2026 Actual CompTIA CAS-005 Dumps, Updated Exam Questions for Guaranteed Pass

CAS-005 free sample questions and answers

CompTIA CAS-005 practice quiz with correct answers for search indexing.

1. Question 1

   A company updates itscloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved lo the repository The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment Which of the following should a security engineer recommend to reduce the deployment failures? (Select two).

   ASoftware composition analysis
   

   BPre-commit code linting
   

   CRepository branch protection
   

   DAutomated regression testing
   

   ECode submit authorization workflow
   

   FPipeline compliance scanning
   

   Correct answer: B, D

   B . Pre-commit code linting: Linting tools analyze code for syntax errors andadherence to coding standards before the code is committed to the repository. This helps catch minor code issues early in the development process, reducing the likelihood of deployment failures.

   D . Automated regression testing: Automated regression tests ensure that new code changes do not introduce bugs or regressions into the existing codebase. By running these tests automatically during the deployment process, developers can catch issues early and ensure the stability of the development environment.

   Other options:

   A . Software composition analysis: This helps identify vulnerabilities in third-party components but does not directly address code quality or deployment failures.

   C . Repository branch protection: While this can help manage the code submission process, it does not directly prevent deployment failures caused by code issues or security check failures.

   E . Code submit authorization workflow: This manages who can submit code but does not address the quality of the code being submitted.

   F . Pipeline compliance scanning: This checks for compliance with security policies but does not address syntax or regression issues.

   
   

   CompTIA Security+ Study Guide

   'Continuous Integration and Continuous Delivery' by Jez Humble and David Farley

   OWASP (Open Web Application Security Project) guidelines on secure coding practices

2. Question 2

   Operational technology often relies upon aging command, control, and telemetry subsystems that were created with the design assumption of:

   Aoperating in an isolated/disconnected system.
   

   Bcommunicating over distributed environments
   

   Cuntrustworthy users and systems being present.
   

   Dan available EtherneVIP network stack for flexibility.
   

   Eanticipated eavesdropping from malicious actors.
   

   Correct answer: A

   Step by Step

   Understanding the Scenario: The question focuses on the historical design assumptions behind older operational technology (OT)systems, particularly in the context of command, control, and telemetry.

   Analyzing the Answer Choices:

   A . operating in an isolated/disconnected system: This is the most accurate assumption for many legacy OT systems. Historically, these systems weredesigned to operate in air-gapped environments, completely isolated from external networks (including the internet).

   
   

   B . communicating over distributed environments: While OT systems can be distributed, the core design assumption, especially for older systems, wasn't centered around interconnectivity in the way modern IT systems are.

   C . untrustworthy users and systems being present: This is a more modern security principle (Zero Trust). Older OT systems often operated under a model of implicit trust within their isolated environment.

   D . an available EtherneVIP network stack for flexibility: Ethernet/IP is a relatively newer industrial protocol. Older OT systems often used proprietary or less flexible communication protocols. Also, there is no such thing as EtherneVIP.

   E . anticipated eavesdropping from malicious actors: While security was a concern, the primary threat model for older, isolated OT systems didn't heavily emphasize external malicious actors due to the assumed isolation.

   Why A is the Correct Answer:

   Air Gap: The concept of an air gap (physical isolation) was the cornerstone of security for many legacy OT systems. These systems were not connected to the internet or corporate networks, making them less susceptible to remote attacks.

   Legacy Protocols: Older OT systems often used proprietary or serial communication protocols, not designed for internet connectivity.

   Implicit Trust: Within the isolated environment, there was often an assumption of trust among the connected components.

   CASP+ Relevance: The challenges of securing legacy OT systems, especially in the face of increasing connectivity, are a key area of focus in CASP+. Understanding the historical context and the shift in security paradigms is crucial.

   Modern OT Security Considerations (Elaboration):

   Convergence: Today, the lines between IT and OT are blurring. OT systems are increasingly connected to corporate networks and the internet, necessitating a shift from isolation-based security to a more comprehensive approach.

   Threat Landscape: Modern OT systems face a wider range of threats, including targeted attacks from sophisticated actors.

   Security Controls: Modern OT security involves implementing network segmentation, intrusion detection, access controls, and other measures to protect against these evolving threats.

   In conclusion, the primary design assumption for many older OT systems was that they would operate in isolated or disconnected environments. This historical context is important for understanding the security challenges faced by organizations today as they integrate these legacy systems into modern, connected environments. This is a core concept discussed in CASP+ in the context of OT security and risk management.

   =================

3. Question 3

   A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

   

   Which of thefollowing is the best action for the security analyst to take?

   ABlock messages from hr-saas.com because it is not a recognized domain.
   

   BReroute all messages with unusual security warning notices to the IT administrator
   

   CQuarantine all messages with sales-mail.com in the email header
   

   DBlock vendor com for repeated attempts to send suspicious messages
   

   Correct answer: D

   In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:

   A . Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.

   B . Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.

   C . Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.

   D . Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.

   
   

   CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.

   NIST Special Publication 800-45 Version 2, 'Guidelines on Electronic Mail Security': Provides guidelines on email security, including the management of suspicious email domains.

   'Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft' by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.

   By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.

4. Question 4

   An analyst needs to identify security event trends. The following is an excerpt from the SIEM:

   Time Alert Source Destination

   20250407-UTC Successful login from uncommon auth method in 24 hours user1 AD-DC-01.corp

   20250407-UTC User accessed sensitive resources user1 NFS-01/financial/share

   20250407-UTC Potential password spraying from host 10.10.15.100 iga-server.corp

   20250407-UTC Threshold exceeded user visiting high risk websites user2 freehacks.com

   20250407-UTC Risk score exceeded for user user1 bar.ru

   20250407-UTC NULL NULL NULL

   Which of the following is the most practical way to identify trends?

   ADecreasing the timing window for detections related to user1
   

   BIncorporating audit log reduction
   

   CCorrelating based on source field in batches of time
   

   DDisabling the noisy rules based on total alerts fired per day
   

   Correct answer: C

   The best answer is C. Correlating based on source field in batches of time. To identify trends in SIEM data, the analyst should group related events over a time window and correlate them around a common field. In this excerpt, user1 appears repeatedly across multiple alert types, including unusual authentication, access to sensitive resources, and elevated risk score. That pattern is exactly the sort of repeated behavior that becomes visible when events are correlated by source over time. CompTIA's official SecurityX objectives in the Security Operations domain include ''Data analysis: indicators of malicious activity, trend analysis, statistics, and deduplication/correlation.'' That objective language directly supports this answer.

   Why the other options are not best:

   A narrows only one rule window and does not systematically identify trends across multiple event types. B may reduce volume, but reduction alone does not reveal trends. D is risky because noisy rules might still provide useful context, and disabling them based only on total daily alerts can hide meaningful multi-event patterns. The practical, operational approach is to correlate records by a shared field such as source/user across time batches so repeated suspicious behavior stands out.

   
   

   CompTIA SecurityX official exam objectives summary, Security Operations domain including trend analysis and correlation.

   CompTIA SecurityX CAS-005 exam objectives PDF mirror with the same operational analysis themes.

5. Question 5

   A company is adopting microservice architecture in order to quickly remediate vulnerabilities and deploy to production. All of the microservices run on the same Linux platform. Significant time was spent updating the base OS before deploying code. Which of the following should the company do to make the process efficient?

   AUse Terraform scripts while creating golden images
   

   BCreate a cron job to run apt-update every 30 days.
   

   CUse snapshots to deploy code to existing compute instances.
   

   DDeploy a centralized update server.
   

   Correct answer: A

   The best approach is to use Terraform scripts while creating golden images (A). Terraform is an Infrastructure as Code (IaC) tool that allows organizations to automate infrastructure deployment consistently across environments. A golden image is a pre-configured, patched, and hardened system image used as a standard baseline. By creating golden images via Terraform scripts, the company ensures that every microservice instance is deployed on an already-updated and secure OS. This eliminates the need for repeatedly patching the base OS before code deployment.

   Option B (cron job with apt-update) applies patches but introduces delays (every 30 days) and lacks consistency across new deployments. Option C (snapshots) saves deployment states but risks replicating outdated or unpatched images. Option D (centralized update server) is useful but still requires updates post-deployment, which slows the rollout of microservices.

   By automating golden image creation through Terraform, the company gains efficiency, repeatability, and security assurance, aligning with DevSecOps principles and CAS-005 cloud-native best practices.