A multinational company has offices in multiple regions and needs to connect them to AWS. They require low latency and high availability, and they want to avoid using the public internet. They also want to ensure that if one connection fails, traffic automatically fails over to another. Which solution should they implement?

Use AWS Transit Gateway with a single Direct Connect connection.

Use AWS Site-to-Site VPN with multiple tunnels.

Set up multiple AWS Direct Connect connections and configure BGP with AS path prepending for failover.

Use a single AWS Direct Connect connection with a VPN backup.

A company is adopting a DevOps model and wants to implement proactive security controls in their CI/CD pipeline. They want to automatically block a deployment if a critical vulnerability is found in the application code or infrastructure templates. Which set of tools should they integrate?

A firewall that blocks traffic to vulnerable applications.

A vulnerability scanner that runs weekly on production systems.

A SIEM tool that monitors production logs.

SAST, DAST, and IaC scanning tools integrated into the pipeline with a fail-on-critical policy.

A financial services company uses a multi-cloud environment (AWS and Azure) and must maintain continuous compliance with PCI DSS. They have automated security assessments that run on a schedule, but they need to ensure that any new cloud resource is automatically evaluated for compliance before it can be used. Which approach best meets this requirement?

Enable AWS CloudTrail and Azure Monitor to log all API calls and review them monthly.

Implement a CI/CD pipeline that scans infrastructure-as-code templates before deployment.

Use AWS Config and Azure Policy to automatically evaluate resources against compliance rules and remediate non-compliant resources.

Run weekly manual compliance reviews using a third-party auditing tool.

A company is designing a new cloud environment on GCP. They want to implement proactive controls to reduce the risk of misconfiguration. They also need to ensure that any changes to infrastructure are reviewed and approved before deployment. Which set of controls best meets these requirements?

Use GCP Organization Policies to restrict resource creation, and implement a CI/CD pipeline with mandatory peer review for infrastructure-as-code changes.

Grant all developers full access to GCP and rely on a monthly security review.

Enable GCP Cloud Audit Logs and set up alerts for any changes to resources.

Use GCP Cloud Security Command Center to scan for vulnerabilities weekly.

CompTIASecurityX (CASP+)

Domain 2Objective 3

Cloud Control Strategies CAS-005 Practice Questions (Page 2)

Part of the Security architecture domain, which accounts for 27% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–30 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

27%of the exam

Questions 6–10

6foundation · easy
A cloud administrator wants to implement a control that will prevent unauthorized users from accessing sensitive data stored in a cloud database. Which control type is most appropriate?
Select an answer first
7expert · hard
A multinational company has offices in multiple regions and needs to connect them to AWS. They require low latency and high availability, and they want to avoid using the public internet. They also want to ensure that if one connection fails, traffic automatically fails over to another. Which solution should they implement?
Select an answer first
8expert · hard
A company is adopting a DevOps model and wants to implement proactive security controls in their CI/CD pipeline. They want to automatically block a deployment if a critical vulnerability is found in the application code or infrastructure templates. Which set of tools should they integrate?
Select an answer first
9expert · hard
A financial services company uses a multi-cloud environment (AWS and Azure) and must maintain continuous compliance with PCI DSS. They have automated security assessments that run on a schedule, but they need to ensure that any new cloud resource is automatically evaluated for compliance before it can be used. Which approach best meets this requirement?
Select an answer first
10expert · hard
A company is designing a new cloud environment on GCP. They want to implement proactive controls to reduce the risk of misconfiguration. They also need to ensure that any changes to infrastructure are reviewed and approved before deployment. Which set of controls best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Cloud Control Strategies CAS-005 Practice Questions (Page 2)

Questions 6–10

A cloud administrator wants to implement a control that will prevent unauthorized users from accessing sensitive data stored in a cloud database. Which control type is most appropriate?

A company is adopting a DevOps model and wants to implement proactive security controls in their CI/CD pipeline. They want to automatically block a deployment if a critical vulnerability is found in the application code or infrastructure templates. Which set of tools should they integrate?

A company is designing a new cloud environment on GCP. They want to implement proactive controls to reduce the risk of misconfiguration. They also need to ensure that any changes to infrastructure are reviewed and approved before deployment. Which set of controls best meets these requirements?

Keep studying — Security architecture