CompTIA CAS-005: CompTIA SecurityX

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Security engineering

   A company must allow developers to deploy containers that call a payment API. The API must accept only traffic from workloads with a verified identity, and no static API keys may be stored in images. Which control best meets this?

   1. AWorkload identity with short-lived tokens issued by a workload identity provider, validated by the API gateway
   2. BBasic authentication with a password stored in the container configuration file and passed to the API gateway as a base64 header
   3. CA shared API key stored in an environment variable baked into the image during the build step
   4. DSource IP allowlisting of the cluster egress NAT address on the gateway using a static /24 CIDR rule
   Show answer and explanationHide answer

   Correct answer: A

   Short-lived workload identities remove static secrets and let the gateway verify who is calling. A shared key in an image is exactly the secret exposure the requirement forbids, and IP allowlisting does not prove workload identity.

2. Question 2Security operations

   A SOC analyst notices repeated failed logins followed by a successful login from an unusual country for a privileged account. Which response is the most appropriate first step?

   1. AWait a week and monitor whether the failed login pattern repeats later
   2. BDisable or lock the account pending verification, and review recent session activity
   3. CClose the alert because the login succeeded with valid credentials and an approved MFA prompt on record
   4. DShare the account password in the incident channel to speed up review of the session records
   Show answer and explanationHide answer

   Correct answer: B

   Locking the account and reviewing session activity contains a likely account takeover quickly. Waiting, closing the alert and exposing credentials all increase the damage.

3. Question 3Security architecture

   An enterprise is designing a zero-trust network for remote employees accessing internal applications. Which principle should guide the design?

   1. ATrust is granted per request based on identity, device posture, and context rather than network location
   2. BPerimeter firewalls with strict ingress rules are the primary control required at the edge
   3. CUsers connected through the corporate VPN are trusted by default and their subnet is internal
   4. DAccess is granted once at login and the session is then trusted without reevaluation for its lifetime, even after device changes
   Show answer and explanationHide answer

   Correct answer: A

   Zero trust evaluates each access request using identity, device health and context, and it does not assume trust from network location. Perimeter-only and VPN-based trust models contradict this principle.

4. Question 4Governance, risk, and compliance

   A regulated company must demonstrate that access to sensitive systems is reviewed regularly. Which control best provides this evidence?

   1. ADeleting logs after a week to free storage on the collectors and shorten index rebuilds
   2. BPeriodic access reviews with documented approvals, removals, and retained records
   3. CGranting administrator rights to every staff member by default so helpdesk tickets close faster
   4. DAn undocumented verbal agreement with managers reviewed once a year
   Show answer and explanationHide answer

   Correct answer: B

   Periodic, documented access reviews with retained records give auditors evidence of control operation. Verbal agreements, broad rights and short log retention fail the requirement.

5. Question 5Security engineering

   A security engineer must protect data at rest in a cloud object store using keys that the company controls, with the ability to revoke access to the data quickly. Which approach is best?

   1. ARelying on TLS to protect data stored at rest, since the bucket uses HTTPS
   2. BEncrypting files with a password written in the same bucket as the objects
   3. CProvider-managed keys with no rotation policy, so the tenant has no direct key revocation path for the bucket
   4. DCustomer-managed keys in a KMS with a key policy that can be disabled to revoke access
   Show answer and explanationHide answer

   Correct answer: D

   Customer-managed keys let the organization disable or revoke the key, which makes the data unreadable on demand. TLS protects data in transit, not at rest, and keeping passwords beside the data defeats encryption.