Free CompTIA SecurityX / CASP+ CAS-005 Actual Exam Questions

B. SSO directly reduces the number of passwords users need to remember by centralizing access, which helps with the root problem of too many passwords, especially if most apps support it.

It’s C because a password manager works across all apps regardless of SSO support. It actually helps users store and generate strong passwords without needing to write them down, which directly tackles the risk.

I’m thinking B makes the most sense here. Local caching reduces repeated data transfers over the limited bandwidth link, which speeds up access to both internal and external resources without needing complex routing changes. Plus, it keeps threat visibility intact since the security team can monitor traffic locally. Options like CDN mainly help with external content and SD-WAN might be overkill or not as effective for internal resource speed in this case. So yeah, B feels like the best bet for balancing speed, bandwidth, and security visibility.

Maybe D since SD-WAN can dynamically manage bandwidth and maintain security visibility.

Makes sense to rule out key rotation (C) here since it’s about changing keys over time, not directly strengthening stored passwords. E still feels like the best pick.

E/D? Key stretching (E) is known to strengthen password security by making brute-force attacks harder without changing the whole system. But key encryption (D) can protect keys better too. Still, stretching passwords sounds more direct here.

Maybe B makes sense because prompt injection directly involves malicious inputs trying to manipulate the AI, so sanitizing inputs should help prevent that.

B tbh, prompt injection seems like the best fit here. Input sanitation is all about cleaning or filtering inputs to stop malicious stuff from affecting the system. Model inversion and data poisoning are more about attacks on the training data or model itself, not just bad inputs. Non-explainable models is a different issue entirely. So yeah, getting rid of harmful inputs matches prompt injection the most. A is kinda a trap since it sounds AI-specific but input sanitation won’t really fix that.

A imo, if logs aren’t capturing properly, you’re flying blind. Fixing log config first helps understand the full scope before taking drastic actions like disabling accounts.

D - automation to disable risky accounts sounds most efficient here.

C seems right, SIEM usually handles log aggregation well.

A Automating alerts for phone outages cuts out delay in manual reporting and directly gets the right team involved fast. Dashboards are good, but this targets a key pain point more precisely.

Option A makes sense because automating alerts for specific issues like phone outages means the right team gets notified immediately without waiting or missing manual checks. That direct approach can definitely speed up responses.

B/C/H? SPF and DKIM handle verification, MX points to the mail server. If DNS wasn’t updated after cert changes, MX records might be pointing wrong, so fixing those three makes sense.

B, C, H

C imo, admin from alternate spots blocked fits the scenario better here.

B vs C, but the policy blocking admin from alternate locations fits well here.

Actually, just blocking UDP/53 (B) wouldn’t help much since zone transfers use TCP/53 as shown here. So B can be ruled out because it wouldn’t stop this kind of attack.

A imo, because disabling zone transfers outright stops the attacker from pulling the entire DNS info regardless of where they query from, making it a stronger fix than just restricting clients.

Maybe D. Attestation fits since PKI can prove a message’s origin and integrity, certifying it’s authentic. Non-repudiation is close but attestation covers confirming the message’s validity too.

It’s A because PKI mainly ensures the sender can’t deny the message later with digital signatures.

C, F. SASE definitely tackles the split-tunnel issue by integrating secure networking and access in one framework. For identity and access management across different clouds and external resources, CASB makes sense since it provides visibility and control specifically over cloud apps and services, which fits better than Federation here. Federation mostly handles single sign-on but doesn’t cover cloud app security or traffic flow control like CASB does. So pairing CASB with SASE seems like a solid combo for the requirements.

I’m with F for sure, since SASE integrates networking and security to kill split-tunnel issues. Instead of Federation, I’d pick D (PAM) because managing privileged access is crucial for internal resources and helps tighten identity controls beyond just single sign-on. So F plus D feels like the right combo here.

Option B stands out for me because if credentials get stolen, attackers could access sensitive client data or even manipulate the AI system itself. That poses a direct privacy risk, exposing personal info or changing loan rates unfairly. While explainability is important for fairness, unauthorized access is a more immediate privacy breach threat. Prompt injections and social engineering are concerns but feel less directly tied to privacy compared to credential theft in this context.

A. Model explainability is crucial because if the AI is making loan decisions, clients have a right to understand why they got a certain rate. Without transparency, it’s hard to ensure there’s no bias or discrimination, which is a big privacy and fairness risk. B and D are valid security concerns but less about privacy specifically, and C (prompt injections) seems more about system integrity than directly about client privacy.

A/E? Storing REMOTE_ADDR (E) is good for capturing what the web server actually sees, but if the load balancer isn’t forwarding the original client IP, then logs will just show the load balancer’s private IP, not the true source. Enabling X-Forwarded-For (A) at the load balancer lets the web servers log the real client IP from that header, which is more accurate for tracing incidents. So without A, E might still miss the real source. I’d recommend A to make sure the original client IP gets passed along properly.

E imo, because storing REMOTE_ADDR on the web servers would capture the immediate client IP seen by each server, helping trace requests even if the load balancer isn’t forwarding client IPs properly.

B makes sense because if the vendor changes product offerings, you can’t easily switch or adapt without headaches. D also fits since being locked in often means that service quality might drop but you have no alternatives. A, E, and F actually describe benefits or flexibility, which are the opposite of lock-in risks. C isn’t really about risk either. So B and D seem like the only solid choices here.

Maybe B and D make the most sense. Vendor lock-in means you can’t easily switch, so if the vendor changes stuff (B) or drops service quality (D), you’re stuck dealing with it.