CompTIASecurityX (CASP+)
Domain 1Objective 8
Threat Modeling CAS-005 Practice Questions (Page 1)
Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)
22questions here
5free pages
5concepts
20%of the exam
Questions 1–5
- 1
A security team is using CAPEC to identify mitigations for a web application that is vulnerable to SQL injection. Which mitigation is MOST directly associated with CAPEC-66?
Select an answer first - 2
A developer is reviewing a web application that allows users to upload profile pictures. The application stores the files in a public directory and serves them directly. Which CAPEC pattern is the developer MOST likely to use to describe the associated risk?
Select an answer first - 3
Which STRIDE threat category is primarily concerned with an attacker gaining higher privileges than they are authorized to have?
Select an answer first - 4
In the MITRE ATT&CK framework, which term describes the specific actions an adversary performs to achieve an objective?
Select an answer first - 5
A security architect is using STRIDE to analyze a new payment processing system. The system accepts credit card numbers, processes them, and stores them in a database. Which STRIDE category is MOST directly addressed by encrypting the credit card numbers in the database?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.