CompTIA CAS-004 CompTIA Advanced Security Practitioner (CASP+) Exam Practice Test

Answer : A

Federation is the best strategy for unifying application access between two companies without merging their internal authentication stores. Federation allows users from different organizations to authenticate and access resources using their existing credentials through trusted third-party identity providers. This enables seamless access without the need to merge or consolidate internal authentication systems. CASP+ emphasizes federation as a key technology for enabling cross-organizational authentication while maintaining the integrity of separate identity stores.

CASP+ CAS-004 Exam Objectives: Domain 2.0 -- Enterprise Security Operations (Federated Identity and Authentication)

CompTIA CASP+ Study Guide: Federated Identity Management for Mergers and Cross-Company Access

Answer : B

A business impact analysis (BIA) is the most useful resource for calculating the exposure factor in a risk assessment. The BIA helps identify the criticality of systems and processes and quantifies the potential financial and operational impact of vulnerabilities being exploited. By understanding the business impact, the security team can more accurately determine the exposure factor, which is the proportion of an asset's value that is at risk in the event of a security incident. CASP+ highlights the role of BIAs in understanding risk exposure and supporting effective risk management decisions.

CASP+ CAS-004 Exam Objectives: Domain 1.0 -- Risk Management (Business Impact Analysis and Risk Exposure)

CompTIA CASP+ Study Guide: Business Impact Analysis for Risk Assessment

Answer : A

Before migrating previously isolated systems to the cloud, it is essential to perform patching and hardening. These systems may have been neglected while isolated, so updating them with the latest security patches and applying hardening measures (such as disabling unnecessary services and implementing strict access controls) is crucial to reduce vulnerabilities. This ensures that the systems are secure before they are exposed to the wider cloud environment. CASP+ emphasizes the importance of securing systems through patch management and hardening before integrating them into more exposed environments like the cloud.

CASP+ CAS-004 Exam Objectives: Domain 2.0 -- Enterprise Security Operations (Patching, Hardening, and Cloud Migration Security)

CompTIA CASP+ Study Guide: Securing and Hardening Systems Before Cloud Migration

Answer : B

To prevent similar issues from occurring again, the CISO should create an effective communication plan and ensure all employees are aware of it. A clear communication plan ensures that critical security information, such as breaches or vulnerabilities, is promptly communicated to the right stakeholders (e.g., the CEO) in a timely manner, preventing situations where the media reports on breaches before internal teams are fully informed. CASP+ emphasizes the importance of having structured communication protocols during security incidents to ensure accurate and timely responses.

CASP+ CAS-004 Exam Objectives: Domain 2.0 -- Enterprise Security Operations (Incident Communication Plans)

CompTIA CASP+ Study Guide: Developing and Implementing Effective Incident Communication Plans

Answer : A

A cloud container service is the best way to meet the security and organizational infrastructure requirements described. Containers are sessionless, scalable, and can enforce ephemeral storage, which ensures that sensitive data like Personally Identifiable Information (PII) is only stored temporarily. Containers also restrict access to only necessary ports, such as TLS, and can easily scale across multiple nodes to handle varying workloads. CASP+ emphasizes the use of containers in modern, scalable, and secure application deployments, especially for API-based, sessionless applications that require flexible scaling and network security controls.

CASP+ CAS-004 Exam Objectives: Domain 3.0 -- Enterprise Security Architecture (Containers and Cloud Services for Secure Application Deployment)

CompTIA CASP+ Study Guide: Deploying Scalable and Secure Applications with Containers

Answer : D

A risk-based threat modeling approach is the best recommendation to prevent the recurrence of major process issues during the development lifecycle. Threat modeling identifies potential security threats, vulnerabilities, and design flaws early in the development process by focusing on the specific risks posed to the system. By proactively identifying and addressing security concerns before they escalate, the development team can avoid the need for significant rewrites and ensure that security is embedded into the design of new projects. CASP+ emphasizes threat modeling as a critical activity to improve secure development practices.

CASP+ CAS-004 Exam Objectives: Domain 2.0 -- Enterprise Security Operations (Threat Modeling and Risk-Based Security Approaches)

CompTIA CASP+ Study Guide: Threat Modeling and Secure Development Lifecycle

Answer : A

The most appropriate technology for this virtualization solution is containers. Containers allow multiple services to run on a single host with isolated environments, while sharing the same kernel version and properties of the host operating system. Each container has its own instance of the operating system and runs independently from the others, meeting the requirement for separate environments with their own OS. Containers are more lightweight than full hypervisors and are ideal for running microservices in isolated environments. CASP+ emphasizes the use of containers in scenarios where services need to be isolated but share the same host OS kernel.

CASP+ CAS-004 Exam Objectives: Domain 3.0 -- Enterprise Security Architecture (Virtualization Technologies, Containers)

CompTIA CASP+ Study Guide: Virtualization and Containerization for Isolated Services