CompTIA SecurityX (CAS-005) Practice Test
Gana confianza para CompTIA SecurityX (CAS-005). Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
The CompTIA Security+ (SY0-701) certification is a globally recognized, vendor-neutral credential that validates the foundational cybersecurity skills required for core security functions and an IT security career. It establishes the baseline knowledge necessary for roles such as Security Analyst, Systems Administrator, and Network Administrator, focusing on hands-on practical skills to identify, assess, and respond to security incidents. The certification covers the most current principles for risk management, threat mitigation, and security architecture, ensuring professionals are equipped to address today's complex threat landscape. Earning Security+ demonstrates a professional's competency in key areas like network security, compliance, operational security, and threats/vulnerabilities, making it a critical first step for those entering the cybersecurity field and a requirement for many Department of Defense (DoD) positions. It serves as a springboard to intermediate-level cybersecurity jobs and more advanced certifications.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
A government agency's security architect is planning the transition to post-quantum TLS for high-security web services that will be operational beyond 2030. NIST recommends a hybrid classical+PQC approach during the transition period. Which hybrid key exchange approach in TLS 1.3 is being standardized to provide both classical and post-quantum security simultaneously, and what is the security rationale for the hybrid approach?
A brokerage's endpoint telemetry shows browser-based exploitation attempts against analysts who open untrusted research links. The endpoints are fully patched, but the business requires analysts to view hostile sites. The CISO wants to reduce exploit impact without blocking research. Which control best fits?
La isla de navegación remota es correcta porque la renderización riesgosa ocurre lejos del punto final mientras se preserva el flujo de trabajo del analista. La respuesta tentadora incorrecta es la capacitación de conciencia porque reduce los clics en algunos casos, pero no contiene la explotación cuando el trabajo requiere visitar sitios hostiles.
A defense contractor is replacing static roles in an engineering portal. Access decisions must consider clearance, project assignment, device compliance, export-control citizenship, and time-limited need-to-know. Audit wants one place to evaluate policy while applications enforce the result consistently. Which design best fits?
A DevSecOps team is hardening their software supply chain following a build-system compromise similar to the SolarWinds attack. They want to implement the SLSA (Supply-chain Levels for Software Artifacts) framework to establish build provenance. The team's current CI/CD pipeline uses GitHub Actions and builds Docker container images. They want to achieve at minimum SLSA Level 3 for all production container images. Which combination of requirements MUST the team implement to satisfy SLSA Level 3?
An enterprise DLP solution is configured to prevent exfiltration of PII, PCI cardholder data, and proprietary trade secrets. The DLP policy uses content inspection with regex patterns for credit card numbers and SSNs. Security analysts observe that a large volume of sensitive data is being transmitted via HTTPS to a cloud file-sharing service without triggering DLP alerts. Forensic analysis reveals the data was compressed with 7-Zip before upload. Which DLP evasion technique is demonstrated, and which DLP capability is required to detect it?
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
Usa las ponderaciones publicadas de los dominios para planificar tu estudio. Los resultados de práctica no predicen tu puntuación en el examen de certificación.
01Security engineering
Presents security engineering concepts carrying a 31.0 percent weight, including automation, vulnerability management, and advanced cryptography designed to secure modern systems against evolving threats and infrastructure vulnerabilities encountered in professional environments.
Temas
- Automation
- Vulnerability management
- Advanced cryptography
- Cryptographic use cases
- Cryptographic techniques
Objetivos de aprendizaje
- Automation: scripting (PowerShell, Bash, Python), event triggers, IaC, cloud APIs, generative AI, containerization, patching, SOAR, and workflow automation
- Vulnerability management: scanning, reporting, and SCAP (OVAL, XCCDF, CPE, CVE, CVSS)
- Advanced cryptography: PQC, key stretching, homomorphic encryption, forward secrecy, and hardware acceleration
- Cryptographic use cases: data at rest, in transit, and in use; secure email, blockchain, privacy, compliance, and certificate-based authentication
- Cryptographic techniques: tokenization, code signing, cryptographic erase, digital signatures, hashing, and symmetric/asymmetric cryptography
02Security architecture
Focuses on security architecture with a 27.0 percent weight, addressing cloud capabilities, cloud data security, and tailored control strategies for complex enterprise environments to ensure strong protection of digital assets across systems.
Temas
- Cloud capabilities
- Cloud data security
- Cloud control strategies
- Network architecture
- Security boundaries
- Deperimeterization
- Zero trust concepts
Objetivos de aprendizaje
- Cloud capabilities: CASB (API-based, proxy-based), shadow IT detection, shared responsibility model, CI/CD pipeline, Terraform, Ansible, container security, orchestration, and serverless workloads
- Cloud data security: data exposure, leakage, remanence, insecure storage, and encryption keys
- Cloud control strategies: proactive, detective, and preventative controls; customer-to-cloud connectivity, service integration, and continuous authorization
- Network architecture: segmentation, microsegmentation, VPN, always-on VPN, and API integration
- Security boundaries: asset identification, management, attestation, data perimeters, and secure zones
- Deperimeterization: SASE, SD-WAN, and software-defined networking
- Zero trust concepts: defining subject-object relationships
03Security operations
Involves security operations carrying a 22.0 percent weight, concentrating on monitoring and data analysis, vulnerabilities and attack surfaces, alongside proactive threat hunting methodologies utilized for effective incident detection and response.
Temas
- Monitoring and data analysis
- Vulnerabilities and attack surface
- Threat hunting
- Incident response
Objetivos de aprendizaje
- Monitoring and data analysis: SIEM (event parsing, retention, false positives/negatives), aggregate analysis (correlation, prioritization, trends), and behavior baselines (network, systems, users)
- Vulnerabilities and attack surface: injection, XSS, insecure configurations, outdated software, and weak ciphers; mitigations include input validation, patching, encryption, and defense-in-depth
- Threat hunting: internal intelligence (honeypots, UBA), external intelligence (OSINT, dark web, ISACs), TIPs, IoC sharing (STIX, TAXII), and rule-based languages (Sigma, YARA, Snort)
- Incident response: malware analysis (sandboxing, IoC extraction, code stylometry), reverse engineering, metadata analysis, data recovery, and root cause analysis
04Governance, risk, and compliance
Covers governance, risk, and compliance with a 20.0 percent weight, focusing heavily on program management, frameworks, and vital security program documentation required for organizational security compliance and standard operations.
Temas
- Security program documentation
- Program management
- Frameworks
- Configuration management
- GRC tools
- Data governance
- Risk management
- Threat modeling
- Attack surface
- Compliance strategies
- Security frameworks
Objetivos de aprendizaje
- Security program documentation: policies, procedures, standards, and guidelines
- Program management: training (phishing, security, privacy), communication, reporting, and RACI matrix
- Frameworks: COBIT, ITIL, etc
- Configuration management: asset life cycle, CMDB, and inventory
- GRC tools: mapping, automation, and compliance tracking
- Data governance: production, development, testing, and QA
- Risk management: impact analysis, risk assessment (quantitative vs. qualitative), third-party risk, confidentiality, integrity, and availability
- Threat modeling: actor characteristics, attack patterns, and frameworks (ATT&CK, CAPEC, STRIDE)
- Attack surface: architecture reviews, data flows, and trust boundaries
- Compliance strategies: industry-specific standards (PCI DSS, ISO/IEC 27000)
- Security frameworks: NIST, CSF, CSA, and others