Question Q-5724 A security architect must implement a solution to protect containerized…
1 comment · last active Jun 2, 2026
CompTIA CASP+ SecurityX CAS-005 - All Domains Advanced Security Architecture Engineering
By Jordan Blake · Updated May 25, 2026
| Questions | 25 |
| Passing Score | 75% |
| Format | 100% Multiple Choice |
| Sessions Logged | 1,734 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized25 questions
Discussion
Log in to post a comment, reply, or expand a question.
Zero trust = never trust, always verify, assume breach. Not 'firewall at the edge and we're done'.
+1 votes
BYOK/customer-managed keys in cloud = provider can't read tenant data at rest — exam loves CMK/HSM wording.
SASE converges SD-WAN + security edge (SWG/CASB/ZTNA) — reduces hairpin VPN to DC.
DCSync = replicate AD password hashes via replication permission abuse — Golden Ticket territory.
+1 votes
Golden Ticket = forged TGT with KRBTGT hash. Remediation = rotate KRBTGT twice + hunt persistence.
STRIDE Tampering = unauthorized data modification. Spoofing = fake identity.
SAST = static code analysis in CI. DAST = running app testing. Both in DevSecOps pipeline.
+1 votes
Post-quantum threat to RSA/ECC — Shor's algorithm on quantum computers breaks asymmetric crypto.
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
A company's development team wants to integrate security into their CI/CD pipeline. A security engineer proposes running SAST and DAST tools automatically. What is the difference?
Explanation
SAST analyzes source code, bytecode, or binaries to find vulnerabilities (SQLi, buffer overflows, hardcoded credentials) without running the code. DAST attacks the running application (like a black-box test) to find runtime vulnerabilities (authentication flaws, injection, misconfigurations).
Question 2
A security engineer is implementing TLS for an internal API. They want to ensure that only the server's certificate is trusted (not any CA certificate), preventing man-in-the-middle attacks even with valid CA-signed certificates. What technique should be used?
Explanation
Certificate pinning "pins" the expected certificate or public key in the application, rejecting any certificate that doesn't match — even valid CA-signed certificates. This prevents MITM attacks using fraudulently-issued or CA-compromised certificates, at the cost of more complex certificate rotation.
Question 3
An organization wants to measure the effectiveness of their security program. Which metric would BEST indicate the organization's ability to detect and respond to threats?
Explanation
MTTD and MTTR are outcome-based metrics that directly measure security program effectiveness. Decreasing MTTD shows improved detection capability; decreasing MTTR shows improved response capability. They measure actual security outcomes, not just activity metrics (policies written, training completed).
Question 4
A CISO is designing a supply chain security program after a major vendor compromise. Which control would MOST effectively reduce supply chain risk?
Explanation
Supply chain security requires: TPRM (Third-Party Risk Management) assessments for vendor security posture, attestation to security standards, software SCA to detect vulnerable/malicious dependencies in vendor-supplied code, and monitoring vendor privileged access (as seen in SolarWinds attack).
Question 5
An enterprise security architect is designing a solution to ensure that privileged access to cloud infrastructure is temporary, audited, and eliminates permanent credentials. Which capability achieves this?
Explanation
JIT (Just-in-Time) PAM grants elevated privileges for a specific time window (e.g., 1 hour) based on approved request, records the session, and automatically revokes access afterward. This eliminates standing privileges that represent persistent risk from credential compromise.
Container escape mitigations: seccomp, AppArmor/SELinux, read-only rootfs, drop caps.