Pass CompTIA CASP CAS-004 exam [Nov 28, 2025] Updated 620 Questions
CompTIA CAS-004 Actual Questions and 100% Cover Real Exam Questions
The CASP+ certification is ideal for IT professionals who are looking to advance their careers in the field of cybersecurity. CompTIA Advanced Security Practitioner (CASP+) Exam certification provides a comprehensive understanding of advanced security concepts and validates the ability to implement and manage security solutions that are effective against advanced threats. It is also a valuable credential for individuals who are looking to move into leadership positions within their organizations.
The CASP+ certification exam is a vendor-neutral certification, which means that it is not tied to any specific technology or product. It is designed to test the skills of security professionals who work with a wide range of technologies, including hardware, software, and networks. CAS-004 exam covers topics such as risk management, enterprise security architecture, research and analysis, and incident response. CAS-004 exam also includes performance-based questions that test the candidate's ability to solve real-world security problems.
NEW QUESTION # 118
An organization is implementing a new identity and access management architecture with the following objectives:
- Supporting MFA against on-premises infrastructure
- Improving the user experience by integrating with SaaS applications
- Applying risk-based policies based on location
- Performing just-in-time provisioning
Which of the following authentication protocols should the organization implement to support these requirements?
- A. OTP and 802.1X
- B. OAuth and OpenID
- C. SAML and RADIUS
- D. Kerberos and TACACS
Answer: C
Explanation:
Definitely SAML and RADIUS (SAML because of just-in-time, and RADIUS because of AAA).
NEW QUESTION # 119
A DNS forward lookup zone named complia.org must:
* Ensure the DNS is protected from on-path attacks.
* Ensure zone transfers use mutual authentication and are authenticated and negotiated.
Which of the following should the security architect configure to meet these requirements? (Select two).
- A. Conditional forwarders
- B. DNSSEC
- C. Public keys
- D. Root hints
- E. CNAME records
- F. SRV records
Answer: B,C
Explanation:
To protect DNS from on-path attacks and ensure that zone transfers are mutually authenticated and secure, the security architect should configure DNSSEC and Public keys. DNSSEC (Domain Name System Security Extensions) provides protection against DNS spoofing by digitally signing DNS data to ensure its integrity. Public keys are crucial for mutual authentication during zone transfers, ensuring that only authorized parties can exchange DNS zone data. Together, these options help meet both the requirements of securing DNS queries and authenticating zone transfers with cryptographic integrity.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (DNS Security) CompTIA CASP+ Study Guide: DNSSEC Implementation and Use of Public Keys
NEW QUESTION # 120
An enterprise is deploying APIs that utilize a private key and a public key to ensure the connection string is protected. To connect to the API, customers must use the private key.
Which of the following would BEST secure the REST API connection to the database while preventing the use of a hard-coded string in the request string?
- A. Sign the key with DSA.
- B. Deploy MFA for the service accounts.
- C. Utilize HMAC for the keys.
- D. Implement a VPN for all APIs.
Answer: C
Explanation:
Utilizing HMAC (hash-based message authentication code) for the keys is the best option for securing the REST API connection to the database while preventing the use of a hard-coded string in the request string.
HMAC is a technique that uses a secret key and a hash function to generate a code that can verify the authenticity and integrity of a message, preventing unauthorized modifications or tampering. Utilizing HMAC for the keys can prevent the use of a hard-coded string in the request string, as it can dynamically generate a unique code for each request based on the secret key and the message content, making it difficult to forge or replay. Implementing a VPN (virtual private network) for all APIs is not a good option for securing the REST API connection to the database, as it could introduce latency or performance issues for API requests, as well as not prevent the use of a hard-coded string in the request string. Signing the key with DSA (Digital Signature Algorithm) is not a good option for securing the REST API connection to the database, as it could be vulnerable to attacks or forgery if the key is compromised or weak, as well as not prevent the use of a hard- coded string in the request string. Deploying MFA (multi-factor authentication) for the service accounts is not a good option for securing the REST API connection to the database, as it could affect the usability or functionality of API requests, as well as not prevent the use of a hard-coded string in the request string.
Verified References: https://www.comptia.org/blog/what-is-hmac https://partners.comptia.org/docs/default- source/resources/casp-content-guide
NEW QUESTION # 121
A security architect is reviewing the following organizational specifications for a new application:
* Be sessionless and API-based
* Accept uploaded documents with Pll, so all storage must be ephemeral
* Be able to scale on-demand across multiple nodes
* Restrict all network access except for the TLS port
Which of the following ways should the architect recommend the application be deployed in order to meet security and organizational infrastructure requirements?
- A. Utilizing the cloud container service
- B. With a content delivery network
- C. Using scripted delivery
- D. On server instances with autoscaling groups
Answer: A
Explanation:
A cloud container service is the best way to meet the security and organizational infrastructure requirements described. Containers are sessionless, scalable, and can enforce ephemeral storage, which ensures that sensitive data like Personally Identifiable Information (PII) is only stored temporarily. Containers also restrict access to only necessary ports, such as TLS, and can easily scale across multiple nodes to handle varying workloads. CASP+ emphasizes the use of containers in modern, scalable, and secure application deployments, especially for API-based, sessionless applications that require flexible scaling and network security controls.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (Containers and Cloud Services for Secure Application Deployment) CompTIA CASP+ Study Guide: Deploying Scalable and Secure Applications with Containers
NEW QUESTION # 122
When evaluating compliance requirements for handling sensitive data, which of the following is most relevant?
- A. Due diligence
- B. Data classification
- C. Reference framework
- D. Data retention
Answer: A
Explanation:
Comprehensive and Detailed Step by Step Explanation:
* Due diligence involves researching and understanding regulatory requirements (e.g., HIPAA) to ensure compliance for handling sensitive data like personal health information.
* Data retention refers to how long data is stored, not compliance research.
* Data classification organizes data by sensitivity but is not specific to compliance research.
* Reference frameworks provide guidelines for implementation but are not directly about research.
References:
* CompTIA CASP+ Exam Objective 1.1: Analyze business and compliance requirements.
* CASP+ Study Guide, 5th Edition, Chapter 2, Legal and Regulatory Compliance.
NEW QUESTION # 123
A software development company needs to mitigate third-party risks to its software supply chain. Which of the following techniques should the company use in the development environment to best meet this objective?
- A. Performing software composition analysis
- B. Establishing coding standards and monitoring for compliance
- C. Requiring multifactor authentication
- D. Implementing a robust unit and regression-testing scheme
Answer: A
Explanation:
Software composition analysis (SCA) is the most effective method to mitigate third-party risks in a software supply chain. SCA tools analyze the open-source and third-party components used in software development to identify known vulnerabilities, outdated dependencies, or licensing issues. By integrating SCA into the development environment, the company can proactively address risks related to external libraries or codebases that may introduce vulnerabilities into the software supply chain. CASP+ emphasizes the importance of securing the supply chain, particularly by identifying and addressing risks introduced by third- party software components.
References:
* CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (Third-Party Risk Management)
* CompTIA CASP+ Study Guide: Securing Software Supply Chains with SCA
NEW QUESTION # 124
A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate UTM will not allow users to download email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead. The network comprises three VLANs:
The security engineer looks at the UTM firewall rules and finds the following:
Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?
- A. Confirm the email server certificate is installed on the corporate computers.
- B. Make sure the UTM certificate is imported on the corporate computers.
- C. Contact the email service provider and ask if the company IP is blocked.
- D. Create an IMAPS firewall rule to ensure email is allowed.
Answer: A
Explanation:
To ensure that IMAPS functions properly on the corporate user network, the security engineer should take the following steps:
Confirm that the email server certificate is installed on the corporate computers. In order to establish a secure connection using IMAPS, the client computer must trust the certificate of the server that it is connecting to. If the email server certificate is not installed on the corporate computers, users will not be able to establish a secure connection using IMAPS.
NEW QUESTION # 125
A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security.
Which of the following encryption methods should the cloud security engineer select during the implementation phase?
- A. Array controller-based
- B. Storage-based
- C. Instance-based
- D. Proxy-based
Answer: B
Explanation:
We recommend that you encrypt your virtual hard disks (VHDs) to help protect your boot volume and data volumes at rest in storage, along with your encryption keys and secrets.
Azure Disk Encryption helps you encrypt your Windows and Linux IaaS virtual machine disks.
Azure Disk Encryption uses the industry-standard BitLocker feature of Windows and the DM- Crypt feature of Linux to provide volume encryption for the OS and the data disks. The solution is integrated with Azure Key Vault to help you control and manage the disk-encryption keys and secrets in your key vault subscription. The solution also ensures that all data on the virtual machine disks are encrypted at rest in Azure Storage.
NEW QUESTION # 126
A cybersecurity analyst created the following tables to help determine the maximum budget amount the business can justify spending on an improved email filtering system:
Which of the following meets the budget needs of the business?
- A. Filter ABC
- B. Filter TUV
- C. Filter GHI
- D. Filter XYZ
Answer: D
Explanation:
Explanation
Filter XYZ is the best option that meets the budget needs of the business. Filter XYZ has an ALE of $1 million per year, which is lower than any other filter option. ALE stands for annualized loss expectancy, which is a measure of how much money a business can expect to lose due to a risk over a year. ALE is calculated by multiplying the annualized rate of occurrence (ARO) of an event by the single loss expectancy (SLE) of an event. ARO is how often an event is expected to occur in a year. SLE is how much money an event will cost each time it occurs. Therefore, ALE = ARO x SLE. Filter XYZ has an ARO of 0.1 and an SLE of $10 million, so ALE = 0.1 x $10 million = $1 million. Verified References:
https://www.comptia.org/training/books/casp-cas-004-study-guide ,
https://www.techopedia.com/definition/24771/annualized-loss-expectancy-ale
NEW QUESTION # 127
A threat analyst notices the following URL while going through the HTTP logs.
Which of the following attack types is the threat analyst seeing?
- A. SQL injection
- B. XSS
- C. CSRF
- D. Session hijacking
Answer: B
NEW QUESTION # 128
A security analyst is participating in a risk assessment and is helping to calculate the exposure factor associated with various systems and processes within the organization. Which of the following resources would be most useful to calculate the exposure factor in this scenario?
- A. Lessons learned
- B. Business impact analysis
- C. Information security policy
- D. Gap analysis
- E. Risk register
Answer: B
Explanation:
A business impact analysis (BIA) is the most useful resource for calculating the exposure factor in a risk assessment. The BIA helps identify the criticality of systems and processes and quantifies the potential financial and operational impact of vulnerabilities being exploited. By understanding the business impact, the security team can more accurately determine the exposure factor, which is the proportion of an asset's value that is at risk in the event of a security incident. CASP+ highlights the role of BIAs in understanding risk exposure and supporting effective risk management decisions.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 1.0 - Risk Management (Business Impact Analysis and Risk Exposure) CompTIA CASP+ Study Guide: Business Impact Analysis for Risk Assessment
NEW QUESTION # 129
The primary advantage of an organization creating and maintaining a vendor risk registry is to:
- A. define the risk assessment methodology.
- B. ensure that inventory of potential risk is maintained.
- C. study a variety of risks and review the threat landscape.
- D. ensure that all assets have low residual risk.
Answer: B
Explanation:
The primary advantage of creating and maintaining a vendor risk registry is to ensure that an inventory of potential risks is maintained. A vendor risk registry helps organizations keep track of the risks associated with third-party vendors, especially as they may introduce vulnerabilities or non-compliance issues. By maintaining this registry, the organization can continuously monitor and manage vendor-related risks in a structured way, improving its overall security posture. CASP+ emphasizes the importance of vendor risk management in an organization's broader risk management strategy.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 1.0 - Risk Management (Vendor Risk Management) CompTIA CASP+ Study Guide: Third-Party Risk Management and Risk Registries
NEW QUESTION # 130
A cloud engineer is tasked with improving the responsiveness and security of a company's cloud- based web application. The company is concerned that international users will experience increased latency.
Which of the following is the BEST technology to mitigate this concern?
- A. Containerization
- B. Clustering
- C. Content delivery network
- D. Caching
Answer: C
NEW QUESTION # 131
A vulnerability analyst identified a zero-day vulnerability in a company's internally developed software. Since the current vulnerability management system does not have any checks for this vulnerability, an engineer has been asked to create one.
Which of the following would be BEST suited to meet these requirements?
- A. Node.js
- B. OVAL
- C. ARF
- D. ISACs
Answer: B
Explanation:
OVAL (Open Vulnerability and Assessment Language) is a standard that would be best suited for creating checks for a zero-day vulnerability in an organization's internally developed software. OVAL is a standard for expressing system configuration information and vulnerabilities in an XML format, allowing interoperability and automation among different security tools and platforms. An engineer can use OVAL to create definitions or tests for specific vulnerabilities or states in the software, and then use OVAL-compatible tools to scan or evaluate the software against those definitions or tests. ARF (Asset Reporting Format) is not astandard for creating checks for vulnerabilities, but a standard for expressing information about assets and their characteristics in an XML format, allowing interoperability and automation among different security tools and platforms. ISACs (Information Sharing and Analysis Centers) are not standards for creating checks for vulnerabilities, but organizations that collect, analyze, and disseminate information about threats, vulnerabilities, incidents, or best practices among different sectors or communities. Node.js is not a standard for creating checks for vulnerabilities, but a runtime environment that allows executing JavaScript code outside of a web browser, enabling the development of scalable web applications or services. Verified References:
https://www.comptia.org/blog/what-is-ovalhttps://partners.comptia.org/docs/default-source/resources/casp-conte
NEW QUESTION # 132
A security analyst discovered that a database administrator's workstation was compromised by malware. After examining the Jogs. the compromised workstation was observed connecting to multiple databases through ODBC. The following query behavior was captured:
Assuming this query was used to acquire and exfiltrate data, which of the following types of data was compromised, and what steps should the incident response plan contain?
A) Personal health information: Inform the human resources department of the breach and review the DLP logs.
#) Account history; Inform the relationship managers of the breach and create new accounts for the affected users.
C) Customer IDs: Inform the customer service department of the breach and work to change the account numbers.
D) PAN: Inform the legal department of the breach and look for this data in dark web monitoring.
- A. Option A
- B. Option B
- C. Option C
- D. Option D
Answer: D
NEW QUESTION # 133
The general counsel at an organization has received written notice of upcoming litigation. The general counsel has issued a legal records hold. Which of the following actions should the organization take to comply with the request?
- A. Require employees to be trained on legal record holds
- B. Preserve all communication matching the requested search terms
- C. Request that all users do not delete any files
- D. Block communication with the customer while litigation is ongoing
Answer: B
Explanation:
When a legal records hold is issued, the organization is required to preserve all documents and communications that may relate to the litigation. This includes emails, files, and any other form of communication that contains the requested search terms. It is a process of ensuring that this information is not deleted, altered, or otherwise tampered with.
NEW QUESTION # 134
A penetration tester inputs the following command:
This command will allow the penetration tester to establish a:
- A. network pivot
- B. proxy chain
- C. reverse shell
- D. port mirror
Answer: C
Explanation:
The command depicted is indicative of a reverse shell, which is a type of shell where the target system initiates an outgoing connection to a remote host, and then standard input and output of the command line interface on the target system is redirected through this connection to the remote host. This is typically used by an attacker after exploitation to open a remote command line interface to control the compromised machine.
NEW QUESTION # 135
A company is preparing to deploy a global service.
Which of the following must the company do to ensure GDPR compliance? (Choose two.)
- A. Provide alternative authentication techniques.
- B. Provide opt-in/out for marketing messages.
- C. Grant data access to third parties.
- D. Inform users regarding what data is stored.
- E. Provide optional data encryption.
- F. Provide data deletion capabilities.
Answer: D,F
Explanation:
Explanation
The main rights for individuals under the GDPR are to:
allow subject access
have inaccuracies corrected
have information erased
prevent direct marketing
prevent automated decision-making and profiling
allow data portability (as per the paragraph above)
source:https://www.clouddirect.net/11-things-you-must-do-now-for-gdpr-compliance/
NEW QUESTION # 136
A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stopped. The files were transferred via TLS-protected HTTP sessions from systems that do not send traffic to those sites.
The technician will define this threat as:
- A. a zero-day attack.
- B. a decrypting RSA using obsolete and weakened encryption attack.
- C. an on-path attack.
- D. an advanced persistent threat.
Answer: D
Explanation:
Reference:
An advanced persistent threat (APT) is a type of cyberattack that involves a stealthy and continuous process of compromising and exploiting a target system or network. An APT typically has a specific goal or objective, such as stealing sensitive data, disrupting operations, or sabotaging infrastructure. An APT can use various techniques to evade detection and maintain persistence, such as encryption, proxy servers, malware, etc. The scenario described in the question matches the characteristics of an APT. Reference: https://www.cisco.com/c/en/us/products/security/what-is-apt.html https://www.imperva.com/learn/application-security/advanced-persistent-threat-apt/
NEW QUESTION # 137
The SOC is reviewing processes and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. This allowed the malware to spread to additional hosts before it was contained. Which of the following would BEST to improve the incident response process?
- A. Dividing the network into trusted and untrusted zones
- B. Providing additional end-user training on acceptable use
- C. Updating the playbook with better decision points
- D. Implementing manual quarantining of infected hosts
Answer: B
NEW QUESTION # 138
A financial institution generates a list of newly created accounts and sensitive information on a daily basis. The financial institution then sends out a file containing thousands of lines of data.
Which of the following would be the best way to reduce the risk of a malicious insider making changes to the file that could go undetected?
- A. Create a script that compares the size of the file on an hourly basis and generates alerts when changes are identified.
- B. Implement a FIM that automatically generates alerts when the file is accessed by IP addresses that are not associated with the application.
- C. Write a SIEM rule that generates a critical alert when files are created on the application server.
- D. Tune the rules on the host-based IDS for the application server to trigger automated alerts when the application server is accessed from the internet.
Answer: B
Explanation:
File Integrity Monitoring (FIM) is a technology that can detect changes in files, often used to safeguard critical data. Implementing a FIM solution that generates alerts for access by unauthorized IP addresses would ensure that any unauthorized modifications to the file can be detected and acted upon. This helps in mitigating the risk of insider threats, as it would alert to any changes not made through the expected application process.
NEW QUESTION # 139
......
CompTIA CAS-004 Real 2025 Braindumps Mock Exam Dumps: https://www.testkingpdf.com/CAS-004-testking-pdf-torrent.html
CAS-004 Free Exam Questions and Answers PDF Updated on Nov-2025: https://drive.google.com/open?id=1yymgbzm86qLpV_iCuNzcbU3unA0ilB0Z
