Pass the CompTIA CompTIA CASP CAS-005 Questions and answers with CertsForce

The best answer is C. Enabling network segmentation controls . The most obvious security weakness shown in the configuration is the interface address 10.12.14.1/8 , which places the device in an extremely broad network range instead of a tightly bounded segment. From a SecurityX perspective, the strongest improvement is to reduce unnecessary trust exposure by applying segmentation and tighter network boundaries. CompTIA’s official SecurityX objectives explicitly call out “Network architecture: segmentation, microsegmentation, virtual local area networks (VLANs), virtual routing and forwarding (VRF), software-defined networking (SDN)” and also emphasize “Security boundaries: secure zones, access control lists (ACLs), virtual private network (VPN)” under Security Architecture.

Why the other options are not the best choice:

A may improve cryptographic strength, but the configuration already shows SSH and HTTPS , so encrypted management access is already present. B is not the best answer because no unencrypted terminal service such as Telnet is shown in the configuration. D is generally useful operationally, but automatic patching and rebooting is not the main architectural weakness indicated by the config excerpt. The clearest risk visible in the router snippet is inadequate network scoping and boundary control, which points to segmentation as the best improvement.

The best answer is B. The attacker registered a new domain . The key evidence is in the visible sender fields: From: jdoe@exampl.com and Reply-To: jdoe@exampl.com . The legitimate company domain appears to be example.com , but the fraudulent email uses exampl.com , which is a lookalike domain missing the letter “e” . That is a classic typosquatting/business email compromise pattern. The headers also show Received-SPF: pass , which means the message passed SPF for the domain it actually came from, not that it was legitimate for the intended organization. The presence of a DKIM-Signature also shows that lack of domain keys is not the issue. This is therefore best explained by an attacker creating or registering a deceptive domain and sending authenticated email from it. CompTIA SecurityX’s Security Operations domain includes activities around analyzing indicators, email artifacts, and attack patterns to identify malicious activity.

Why the other options are incorrect:

A is not the best explanation because the scenario says John Doe’s account had been compromised earlier, but the specific headers here point to a spoof-like lookalike domain attack, not necessarily direct reuse of John’s real mailbox. C is incorrect because the headers explicitly show a DKIM-Signature , so domain keys were used. D is incorrect because the headers show Received-SPF: pass , not fail. The payment succeeded because the attacker used a deceptive domain that looked close enough to the legitimate one to fool the recipient during the invoice exchange.

SecurityX CAS-005 endpoint security and network control objectives emphasize least privilege network access.

Creating a firewall rule to allow outbound traffic only via a proxy (A) ensures centralized inspection and control.

Configuring the proxy to allow only the required FQDNs for EDR management communication (C) limits exposure to necessary destinations.Options D and E allow broader access than necessary, and B would block required communications entirely. F relies on blocklists instead of allowlists, which is less secure for high-assurance environments.

Qualitative risk assessment is used when quantitative data (monetary loss, exact downtime cost, RTO) is unavailable or unreliable. The SecurityX CAS-005 GRC objectives note that qualitative methods rely on expert judgment, likelihood scales, and impact ratings rather than financial calculations. In this case, insufficient metrics rule out quantitative analysis.

Option A (work experience) is irrelevant to the choice of assessment type.

Option C (risk register) supports tracking, not selecting the assessment method.

Option D describes a quantitative goal, which is not possible with the given lack of metrics.

Best practice in CAS-005 network security design is to deploy:

NIDS passively via a port mirror (SPAN port) to avoid introducing latency or failure points.

NIPS inline in a strategic point, such as integrated with the main firewall, to actively block threats.This combination provides both visibility and active protection without overloading network paths.

The question states that security scanning and quality assurance (QA) in the CI/CD pipeline have been completed with no issues, indicating that the code in the test branch is ready for production. According to the CompTIA SecurityX CAS-005 study guide (Domain 2: Security Operations, 2.3), in a secure CI/CD pipeline, once code passes automated security scans, QA, and other checks (e.g., unit testing, peer reviews), the next step is to merge the tested branch into the main branch for deployment to production.

Option B:Threat modeling is typically performed earlier, during design or development, not after passing CI/CD checks.

Option C:Unit testing is part of the CI/CD pipeline and should already be completed.

Option D:Peer reviews are conducted before or during the test phase, not after QAand security scans are clear.

Option A:Merging the test branch to the main branch is the logical next step to prepare for production deployment.

The best way to reduce liability and secure customer environments is to require that all employee-owned laptops have a corporate-licensed and managed Endpoint Detection and Response (EDR) solution installed. This ensures that devices accessing sensitive customer infrastructure are monitored for malware, unauthorized processes, and suspicious behaviors. EDR provides visibility into endpoint security posture and enforces corporate security baselines, which unmanaged personal devices typically lack.

Option A (MDM with attestation) works well for corporate-owned devices but is difficult to enforce reliably across personally owned laptops. Option C (VPN with certificate authentication) ensures encrypted access but does not validate whether the device is secure. Option D (host checking to jump boxes) reduces exposure but still allows unmanaged endpoints to connect indirectly.

CAS-005 emphasizes endpoint controls and assurance mechanisms for environments with third-party or bring-your-own-device (BYOD) risk. Deploying managed EDR ensures visibility, consistent policies, and rapid response across all devices, making this the most secure and practical option.

A crisis management plan defines coordinated communication and response strategies for high-profile incidents that may harm an organization’s public reputation and shareholder confidence. CAS-005 GRC content includes crisis communication planning for regulatory compliance and public relations in the wake of breaches.

A Data Subject Access Request (A) addresses individual data rights, not overall crisis handling.

Business Impact Analysis (B) helps assess potential operational and financial impacts but does not manage public perception during an incident.

Supply chain management (C) is preventative for vendor risks, not responsive to current crises.