Free 10-Question SecurityX CAS-005 Practice Test

Try a mixed diagnostic across all four CompTIA SecurityX V5 domains. Results show practice accuracy, not an official pass prediction.

Sample Question 1 — Governance, Risk, and Compliance

Developers at a software company keep asking the security team whether new internal services may use TLS 1.1, which cipher suites are permitted, and what minimum key lengths are required. The CISO wants these answers to be mandatory and consistent across all teams. Which of the following documents should the security team create?

  1. A. A cryptographic guideline that recommends preferred protocols and key lengths
  2. B. A cryptographic standard that mandates protocol versions and key lengths (Correct answer)
  3. C. A step-by-step procedure for requesting a certificate from the internal CA
  4. D. An acceptable use policy that describes how employees may use company systems

Correct answer: B

Explanation: B is correct because standards define mandatory, specific, measurable requirements, such as minimum protocol versions and key lengths, that support a higher-level policy. A is incorrect because guidelines are recommendations that allow discretion, but the CISO wants the requirements to be mandatory. C is incorrect because a procedure describes how to perform a task; it does not define which cryptographic settings are required. D is incorrect because an acceptable use policy governs user behavior and is too high level to specify protocol versions or cipher suites.

Sample Question 2 — Security Architecture

A water utility wants to detect malicious commands on the network link between its SCADA servers and field controllers. Engineers insist that no security device may drop, delay, or alter traffic on this link, because a false positive could disrupt water treatment. Which of the following designs best meets these requirements?

  1. A. A next-generation firewall placed between servers and controllers
  2. B. A passive IDS that receives a copy of traffic from a network tap (Correct answer)
  3. C. A web application firewall in front of the SCADA servers
  4. D. An inline IPS configured to block known malicious commands

Correct answer: B

Explanation: B is correct because a network tap copies traffic to a passive IDS out of band, so threats are detected without any device sitting inline where it could block or delay control traffic. A is incorrect because an inline firewall can block or delay traffic and does not satisfy the requirement. C is incorrect because a WAF inspects HTTP traffic to web applications and sits inline, so it fits neither the protocol nor the requirement. D is incorrect because an inline IPS can drop legitimate traffic after a false positive, which the engineers have ruled out.

Sample Question 3 — Security Engineering

After a web application's service account is migrated to a new server, users receive authentication errors when accessing the application with Kerberos. A domain controller logs the following: Event: KRB_AP_ERR_MODIFIED Service principal name: HTTP/intranet.corp.example.com Accounts with this SPN: svc_web_old, svc_web_new Which of the following should an engineer do to resolve the issue?

  1. A. Switch the application to NTLM authentication permanently
  2. B. Increase the Kerberos maximum ticket lifetime in the domain policy
  3. C. Remove the duplicate SPN so it is registered only on the account running the service (Correct answer)
  4. D. Reset the passwords of all users who reported errors

Correct answer: C

Explanation: C is correct because Kerberos service tickets are encrypted with the key of the account that holds the SPN; when the same SPN is registered on two accounts, tickets may be encrypted for the wrong account and fail to decrypt. A is incorrect because falling back to NTLM weakens authentication and does not fix the SPN misconfiguration. B is incorrect because ticket lifetime does not affect which account's key is used to encrypt the service ticket. D is incorrect because user passwords are not involved in decrypting the service ticket; the problem is the service account SPN.

Sample Question 4 — Security Operations

A SOC analyst reviews the following correlated SIEM events for a single user account within a two-minute window: 08:14:02 VPN login success, user jmalik, source 203.0.113.44 (country: Brazil) 08:14:20 Badge access granted, user jmalik, building HQ-2 (country: United States) 08:15:33 Mailbox rule created: forward all mail to external address Which of the following best describes what the SIEM correlation has revealed?

  1. A. Impossible travel followed by a suspicious mailbox forwarding rule, indicating account compromise (Correct answer)
  2. B. A user legitimately working remotely while a colleague badges in for them
  3. C. Normal behavior that requires no further investigation
  4. D. A time synchronization problem between the VPN and badge systems

Correct answer: A

Explanation: A is correct because the account authenticated from Brazil and badged into a U.S. building within two minutes, which is physically impossible, and the new external forwarding rule is a common post-compromise action. B is incorrect because badge sharing does not explain a simultaneous VPN login from another country or the external forwarding rule. C is incorrect because impossible travel combined with external forwarding is a strong indicator of compromise. D is incorrect because a clock offset would not create a foreign VPN login or an external mail forwarding rule.

Sample Question 5 — Governance, Risk, and Compliance

An internal audit finds that system administrators perform the quarterly privileged access review required by the access control policy in very different ways. Some export user lists from the directory, others review only group names, and several skip service accounts. Which of the following would best address this finding?

  1. A. Rewriting the access control policy to state that reviews are mandatory
  2. B. Writing a step-by-step procedure for performing the access review (Correct answer)
  3. C. Publishing a guideline that suggests possible approaches to reviewing access
  4. D. Increasing the review frequency from quarterly to monthly

Correct answer: B

Explanation: B is correct because the policy already requires the review; a procedure provides the detailed, repeatable steps that make the review consistent and complete. A is incorrect because the policy already mandates the review; restating it does not tell administrators how to perform it consistently. C is incorrect because guidelines are optional recommendations, so they would not eliminate the inconsistency the audit found. D is incorrect because reviewing more often does not fix the fact that each administrator reviews access differently and incompletely.

Sample Question 6 — Security Architecture

A company's perimeter firewall allows HTTPS to web servers in its screened subnet. Attackers continue to exploit known vulnerabilities in the servers' software through these allowed connections. The company wants to automatically block such exploit attempts in real time. Where should an IPS be placed?

  1. A. Inline between the perimeter firewall and the screened subnet (Correct answer)
  2. B. Outside the perimeter firewall, before any traffic filtering occurs
  3. C. On a SPAN port of the core switch in the internal network
  4. D. On each employee workstation as a host-based agent

Correct answer: A

Explanation: A is correct because placing an IPS inline on the path to the web servers lets it inspect permitted traffic and block exploit attempts before they reach the servers. B is incorrect because outside the firewall, the IPS would spend resources on traffic the firewall would drop anyway, and the placement is not required to protect the servers. C is incorrect because a device on a SPAN port receives only copies of traffic and cannot block attacks, and the core switch is not on the path to the screened subnet. D is incorrect because workstation agents do not inspect traffic headed to servers in the screened subnet.

Sample Question 7 — Security Engineering

A warehouse installs fingerprint readers at its entrances. Workers in cold conditions frequently fail to authenticate, and a manager asks the vendor to lower the matching threshold. Which of the following best describes the current problem and the risk of the manager's request?

  1. A. A high false rejection rate; lowering the threshold decreases the false acceptance rate
  2. B. A low crossover error rate; lowering the threshold has no effect on accuracy
  3. C. A high false acceptance rate; lowering the threshold decreases the false rejection rate
  4. D. A high false rejection rate; lowering the threshold increases the false acceptance rate (Correct answer)

Correct answer: D

Explanation: D is correct because rejecting legitimate users indicates a high false rejection rate, and loosening the matching threshold reduces rejections at the cost of accepting more unauthorized users. A is incorrect because lowering the threshold makes matching more permissive, which increases false acceptances. B is incorrect because threshold changes always trade off false acceptance and false rejection rates. C is incorrect because the problem is legitimate users being rejected, which is false rejection, not false acceptance.

Sample Question 8 — Security Operations

A SIEM engineer finds that firewall logs are being stored but no rules match them, because the firewall was upgraded and now sends events in a new format. Which of the following SIEM functions must be corrected?

  1. A. Event parsing (Correct answer)
  2. B. Log retention
  3. C. Role-based access to the SIEM console
  4. D. Alert prioritization

Correct answer: A

Explanation: A is correct because parsing normalizes raw log data into fields the SIEM can use; when a log format changes, the parser must be updated or the events will not be searchable or matched by rules. B is incorrect because retention controls how long events are stored, not whether they are parsed into fields. C is incorrect because access control governs who can use the SIEM, not how logs are parsed. D is incorrect because prioritization ranks alerts that already exist and does not extract fields from raw logs.

Sample Question 9 — Governance, Risk, and Compliance

A security architect wants to give development teams secure design advice for a new microservices platform. Teams use different languages and frameworks, and the architect wants them to apply judgment rather than follow rigid rules. Which of the following document types is most appropriate?

  1. A. Standards
  2. B. Procedures
  3. C. Guidelines (Correct answer)
  4. D. Policies

Correct answer: C

Explanation: C is correct because guidelines offer recommended practices that teams can adapt to their context, which suits diverse technology stacks where rigid rules would not fit. A is incorrect because standards are mandatory and specific, which conflicts with the architect's goal of letting teams apply judgment. B is incorrect because procedures prescribe exact step-by-step actions, which is the opposite of allowing teams to apply judgment. D is incorrect because policies state high-level management intent and requirements; they do not provide detailed design advice.

Sample Question 10 — Security Architecture

A security team needs a full-fidelity copy of all traffic on a 10 Gbps data center link for forensic packet capture. Previous captures from a switch SPAN port dropped packets during busy periods and omitted malformed frames. Which of the following should the team deploy?

  1. A. A NetFlow collector attached to the core router
  2. B. A forward proxy that logs all outbound connections
  3. C. A passive network tap on the link (Correct answer)
  4. D. An additional SPAN session on a second switch

Correct answer: C

Explanation: C is correct because a network tap copies every frame at the physical layer, including errors, without depending on switch resources, so it provides complete captures even under heavy load. A is incorrect because NetFlow records traffic metadata only and does not capture full packets. B is incorrect because a proxy logs application-layer requests it handles and does not capture all link traffic. D is incorrect because a second SPAN session is still processed by the switch and can drop packets and filter malformed frames.

Return to the SecurityX practice-test hub.