An organization uses a legacy application that is no longer supported by the vendor and has known security vulnerabilities. Which strategy is most appropriate to mitigate the risk while the application is still in use?

Implement compensating controls such as network segmentation and strict access controls

Disable all network access to the application

Ignore the risk because the application is legacy

Upgrade the operating system to a newer version

An organization has a mix of Windows and Linux servers. Which practice is essential for an effective patch management program across these systems?

Use the same patch for all operating systems

Maintain an inventory of all systems and their installed software versions

Patch only when a vulnerability is actively exploited

Rely solely on vendor automatic updates

A company runs a legacy application on a Windows Server that is no longer supported by the vendor. The application cannot be upgraded or replaced in the near term. Which strategy best reduces the risk from outdated software?

Enable automatic updates from the vendor's website.

Apply third-party security patches that are not vendor-approved.

Place the server on an isolated network segment and restrict access to only necessary ports.

Install a host-based intrusion detection system (HIDS) on the server.

CompTIASecurityX (CASP+)

Domain 4Objective 2

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 1)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

22%of the exam

Questions 1–5

1foundation · easy
An organization uses a legacy application that is no longer supported by the vendor and has known security vulnerabilities. Which strategy is most appropriate to mitigate the risk while the application is still in use?
Select an answer first
2foundation · easy
An organization has a mix of Windows and Linux servers. Which practice is essential for an effective patch management program across these systems?
Select an answer first
3foundation · easy
An attacker exploits a vulnerability in a web application to execute operating system commands on the underlying server. The application passes user-supplied filenames to a system shell without sanitization. What type of injection attack is this?
Select an answer first
4application · medium
A company runs a legacy application on a Windows Server that is no longer supported by the vendor. The application cannot be upgraded or replaced in the near term. Which strategy best reduces the risk from outdated software?
Select an answer first
5foundation · easy
A security audit reveals that a web server is running with default administrative credentials and has directory listing enabled. Which category of vulnerability does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 1)

Questions 1–5

An organization uses a legacy application that is no longer supported by the vendor and has known security vulnerabilities. Which strategy is most appropriate to mitigate the risk while the application is still in use?

An organization has a mix of Windows and Linux servers. Which practice is essential for an effective patch management program across these systems?

An attacker exploits a vulnerability in a web application to execute operating system commands on the underlying server. The application passes user-supplied filenames to a system shell without sanitization. What type of injection attack is this?

A company runs a legacy application on a Windows Server that is no longer supported by the vendor. The application cannot be upgraded or replaced in the near term. Which strategy best reduces the risk from outdated software?

A security audit reveals that a web server is running with default administrative credentials and has directory listing enabled. Which category of vulnerability does this represent?

Keep studying — Security operations