A security analyst is reviewing a CAPEC entry for a web application that allows users to submit comments. The analyst notices that the application does not sanitize user input, allowing an attacker to inject malicious scripts. Which CAPEC pattern is the analyst MOST likely reviewing?

CAPEC-650: Upload a Malicious File

CAPEC-63: Cross-Site Scripting (XSS)

CAPEC-253: Remote Code Inclusion

A security analyst is profiling a threat actor known for using publicly available exploit code, targeting unpatched systems, and operating with moderate technical skill. Which characteristic best describes this actor?

Hacktivist with a political or social agenda

Script kiddie relying on existing tools and exploits

Insider threat with authorized access to the network

Nation-state actor with advanced persistent threat capabilities

CompTIASecurityX (CASP+)

Domain 1Objective 8

Threat Modeling CAS-005 Practice Questions (Page 4)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 16–20

16application · medium
A security analyst is reviewing a CAPEC entry for a web application that allows users to submit comments. The analyst notices that the application does not sanitize user input, allowing an attacker to inject malicious scripts. Which CAPEC pattern is the analyst MOST likely reviewing?
Select an answer first
17application · medium
A threat intelligence analyst is mapping an adversary's behavior to MITRE ATT&CK. The adversary is known to use valid accounts for initial access and then escalate privileges via a vulnerability in a service. Which ATT&CK tactic does the privilege escalation technique belong to?
Select an answer first
18application · medium
A security team is using STRIDE to assess a new authentication service. The service uses a shared secret for API authentication. Which STRIDE threat is MOST relevant to the shared secret being compromised?
Select an answer first
19foundation · easy
Which MITRE ATT&CK tactic is associated with the adversary's goal of moving from one compromised system to another within the network?
Select an answer first
20foundation · easy
A security analyst is profiling a threat actor known for using publicly available exploit code, targeting unpatched systems, and operating with moderate technical skill. Which characteristic best describes this actor?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Threat Modeling CAS-005 Practice Questions (Page 4)

Questions 16–20

A security analyst is reviewing a CAPEC entry for a web application that allows users to submit comments. The analyst notices that the application does not sanitize user input, allowing an attacker to inject malicious scripts. Which CAPEC pattern is the analyst MOST likely reviewing?

A threat intelligence analyst is mapping an adversary's behavior to MITRE ATT&CK. The adversary is known to use valid accounts for initial access and then escalate privileges via a vulnerability in a service. Which ATT&CK tactic does the privilege escalation technique belong to?

A security team is using STRIDE to assess a new authentication service. The service uses a shared secret for API authentication. Which STRIDE threat is MOST relevant to the shared secret being compromised?

Which MITRE ATT&CK tactic is associated with the adversary's goal of moving from one compromised system to another within the network?

A security analyst is profiling a threat actor known for using publicly available exploit code, targeting unpatched systems, and operating with moderate technical skill. Which characteristic best describes this actor?

Keep studying — Governance, risk, and compliance