COMPTIA CASP+ (ADVANCED SECURITY
PRACTITIONER) EXAM ACTUAL PREP
QUESTIONS AND WELL REVISED ANSWERS -
LATEST AND COMPLETE UPDATE WITH
VERIFIED SOLUTIONS – ASSURES PASS
1. A security architect wants to prevent lateral movement within a data center.
Which approach is MOST effective?
A. Network address translation
B. Traditional perimeter firewall
C. Network microsegmentation
D. Port forwarding
Microsegmentation limits east-west traffic by enforcing granular security controls
between workloads, effectively reducing lateral movement.
2. Which risk management strategy involves shifting risk to a third party?
A. Risk acceptance
B. Risk avoidance
C. Risk transference
D. Risk mitigation
Risk transference commonly involves insurance or outsourcing to transfer
financial or operational risk.
, 3. A CASP+ practitioner is designing a secure cloud architecture. Which
shared responsibility belongs to the cloud customer in an IaaS model?
A. Physical data center security
B. Hypervisor patching
C. Operating system hardening
D. Power and cooling
In IaaS, customers are responsible for securing the guest operating systems and
applications.
4. Which encryption method provides both confidentiality and integrity?
A. AES-CBC
B. RSA
C. AES-GCM
D. DES
AES-GCM is an authenticated encryption mode that ensures confidentiality,
integrity, and authenticity.
5. Which control BEST protects against credential stuffing attacks?
A. CAPTCHA
B. Multi-factor authentication
C. Password expiration
D. Security questions
,MFA prevents attackers from gaining access even if credentials are compromised.
6. Which attack exploits differences in system response time?
A. Replay attack
B. Cross-site scripting
C. Timing attack
D. Buffer overflow
Timing attacks analyze response delays to infer sensitive information such as
cryptographic keys.
7. Which security framework focuses on identifying, protecting, detecting,
responding, and recovering?
A. ISO 27001
B. NIST Cybersecurity Framework
C. COBIT
D. ITIL
The NIST CSF is structured around these five core functions.
8. Which protocol is MOST secure for directory authentication?
A. LDAP
B. RADIUS
, C. LDAPS
D. TACACS+
LDAPS encrypts LDAP traffic using TLS, providing confidentiality and integrity.
9. Which solution BEST protects encryption keys in cloud environments?
A. Software keystore
B. Hardware security module (HSM)
C. Password manager
D. TPM emulator
HSMs provide tamper-resistant key storage and cryptographic operations.
10.Which metric BEST measures the impact of a security incident?
A. Mean time to detect (MTTD)
B. Mean time to respond (MTTR)
C. Single loss expectancy (SLE)
D. Annualized rate of occurrence (ARO)
SLE quantifies the financial impact of a single security incident.
11.Which access control model uses attributes such as role, location, and time?
A. DAC
B. MAC
PRACTITIONER) EXAM ACTUAL PREP
QUESTIONS AND WELL REVISED ANSWERS -
LATEST AND COMPLETE UPDATE WITH
VERIFIED SOLUTIONS – ASSURES PASS
1. A security architect wants to prevent lateral movement within a data center.
Which approach is MOST effective?
A. Network address translation
B. Traditional perimeter firewall
C. Network microsegmentation
D. Port forwarding
Microsegmentation limits east-west traffic by enforcing granular security controls
between workloads, effectively reducing lateral movement.
2. Which risk management strategy involves shifting risk to a third party?
A. Risk acceptance
B. Risk avoidance
C. Risk transference
D. Risk mitigation
Risk transference commonly involves insurance or outsourcing to transfer
financial or operational risk.
, 3. A CASP+ practitioner is designing a secure cloud architecture. Which
shared responsibility belongs to the cloud customer in an IaaS model?
A. Physical data center security
B. Hypervisor patching
C. Operating system hardening
D. Power and cooling
In IaaS, customers are responsible for securing the guest operating systems and
applications.
4. Which encryption method provides both confidentiality and integrity?
A. AES-CBC
B. RSA
C. AES-GCM
D. DES
AES-GCM is an authenticated encryption mode that ensures confidentiality,
integrity, and authenticity.
5. Which control BEST protects against credential stuffing attacks?
A. CAPTCHA
B. Multi-factor authentication
C. Password expiration
D. Security questions
,MFA prevents attackers from gaining access even if credentials are compromised.
6. Which attack exploits differences in system response time?
A. Replay attack
B. Cross-site scripting
C. Timing attack
D. Buffer overflow
Timing attacks analyze response delays to infer sensitive information such as
cryptographic keys.
7. Which security framework focuses on identifying, protecting, detecting,
responding, and recovering?
A. ISO 27001
B. NIST Cybersecurity Framework
C. COBIT
D. ITIL
The NIST CSF is structured around these five core functions.
8. Which protocol is MOST secure for directory authentication?
A. LDAP
B. RADIUS
, C. LDAPS
D. TACACS+
LDAPS encrypts LDAP traffic using TLS, providing confidentiality and integrity.
9. Which solution BEST protects encryption keys in cloud environments?
A. Software keystore
B. Hardware security module (HSM)
C. Password manager
D. TPM emulator
HSMs provide tamper-resistant key storage and cryptographic operations.
10.Which metric BEST measures the impact of a security incident?
A. Mean time to detect (MTTD)
B. Mean time to respond (MTTR)
C. Single loss expectancy (SLE)
D. Annualized rate of occurrence (ARO)
SLE quantifies the financial impact of a single security incident.
11.Which access control model uses attributes such as role, location, and time?
A. DAC
B. MAC
