A company has a microservices architecture where each service has its own database. The services communicate via a message bus. The security team is identifying trust boundaries. They find that the message bus is accessible from the internet for a partner integration. The team must secure the trust boundary without redesigning the entire architecture. Which control is MOST effective?

Implement mutual TLS between the partner and the message bus.

Encrypt the messages in the message bus.

Require the partner to use a VPN to access the message bus.

Place the message bus behind a firewall that only allows the partner's IP address.

What is an example of a security control that can be used at a trust boundary?

An intrusion detection system (IDS)

A data flow diagram for an online banking system shows that user credentials are sent from the mobile app to the authentication service, and then to the account service. The security team is reviewing the diagram. They notice that the credentials are also sent to a logging service. Which action is MOST appropriate?

Ensure the logging service is in a separate trust boundary.

Encrypt the credentials before sending them to the logging service.

Use a different logging service that is more secure.

Remove the logging of credentials from the logging service.

A security architect is performing a risk assessment on a new e-commerce platform. The architecture includes a web tier, an application tier, and a database tier. The architect identifies that the database is directly accessible from the internet. Which risk treatment is MOST appropriate?

Avoid the risk by discontinuing the e-commerce platform.

Accept the risk because the database is protected by a strong password.

Transfer the risk by purchasing cyber insurance.

Mitigate the risk by placing the database in a private subnet with no direct internet access.

A company has a web application that allows users to upload files. The application stores these files in a cloud storage bucket and serves them back to users. The security team is identifying trust boundaries. Which of the following is a trust boundary that requires a security control?

Between the cloud storage bucket and the CDN

Between the application logic and the database

Between the user's browser and the web server

Between the web server and the application logic

CompTIASecurityX (CASP+)

Domain 1Objective 9

Attack Surface CAS-005 Practice Questions (Page 2)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

20%of the exam

Questions 6–10

6expert · hard
A company has a microservices architecture where each service has its own database. The services communicate via a message bus. The security team is identifying trust boundaries. They find that the message bus is accessible from the internet for a partner integration. The team must secure the trust boundary without redesigning the entire architecture. Which control is MOST effective?
Select an answer first
7foundation · easy
What is an example of a security control that can be used at a trust boundary?
Select an answer first
8expert · hard
A data flow diagram for an online banking system shows that user credentials are sent from the mobile app to the authentication service, and then to the account service. The security team is reviewing the diagram. They notice that the credentials are also sent to a logging service. Which action is MOST appropriate?
Select an answer first
9application · medium
A security architect is performing a risk assessment on a new e-commerce platform. The architecture includes a web tier, an application tier, and a database tier. The architect identifies that the database is directly accessible from the internet. Which risk treatment is MOST appropriate?
Select an answer first
10application · medium
A company has a web application that allows users to upload files. The application stores these files in a cloud storage bucket and serves them back to users. The security team is identifying trust boundaries. Which of the following is a trust boundary that requires a security control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Attack Surface CAS-005 Practice Questions (Page 2)

Questions 6–10

What is an example of a security control that can be used at a trust boundary?

A security architect is performing a risk assessment on a new e-commerce platform. The architecture includes a web tier, an application tier, and a database tier. The architect identifies that the database is directly accessible from the internet. Which risk treatment is MOST appropriate?

A company has a web application that allows users to upload files. The application stores these files in a cloud storage bucket and serves them back to users. The security team is identifying trust boundaries. Which of the following is a trust boundary that requires a security control?

Keep studying — Governance, risk, and compliance