Free CompTIA SecurityX (CAS-005) practice questions

Sample question 1. A database holds national ID numbers. The threat model includes stolen disk snapshots, but also a malicious database administrator and an injection flaw that returns query results. Which control gives protection against ALL three threats?

1. Application-layer field encryption with keys held in a key service the database cannot reach
2. Transparent data encryption on the database files, with the encryption key managed by the database administrators themselves
3. Full-disk encryption on every storage volume that holds the database files, the transaction logs and the snapshots
4. Row-level security so each application user only sees rows for their own records

Sample question 2. On a file server, EDR records svchost_upd.exe copy --max-age 1y "\\FS01\Finance" remote:data --transfers 8 --bwlimit 20M, with the binary’s original file name in its version info shown as rclone.exe. Firewall logs show sustained TLS uploads to a cloud storage provider the company does not use. No encryption of files has happened yet. Which assessment and priority fit?

1. A backup job set up by IT that uses a third-party sync tool; confirm with the backup team next business day before taking any action
2. Data exfiltration to cloud storage with a renamed sync tool, often before ransomware: block the destination, contain the host, scope what was sent
3. A cryptominer using the file server’s bandwidth to sync blockchain data, so kill the process and rescan the server with antivirus
4. Ransomware encryption in progress, so shut the server down immediately to stop files being encrypted before they are lost

Sample question 3. A research team replaces patient names with random tokens but keeps the lookup table in a separate, access-controlled system under the same organization. A colleague says the dataset is now outside the GDPR. Which statement is correct?

1. The dataset is outside scope, because replacing names with tokens makes patients anonymous
2. The dataset is still personal data, because the organization can re-identify people with the separate table
3. The dataset is outside scope as long as the lookup table is encrypted with a strong algorithm
4. The dataset is in scope only for the lookup table, while the tokenized records are free of the regulation entirely