A company's CI/CD pipeline deploys infrastructure using Terraform and configures servers using Ansible. The security team has identified that secrets are stored in plaintext in the pipeline's environment variables. They also want to ensure that only approved changes are deployed. Which combination of actions should the team take?

Integrate a secrets manager and implement code review for all pipeline changes

Use a more complex secret and rotate it weekly

Move the pipeline to a different CI/CD tool

Encrypt the pipeline's environment variables and restrict access to the pipeline

A security architect is reviewing a Terraform configuration that deploys a web application. The configuration includes a hard-coded API key. The architect also notices that the Terraform state file is stored in a shared network drive. Which action should the architect take to address the most critical security risk?

Restrict access to the shared network drive

Move the API key to a secrets manager and store the state file in a secure remote backend

Encrypt the Terraform configuration file

In the shared responsibility model for IaaS, which security aspect is typically the customer's responsibility?

Patching the guest operating system

Network infrastructure security

Physical security of the data center

A company has a CASB deployed in proxy mode. The security team is concerned that some employees are using a cloud application that bypasses the proxy. They want to detect this shadow IT usage. Which method is most effective?

Increase the proxy's logging level

Use the CASB's API integration to discover unsanctioned applications

Block all traffic to the unsanctioned application

Ask employees to report their cloud usage

A company is migrating a legacy application to the cloud. The application consists of a web front-end, a database, and a batch processing component. The security team is defining the shared responsibility model. The company wants to minimize its security management overhead. Which cloud service model should the company choose for the batch processing component?

Infrastructure as a Service (IaaS)

CompTIASecurityX (CASP+)

Domain 2Objective 1

Cloud Capabilities CAS-005 Practice Questions (Page 3)

Part of the Security architecture domain, which accounts for 27% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–30 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

27%of the exam

Questions 11–15

11expert · hard
A company's CI/CD pipeline deploys infrastructure using Terraform and configures servers using Ansible. The security team has identified that secrets are stored in plaintext in the pipeline's environment variables. They also want to ensure that only approved changes are deployed. Which combination of actions should the team take?
Select an answer first
12expert · hard
A security architect is reviewing a Terraform configuration that deploys a web application. The configuration includes a hard-coded API key. The architect also notices that the Terraform state file is stored in a shared network drive. Which action should the architect take to address the most critical security risk?
Select an answer first
13foundation · easy
In the shared responsibility model for IaaS, which security aspect is typically the customer's responsibility?
Select an answer first
14expert · hard
A company has a CASB deployed in proxy mode. The security team is concerned that some employees are using a cloud application that bypasses the proxy. They want to detect this shadow IT usage. Which method is most effective?
Select an answer first
15expert · hard
A company is migrating a legacy application to the cloud. The application consists of a web front-end, a database, and a batch processing component. The security team is defining the shared responsibility model. The company wants to minimize its security management overhead. Which cloud service model should the company choose for the batch processing component?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Cloud Capabilities CAS-005 Practice Questions (Page 3)

Questions 11–15

In the shared responsibility model for IaaS, which security aspect is typically the customer's responsibility?

A company has a CASB deployed in proxy mode. The security team is concerned that some employees are using a cloud application that bypasses the proxy. They want to detect this shadow IT usage. Which method is most effective?

Keep studying — Security architecture