CAS-005 Exam Dumps - CompTIA CASP Questions and Answers

Risk appetite is the amount of risk an organization is willing to accept to achieve its objectives. When operating with a constrained budget, understanding the organization ' s risk appetite is crucial because:

It helps prioritize security investments based on the level of risk the organization is willing to tolerate.

High-impact, low-likelihood events may be deemed acceptable if they fall within the organization ' s risk appetite, allowing for budget allocation to other critical areas.

Properly understanding and defining risk appetite ensures that limited resources are used effectively to manage risks that align with the organization ' s strategic goals.

To improve the quality of code scanning results and reduce false positives, the best solution is to limit the tool to a specific coding language and fine-tune the rule set. By configuring the code scanning tool to focus on the specific language used in the application, the tool can more accurately identify relevant issues and reduce the number of false positives. Additionally, tuning the rule set ensures that the tool ' s checks are appropriate for the application ' s context, further improving the accuracy ofthe scan results.

In the given scenario, the security engineer is likely examining login activities and their associated geolocations. This type of analysis is aimed at identifying unusual login patterns that might indicate an impossible travel scenario. An impossible travel scenario is when a single user account logs in from geographically distant locations in a short time, which is physically impossible. By assessing login activities using geolocation, the engineer can tune alerts to identify and respond to potential security breaches more effectively.

Code signing uses cryptographic digital signatures to prove that software or updates come from a trusted source and have not been altered. In the SecurityX CAS-005 objectives, this is covered under security engineering and cryptographic assurance mechanisms.

Envelope encryption protects confidentiality but does not authenticate the source.

File integrity monitoring detects file changes but does not confirm the origin of the update.

Application control manages which software can run but does not ensure authenticity of distributed files.Only code signing meets all three objectives: verifying the source, ensuring authorization, and proving integrity.

Segmentationis the best option to ensure the security of legacy badge readers that cannot be upgraded. Segmentation isolates the legacy devices on a separate network segment to minimize their exposure to potential threats. This approach reduces the attack surface by preventing unauthorized access from other parts of the network while still allowing necessary connectivity to the enterprise resource planning (ERP) system.

Vulnerability scans (B)are useful for identifying weaknesses but do not actively protect the badge readers.

Anti-malware (C)is ineffective since the badge readers use a legacy platform that likely does not support modern endpoint protection solutions.

Public Key Infrastructure (PKI) supports change management by securing messages (e.g., approvals, updates).Non-repudiation, provided via digital signatures, ensures a sender cannot deny sending a message, critical for auditability in change processes.

Option A:Correct—PKI’s digital signatures ensure non-repudiation.

Option B:Confidentiality (via encryption) is a PKI feature but less tied to change management’s focus on accountability.

Option C:Delivery receipts are not aPKI function; they’re protocol-specific (e.g., SMTP).

Option D:Attestation relates to verifying attributes, not a direct PKI message capability.

The log-in activity indicates a security threat, particularly involving the ADMIN account with a high-risk failure status. This suggests that the account may be targeted by malicious activities such as credential stuffing or brute force attacks.

Updating log configuration settings (A) may help in better logging future activities but does not address the immediate threat.

Changing the admin account password (B) is a good practice but may not fully mitigate the ongoing threat if the account has already been compromised.

Blocking employees (C) from logging into non-business applications might help in reducing attack surfaces but doesn ' t directly address the compromised account issue.

Implementing automation to disable accounts associated with high-risk activities ensures an immediate response to the detected threat, preventing further unauthorized access and allowing time for thorough investigation and remediation.

Using X.509 certificates for authentication with HTTPS encrypts credentials in transit and provides server identity verification. In SecurityX CAS-005 objectives, securing internal web services with TLS and mutual authentication is a primary method to reduce credential interception or reuse.

802.1X EAP-TTLS is for network access control, not web authentication.

DNS security (DNSSEC) ensures DNS integrity, not web session encryption.

IDS rules help detect, but not prevent, credential exposure.