Free CAS-005 Practice Test Questions 2026

A compliance officer isfacilitating abusiness impact analysis (BIA)and wantsbusiness unit leadersto collect meaningful data. Several business unit leaders want more information about the types of data the officer needs. Which of the following data types would be the most beneficial for the compliance officer?(Select two)

A. Inventory details

B. Applicable contract obligations

C. Costs associated with downtime

D. Network diagrams

E. Contingency plans

F. Critical processes

An administrator reviews the following log and determines the root cause of a site-to-site tunnel failure:

Which of the following actions should the administrator take to most effectively correct the failure?

A. Enable perfect forward secrecy on the remote peer.

B. Update the cipher suites configured for use on the server side.

C. Add a new subnet as a permitted initiator.

D. Disable IKE version 1 and run IKE version 2.

A security engineer needs to review the configurations of several devices on the network to meet the following requirements:
• The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.
• The SSH daemon on the database server must be configured to listen to port 4022.
• The SSH daemon must only accept connections from a Single workstation.
• All host-based firewalls must be disabled on all workstations.
• All devices must have the latest updates from within the past eight days.
•All HDDs must be configured to secure data at rest.
• Cleartext services are not allowed.
• All devices must be hardened when possible.

Instructions:
Click on the various workstations and network devices to review the posture assessment results. Remediate any possible issues or indicate that no issue is found.
Click on Server A to review output data. Select commands in the appropriate tab to remediate connectivity problems to the pOSTGREsql DATABASE VIA ssh

A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems Given the following output:

Which of the following actions would address the root cause of this issue?

A. Automating the patching system to update base Images

B. Recompiling the affected programs with the most current patches

C. Disabling unused/unneeded ports on all servers

D. Deploying a WAF with virtual patching upstream of the affected systems

During a recent audit, a company's systems were assessed- Given the following information:

Which of the following is the best way to reduce the attack surface?

A. Deploying an EDR solution to all impacted machines in manufacturing

B. Segmenting the manufacturing network with a firewall and placing the rules in monitor mode

C. Setting up an IDS inline to monitor and detect any threats to the software

D. Implementing an application-aware firewall and writing strict rules for the application access

Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique?

A. It is computationally efficient and provides perfect forward secrecy.

B. It is more resilient to brute-force attacks than ECC.

C. It supports ephemeral key exchange and digital signatures.

D. It is currently considered a robust PQC technique.

E. It enables processing on data while remaining in an encrypted state.

A company recently acquired a manufacturing plant. The acquiring company plans to create a unified network that does not impact its security posture. The manufacturing plant has been in operation for more than 30 years and has not followed an equipment replacement life cycle. Which of the following is the best way to meet this objective?

A. Implementing a WAF and patching the legacy IT equipment

B. Extending an SD-WAN with specific policies

C. Using a site-to-site VPN and integrating the manufacturing plant into the SIEM

D. Deploying a proxy server at the manufacturing plant

A threat intelligence company's business objective is to allow customers to integrate data directly to different TIPs through an API. The company would like to address as many of the following objectives as possible:
• Reduce compute spend as much as possible.
• Ensure availability for all users.
• Reduce the potential attack surface.
• Ensure the integrity of the data provided.
Which of the following should the company consider to best meet the objectives?

A. Configuring a unique API secret key for accounts

B. Publishing a list of IoCs on a public directory

C. Implementing rate limiting for each registered user

D. Providing a hash of all data that is made available

As part of a security audit in the software development life cycle, a product manager must demonstrate and provide evidence of a complete representation of the code and modules used within the production-deployed application prior to the build. Which of the following best provides the required evidence?

A. Software composition analysis

B. Runtime application inspection

C. Static application security testing

D. Interactive application security testing

A security administrator needs to review the efficacy of the detection rules configured on the SIEM by employing real-world attacker TTPs. Which of the following actions should the security administrator take to accomplish this objective?

A. Perform an internal penetration test.

B. Use adversary emulation.

C. Execute an internal vulnerability assessment.

D. Perform a threat hunt exercise.

E. Ingest new threat intelligence feeds.

An organization recently implemented a new email DLP solution. Emails sent from company email addresses to matching personal email addresses generated a large number of alerts, but the content of the emails did not include company data. The security team needs to reduce the number of emails sent without blocking all emails to common personal email services. Which of the following should the security team implement first?

A. Automatically quarantine outgoing email.

B. Create an acceptable use policy.

C. Enforce email encryption standards.

D. Perform security awareness training focusing on phishing.

A company designs policies and procedures for hardening containers deployed in the production environment. However, a security assessment reveals that deployed containers are not complying with the security baseline. Which of the following solutions best addresses this issue throughout early life-cycle stages?

A. Installing endpoint agents on each container and setting them to report when configurations drift from the baseline

B. Finding hardened container images and enforcing them as the baseline for new deployments

C. Creating a pipeline to check the containers through security gates and validating the baseline controls before the final deployment

D. Running security assessments regularly and checking for the security baseline on containers already in production