A global consulting firm is implementing zero trust. They need to ensure that only authorized users on managed devices can access the corporate SaaS applications. Which IAM control is most essential to establish and maintain the subject-object relationship in this scenario?

A directory service that stores user accounts and group memberships.

A conditional access policy that evaluates user identity, device compliance, and location in real-time before granting access to each application.

A single sign-on (SSO) solution that allows users to authenticate once and access all applications.

A privileged access management (PAM) solution to manage and monitor administrative accounts.

A software company is adopting zero trust. The development team needs access to a production database to troubleshoot a live issue. According to the principle of least privilege, what is the most appropriate access control policy?

Grant the lead developer full administrative access to the production database permanently to avoid future delays.

Grant the entire development team read-only access to the production database for the duration of the incident.

Grant the specific developer investigating the issue read-only access to the relevant tables for a limited time, with approval from the database owner.

Provide the developer with a copy of the production database on a development server to troubleshoot the issue.

A zero trust architecture is being implemented. The IAM team is configuring the system to establish a subject-object relationship. They need to ensure that the user's identity is verified and that the user is authorized to access the specific resource. Which IAM process is responsible for this?

Provisioning, which creates user accounts.

Authorization, which determines what the user is allowed to do.

Accounting, which tracks user activity.

Authentication, which verifies the user's identity.

A large enterprise is transitioning from a traditional perimeter-based security model to zero trust. They have a mix of legacy on-premises applications and modern cloud SaaS applications. The CISO wants to eliminate implicit trust for all access, but the legacy applications do not support modern authentication protocols like SAML or OIDC. The security architect must design a solution. What is the most practical approach to address this constraint?

Implement microsegmentation around the legacy applications and rely on network-level access control lists (ACLs) to restrict access.

Use a zero trust network access (ZTNA) solution that can proxy access to legacy applications, enforcing identity-based policies before the user reaches the application.

Place the legacy applications behind a traditional VPN and require users to connect to the VPN before accessing them.

Replace all legacy applications with modern, cloud-native versions that support SAML and OIDC.

A company is designing a zero trust network. They want to ensure that even if a user's workstation is compromised, the attacker cannot easily move laterally to other parts of the network. Which combination of zero trust concepts is most effective for this goal?

Implementing microsegmentation to isolate workloads and enforcing strict identity-based access policies for all inter-segment communication.

Implementing a SIEM system to collect and correlate logs from all network devices.

Deploying a strong next-generation firewall at the network perimeter and requiring all traffic to pass through it.

Using a VPN for all remote access and relying on the corporate directory for authentication.

CompTIASecurityX (CASP+)

Domain 2Objective 7

Zero Trust Concepts CAS-005 Practice Questions (Page 1)

Part of the Security architecture domain, which accounts for 27% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–30 in this domain), expect 3–4 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

6concepts

27%of the exam

Questions 1–5

1application · medium
A global consulting firm is implementing zero trust. They need to ensure that only authorized users on managed devices can access the corporate SaaS applications. Which IAM control is most essential to establish and maintain the subject-object relationship in this scenario?
Select an answer first
2application · medium
A software company is adopting zero trust. The development team needs access to a production database to troubleshoot a live issue. According to the principle of least privilege, what is the most appropriate access control policy?
Select an answer first
3application · medium
A zero trust architecture is being implemented. The IAM team is configuring the system to establish a subject-object relationship. They need to ensure that the user's identity is verified and that the user is authorized to access the specific resource. Which IAM process is responsible for this?
Select an answer first
4expert · hard
A large enterprise is transitioning from a traditional perimeter-based security model to zero trust. They have a mix of legacy on-premises applications and modern cloud SaaS applications. The CISO wants to eliminate implicit trust for all access, but the legacy applications do not support modern authentication protocols like SAML or OIDC. The security architect must design a solution. What is the most practical approach to address this constraint?
Select an answer first
5application · medium
A company is designing a zero trust network. They want to ensure that even if a user's workstation is compromised, the attacker cannot easily move laterally to other parts of the network. Which combination of zero trust concepts is most effective for this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.