Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems Given the following output:
Which of the following actions would address the root cause of this issue?
The output shows that multiple systems have outdated or vulnerable software versions (OpenSSL 1.01 and Java 11 runtime). This suggests that the systems are not being patched regularly or effectively.
A . Automating the patching system to update base images: Automating the patching process ensures that the latest security updates and patches are applied to all systems, including newly deployed ones. This addresses the root cause by ensuring that base images used for deployment are always up-to-date with the latest security patches.
B . Recompiling the affected programs with the most current patches: While this can fix the immediate vulnerabilities, it does not address the root cause of the problem, which is the lack of regular updates.
C . Disabling unused/unneeded ports on all servers: This improves security but does not address the specific issue of outdated software.
D . Deploying a WAF with virtual patching upstream of the affected systems: This can provide a temporary shield but does not resolve the underlying issue of outdated software.
Automating the patching system to update base images ensures that all deployed systems are using the latest, most secure versions of software, addressing the root cause of the vulnerability trend.
CompTIA Security+ Study Guide
NIST SP 800-40 Rev. 3, 'Guide to Enterprise Patch Management Technologies'
CIS Controls, 'Control 7: Continuous Vulnerability Management'
Recent repents indicate that a software tool is being exploited Attackers were able to bypass user access controls and load a database. A security analyst needs to find the vulnerability and recommend a mitigation. The analyst generates the following output:
Which of the following would the analyst most likely recommend?
The output indicates that the software tool contains hard-coded credentials, which attackers can exploit to bypass user access controls and load the database. The mostlikely recommendation is to remove hard-coded credentials from the source code. Here's why:
Security Best Practices: Hard-coded credentials are a significant security risk because they can be easily discovered through reverse engineering or simple inspection of the code. Removing them reduces the risk of unauthorized access.
Credential Management: Credentials should be managed securely using environment variables, secure vaults, or configuration management tools that provide encryption and access controls.
Mitigation of Exploits: By eliminating hard-coded credentials, the organization can prevent attackers from easily bypassing authentication mechanisms and gaining unauthorized access to sensitive systems.
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
OWASP Top Ten: Insecure Design
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
A SOC analyst is investigating an event in which a penetration tester was able to successfully create and execute a payload. The analyst pulls the following command history from the affected server-
Which of the following should the analyst implement lo improve the security of the server?
The best way to mitigate the ability of attackers or penetration testers to execute arbitrary payloads is to enforce application controls with allow lists (B). Application allow listing ensures that only pre-approved, trusted software and scripts can be executed on the system. This prevents attackers from dropping or running malicious binaries, even if they exploit vulnerabilities to gain access. CAS-005 emphasizes allow listing as a preventive control against post-exploitation persistence and lateral movement.
Option A (ASLR) randomizes memory addresses and helps mitigate buffer overflow exploits but does not directly prevent execution of unauthorized programs. Option C (OS restrictions of globally writable folders) improves security hygiene but still does not stop attackers from executing already placed payloads in non-restricted locations. Option D (EDR signatures) are reactive and limited, since attackers often use novel or obfuscated payloads not yet captured by signature databases.
Therefore, implementing application controls with allow lists provides the strongest defense against unauthorized payload execution in this context.
A water power generation plant fails a security inspection. The controllers are distributed across a river that is 0.5mi (0.8km) wide. The controllers are connected via HTTP to the shoreside master controller. The distributed controllers and the shoreside controller communicate over the internet using a cellular network. The company cannot encrypt control traffic because the systems will not tolerate the additional overhead. Which of the following strategies is the best way to reduce the risk of compromise?
The best answer is D. Deploying a dedicated base station and reducing the footprint with highly directional antennas. The biggest risk in the scenario is that unencrypted control traffic is traversing the internet over a cellular network. Since encryption is not feasible, the best compensating control is to reduce exposure by making the wireless path more private, more local, and less accessible to unintended parties. A dedicated base station with directional antennas narrows the RF footprint and reduces interception and unauthorized access opportunities compared with broad internet-based cellular exposure. CompTIA's SecurityX objectives emphasize Security Architecture, including secure boundaries, compensating controls, and resilient design choices when ideal controls cannot be used.
Why the other options are not best:
A is helpful as a detective control, but it does not reduce the core exposure of unencrypted communications over public infrastructure. B is impractical and technically weak here; standard Cat 5e is not the right medium for a 0.5-mile river crossing. C may detect post-compromise changes, but it does not reduce the likelihood of network compromise in the first place. Because encryption cannot be used, the best risk-reduction strategy is to minimize signal exposure and dependence on public internet-connected cellular paths.
CompTIA SecurityX official exam objectives summary, especially Security Architecture and compensating-control themes.
A company has the following requirements for a cloud-based web application:
* Must authenticate customers
* Must prevent data exposure
* Must allow customer access to data throughout the cloud environment
* Must restrict access by specific regions
Which of the following solutions best addresses these security requirements?
The best way to address these requirements is to apply Role-Based Access Controls (RBAC) combined with geolocation policies. RBAC ensures that customers are authenticated and authorized to access only the data they are entitled to, thereby minimizing data exposure risks. At the same time, geolocation policies enforce restrictions on which regions customers can access data from, helping with compliance requirements such as GDPR or regional sovereignty laws.
Option B (replicating data in each customer environment) is inefficient, expensive, and introduces additional risks related to data sprawl. Option C (regional hosting with unique links) complicates access management and does not inherently prevent exposure or enforce strong authentication. Option D (restricting to a single region provider) removes flexibility and may conflict with customer needs for global access.
Therefore, implementing RBAC along with geolocation controls provides fine-grained access management, ensures compliance, prevents unnecessary data exposure, and is scalable for a global cloud environment.
345 questions covering all exam domains, starting from $20
Exam domains verified against: Official CompTIA CAS-005 exam guide, last checked August 2026.
Implement governance components that align with organizational security requirements and compliance frameworks. Focus on phishing and social engineering threats, security communication protocols, and risk assessment methods like COBIT framework implementation.
Analyze security requirements to design resilient systems with proper component placement and configuration. Design secure network architectures, including firewalls and intrusion prevention systems, for complex enterprise environments supporting zero-trust and hybrid cloud scenarios.
Troubleshoot common issues with identity and access management components in enterprise environments. Apply cryptographic solutions, design secure integrations, and solve real-world authentication and authorization challenges across diverse platforms.
Analyze security data to enable monitoring and response across complex environments. Implement threat detection, incident response procedures, and digital forensics capabilities to identify and mitigate security events in real time.
Sample question from this domain above: Q3
Common questions about the exam itself
