CompTIA SecurityX Practice Test (CAS-005)

Groups driven by social or political causes target organizations to highlight their concerns, often through public campaigns or protest tactics. Criminal networks concentrate on unlawful gains, insiders are typically seeking revenge or personal advantage, and nation-state operatives focus on intelligence gathering or strategic benefits. Recognizing these differences helps security teams anticipate the nature of attacks and better align defenses.

Applying and testing a fix in a controlled environment confirms that the solution is effective and does not introduce unintended problems. Not taking direct and validated action leaves the business at risk or disrupts normal processes unnecessarily.

A central system that captures events and enforces approval steps provides a reliable audit trail. Each update is logged with a record of who made it. Weekly snapshots miss incremental details, relying on multiple separate logs can create gaps, and read-only channels supplemented by personal notes can fragment the information. A unified approach makes it simpler to validate actions during reviews.

A specialized processor extension that dedicates an environment for cryptographic operations is correct because it ensures sensitive code runs in a secure area, safe from malicious activities. A tool that allows memory scanning helps identify threats but does not guarantee real-time isolation. An external service for key rotation is valuable for managing keys but does not protect local processing. Automatically deploying patches is a broad maintenance strategy rather than a solution for hardware isolation.

Pivoting through compromised machines means the intruder is using one infiltrated device to access other internal targets. This broadens their presence inside a network. Monitoring traffic focuses on collecting data and does not allow hopping from one device to another. DNS (Domain Name System) tunneling is often used to disguise data exfiltration, not move deeper into multiple systems. Stopping malicious processes on a single host does not provide new access to other endpoints.

Adjusting correlation and priority settings ensures that alerts reflect real threats rather than routine traffic. The effective approach involves tuning severity levels for different event types. Increasing the scanning scope generates more data, which can further overwhelm the team. Relying on a specialized distribution platform or container handling does not directly target the root issue of setting rules that filter repetitive events and highlight events likely to be malicious.

Recognized security standards enable unified defense by aligning teams under consistent goals, risk assessments, and technical safeguards. Rather than promoting one-size-fits-all tools or compliance for its own sake, these frameworks empower coordinated, evidence-based security practices at every level of the organization. Other options focus too narrowly on vendor reliance, prioritize particular methods without proper context, or minimize assessment of outside groups by relying excessively on compliance.

Requiring full-device encryption ensures that data on the smartphone's internal storage is unreadable without the user's passcode. Even if an attacker removes the storage medium or uses forensic tools, the encrypted data cannot be accessed. Settings such as short screen-lock timeouts, camera restrictions, or Wi-Fi whitelisting provide security benefits but do not protect data at rest when the device is physically out of the company's control.

The root cause is the failure to properly delete or destroy superseded cryptographic keys after their intended lifecycle. Merely marking a key as 'inactive' or 'disabled' is insufficient, as an attacker with sufficient privileges within the KMS may be able to reactivate or use it. Proper key deletion is a critical step in a key management lifecycle to prevent unauthorized access to historical encrypted data. While key rotation was performed, the failure to delete the old key created the vulnerability. The type of encryption is irrelevant to the key management failure, and while monitoring was useful for the investigation, it did not cause the breach.

Adjusting the updated filters helps reduce erroneous triggers and ensures genuine malicious traffic is still identified. Temporarily disabling detection leaves gaps in coverage. Placing flagged traffic into a silent log does not solve the root cause and allows problematic alerts to persist. Restricting known services does not resolve the misconfigurations and might disrupt normal processes.

A specialized pattern-based approach, known as YARA (Yet Another Recursive Acronym), is designed to detect malicious code by matching specific text, hex, or wildcard strings. It is especially effective for scanning memory and files across various operating systems. The other suggested methods focus on different aspects, such as correlating logs, gathering open-source indicators, or analyzing network traffic flows, rather than defining flexible string-based rules for suspicious code.

Data localization laws in jurisdictions such as the European Union (GDPR Art. 44–50), India (DPDP 2023), and China's PIPL prohibit the transfer of certain personal data outside the region without specific authorization or safeguards. Building data centers or storage facilities within the mandated geography and ensuring access controls and backup redundancy remain within regional boundaries satisfies compliance. Encryption alone does not fulfill storage residency requirements, nor do voluntary user consents override legal obligations. A single global infrastructure or encryption schema cannot address jurisdictional boundaries effectively.

Implementing file inspection on outbound traffic helps identify secret details to protect them from departure. Granting broader privileges does not address outbound movement of sensitive items, and focusing on incoming data or user login processes does not avert all unauthorized attempts to export files.

A dependency scanner checks known flaws and usage obligations in imported components before finalizing the application. Manual review and repeated tests can catch some problems, but they do not give deep insight into the library's background or potential conflicts. Embedded defense tools monitor issues during runtime, rather than examining the integrity and license status of external code artifacts.

Automated pipelines that include security checks provide a scalable, repeatable method for validating code with every update. These checks detect newly introduced vulnerabilities in near-real time and generate feedback quickly, minimizing the risk of regression or lingering flaws. Manual reviews or milestone-based audits introduce delays and gaps, which can leave weaknesses unaddressed between cycles. By contrast, integrated security tooling within CI/CD ensures each change is evaluated consistently, helping maintain a strong security posture across frequent deployments.

A coordinated sequence for each update helps prevent conflicting modifications. Scanning memory examines content but does not regulate updates. Creating more backups does not reliably avert corrupting the shared resource. Text-based checks target input anomalies rather than task overlap.

Dividing roles ensures that the group verifying authenticity does not also grant credentials, preventing a single breach from breaking the entire trust model. Combining identity checks and distribution in one place consolidates power and raises risk. Granting departments their own distribution oversight lacks rigorous reviews. Turning all duties over to an automated approach does not involve meaningful separation of responsibilities.

Using a distributed approach, where multiple scanning points cover each segment, helps detect flaws throughout the environment and reduces excessive bandwidth usage that could occur with a single scanner. Manual checks after significant changes or skipping certain servers leads to incomplete insight. Having only one scanning node for the entire internal landscape can overload the network as it processes many connections, limiting scalability and coverage.

Publisher (digital-signature) rules verify the signer's certificate and can allow all versions of a signed application without referencing its exact path. Unlike path-based rules-which can be bypassed if an attacker drops a malicious file into an allowed location-publisher rules remain effective even if the file is copied elsewhere and do not need to be updated every time the vendor releases a signed update. Complete or directory-based path rules and filename rules offer less protection against path spoofing and typically require more frequent changes when applications move or are upgraded.

Retrieving a short-lived token from a centralized secrets-management service at runtime keeps the credential out of source code and the filesystem, limits its exposure to the memory space of the executing process, and allows the secrets platform to enforce rotation and revocation. The other choices leave the secret in plaintext (or easily reversible Base64) on disk or make it globally accessible through environment variables, defeating the security goals.