A company is deploying a new application on AWS. They want to ensure that only authorized users can access the application, and they want to automatically rotate access keys for any service accounts. Which combination of services should they use?

AWS IAM with a password policy and AWS CloudTrail for logging.

AWS IAM with MFA and AWS Secrets Manager for automatic key rotation.

AWS Cognito for user authentication and AWS Key Management Service (KMS) for encryption.

AWS Organizations with service control policies (SCPs) and AWS Config.

A company has a hybrid cloud environment with an ExpressRoute connection to Azure. They want to detect any unauthorized attempts to access their Azure resources from the on-premises network. Which detective control should they implement?

Configure Azure Firewall to log all traffic and review the logs monthly.

Implement Azure Bastion for all administrative access.

Enable Azure Network Watcher flow logs and analyze them with Azure Sentinel.

Use Azure Policy to deny all inbound traffic from the on-premises network.

A company is required to maintain continuous authorization for its cloud environment. They have implemented automated compliance checks, but they are struggling with the volume of alerts. They want to reduce alert fatigue while still maintaining a strong security posture. Which approach should they take?

Disable alerts for low-risk resources.

Implement a risk-based alerting system that prioritizes alerts based on the criticality of the affected resource.

Increase the threshold for alerts to reduce the number of notifications.

Review alerts only once a week.

What is a key characteristic of continuous authorization?

It is a one-time approval process before deployment

It only applies to on-premises environments

It involves ongoing monitoring and re-evaluation of security posture

It requires periodic manual reviews of security controls

What is the primary purpose of service integration in a cloud environment?

To isolate each cloud service to prevent any interaction

To ensure seamless operation and security across multiple cloud services

To reduce the number of cloud services used

To replace all cloud services with a single monolithic application

CompTIASecurityX (CASP+)

Domain 2Objective 3

Cloud Control Strategies CAS-005 Practice Questions (Page 4)

Part of the Security architecture domain, which accounts for 27% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–30 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

27%of the exam

Questions 16–20

16application · medium
A company is deploying a new application on AWS. They want to ensure that only authorized users can access the application, and they want to automatically rotate access keys for any service accounts. Which combination of services should they use?
Select an answer first
17application · medium
A company has a hybrid cloud environment with an ExpressRoute connection to Azure. They want to detect any unauthorized attempts to access their Azure resources from the on-premises network. Which detective control should they implement?
Select an answer first
18expert · hard
A company is required to maintain continuous authorization for its cloud environment. They have implemented automated compliance checks, but they are struggling with the volume of alerts. They want to reduce alert fatigue while still maintaining a strong security posture. Which approach should they take?
Select an answer first
19foundation · easy
What is a key characteristic of continuous authorization?
Select an answer first
20foundation · easy
What is the primary purpose of service integration in a cloud environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.