A web application accepts a username that is later used in a SQL query. Which input validation technique is most effective at preventing SQL injection?

Blacklisting common SQL keywords like 'SELECT' and 'DROP'

Limiting the input length to 20 characters

Parameterized queries with bound parameters

Removing all single quotes from the input

A security architect is designing a new web service that must support clients using legacy browsers that only support TLS 1.0. The service handles sensitive data. Which approach best balances security and the requirement to support legacy clients?

Use TLS 1.0 only for non-sensitive endpoints and TLS 1.2 for sensitive data.

Disable TLS 1.0 and require clients to upgrade to a modern browser.

Implement a reverse proxy that terminates TLS 1.0 and re-encrypts to the backend using TLS 1.2.

Enable TLS 1.0 with strong cipher suites and implement additional compensating controls.

A company needs to store sensitive customer data in a database. Which encryption technique is most appropriate to protect the data at rest?

TLS encryption for client connections

Full-disk encryption on the database server

A web application takes a user-supplied product ID and directly concatenates it into a SQL query string that is sent to the database. An attacker submits a product ID value that alters the query to return all customer records. Which type of vulnerability is being exploited?

XML external entity (XXE) injection

CompTIASecurityX (CASP+)

Domain 4Objective 2

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 3)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

22%of the exam

Questions 11–15

11foundation · easy
A web application accepts a username that is later used in a SQL query. Which input validation technique is most effective at preventing SQL injection?
Select an answer first
12expert · hard
A security architect is designing a new web service that must support clients using legacy browsers that only support TLS 1.0. The service handles sensitive data. Which approach best balances security and the requirement to support legacy clients?
Select an answer first
13foundation · easy
A developer is reviewing code for a blog application. A comment feature saves user posts to a database and later displays them to all visitors without sanitization. An attacker posts a comment containing a <script> tag that steals cookies from every user who views the page. Which type of XSS vulnerability is this?
Select an answer first
14foundation · easy
A company needs to store sensitive customer data in a database. Which encryption technique is most appropriate to protect the data at rest?
Select an answer first
15foundation · easy
A web application takes a user-supplied product ID and directly concatenates it into a SQL query string that is sent to the database. An attacker submits a product ID value that alters the query to return all customer records. Which type of vulnerability is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.