Free CAS-005 practice test: 30 questions with answers

Short-lived workload identities remove static secrets and let the gateway verify who is calling. A shared key in an image is exactly the secret exposure the requirement forbids, and IP allowlisting does not prove workload identity.

Customer-managed keys let the organization disable or revoke the key, which makes the data unreadable on demand. TLS protects data in transit, not at rest, and keeping passwords beside the data defeats encryption.

TLS 1.3 uses ephemeral key exchange, which provides forward secrecy, and legacy protocols are disabled. Static RSA key exchange lacks forward secrecy, and SSL 3.0, RC4 and export ciphers are broken.

Microsegmentation with default-deny policies restricts which workloads can talk to each other, which contains lateral movement. The other options do not limit east-west traffic.

A digital signature lets anyone verify with the public key while only the publisher holds the private key. A shared MAC would let verifiers forge tags, and a hash on the same page can be replaced by an attacker who controls the page.

Secure prevents transmission over plain HTTP, and HttpOnly stops JavaScript from reading the cookie, which reduces theft via network sniffing and script injection. Longer lifetimes and URL tokens increase exposure.

A managed secrets service with rotation and audit logs keeps secrets out of code and records access. Committed or logged secrets leak, and shared spreadsheets lack control and auditability.

Protected branches with review and signed artifacts with verified provenance prevent unreviewed or tampered code reaching production. Broad admin rights and keys in the repository make tampering easy.

Locking the account and reviewing session activity contains a likely account takeover quickly. Waiting, closing the alert and exposing credentials all increase the damage.

Centralized, correlated logging with tuned detections across sources shortens detection time. Local-only logs, disabled alerts and quarterly reviews all delay detection.

Capturing volatile memory and disk images before containment preserves evidence, and isolation then limits spread. Rebooting or deleting files destroys evidence, and wiping without imaging does the same.

Compensating controls reduce exposure immediately, and an expedited patch follows the risk. Ignoring or waiting leaves the exposure open, and disabling scans hides the risk.

Hypothesis-driven hunts using behavioural telemetry and ATT&CK techniques find activity that signatures miss. Signature-only detection and blanket blocks miss or disrupt legitimate work, and deny logs cover a narrow slice.

Checking the hash against threat intelligence and reviewing its execution context gives fast evidence of whether the alert is malicious. Broad quarantine and public posting are premature, and waiting for the vendor delays response.

Revoking sessions and resetting credentials stop the attacker's access, and preserving logs supports analysis. Deleting content and disabling logging destroy evidence and reduce visibility.

A suspicious process chain with a known-bad outbound connection is strong evidence of compromise. Name similarity, age and load alone are weak indicators.

Zero trust evaluates each access request using identity, device health and context, and it does not assume trust from network location. Perimeter-only and VPN-based trust models contradict this principle.

Federation with a central identity provider gives one source of truth and consistent policy, with automated provisioning such as SCIM. Local accounts and shared administrators cannot be governed consistently.

A DMZ gateway with mutual TLS exposes only the required API and keeps the internal network hidden. A full VPN or open firewall ports reveal far more than the partner needs.

Encrypted cross-region replication with consistent key management and tested failover preserves both availability and confidentiality. Unencrypted public copies and disabling encryption violate confidentiality, and a single region does not survive a regional outage.

A minimal, pinned and signed image reduces attack surface and makes builds reproducible. Installing everything and manual laptop builds increase exposure and drift, and default credentials are a direct weakness.

Segmentation, least-privilege identities and flow monitoring each limit or reveal lateral movement. A flat network and shared admin credentials make movement easier.

SASE delivers inspection and identity-based access from the cloud without forcing traffic through the data center. Backhauling adds latency, and removing inspection increases risk.

Periodic, documented access reviews with retained records give auditors evidence of control operation. Verbal agreements, broad rights and short log retention fail the requirement.

Third-party assessments, audit rights and periodic evidence reviews verify compliance throughout the relationship. Marketing claims, assumptions and one-time checks do not prove ongoing compliance.

A retention schedule with evidence of automated deletion demonstrates the control. The other artifacts do not show retention decisions or enforcement.

A risk register records ownership, assessed likelihood and impact, the treatment decision and review dates. Personal and unrelated data do not belong there.

A documented assessment and approval before go-live provides evidence of due diligence. Adoption without review, reliance on certificates alone and post-incident review fail the requirement.

Completion records tied to each employee provide verifiable evidence. Offers, unlinked slides and verbal confirmation are not auditable.

A privacy impact assessment and legal review before processing ensure requirements are met. Launching first or sharing externally creates unmanaged compliance risk.