Free Questions for CAS-005 - Multiple Choice Security Practice

Sep 20, 2026

Uploaded by McGucket

Free practice questions for CAS-005 covering scenario-based multiple-choice security topics, including prioritizing patching for internet-facing hosts using CVSS, exploit evidence, and exposure context. Includes an encryption cipher selection scenario for a social media company, focusing on memory and CPU efficiency and compatibility with TLS 1.3 for broadcasting. Provides structured options with answers and detailed explanations tied to common security risk concepts.

LanguageEnglish

CategoryExam

FormatPDF

Pages16

Reading Time40 min

AccessFree to download

Free Questions for CAS-005

Question 1

Explanation

Question 2

Explanation

# Free Questions for CAS-005 Shared by Holden on 16-04-2026 For More Free Questions and Preparation ResourcesCheck the Links on Last Page Question 1 Question Type:MultipleChoice A security analyst is reviewing the following vulnerability assessment report: 192.168.1.5,Host =Server1,CVSS 7.5,Web Server,Remotely Executable =Yes,Exploit =Yes205.1.3.5,Host =Server2,CVSS 6.5,Bind Server,Remotely Executable =Yes,Exploit =POC207.1.5.7,Host =Server3,CVSS 5.5,Email Server,Remotely Executable =Yes,Exploit =Yes192.168.1.6,Host =Server4,CVSS 9.8,Domain Controller,Remotely Executable =Yes,Exploit=Yes Which of the following should be patched first to minimize attacks against internet-facing hosts? Options: A-Serverl A-Pass-the-hash attack:This attack involves using a stolen hash of a user's password toauthenticate without needing the actual password.It's unrelated to software package integrity.Why A is the Correct Answer: A supply chain attack is exactly what the organization is trying to mitigate.By creating a registryof known-good software packages and their hashes,they can verify that the packages they areusing are legitimate and haven't been altered. If an attacker were to compromise a software package in the supply chain,the hash of thealtered package would not match the hash in the organization's registry.This would immediatelyalert the organization to a potential compromise. CASP+Relevance:This aligns with the CASP+exam objectives,which emphasize the importanceof risk management,threat intelligence,and implementing security controls to address variousattack vectors,including supply chain risks. How the Registry Works(Elaboration based on CASP+principles): Hashing:When a package is vetted,a cryptographic hash function(like SHA-256)is used togenerate a unique 'fingerprint'(the hash)of the package's contents. Verification:Before installing or using a package,its hash is calculated and compared to the hashstored in the registry.A match confirms the package's integrity.A mismatch indicates tampering.Incident Response:If a vulnerability is discovered in a commonly used package,the registryhelps the organization quickly identify which systems are affected based on the dependency listand the stored hashes. In conclusion,maintaining a registry of software dependencies with hashes is a crucial securitycontrol that directly addresses the threat of supply chain attacks by ensuring the integrity andauthenticity of software packages.The use of hash functions for verification is a common practicein security and is emphasized in the CASP+material.B-Server2 B-Configure a proxy policy that allows only fully qualified domain names needed to communicateto a portal.C-Server3 C-Running the container in an isolated network and placing a load balancer in a public-facingnetwork.Adding the following ACL to the load balancer:PZRKZI HTTES from 0-0.0.0.0/0 pert 443D-Server4D-Update the MX record to contain only the primary email server. Answer: B,B ## Explanation: The question focuses oninternet-facing hosts,implying external exposure.CVSS scores,remoteexecutability,and exploitavailability guide prioritization.Server2(205.1.3.5,CVSS 6.5,BindServer)has a public IP,suggesting it's internet-facing,unlike Serverl and Server4(192.168.x.x,private IPs).Server3(207.1.5.7,CVSS 5.5)is also public but has a lower score and risk comparedto Server2's proof-of-concept(POC)exploit.Server2's Bind Server(DNS)role is critical andcommonly targeted,making it the priority. Option A:Server1 (CVSS 7.5)is private,not internet-facing. Option B:Server2(CVSS 6.5)is internet-facing with an exploit POC,warranting immediatepatching. Option C:Server3 (CVSS 5.5)is internet-facing but less severe. Option D:Server4 (CVSS 9.8)is critical but private,not internet-facing. Question 2 Question Type:MultipleChoice

FAQs

How should the organization prioritize patching for internet-facing hosts in Question 1?

Prioritize the host that is both internet-facing and shows higher risk indicators such as bind/DNS role and exploit availability. The explanation highlights Server2 as the priority due to its public exposure and exploit proof-of-concept.

What cipher choice best satisfies the requirements in Question 2?

ChaCha20-Poly1305. The document explains it is efficient on limited hardware, supports strong security with lower RAM and CPU usage, and works natively with TLS 1.3.

Why are the CBC options not recommended in the TLS 1.3 encryption scenario?

CBC-based suites like IDEA-CBC and Camellia-CBC are less efficient and are described as not recommended under TLS 1.3, while the selected suite offers better performance characteristics for the given environment.

Sep 20, 2026

Uploaded by McGucket