A company is running an older version of a content management system (CMS) that has a known remote code execution vulnerability. The vendor has released a security patch. What is the primary risk of continuing to run the outdated software?

Attackers can exploit the known vulnerability to compromise the system

The software will become slower over time

The vendor will delete the software from the server

The software will automatically stop functioning

A security analyst is reviewing a server's TLS configuration and finds that it supports the DES encryption algorithm. Why is this considered a weak cipher?

DES is a proprietary algorithm that is not publicly reviewed

DES is a stream cipher and is inherently insecure

DES does not provide authentication

DES uses a 56-bit key, which is vulnerable to brute-force attacks

A company runs a critical legacy application on an unsupported operating system. The application is required for daily operations and cannot be migrated. The security team has identified multiple known vulnerabilities in the OS. Which risk mitigation strategy is most appropriate?

Apply unofficial patches from a third-party vendor.

Upgrade the operating system despite the application incompatibility.

Disconnect the server from the network and use it only locally.

Implement virtual patching using a host-based intrusion prevention system (HIPS).

A company's web application has been attacked via stored XSS. The application is behind a WAF and uses a Content Security Policy (CSP). Despite these controls, the attack succeeded. Which additional control would most effectively prevent future stored XSS attacks?

Implement server-side output encoding for all user-generated content.

Disable JavaScript in the users' browsers.

Strengthen the WAF rules to block more XSS payloads.

Use a more restrictive CSP that disallows all inline scripts.

A company has a mixed environment of Windows and Linux servers. The security team needs to ensure that critical security patches are applied within 48 hours of release. Which approach best meets this requirement?

Use a centralized patch management tool that supports both Windows and Linux.

Manually patch each server as soon as a patch is released.

Enable automatic updates on each server individually.

Deploy patches only after a 30-day testing period.

CompTIASecurityX (CASP+)

Domain 4Objective 2

Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 6)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

22%of the exam

Questions 26–30

26foundation · easy
A company is running an older version of a content management system (CMS) that has a known remote code execution vulnerability. The vendor has released a security patch. What is the primary risk of continuing to run the outdated software?
Select an answer first
27foundation · easy
A security analyst is reviewing a server's TLS configuration and finds that it supports the DES encryption algorithm. Why is this considered a weak cipher?
Select an answer first
28expert · hard
A company runs a critical legacy application on an unsupported operating system. The application is required for daily operations and cannot be migrated. The security team has identified multiple known vulnerabilities in the OS. Which risk mitigation strategy is most appropriate?
Select an answer first
29expert · hard
A company's web application has been attacked via stored XSS. The application is behind a WAF and uses a Content Security Policy (CSP). Despite these controls, the attack succeeded. Which additional control would most effectively prevent future stored XSS attacks?
Select an answer first
30application · medium
A company has a mixed environment of Windows and Linux servers. The security team needs to ensure that critical security patches are applied within 48 hours of release. Which approach best meets this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.