A startup is deploying a web application on AWS. They want to ensure that only authenticated users can access the application, and they want to automatically block common attack patterns like SQL injection. They also need to log all access attempts for later analysis. Which combination of AWS services should they use?

AWS IAM, AWS Shield, and AWS Config

AWS WAF, AWS Shield, and AWS CloudTrail

AWS Cognito, AWS Shield, and AWS CloudTrail

AWS Cognito, AWS WAF, and AWS CloudWatch Logs

A company uses a multi-cloud environment and wants to centralize security monitoring. They want to collect logs from all cloud services and analyze them for potential security incidents. Which solution should they implement?

Use a third-party SIEM that supports multiple cloud providers.

Use a cloud storage service to store logs.

Use a cloud access security broker (CASB) for monitoring.

Use each cloud provider's native monitoring tool.

A company is planning to migrate to the cloud and wants to implement proactive controls to prevent data breaches. They want to ensure that all data stored in the cloud is encrypted, and that access to the encryption keys is controlled. Which control strategy should they implement?

Use a cloud KMS to manage encryption keys and enable automatic encryption for all storage services.

Use a cloud firewall to block unauthorized access.

Use a CASB to monitor data access.

Use a VPN to encrypt all traffic to the cloud.

Which of the following is an example of a preventative control in a cloud environment?

Reviewing access logs for unusual activity

Restoring a database from a backup after a breach

Conducting a post-incident review

Enabling encryption for data at rest

A government agency uses a cloud environment that must maintain FedRAMP compliance. They need to ensure that any changes to the environment are assessed for security impact before they are implemented. Which process should they implement?

Implement a change advisory board (CAB) that reviews all changes for security impact.

Rely on the cloud provider's compliance certifications.

Enable cloud audit logs and review them monthly.

Use automated security scanning after changes are deployed.

CompTIASecurityX (CASP+)

Domain 2Objective 3

Cloud Control Strategies CAS-005 Practice Questions (Page 5)

Part of the Security architecture domain, which accounts for 27% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–30 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

27%of the exam

Questions 21–25

21application · medium
A startup is deploying a web application on AWS. They want to ensure that only authenticated users can access the application, and they want to automatically block common attack patterns like SQL injection. They also need to log all access attempts for later analysis. Which combination of AWS services should they use?
Select an answer first
22application · medium
A company uses a multi-cloud environment and wants to centralize security monitoring. They want to collect logs from all cloud services and analyze them for potential security incidents. Which solution should they implement?
Select an answer first
23application · medium
A company is planning to migrate to the cloud and wants to implement proactive controls to prevent data breaches. They want to ensure that all data stored in the cloud is encrypted, and that access to the encryption keys is controlled. Which control strategy should they implement?
Select an answer first
24foundation · easy
Which of the following is an example of a preventative control in a cloud environment?
Select an answer first
25application · medium
A government agency uses a cloud environment that must maintain FedRAMP compliance. They need to ensure that any changes to the environment are assessed for security impact before they are implemented. Which process should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.