A security team is updating its password policy. The policy currently requires passwords to be changed every 90 days. The team wants to provide additional advice on creating strong passwords but does not want to change the policy. What should they do?

Update the security policy to include password complexity requirements

Create a security procedure for resetting passwords

Create a security standard that mandates password length and complexity

Create a security guideline that recommends password best practices

An organization is developing its security program documentation. The CISO wants to ensure that the documentation is comprehensive and that each document type serves its intended purpose. Which approach best achieves this?

Create standards and guidelines, as they are more detailed than policies

Create a single document that combines policy, standards, procedures, and guidelines

Create separate documents for each type, ensuring they are aligned and cross-referenced

Create only policies and procedures, as they are the most important

A company is adopting a new cloud service. The security policy requires that 'all data be encrypted in transit.' The cloud provider offers multiple encryption options, but the company wants to ensure that the chosen option is consistently applied across all departments. What should the company do?

Create a security guideline recommending the use of encryption

Rely on the cloud provider's default encryption settings

Update the security policy to specify the exact encryption protocol

Create a security standard that mandates the specific encryption protocol and configuration

CompTIASecurityX (CASP+)

Domain 1Objective 1

Security Program Documentation CAS-005 Practice Questions (Page 1)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

4concepts

20%of the exam

Questions 1–5

1expert · hard
A security team is updating its password policy. The policy currently requires passwords to be changed every 90 days. The team wants to provide additional advice on creating strong passwords but does not want to change the policy. What should they do?
Select an answer first
2expert · hard
An organization is developing its security program documentation. The CISO wants to ensure that the documentation is comprehensive and that each document type serves its intended purpose. Which approach best achieves this?
Select an answer first
3application · medium
A financial services firm is updating its security program documentation. The CISO wants a document that defines the mandatory requirements for encryption strength and key lengths across all systems. Which type of document should be created?
Select an answer first
4foundation · easy
Which document would an administrator consult to find the exact steps for resetting a user's password?
Select an answer first
5expert · hard
A company is adopting a new cloud service. The security policy requires that 'all data be encrypted in transit.' The cloud provider offers multiple encryption options, but the company wants to ensure that the chosen option is consistently applied across all departments. What should the company do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Security Program Documentation CAS-005 Practice Questions (Page 1)

Questions 1–5

A security team is updating its password policy. The policy currently requires passwords to be changed every 90 days. The team wants to provide additional advice on creating strong passwords but does not want to change the policy. What should they do?

An organization is developing its security program documentation. The CISO wants to ensure that the documentation is comprehensive and that each document type serves its intended purpose. Which approach best achieves this?

A financial services firm is updating its security program documentation. The CISO wants a document that defines the mandatory requirements for encryption strength and key lengths across all systems. Which type of document should be created?

Which document would an administrator consult to find the exact steps for resetting a user's password?

A company is adopting a new cloud service. The security policy requires that 'all data be encrypted in transit.' The cloud provider offers multiple encryption options, but the company wants to ensure that the chosen option is consistently applied across all departments. What should the company do?

Keep studying — Governance, risk, and compliance