Free SecurityX Security Engineering Practice Questions | CAS-005

This domain represents 31% of CAS-005 and covers secure engineering, cryptography, automation, infrastructure controls, application security, emerging technology, and control integration.

Sample Question 1 — Security Engineering

After a web application's service account is migrated to a new server, users receive authentication errors when accessing the application with Kerberos. A domain controller logs the following: Event: KRB_AP_ERR_MODIFIED Service principal name: HTTP/intranet.corp.example.com Accounts with this SPN: svc_web_old, svc_web_new Which of the following should an engineer do to resolve the issue?

  1. A. Switch the application to NTLM authentication permanently
  2. B. Increase the Kerberos maximum ticket lifetime in the domain policy
  3. C. Remove the duplicate SPN so it is registered only on the account running the service (Correct answer)
  4. D. Reset the passwords of all users who reported errors

Correct answer: C

Explanation: C is correct because Kerberos service tickets are encrypted with the key of the account that holds the SPN; when the same SPN is registered on two accounts, tickets may be encrypted for the wrong account and fail to decrypt. A is incorrect because falling back to NTLM weakens authentication and does not fix the SPN misconfiguration. B is incorrect because ticket lifetime does not affect which account's key is used to encrypt the service ticket. D is incorrect because user passwords are not involved in decrypting the service ticket; the problem is the service account SPN.

Sample Question 2 — Security Engineering

A warehouse installs fingerprint readers at its entrances. Workers in cold conditions frequently fail to authenticate, and a manager asks the vendor to lower the matching threshold. Which of the following best describes the current problem and the risk of the manager's request?

  1. A. A high false rejection rate; lowering the threshold decreases the false acceptance rate
  2. B. A low crossover error rate; lowering the threshold has no effect on accuracy
  3. C. A high false acceptance rate; lowering the threshold decreases the false rejection rate
  4. D. A high false rejection rate; lowering the threshold increases the false acceptance rate (Correct answer)

Correct answer: D

Explanation: D is correct because rejecting legitimate users indicates a high false rejection rate, and loosening the matching threshold reduces rejections at the cost of accepting more unauthorized users. A is incorrect because lowering the threshold makes matching more permissive, which increases false acceptances. B is incorrect because threshold changes always trade off false acceptance and false rejection rates. C is incorrect because the problem is legitimate users being rejected, which is false rejection, not false acceptance.

Sample Question 3 — Security Engineering

A company's secrets manager automatically rotated a database password at 02:00. Since then, an order processing application has failed to connect. Application logs show the following: 02:00:14 Connected to db01 using cached credential for app_svc 02:47:31 Connection pool refresh started 02:47:31 FATAL: password authentication failed for user "app_svc" 02:47:32 Retrying with cached credential for app_svc Which of the following is the best long-term fix?

  1. A. Configure the application to retrieve credentials from the secrets manager when connecting (Correct answer)
  2. B. Disable automatic rotation for the app_svc database account
  3. C. Hardcode the new password in the application's configuration file
  4. D. Grant app_svc database administrator privileges to avoid failures

Correct answer: A

Explanation: A is correct because the application kept using a cached password after rotation; retrieving secrets dynamically, or reloading them when rotation occurs, lets rotation happen without outages. B is incorrect because disabling rotation leaves long-lived credentials that are more likely to be compromised. C is incorrect because hardcoding breaks again at the next rotation and exposes the secret in configuration. D is incorrect because additional privileges do not fix an incorrect password and violate least privilege.

Sample Question 4 — Security Engineering

Developers are integrating a new web application with the company's OAuth 2.0 authorization server. After signing in, users see the following error instead of being returned to the application: error=invalid_request error_description=The redirect_uri does not match a registered value Requested: https://app.example.com/callback/ Registered: https://app.example.com/callback Which of the following should the developers do?

  1. A. Increase the lifetime of the authorization code to 24 hours
  2. B. Make the requested redirect URI exactly match the registered URI (Correct answer)
  3. C. Configure the authorization server to accept any redirect URI
  4. D. Switch the application from the authorization code flow to the implicit flow

Correct answer: B

Explanation: B is correct because authorization servers require an exact match between the requested and registered redirect URIs to prevent authorization codes from being sent to attacker-controlled locations; the trailing slash causes the mismatch. A is incorrect because the code is never delivered because of the mismatch, and long-lived codes increase risk. C is incorrect because accepting arbitrary redirect URIs allows authorization codes to be sent to attackers. D is incorrect because the implicit flow is deprecated and still requires a registered redirect URI.

Sample Question 5 — Security Engineering

After the company's internal CA issues a new certificate for its RADIUS servers from a newly created intermediate CA, laptops can no longer connect to the 802.1X-protected wireless network. The RADIUS logs show that clients terminate the EAP-TLS handshake immediately after receiving the server certificate. Which of the following is the most likely fix?

  1. A. Disable server certificate validation on all laptops
  2. B. Increase the RADIUS server's session timeout value
  3. C. Deploy the new intermediate CA certificate to clients and trust it for RADIUS (Correct answer)
  4. D. Change the wireless network to WPA2-Personal with a pre-shared key

Correct answer: C

Explanation: C is correct because clients validate the RADIUS server's certificate chain; if they do not trust the new intermediate CA, they abort the handshake, so the chain must be distributed and trusted. A is incorrect because disabling validation lets rogue access points impersonate the network and harvest credentials. B is incorrect because session timeouts do not affect certificate trust during the handshake. D is incorrect because a shared key removes per-user authentication and weakens security.

Sample Question 6 — Security Engineering

A penetration tester sets up a rogue access point with the same SSID as the corporate WPA2-Enterprise network and captures MSCHAPv2 challenge-response hashes from several laptops using PEAP. Which of the following changes would best prevent this attack?

  1. A. Increasing the complexity requirements for user domain passwords
  2. B. Moving to EAP-TLS with enforced server certificate validation (Correct answer)
  3. C. Hiding the SSID so the network is not broadcast
  4. D. Enabling MAC address filtering on the corporate access points

Correct answer: B

Explanation: B is correct because EAP-TLS uses certificates rather than password hashes, and enforcing server certificate validation prevents clients from authenticating to a rogue access point. A is incorrect because complex passwords make cracking harder but still expose credential hashes to rogue access points. C is incorrect because hidden SSIDs are easily discovered and do not prevent rogue access points. D is incorrect because MAC filtering on legitimate access points does not stop clients from connecting to a rogue one.

Sample Question 7 — Security Engineering

A company changes its office wireless network to WPA3-Personal using SAE only. Most laptops and phones connect successfully, but several older barcode scanners that support only WPA2 can no longer join. The scanners will be replaced next year. Which of the following is the best interim solution?

  1. A. WPA3 transition mode on the main SSID for all devices
  2. B. An open wireless network for the barcode scanners
  3. C. A separate WPA2 SSID for the scanners on an isolated network segment (Correct answer)
  4. D. WEP encryption for the barcode scanners

Correct answer: C

Explanation: C is correct because isolating legacy devices on a dedicated WPA2 network keeps the main network on SAE-only and limits exposure until the scanners are replaced. A is incorrect because transition mode on the main network allows downgrade attacks against devices that support WPA3. B is incorrect because an open network provides no authentication or encryption. D is incorrect because WEP is broken and should never be used.

Sample Question 8 — Security Engineering

A company's conditional access policy blocks sign-ins from outside its home country. A sales director attending a conference in Germany is blocked from email and CRM access and calls the help desk. Which of the following is the best resolution?

  1. A. Telling the user to connect through a personal VPN service located at home
  2. B. Granting a time-limited exception for the user and country, still requiring MFA (Correct answer)
  3. C. Giving the user another employee's credentials that are not blocked
  4. D. Removing the geographic restriction from the policy for all users

Correct answer: B

Explanation: B is correct because a scoped, temporary exception supports legitimate travel while maintaining strong authentication and keeping the geographic control in place for everyone else. A is incorrect because using a personal VPN to evade the policy undermines the control and introduces untrusted infrastructure. C is incorrect because sharing credentials violates accountability and security policy. D is incorrect because disabling the control company-wide to fix one user's travel removes protection for everyone.

Sample Question 9 — Security Engineering

An employee cannot access company email from a new phone. The identity provider's sign-in log shows the following: User: j.alvarez Application: Corporate Email Result: Failure Reason: Device not compliant Compliance detail: OS version 16.1 is below the required minimum of 17.0 Which of the following is the best way to resolve this issue?

  1. A. Exclude the employee from the device compliance policy
  2. B. Reset the employee's password and MFA registration
  3. C. Have the employee update the phone's operating system to a compliant version (Correct answer)
  4. D. Lower the required minimum OS version for all devices

Correct answer: C

Explanation: C is correct because the configuration-based conditional access policy is working as intended; updating the OS brings the device into compliance, and access will be granted. A is incorrect because excluding the user permanently weakens the control instead of fixing the non-compliant device. B is incorrect because the failure is due to device compliance, not the user's credentials. D is incorrect because lowering the standard for everyone exposes the company to known OS vulnerabilities.

Sample Question 10 — Security Engineering

An engineer in cloud account 222222222222 attempts to assume a role in account 111111111111 and receives the error "not authorized to perform sts:AssumeRole." The engineer's identity policy allows sts:AssumeRole on the role. The role's trust policy is shown below: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::333333333333:root" }, "Action": "sts:AssumeRole" } Which of the following is the most likely cause?

  1. A. The role's trust policy names the wrong account as the trusted principal (Correct answer)
  2. B. The engineer's identity policy must be attached to the role itself
  3. C. The role needs administrator permissions before it can be assumed
  4. D. Cross-account role assumption is not supported by the cloud provider

Correct answer: A

Explanation: A is correct because assuming a cross-account role requires both an identity policy permitting the action and a trust policy on the role that trusts the caller's account; this trust policy trusts 333333333333 instead of 222222222222. B is incorrect because identity policies are attached to the caller, while the role's trust policy controls who can assume it. C is incorrect because the role's permissions determine what it can do after assumption, not who can assume it. D is incorrect because cross-account role assumption is a standard feature when trust is configured correctly.

SecurityX practice-test hub · Mixed quick-start test