An organization implements a web application firewall (WAF) in front of its web servers, in addition to secure coding practices and regular security testing. What is the primary purpose of this layered approach?

To provide multiple layers of protection so that a failure in one control does not compromise the entire system

To eliminate the need for patching vulnerabilities

To reduce the number of security controls needed

To ensure all traffic is encrypted

A company is designing a new application that stores sensitive customer data. The data must be encrypted at rest and in transit. Which combination of encryption techniques should be used?

Base64 encoding for data at rest and HTTPS for data in transit.

AES-256 for data at rest and TLS 1.2 or higher for data in transit.

RC4 for data at rest and TLS 1.0 for data in transit.

DES for data at rest and SSL 3.0 for data in transit.

A web application accepts a customer ID in a URL parameter and uses it directly in a SQL query. A security analyst has confirmed that the application is vulnerable to SQL injection. The development team must fix the issue without changing the application's functionality. Which remediation should the team implement?

Restrict the customer ID parameter to numeric characters using client-side JavaScript validation.

Use parameterized queries for all database access.

Add a Web Application Firewall (WAF) rule to block suspicious requests.

Encode the customer ID using HTML entity encoding before using it in the query.

A developer is writing a function that accepts a filename from user input and uses it to read a file from a server directory. The application is written in Python. Which input validation approach is most effective at preventing path traversal attacks?

Encode the filename using URL encoding before using it in the file path.

Use a whitelist of allowed filenames that the user can request.

Reject any filename containing '../' or absolute path indicators.

Sanitize the input by removing all non-alphanumeric characters.

CompTIASecurityX (CASP+)

Domain 4Objective 2

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 4)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

22%of the exam

Questions 16–20

16foundation · easy
An organization implements a web application firewall (WAF) in front of its web servers, in addition to secure coding practices and regular security testing. What is the primary purpose of this layered approach?
Select an answer first
17application · medium
A company is designing a new application that stores sensitive customer data. The data must be encrypted at rest and in transit. Which combination of encryption techniques should be used?
Select an answer first
18application · medium
A web application accepts a customer ID in a URL parameter and uses it directly in a SQL query. A security analyst has confirmed that the application is vulnerable to SQL injection. The development team must fix the issue without changing the application's functionality. Which remediation should the team implement?
Select an answer first
19application · medium
A developer is writing a function that accepts a filename from user input and uses it to read a file from a server directory. The application is written in Python. Which input validation approach is most effective at preventing path traversal attacks?
Select an answer first
20foundation · easy
A user is sending a confidential document over the internet. Which encryption technique is most appropriate to protect the data in transit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 4)

Questions 16–20

An organization implements a web application firewall (WAF) in front of its web servers, in addition to secure coding practices and regular security testing. What is the primary purpose of this layered approach?

A company is designing a new application that stores sensitive customer data. The data must be encrypted at rest and in transit. Which combination of encryption techniques should be used?

A developer is writing a function that accepts a filename from user input and uses it to read a file from a server directory. The application is written in Python. Which input validation approach is most effective at preventing path traversal attacks?

A user is sending a confidential document over the internet. Which encryption technique is most appropriate to protect the data in transit?

Keep studying — Security operations