Sample CompTIA CASP+ CAS-004 Practice Questions
Q: An enterprise architect is designing a zero trust architecture for a multinational corporation. Which component is MOST critical to implement first to ensure all access requests are properly validated?
A: A. A policy engine that evaluates every access request against dynamic trust scores — In a zero trust architecture, the policy engine is the core decision point that evaluates every access request based on identity, device posture, location, and behavior. VLANs, SSO with static RBAC, and VPNs alone do not fulfill the continuous verification principle of zero trust.
Q: A SOC analyst discovers a significant increase in DNS queries to a newly registered domain from multiple internal hosts. Which type of attack does this MOST likely indicate?
A: B. DNS tunneling or command-and-control beaconing activity — Multiple internal hosts making frequent DNS queries to a newly registered domain is a strong indicator of DNS tunneling or C2 beaconing. Malware often uses DNS to communicate with C2 servers because DNS traffic is commonly allowed through firewalls and the newly registered domain suggests adversary infrastructure.
Q: An organization needs to implement end-to-end encryption for its internal messaging platform. Which protocol provides forward secrecy to protect past communications even if the long-term private key is compromised?
A: B. Diffie-Hellman Ephemeral (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange — DHE and ECDHE provide forward secrecy by generating unique ephemeral session keys for each communication session. Even if the server's long-term private key is later compromised, past session keys cannot be derived, protecting all previously encrypted communications.
Q: An organization is conducting a quantitative risk assessment for its data center. The annual loss expectancy (ALE) for a specific threat is calculated as $500,000. A proposed countermeasure costs $150,000 annually and would reduce the ALE to $100,000. What is the value of the countermeasure to the organization?
A: B. $250,000 (the ALE reduction of $400,000 minus the countermeasure cost of $150,000) — The value of the countermeasure is calculated as: (Original ALE - Reduced ALE) - Cost of countermeasure = ($500,000 - $100,000) - $150,000 = $250,000. This positive value means the countermeasure provides a net benefit of $250,000 annually, making it a sound investment.
Q: A company is migrating to a zero trust model and must handle both legacy OT systems that cannot support modern authentication and cloud-native microservices. Which approach BEST addresses both environments?
A: B. Implement a policy enforcement point with adaptive proxies for legacy systems and service mesh with mTLS for microservices — Adaptive proxies can broker authentication for legacy OT systems that cannot natively support modern protocols, while a service mesh with mTLS enforces zero trust between microservices. This hybrid approach applies zero trust principles consistently across both environments without requiring legacy systems to be re-architected.
Q: An organization needs to secure east-west traffic within its data center. Which approach provides the MOST granular security control?
A: B. Implementing microsegmentation with host-based firewalls and identity-aware policies — Microsegmentation with host-based firewalls and identity-aware policies provides the most granular control over east-west (lateral) traffic within a data center. Perimeter firewalls and DMZ architectures primarily address north-south traffic, while port security alone does not provide application-layer visibility.
Q: Which network architecture concept involves creating isolated segments to limit lateral movement of threats within an enterprise environment?
A: B. Microsegmentation — Microsegmentation creates fine-grained security zones within a data center or cloud environment, isolating workloads and limiting an attacker's ability to move laterally after initial compromise.
Q: A financial institution is designing a hybrid cloud architecture with strict data sovereignty requirements. Sensitive PII must remain in-country while analytics workloads run in a public cloud. Which architecture BEST meets these requirements?
A: C. Implement a data classification engine on-premises with tokenization, sending only tokens to the public cloud for analytics processing — Tokenization replaces sensitive PII with non-reversible tokens, allowing analytics to run in the public cloud on tokenized data while the actual PII never leaves the on-premises environment. This satisfies data sovereignty requirements while still leveraging cloud scalability for analytics workloads.
Q: When integrating IaaS, PaaS, and SaaS services into an enterprise security architecture, which security concern is UNIQUE to the SaaS model compared to IaaS?
A: A. The customer has no control over the underlying operating system patch management — In the SaaS model, the cloud provider manages nearly the entire stack including the OS, middleware, and application. The customer has no ability to patch operating systems, unlike IaaS where the customer manages the OS. Virtual network security groups and hypervisor management are IaaS-level concerns.
Q: An architect is evaluating software-defined networking (SDN) for the enterprise. Which security advantage does SDN provide over traditional network architectures?
A: B. SDN centralizes policy enforcement through a programmable control plane, enabling dynamic and consistent security rules — SDN separates the control plane from the data plane, providing centralized, programmable policy enforcement. This allows security teams to dynamically deploy and update consistent security rules across the entire network from a single control point, rather than configuring each device individually.