Free CAS-004 Practice Test Questions and Answers (2026)

:

Step by Step

NIST (National Institute of Standards and Technology): Provides comprehensive password guidelines

(e.g., SP 800-63B) widely used for securing systems, including handling PII.

GDPR (General Data Protection Regulation): Focuses on data privacy laws rather than technical

password policies.

CMMI (Capability Maturity Model Integration): Addresses process improvement, not password

complexity.

COPPA (Children's Online Privacy Protection Act): Focuses on child data privacy, not password rules.

Reference: CASP+ Exam Objectives 5.3 – Implement security controls and best practices using NIST

standards.

A network traffic analyzer (also known as a packet sniffer) is the best tool to identify credentials

being transmitted in plaintext, such as those used in Telnet sessions. Since Telnet transmits data

without encryption, a network traffic analyzer can capture the traffic between the client and the

network switches, revealing sensitive information, including login credentials, in clear text. This tool

helps identify insecure protocols and enables remediation by switching to encrypted alternatives like

SSH. CASP+ highlights the importance of using secure protocols and tools like traffic analyzers to

identify vulnerabilities in network communications.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Network Traffic

Analysis and Insecure Protocols)

CompTIA CASP+ Study Guide: Monitoring Network Traffic for Plaintext Credentials

A runbook is a detailed guide that provides step-by-step instructions on how to respond to specific

types of incidents. It is used by the SOC team to ensure a consistent, organized, and efficient

response to incidents. In this case, after the incident investigation, creating a runbook would help

standardize the response process for future security incidents, enabling the team to act quickly and

effectively. CASP+ emphasizes the importance of having detailed runbooks for incident response as

part of an organization's overall incident response strategy.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Incident Response

and Runbooks)

CompTIA CASP+ Study Guide: Incident Response Procedures and Runbooks

To meet the mobile platform security requirements, the manufacturer should implement the following technologies: eFuse: This hardware feature helps track and prevent unauthorized firmware by physically "blowing" fuses to record events, such as firmware tampering, making it impossible to revert to older, unapproved firmware. Secure boot: This ensures that only trusted and authorized firmware can be loaded during the boot process, preventing malicious or unauthorized software from running. Secure enclave: A secure enclave is used to store sensitive information like biometric data in a hardware-isolated environment, protecting it from tampering or unauthorized access. These three solutions provide the tamper resistance, secure firmware validation, and protection of sensitive data required for the platform. CASP+ emphasizes the use of hardware-based security features for protecting sensitive information and enforcing secure boot processes in embedded and mobile systems. Reference: CASP+ CAS-004 Exam Objectives: Domain 3.0 – Enterprise Security Architecture (Secure Hardware and Firmware Protection) CompTIA CASP+ Study Guide: Hardware Security Features (eFuse, Secure Boot, Secure Enclave)

Step by Step

The information disclosed in the error message (e.g., "Apache Tomcat 7.0.52") provides attackers

insights into the software version, which may have known vulnerabilities.

Correcting this issue ensures that attackers cannot use the disclosed information to tailor more

sophisticated or targeted attacks.

Best practices include suppressing unnecessary error details to mitigate the risk of information

disclosure.

Reference: CASP+ Exam Objectives 5.3 – Mitigate vulnerabilities related to service information

leakage.

PCI DSS (Payment Card Industry Data Security Standard) is the most appropriate governance

framework when collecting and processing credit card data, including international user data. PCI

DSS establishes security standards for organizations that handle payment card transactions and

ensures theprotection of cardholder data globally. The other options, such as ISO 27001 and NIST

800-53, provide general security frameworks, but PCI DSS is specifically designed for payment card

security, which is critical when handling credit card information. CASP+ emphasizes the role of PCI

DSS in ensuring the secure handling of payment data.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 1.0 – Risk Management (PCI DSS Compliance for Payment

Systems)

CompTIA CASP+ Study Guide: Payment Systems Security and PCI DSS

Step by Step

RPO (Recovery Point Objective): Specifies the maximum acceptable amount of data loss measured in

time. If data loss of more than one hour is unacceptable, the RPO should be set to less than or equal

to one hour.

RTO (Recovery Time Objective): Refers to the acceptable duration of system downtime, which is not

relevant to the question.

The BCP, DRP, and SLA do not directly address data loss.

Reference: CASP+ Exam Objectives 1.3 – Analyze BIA results to determine RPO and RTO

requirements.

While the company has implemented Single Sign-On (SSO) with strong passwords, additional security

controls are required to mitigate attacks such as LDAP injections, brute-force, whaling, and spear-

phishing. Two-factor authentication (2FA) provides an additional layer of security by requiring users

to provide two different forms of authentication (e.g., a password and a security token or a biometric

factor), reducing the likelihood of unauthorized access even if passwords are compromised. CASP+

emphasizes the importance of using multi-factor authentication mechanisms to strengthen access

control and protect against such attacks.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Access Control and

Multi-factor Authentication)

CompTIA CASP+ Study Guide: Implementing Two-Factor Authentication for System Access

Before determining which data should be deleted during a data cleanup project, it is critical to first

review retention schedules. Retention schedules specify how long data must be retained to comply

with legal, regulatory, or business requirements. Deleting data prematurely could result in non-

compliance or the loss of important information. By consulting retention schedules, the security

administrator ensures that data is deleted in a compliant and controlled manner, based on its

retention policy. CASP+ highlights data retention management as a key element in data governance

and security.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 1.0 – Risk Management (Data Governance and Retention

Policies)

CompTIA CASP+ Study Guide: Data Retention, Deletion, and Compliance Requirements

Full Disk Encryption ensures that the data on the laptop is encrypted at rest, preventing unauthorized

access even if the device is stolen and its hard drive accessed externally. This aligns with CASP+

objective 3.5, which emphasizes implementing encryption to protect sensitive data against theft and

compromise.

The best way to reduce the risk of terminated employees’ accounts not being disabled is to automate

the process by integrating Active Directory (AD) with the human resources information system

(HRIS). By automating this integration, when an employee’s termination date is updated in the HRIS,

the corresponding account in AD is automatically disabled, reducing the risk of accounts being left

active after an employee leaves the organization. CASP+ highlights the importance of automating

security processes, especially for user access management, to minimize human error and ensure

timely action.

Reference:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Automation of User

Access Management)

CompTIA CASP+ Study Guide: Integration of HR Systems and Active Directory for Account

Management

Non-repudiation ensures that a sender cannot deny having sent a message, achieved through digital

signatures provided by PKI. This aligns with CASP+ objective 3.2, emphasizing cryptographic

assurance in communication.

:

Query parameterization prevents SQL injection attacks by separating SQL commands from data inputs. This ensures that user-supplied input cannot be executed as part of a SQL query. In the given code, lack of parameterization could allow attackers to manipulate the ItemID parameter maliciously. This aligns with CASP+ objective 1.5, focusing on secure coding practices to mitigate application vulnerabilities.

A lack of Mobile Device Management (MDM) controls can lead to successful attacks because MDM

solutions provide the ability to enforce security policies, remotely wipe sensitive data, and

managesoftware updates, which can prevent unauthorized access and protect corporate data.

Without MDM, personal devices are more vulnerable to security risks.

:

The organization is implementing homomorphic encryption. Homomorphic encryption is a type of

encryption that allows computations to be performed on encrypted data without decrypting it first.

This means that the organization can analyze the customers’ data and deliver analysis results without

being able to see the raw data, preserving the privacy and confidentiality of the customers.

Homomorphic encryption can enable various applications, such as cloud computing, machine

learning, and data analytics, that require processing sensitive data without compromising security.

Verified Reference:

https://www.techtarget.com/searchsecurity/definition/homomorphic-encryption

https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-at-rest

https://www.ibm.com/topics/homomorphic-encryption

part.

Explanation:

Step 1: Understand the Scenario

Issue:Userscannot authenticateusing personal devices.User claim:No changes have been made to

their devices since they were last able to authenticate.

Step 2: Review the Policy Settings

From theGlobal settingstable:

✅Enabled Policies:

Anonymous networks:Blocks Tor (✅)

Operating systems:Blocks:

Android 8.1.0 and below

iOS 13.7 and below

Windows 7 and below

Chrome OS (all)

BlackBerry (all)

Authentication method:Push only (✅)

User location:Only allows regions:

NORTHAMERICA-REGION-7

NORTHAMERICA-REGION-10

NORTHAMERICA-REGION-11

NORTHAMERICA-REGION-12

Disabled Policies:

Browser restriction(Chrome, Firefox, Edge) isdisabled(i.e., any browser is allowed)

New user policyisdisabled

Step 3: Examine the Authentication Results Table

From the access log table:

Subject

Result

Access object

Jacob

Deny - context

Sales_application

Bob

Time-out

IT_intelligence_svc

Jane

Deny - context

Accounting_database

Jenny

Time-out

Sales_application

These four failed. Let's match them with policies.

Step 4: Correlate With Telemetry Logs

Jacob:

OS:iOS 13.0 →Below 13.7→❌Violation ofOperating System policy

Location:REGION not specified fully, assume okay unless proven otherwise✅Policy

violated:Operating system

Bob:

OS:Android 10 →✅Allowed

Location:NORTHAMERICA-REGION-12 →✅Allowed

Behavior:Time-outThis could be aconnectivityorpush timeout, not policy violation.⛔️Not due to

policy violation

Jane:

OS:iOS 14.2 →✅Allowed

Location:NORTHAMERICA-REGION-6 →❌Not in allowed regions✅Policy violated:User location

Jenny:

OS:Android 10 →✅Allowed

Location:NORTHAMERICA-REGION-6 →❌Not in allowed regions✅Policy violated:User location

✅Step 5: Final Answer

Violated Policies:

✅Operating Systems→ Violated byJacob

✅User Location→ Violated byJaneandJenny

Telemetry Logs that explain violations:

Log 3– Jacob (OS iOS 13.0 → blocked)

Log 6– Jane (Region 6 → blocked)

Log 7– Jenny (Region 6 → blocked)

✔️Final Answer Summary:

Policies Violated:

✅Operating systems

✅User location

Relevant Telemetry Logs:

Jacob → Log 3

Jane → Log 6

Jenny → Log 7

. Explanation: Code Snippet 1 Vulnerability 1: SQL injection SQL injection is a type of attack that exploits a vulnerability in the code that interacts with a database. An attacker can inject malicious SQL commands into the input fields, such asusername or password, and execute them on the database server. This can result in data theft, data corruption, or unauthorized access. Fix 1: Perform input sanitization of the userid field. Input sanitization is a technique that prevents SQL injection by validating and filtering the user input values before passing them to the database. The input sanitization should remove any special characters, such as quotes, semicolons, or dashes, that can alter the intended SQL query. Alternatively, the input sanitization can use a whitelist of allowed values and reject any other values. Code Snippet 2 Vulnerability 2: Cross-site request forgery Cross-site request forgery (CSRF) is a type of attack that exploits a vulnerability in the code that handles web requests. An attacker can trick a user into sending a malicious web request to a server that performs an action on behalf of the user, such as changing their password, transferring funds, or deleting dat a. This can result in unauthorized actions, data loss, or account compromise. Fix 2: Implement anti-forgery tokens. Anti-forgery tokens are techniques that prevent CSRF by adding a unique and secret value to each web request that is generated by the server and verified by the server before performing the action. The anti-forgery token should be different for each user and each session, and should not be predictable or reusable by an attacker. This way, only legitimate web requests from the user’s browser can be accepted by the server.