Aug-2025 Free CompTIA CAS-004 Exam Question Practice Exams [Q234-Q249]

CAS-004 CompTIA

admin -

August 27, 2025

4.5/5 - (2 votes)

Aug-2025 Free CompTIA CAS-004 Exam Question Practice Exams

Ace CAS-004 Certification with 620 Actual Questions

The CASP+ certification is aimed at professionals who are responsible for the security of their organization’s IT environment. CAS-004 exam covers a wide range of topics, including risk management, enterprise security architecture, research and collaboration, and integration of computing, communications, and business disciplines. CompTIA Advanced Security Practitioner (CASP+) Exam certification validates the skills and knowledge required to design and implement secure solutions in complex enterprise environments.

CompTIA CAS-004 exam covers a wide range of topics related to cybersecurity, including risk management, enterprise security architecture, research and collaboration, and integration of computing, communications, and business disciplines. CAS-004 exam also tests the candidate’s knowledge of advanced security concepts such as cryptography, identity and access management, and secure communication protocols.

Q234. A company would like to obfuscate PII data accessed by an application that is housed in a database to prevent unauthorized viewing. Which of the following should the company do to accomplish this goal?

Use cell-level encryption.

Mask the data.

Implement a DLP solution.

Utilize encryption at rest.

Key word here is obfuscation: To obfuscate PII data accessed by an application housed in a database, the company should mask the data. This can be done by replacing the actual data with fake data that has the same format and characteristics, but is not sensitive or identifiable. This can be done using techniques such as data masking or data pseudonymization.

Q235. A security administrator at a global organization wants to update password complexity rules for a system containing personally identifiable information. Which of the following would be the best resource for this information?

NIST

GDPR

CMMI

COPPA

NIST (National Institute of Standards and Technology): Provides comprehensive password guidelines (e.g., SP 800-63B) widely used for securing systems, including handling PII. GDPR (General Data Protection Regulation): Focuses on data privacy laws rather than technical password policies.
CMMI (Capability Maturity Model Integration): Addresses process improvement, not password complexity.
COPPA (Children’s Online Privacy Protection Act): Focuses on child data privacy, not password rules.

Q236. Which of the following indicates when a company might not be viable after a disaster?

Maximum tolerable downtime

Recovery time objective

Mean time to recovery

Annual loss expectancy

The indicator that shows when a company might not be viable after a disaster is the maximum tolerable downtime (MTD). MTD is the maximum amount of time that a business process or function can be disrupted without causing unacceptable consequences for the organization. MTD is a key metric for business continuity planning and disaster recovery, as it helps determine the recovery time objective (RTO) and the recovery point objective (RPO) for each process or function. If the actual downtime exceeds the MTD, the organization may face severe losses, reputational damage, regulatory penalties, or even bankruptcy. Verified References:
https://www.techtarget.com/searchdisasterrecovery/definition/maximum-tolerable-downtime
https://www.techtarget.com/searchdisasterrecovery/definition/recovery-time-objective
https://www.techtarget.com/searchdisasterrecovery/definition/recovery-point-objective

Q237. A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about meeting SLA requirements in the event of a CSP incident.
Which of the following would be BEST to proceed with the transformation?

An on-premises solution as a backup

A load balancer with a round-robin configuration

A multicloud provider solution

An active-active solution within the same tenant

An active-active cluster does nothing if the cloud provider goes down. One of the main features of multi-cloud is redundancy. https://www.cloudflare.com/learning/cloud/what-is-multicloud/

Q238. During a phishing exercise, a few privileged users ranked high on the failure list. The enterprise would like to ensure that privileged users have an extra security-monitoring control in place. Which of the following Is the MOST likely solution?

A WAF to protect web traffic

User and entity behavior analytics

Requirements to change the local password

A gap analysis

User and entity behavior analytics (UEBA) is the best solution to monitor and detect unusual or malicious activity by privileged users who failed the phishing exercise. UEBA uses machine learning and behavioral analytics to establish a baseline of normal activity and identify anomalies that indicate potential threats.
UEBA can help detect compromised credentials, insider threats, and advanced persistent threats that may evade traditional security solutions. The other options are either irrelevant or less effective for the given scenario.

Q239. A company hired a third party to develop software as part of its strategy to be quicker to market.
The company’s policy outlines the following requirements:
– The credentials used to publish production software to the container
registry should be stored in a secure location.
– Access should be restricted to the pipeline service account, without
the ability for the third-party developer to read the credentials
directly.
Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?

TPM

Local secure password file

MFA

Key vault

Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. Key Vault service supports two types of containers: vaults and managed hardware security module (HSM).
https://intellipaat.com/blog/what-is-azure-key-vault/

Q240. A company’s finance department acquired a new payment system that exports data to an unencrypted file on the system. The company implemented controls on the file so only appropriate personnel are allowed access. Which of the following risk techniques did the department use in this situation?

Avoid

Transfer

Mitigate

Comprehensive and Detailed in-Depth
In cybersecurity and risk management, the four primary risk response techniques are:
Accept:Choosing to acknowledge the risk without taking any measures to reduce it. This usually applies when the cost of mitigation outweighs the potential impact.
Avoid:Taking actions to completely eliminate the risk, such as discontinuing a risky activity or process.
Transfer:Shifting the risk to a third party, such as through insurance or outsourcing.
Mitigate:Implementing controls to reduce the impact or likelihood of the risk.
Why the Correct Answer is D (Mitigate):
The company’s finance department implementedaccess controlsto restrict data access to only authorized personnel.
Although the data is exported to anunencrypted file, therisk of unauthorized accessis reduced through the implementation of access control mechanisms.
This is a classic example ofrisk mitigation, where the company does not eliminate the risk entirely (since the file remains unencrypted) but reduces its potential impact through technical controls.
Why the Other Options Are Incorrect:
A . Accept:The company did not simply accept the risk without taking action; they actively implemented controls.
B . Avoid:The risk was not eliminated by changing the system or discontinuing the practice.
C . Transfer:The company did not shift the risk to another entity, such as an insurance provider or third-party service.
Extract from CompTIA SecurityX CAS-005 Study Guide:
According to theCompTIA SecurityX CAS-005 Official Study Guide, risk mitigation is defined as the process of implementing controls to reduce the likelihood or impact of a risk. In this scenario, byrestricting file access to appropriate personnel, the company effectively mitigates the risk of data exposure, despite the file being unencrypted.

Q241. A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.
Which of the following commands would be the BEST to run to view only active Internet connections?

sudo netstat -antu | grep “LISTEN” | awk ‘{print$5}’

sudo netstat -nlt -p | grep “ESTABLISHED”

sudo netstat -plntu | grep -v “Foreign Address”

sudo netstat -pnut -w | column -t -s $’w’

sudo netstat -pnut | grep -P ^tcp

Q242. Due to budget constraints, an organization created a policy that only permits vulnerabilities rated high and critical according to CVSS to be fixed or mitigated. A security analyst notices that many vulnerabilities that were previously scored as medium are now breaching higher thresholds. Upon further investigation, the analyst notices certain ratings are not aligned with the approved system categorization.
Which of the following can the analyst do to get a better picture of the risk while adhering to the organization’s policy?

Align the exploitability metrics to the predetermined system categorization.

Align the remediation levels to the predetermined system categorization.

Align the impact subscore requirements to the predetermined system categorization.

Align the attack vectors to the predetermined system categorization.

Aligning the impact subscore requirements to the predetermined system categorization can help the analyst get a better picture of the risk while adhering to the organization’s policy. The impact subscore is one of the components of the CVSS base score, which reflects the severity of a vulnerability. The impact subscore is calculated based on three metrics: confidentiality, integrity, and availability. These metrics can be adjusted according to the system categorization, which defines the security objectives and requirements for a system based on its potential impact on an organization’s operations and assets. By aligning the impact subscore requirements to the system categorization, the analyst can ensure that the CVSS scores reflect the true impact of a vulnerability on a specific system and prioritize remediation accordingly.

Q243. A security engineer is performing a vulnerability management scan on multihomed Linux systems. The engineer notices that the vulnerability count is high due to the fact that each vulnerability is multiplied by the number of NICs on each system. Which of the following should the engineer do to deduplicate the vulnerabilities and to associate the vulnerabilities with a particular host?

Use a SCAP scanner.

Deploy an agent.

Initiate a discovery scan.

Perform an Nmap scan.

Q244. A security architect discovers the following while reviewing code for a company’s website:
selection = “SELECT Item FROM Catalog WHERE ItemID * ” &
Request(“ItemID”)
Which of the following should the security architect recommend?

Client-side processing

Query parameterization

Data normalization

Escape character blocking

URL encoding

Query parameterization prevents SQL injection attacks by separating SQL commands from data inputs. This ensures that user-supplied input cannot be executed as part of a SQL query. In the given code, lack of parameterization could allow attackers to manipulate the ItemID parameter maliciously.

Q245. The CI/CD pipeline requires code to have close to zero defects and zero vulnerabilities. The current process for any code releases into production uses two-week Agile sprints. Which of the following would BEST meet the requirement?

An open-source automation server

A static code analyzer

Trusted open-source libraries

A single code repository for all developers

A) An open-source automation server is not a tool that can help ensure that the code has close to zero defects and zero vulnerabilities. An open-source automation server is a tool that automates various tasks related to software development and delivery, such as building, testing, deploying, and monitoring. An open-source automation server can help speed up the CI/CD pipeline, but it does not analyze or improve the code itself.
C) Trusted open-source libraries are not tools that can help ensure that the code has close to zero defects and zero vulnerabilities. Trusted open-source libraries are collections of reusable code that developers can use to implement common or complex functionalities in their applications. Trusted open-source libraries can help save time and effort for developers, but they do not guarantee that the code is free of defects or vulnerabilities.
D) A single code repository for all developers is not a tool that can help ensure that the code has close to zero defects and zero vulnerabilities. A single code repository for all developers is a centralized storage location where developers can access and manage their source code files. A single code repository for all developers can help facilitate collaboration and version control, but it does not analyze or improve the code itself.
https://www.comparitech.com/net-admin/best-static-code-analysis-tools/
https://www.perforce.com/blog/sca/what-static-analysis
Explanation:
A static code analyzer is a tool that analyzes computer software without actually running the software. A static code analyzer can help developers find and fix vulnerabilities, bugs, and security risks in their new applications while the source code is in its ‘static’ state. A static code analyzer can help ensure that the code has close to zero defects and zero vulnerabilities by checking the code against a set of coding rules, standards, and best practices. A static code analyzer can also help improve the code quality, performance, and maintainability.

Q246. Which of the following allows computation and analysis of data within a ciphertext without knowledge of the plaintext?

Lattice-based cryptography

Quantum computing

Asymmetric cryptography

Homomorphic encryption

Reference: https://searchsecurity.techtarget.com/definition/cryptanalysis Homomorphic encryption is a type of encryption that allows computation and analysis of data within a ciphertext without knowledge of the plaintext. This means that encrypted data can be processed without being decrypted first, which enhances the security and privacy of the data. Homomorphic encryption can enable applications such as secure cloud computing, machine learning, and data analytics.References:
https://www.ibm.com/security/homomorphic-encryptionhttps://www.synopsys.com/blogs/software-security/hom

Q247. A security officer at an organization that makes and sells digital artwork must ensure the integrity of the artwork can be maintained. Which of the following are the best ways for the security officer to accomplish this task? (Choose two.)

Hashing

ECC

IPSec

Tokenization

Watermarking

Print blocking

Q248. A network security engineer is designing a three-tier web architecture that will allow a third-party vendor to perform the following audit functions within the organization’s cloud environment
* Review communication between all infrastructure endpoints
* Identify unauthorized and malicious data patterns
* Perform automated, risk-mitigating configuration changes
Which of the following should the network security engineer include in the design to address these requirements?

Network edge NIPS

Centralized syslog

Traffic mirroring

Network flow

Traffic mirroring, also known as port mirroring or SPAN (Switched Port Analyzer), involves creating a copy of the actual network traffic for independent analysis. This would allow the third-party vendor to review communications between infrastructure endpoints, identify unauthorized and malicious data patterns, and perform automated, risk-mitigating configuration changes without impacting the live environment. This is used in network intrusion detection systems (NIDS) and for traffic analysis purposes.

Q249. A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack. A security analyst is reviewing the following web server configuration:

Which of the following ciphers should the security analyst remove to support the business requirements?