During a threat modeling exercise, a team identifies that an attacker could exploit a misconfigured firewall to gain unauthorized access to an internal database. Which attack pattern category does this represent?

Configuration/Deployment Vulnerability

A security analyst is reviewing threat intelligence for a regional bank. The intelligence indicates a series of targeted phishing campaigns using legitimate-looking email domains and malware that evades antivirus. The campaigns are well-resourced and appear to be sponsored by a nation-state. Which actor characteristic is MOST relevant when prioritizing defenses?

The actor's financial motivation to steal funds directly from customer accounts

The actor's high level of resources and patience, enabling long-term, stealthy operations

The actor's preference for hacktivism, targeting the bank's public image rather than data

The actor's reliance on publicly available exploit kits, indicating low technical skill

What is the primary purpose of the MITRE CAPEC framework?

To define security requirements for software development

To provide a taxonomy of known software weaknesses

To classify and describe common attack patterns

To catalog adversary tactics and techniques

CompTIASecurityX (CASP+)

Domain 1Objective 8

Threat Modeling CAS-005 Practice Questions (Page 2)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 6–10

6foundation · easy
Which attack pattern is characterized by an attacker intercepting and potentially altering communications between two parties without their knowledge?
Select an answer first
7application · medium
During a threat modeling exercise, a team identifies that an attacker could exploit a misconfigured firewall to gain unauthorized access to an internal database. Which attack pattern category does this represent?
Select an answer first
8application · medium
During a threat modeling session, a team identifies that an attacker could use a phishing email to trick an employee into downloading a malicious attachment that installs ransomware. Which attack pattern category does this represent?
Select an answer first
9application · medium
A security analyst is reviewing threat intelligence for a regional bank. The intelligence indicates a series of targeted phishing campaigns using legitimate-looking email domains and malware that evades antivirus. The campaigns are well-resourced and appear to be sponsored by a nation-state. Which actor characteristic is MOST relevant when prioritizing defenses?
Select an answer first
10foundation · easy
What is the primary purpose of the MITRE CAPEC framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Threat Modeling CAS-005 Practice Questions (Page 2)

Questions 6–10

Which attack pattern is characterized by an attacker intercepting and potentially altering communications between two parties without their knowledge?

During a threat modeling exercise, a team identifies that an attacker could exploit a misconfigured firewall to gain unauthorized access to an internal database. Which attack pattern category does this represent?

During a threat modeling session, a team identifies that an attacker could use a phishing email to trick an employee into downloading a malicious attachment that installs ransomware. Which attack pattern category does this represent?

What is the primary purpose of the MITRE CAPEC framework?

Keep studying — Governance, risk, and compliance