LATEST COMPTIA CASP+ (CAS-004) EXAM
BANK | COMPLETE EXAM BANK WITH
CORRECT ANSWERS AND RATIONALES.
A+ GRADED
1. An enterprise security architect is designing a
solution to protect against data exfiltration via DNS
tunneling. Which control is most effective?
A) Blocking all outbound DNS traffic
B) Implementing DNS over TLS (DoT) with DNS
filtering and analyzing DNS query length and entropy
C) Allowing only recursive queries to internal DNS
servers with strict response size limits
D) Disabling DNS logging
Correct answer: B
Rationale: DoT encrypts DNS queries but does not
prevent tunneling. The most effective control is a
secure DNS gateway that inspects query length,
frequency, and subdomain entropy.
2. A security analyst is implementing a zero trust
architecture. Which of the following best describes
the core principle of zero trust?
,A) Trust but verify once at the perimeter
B) Never trust, always verify. All traffic (inside and
outside the network) is treated as untrusted
C) Trust all internal traffic and only verify external
traffic
D) Use a single factor of authentication
Correct answer: B
Rationale: Zero trust assumes no implicit trust
(internal or external). Every request is authenticated,
authorized, and encrypted regardless of location.
3. An organization is migrating to a multi-cloud
environment (AWS, Azure, and GCP). Which of the
following is a primary security concern when using
multiple cloud providers?
A) Inconsistent identity and access management
(IAM) policies across providers
B) Higher bandwidth costs
C) Increased storage capacity
D) Lack of encryption options
Correct answer: A
Rationale: Each cloud provider has its own IAM
model. Consistent policy enforcement and
,centralized identity management (federation, SSO,
SCIM) across multi-cloud is challenging.
4. A security architect is evaluating a secure SDLC
approach. In which phase should threat modeling
(e.g., STRIDE, PASTA) be performed?
A) Design phase
B) Deployment phase
C) Maintenance phase
D) Incident response phase
Correct answer: A
Rationale: Threat modeling is performed during the
design phase to identify potential threats, attack
surfaces, and mitigations before code is written.
5. An organization needs to implement a
cryptographic solution that provides non-repudiation
for sensitive transactions. Which type of algorithm
should be used?
A) Symmetric encryption (AES)
B) Hashing (SHA-256)
C) Asymmetric encryption (digital signatures using
RSA or ECDSA)
, D) Steganography
Correct answer: C
Rationale: Digital signatures (asymmetric) provide
non-repudiation because only the signer's private key
can create the signature, and the public key verifies
it.
6. A company is required to comply with PCI DSS.
Which of the following is a requirement for protecting
cardholder data?
A) Storing full magnetic stripe data and CVV after
authorization
B) Encrypting cardholder data at rest and in transit
using strong cryptography
C) Allowing all employees access to cardholder data
D) Logging access but not monitoring logs
Correct answer: B
Rationale: PCI DSS requires encryption of stored
cardholder data (tokenization may substitute) and
encrypted transmission. CVV and full track data
cannot be stored after authorization.
7. A security analyst is investigating a potential
container breakout incident in a Kubernetes cluster.
BANK | COMPLETE EXAM BANK WITH
CORRECT ANSWERS AND RATIONALES.
A+ GRADED
1. An enterprise security architect is designing a
solution to protect against data exfiltration via DNS
tunneling. Which control is most effective?
A) Blocking all outbound DNS traffic
B) Implementing DNS over TLS (DoT) with DNS
filtering and analyzing DNS query length and entropy
C) Allowing only recursive queries to internal DNS
servers with strict response size limits
D) Disabling DNS logging
Correct answer: B
Rationale: DoT encrypts DNS queries but does not
prevent tunneling. The most effective control is a
secure DNS gateway that inspects query length,
frequency, and subdomain entropy.
2. A security analyst is implementing a zero trust
architecture. Which of the following best describes
the core principle of zero trust?
,A) Trust but verify once at the perimeter
B) Never trust, always verify. All traffic (inside and
outside the network) is treated as untrusted
C) Trust all internal traffic and only verify external
traffic
D) Use a single factor of authentication
Correct answer: B
Rationale: Zero trust assumes no implicit trust
(internal or external). Every request is authenticated,
authorized, and encrypted regardless of location.
3. An organization is migrating to a multi-cloud
environment (AWS, Azure, and GCP). Which of the
following is a primary security concern when using
multiple cloud providers?
A) Inconsistent identity and access management
(IAM) policies across providers
B) Higher bandwidth costs
C) Increased storage capacity
D) Lack of encryption options
Correct answer: A
Rationale: Each cloud provider has its own IAM
model. Consistent policy enforcement and
,centralized identity management (federation, SSO,
SCIM) across multi-cloud is challenging.
4. A security architect is evaluating a secure SDLC
approach. In which phase should threat modeling
(e.g., STRIDE, PASTA) be performed?
A) Design phase
B) Deployment phase
C) Maintenance phase
D) Incident response phase
Correct answer: A
Rationale: Threat modeling is performed during the
design phase to identify potential threats, attack
surfaces, and mitigations before code is written.
5. An organization needs to implement a
cryptographic solution that provides non-repudiation
for sensitive transactions. Which type of algorithm
should be used?
A) Symmetric encryption (AES)
B) Hashing (SHA-256)
C) Asymmetric encryption (digital signatures using
RSA or ECDSA)
, D) Steganography
Correct answer: C
Rationale: Digital signatures (asymmetric) provide
non-repudiation because only the signer's private key
can create the signature, and the public key verifies
it.
6. A company is required to comply with PCI DSS.
Which of the following is a requirement for protecting
cardholder data?
A) Storing full magnetic stripe data and CVV after
authorization
B) Encrypting cardholder data at rest and in transit
using strong cryptography
C) Allowing all employees access to cardholder data
D) Logging access but not monitoring logs
Correct answer: B
Rationale: PCI DSS requires encryption of stored
cardholder data (tokenization may substitute) and
encrypted transmission. CVV and full track data
cannot be stored after authorization.
7. A security analyst is investigating a potential
container breakout incident in a Kubernetes cluster.
