An organization is working to secure its development process to ensure developers cannot deploy artifacts directly into the production environment.
Which of the following security practice recommendations would be the best to accomplish this objective?
Implement least privilege access to all systems.
Roll out security awareness training for all users.
Set up policies and systems with separation of duties.
Enforce job rotations for all developers and administrators.
Utilize mandatory vacations for all developers.
Review all access to production systems on a quarterly basis.
Show answer and explanation
Correct answer: C. Set up policies and systems with separation of duties.
Separation of duties is a fundamental access control principle that prevents any single individual from having complete control over a critical transaction or process. By implementing policies and systems with separation of duties, the organization ensures that developers cannot unilaterally deploy artifacts to production, this requires approval and execution by different roles. This directly addresses the stated objective of preventing direct production deployments by developers.
Why the other options are wrong
A. Least privilege access is important but doesn't specifically prevent developers from deploying to production if they have any production access.
B. Security awareness training improves security culture but doesn't enforce technical controls preventing direct deployments.
D. Job rotation reduces insider threat risk over time but doesn't prevent current deployment capabilities.
E. Mandatory vacations may help detect fraudulent activities but don't prevent unauthorized deployments.
F. Quarterly access reviews are detective controls that occur too infrequently to prevent unauthorized deployments.
Question 2
A security architect discovers the following while reviewing code for a company's website: selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")
Which of the following should the security architect recommend?
Client-side processing
Query parameterization
Data normalization
Escape character blocking
URL encoding
Show answer and explanation
Correct answer: B. Query parameterization
The code shown is vulnerable to SQL injection because user input from Request('ItemID') is directly concatenated into the SQL query string without sanitization. Query parameterization (also called prepared statements) separates SQL code from data, preventing attackers from injecting malicious SQL commands. This is the industry-standard defense against SQL injection attacks.
Why the other options are wrong
A. Client-side processing cannot prevent SQL injection, which occurs at the database level.
C. Data normalization organizes data structure but doesn't prevent SQL injection attacks.
D. Escape character blocking is an outdated approach less effective than parameterization and can be bypassed.
E. URL encoding protects data in transit but doesn't prevent SQL injection at the database layer.
Question 3
A CRM company leverages a CSP PaaS service to host and publish Its SaaS product. Recently, a large customer requested that all infrastructure components must meet strict regulatory requirements, including configuration management, patch management, and life-cycle management.
Which of the following organizations is responsible for ensuring those regulatory requirements are met?
The CRM company
The CRM company's customer
The CSP
The regulatory body
Show answer and explanation
Correct answer: A. The CRM company
In a PaaS cloud model, the CRM company (the customer) retains responsibility for application-level security controls and compliance requirements. While the CSP provides infrastructure, the CRM company must ensure that its deployment meets regulatory requirements including configuration management, patch management, and lifecycle management of the application and its data. The customer cannot delegate compliance responsibility to the cloud provider.
Why the other options are wrong
B. The customer's customer does not have direct responsibility for the infrastructure requirements.
C. The CSP provides infrastructure but the responsibility for meeting regulatory requirements specific to the customer's business rests with the CRM company.
D. The regulatory body sets requirements but doesn't implement the controls needed to meet them.
7 reviews for CompTIA SecurityX CAS-005 Exam Practice Questions
Rated 5 out of 5
WB –
This content is a MUST PURCHASE!!!!! Great stuff!!! Just passed my SecurityX exam with the help of this content!!!! Please keep them coming!!!!
Rated 5 out of 5
AC –
Passed, thank you
Passed my exam. If you are sitting this exam, get this dump. The exam is expensive and a retake even more so. Spending a small amount on this dump is just sensible. Thank you.
Rated 5 out of 5
Isaias Grant –
Cert Stash’s CAS-005 questions were up to date and aligned with real exam challenges. A great resource for final prep.
Rated 5 out of 5
Gllen Maxvel –
I was struggling to find good study material, but Cert Stash had exactly what I needed. The dump papers covered all the important topics. Highly recommend to anyone preparing for exams.
Rated 5 out of 5
Gina Kamara –
Better than I expected for the price
Rated 5 out of 5
Preston Wagner –
Questions are very close to the real exam
Really appreciate this. Would buy again. Already have for another exam. Will keep doing so.
Rated 5 out of 5
Edith –
Passed with this
Only logged in customers who have purchased this product may leave a review.
How much of the CompTIA SecurityX CAS-005 bank is free?
482 questions in the bank
Each step includes the one before, so buying only adds new questions.
You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
12025% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
237the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
482100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK
What’s in the CompTIA SecurityX CAS-005 pack
482 questions, MCQs and PBQs, mapped to the CAS-005 exam objectives
Answers and explanations for every question, including the wrong options
A questions-only PDF for timed practice runs
Instant delivery by email the moment you check out
Free monthly updates for as long as the exam is live
Pass or your money back
A SecurityX voucher costs US$544, CompTIA's most expensive exam. This pack is US$39, paid once.
What makes the SecurityX hard
Fail it and CompTIA charges the full US$544 again, the most expensive exam in its catalogue. SecurityX is not multiple choice only: performance based questions put you inside real security scenarios and expect you to make the call, not just recognise the right term.
It is also scored pass or fail only. There is no scaled score and no partial credit, so a near miss counts the same as a wide one, and there is no score report telling you how close you came.
This is CompTIA's most advanced cybersecurity certification, the former CASP+ rebranded and expanded, and it is DoD 8140/8570 approved at expert level. For a large share of senior government and defence roles that approval is not optional, it is required. This pack puts all 482 questions, MCQ and PBQ, in one place, so the scenario framing is familiar before exam day.
About the exam
CompTIA SecurityX is CompTIA's most advanced cybersecurity certification, formerly CASP+ and rebranded as part of the Xpert series. It validates expert level skills in security architecture, engineering, governance, risk and compliance, and security operations across complex enterprise environments including cloud, hybrid and on-premises. It is DoD 8140/8570 approved and is treated as a direct competitor to CISSP and CISM for senior security roles. The current version is V5, series code CAS-005, launched 17 December 2024. Ten years of IT experience including five years of hands-on security experience is recommended.
Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
WB –
This content is a MUST PURCHASE!!!!! Great stuff!!! Just passed my SecurityX exam with the help of this content!!!! Please keep them coming!!!!
AC –
Passed my exam. If you are sitting this exam, get this dump. The exam is expensive and a retake even more so. Spending a small amount on this dump is just sensible. Thank you.
Isaias Grant –
Cert Stash’s CAS-005 questions were up to date and aligned with real exam challenges. A great resource for final prep.
Gllen Maxvel –
I was struggling to find good study material, but Cert Stash had exactly what I needed. The dump papers covered all the important topics. Highly recommend to anyone preparing for exams.
Gina Kamara –
Better than I expected for the price
Preston Wagner –
Really appreciate this. Would buy again. Already have for another exam. Will keep doing so.
Edith –
Passed with this