CAS-004 Practice Questions

NetFlow logs provide visibility into network traffic patterns and volume, which can be analyzed to

detect anomalies, including potential security incidents. They can be invaluable in correlating the

timing and nature of network events with security incidents to better understand if there is an

association.

Overloading a machine learning system with incorrect information is an example of poisoning the

data set, which can compromise the integrity of decision-making processes. This aligns with CASP+

objective 2.3, which involves threat modeling and mitigating risks associated with AI and ML

systems.

________________________________________

Email signatures provide non-repudiation, which ensures that the sender of an email cannot deny

having sent it. A digital signature, when attached to an email, uses cryptographic techniques toverify

the sender's identity and confirm the authenticity of the message. This feature helps establish trust

by preventing tampering and ensuring the integrity of the communication. CASP+ emphasizes the

role of digital signatures in ensuring non-repudiation in secure communication protocols.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Non-repudiation and

Digital Signatures)

CompTIA CASP+ Study Guide: Email Security and Non-repudiation with Digital Signatures

Theddtool creates a bit-for-bit copy of a hard drive, preserving its contents exactly as they are. This is

essential for forensic analysis, as it ensures the integrity of evidence. This aligns with CASP+ objective

5.2, which emphasizes forensic tools and techniques for preserving and analyzing digital evidence.

Based on the output in the image, which shows weak cipher suites and vulnerabilities related to

encryption padding, the padding oracle attack is the most likely. This type of attack exploits the way

padding errors are handled during decryption, potentially allowing an attacker to decrypt sensitive

information. The weak cipher suites and lack of forward secrecy further increase the likelihood of

such an attack succeeding. CASP+ highlights padding oracle attacks as critical vulnerabilities,

particularly in environments where weak encryption protocols are used.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Encryption and

Padding Oracle Attacks)

CompTIA CASP+ Study Guide: Cryptographic Attacks and Cipher Vulnerabilities

A Virtual Desktop Infrastructure (VDI) solution meets all the listed requirements: reducing patch management, using standard configurations, allowing for custom resource configurations, andproviding access from multiple device types. VDI allows centralized management of desktop environments, where patches and updates can be applied once and distributed across all virtual desktops. It also supports flexible resource configurations and secure remote access from various devices. CASP+ highlights VDI as a solution for centralized, secure desktop management that meets modern enterprise needs for mobility and security. Reference: CASP+ CAS-004 Exam Objectives: Domain 3.0 – Enterprise Security Architecture (VDI for Secure Remote Desktop Management) CompTIA CASP+ Study Guide: Virtual Desktop Infrastructure for Centralized Management and Security

Embedded facility automation systems are often difficult to upgrade because they are constrained by

available compute. These systems typically have limited processing power, memory, and storage,

which restricts the ability to implement modern security measures, such as encryption, software

updates, or advanced security controls. Security engineers may be unable to apply patches or

updates without exceeding the system’s capacity. CASP+ discusses the challenges posed by resource-

constrained devices, particularly in embedded systems and IoT environments, where upgrading

security can be difficult due to hardware limitations.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 3.0 – Enterprise Security Architecture (Embedded System

Security and Constraints)

CompTIA CASP+ Study Guide: Managing Security for Resource-Constrained Embedded Systems

A Hardware Security Module (HSM) provides the best solution for securely backing up MFA seeds in a

central, offline location with minimal management overhead. HSMs are specialized hardware devices

designed for cryptographic key management, including storing sensitive data like MFA seeds

securely. HSMs offer high levels of protection against tampering and provide offline security, making

them an ideal choice for backing up cryptographic materials. CASP+ recognizes HSMs as critical

components for managing and securing cryptographic keys in centralized, secure environments.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 3.0 – Enterprise Security Architecture (HSM and Secure Key

Management)

CompTIA CASP+ Study Guide: Secure Backup and Key Management with HSM

Comprehensive and Detailed in-Depth

Why the Correct Answer is C (WPA3 SAE):

WPA3 SAE (Simultaneous Authentication of Equals)is the most advanced method for wireless

security in small office environments without centralized authentication (like Active Directory).

It addressesbrute-force attacksthroughforward secrecyand theDragonfly key exchangemethod,

making it resistant to dictionary attacks and offline cracking.

WPA3 SAEenhances security by protecting against password-guessing attacks even when a weak

password is chosen.

Additionally,WPA3 SAEeliminates the vulnerabilities found in WPA2-PSK by using amore secure key

exchange mechanism.

Why the Other Options Are Incorrect:

A . Faraday cage:

A Faraday cage can block wireless signals entirely, but it does not provide asecurity protocolfor

wireless authentication.

It’s primarily used forsignal isolationrather than securing wireless communication.

B . WPA2 PSK:

AlthoughWPA2 PSK (Pre-Shared Key)is widely used, it is vulnerable tobrute-force and offline

dictionary attacks, especially when weak passwords are used.

WPA2 does not includeprotection against offline password cracking, which is a significant concern.

D . WEP 128 bit:

WEP (Wired Equivalent Privacy)is extremely outdated and insecure.

It uses theRC4 stream cipher, which is prone toIV (Initialization Vector) collisionsandkey recovery

attacks.

Modern tools can crack WEP keys within minutes, making it highly unsuitable.

Additional Information:

WPA3 SAEis particularly designed for environments where there is no centralized authentication

server (likeActive Directory), which fits the small office scenario perfectly.

TheDragonfly handshakeused by WPA3 SAE prevents offline brute-force attacks by usingpassword-

based authenticated key exchange.

Even if an attacker captures the handshake, they cannot easily performoffline dictionary attacksdue

toindividualized encryptionfor each session.

Extract from CompTIA SecurityX CAS-005 Study Guide:

According to theCompTIA SecurityX CAS-005 Official Study Guide, WPA3 offers improved security

over WPA2 by providingrobust protection against password guessing attacks, especially in

environments without enterprise-grade authentication mechanisms. TheSAE protocolis highlighted

as essential forpersonal and small office wireless networkswhere enhanced security is required

without the complexity of a RADIUS server.

A directory traversal attack exploits vulnerabilities in file path handling to access unauthorized files,

as seen in this example. To mitigate, sanitize user inputs and avoid directly passing user-supplied

data to the filesystem. This aligns with CASP+ objective 1.5, addressing secure input validation and

mitigating common web-based vulnerabilities.