A software vendor distributes a desktop application. Users report that a downloaded installer fails to launch with a warning that the publisher is unknown. The vendor wants to ensure that users can verify the software's origin and that it has not been tampered with since release. Which solution should the vendor implement?

Sign the installer with a code-signing certificate from a trusted CA and include the certificate chain.

Publish a SHA-256 hash of the installer on the vendor's website.

Encrypt the installer with the vendor's private key and distribute the public key to users.

Compress the installer into a ZIP file with a password and share the password on the website.

A company receives a digitally signed email from a supplier. The signature verifies successfully using the supplier's public key. Later, the supplier claims they did not send the email. What can the company prove?

The email was sent by the supplier and has not been altered.

The supplier's private key was compromised.

The email was encrypted during transmission.

The email was received at a specific time.

A company needs to securely send a large encrypted file to a partner. The company wants to use asymmetric cryptography to establish a shared symmetric key, then use that key to encrypt the file. Which process should the company use?

Use a digital signature to encrypt the file content.

Encrypt the file directly with the partner's public key using RSA.

Encrypt the file with the company's private key and send it to the partner.

Generate a random symmetric key, encrypt it with the partner's public key, and send it along with the file encrypted with the symmetric key.

A financial institution receives a contract from a client. The client claims they never sent the contract. The institution wants to prove that the client did send it and that it was not altered. What should the institution request from the client?

A digital signature of the contract using the client's private key.

A timestamp from a trusted time-stamping authority.

An encrypted copy of the contract using the institution's public key.

A hash of the contract computed by the client.

A developer needs to sign a software update so that users can verify it came from the developer. Which key should the developer use to create the digital signature?

A symmetric key shared with users

CompTIASecurityX (CASP+)

Domain 3Objective 5

Cryptographic Techniques CAS-005 Practice Questions (Page 3)

Part of the Security engineering domain, which accounts for 31% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~20–34 in this domain), expect 4–7 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

31%of the exam

Questions 11–15

11application · medium
A software vendor distributes a desktop application. Users report that a downloaded installer fails to launch with a warning that the publisher is unknown. The vendor wants to ensure that users can verify the software's origin and that it has not been tampered with since release. Which solution should the vendor implement?
Select an answer first
12expert · medium
A company receives a digitally signed email from a supplier. The signature verifies successfully using the supplier's public key. Later, the supplier claims they did not send the email. What can the company prove?
Select an answer first
13expert · hard
A company needs to securely send a large encrypted file to a partner. The company wants to use asymmetric cryptography to establish a shared symmetric key, then use that key to encrypt the file. Which process should the company use?
Select an answer first
14application · medium
A financial institution receives a contract from a client. The client claims they never sent the contract. The institution wants to prove that the client did send it and that it was not altered. What should the institution request from the client?
Select an answer first
15foundation · easy
A developer needs to sign a software update so that users can verify it came from the developer. Which key should the developer use to create the digital signature?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.