traffic.
b) Allow only interactive log-in for users on workstations and restrict port 445 traffic to fileshares.
c) Instruct users to use a password manager when generating new credentials and secure port 443 traffic.
d) Give users permission to rotate administrator passwords and deny port 80 traffic.
07. Which of the following best explains the importance of determining organization risk appetite when operating with a constrained budget?
a) Risk appetite directly impacts acceptance of high-impact low-likelihood events.
b) Organizational risk appetite varies from organization to organization
c) Budgetary pressure drives risk mitigation planning in all companies
d) Risk appetite directly influences which breaches are disclosed publicly
08. A company runs a DAST scan on a web application. The tool outputs the following recommendations:
• Use Cookie prefixes.
• Content Security Policy - SameSite=strict is not set.
Which of the following vulnerabilities has the tool identified?
a) RCE
b) XSS
c) CSRF
d) TOCTOU
09. Which of the following AI concerns is most adequately addressed by input sanitation?
a) Model inversion
b) Prompt Injection
c) Data poisoning
d) Non-explainable model
10. After an increase in adversarial activity, a company wants to implement security measures to mitigate the risk of a threat actor using compromised accounts to mask unauthorized activity. Which of the following is the best way to mitigate the issue?
a) Web application firewall
b) Threat intelligence platforms
c) Reverse engineering
d) User and entity behavior analytics
The purpose of this Sample Question Set is to provide you with information about the CompTIA SecurityX exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the CAS-005 certification test. To get familiar with real exam environment, we suggest you try our Sample CompTIA SecurityX Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual CompTIA SecurityX certification exam.