CAS-005 Exam Dumps - CompTIA SecurityX Certification Exam

The issue is tracing the original source of requests in a tiered architecture with a load balancer. The web server logs show internal IPs (192.168.1.10), not the external client IPs, because the load balancer forwards requests without preserving the source. Enabling theX-Forwarded-Forheader on the load balancer adds the client’s original IP to the HTTP request headers, allowing downstream servers to log it. This ensures traceability without altering the architecture significantly.

Option A:Correct—X-Forwarded-For is the standard solution for preserving client IPs through load balancers.

Option B:A Host-based Intrusion Detection System (HIDS) detects anomalies but doesn’t address IP traceability.

Option C:A trusted CA certificate fixes the self-signed warning but is unrelated to source tracking.

Option D:Stored procedures improve database security but don’t help with IP logging.

Option E:Storing $_SERVER['REMOTE_ADDR'] captures the loadbalancer’s IP, not the client’s, unless X-Forwarded-For is enabled.

The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed. This suggests a Time-Of-Check to Time-Of-Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.

The most cost-effective and secure solution is to configure VPN concentrators inside the OT networks at both sites (Option D). This setup allows encrypted communications between Site A and Site B, enabling controllers at either site to serve as secondary or failover devices for the other. By leveraging VPN tunnels, the organization avoids the expensive and time-consuming process of laying new fiber infrastructure, while still ensuring secure, authenticated, and encrypted connections across sites.

Option A, direct fiber connectivity, provides high performance but is extremely costly and less flexible than VPN solutions. Option B, deploying redundant SCADA controllers at each site, increases hardware, licensing, and management costs while still requiring interconnectivity. Option C, air-gapping the OT network, may improve isolation but would prevent remote failover capabilities, contradicting the requirement for cross-site control.

By implementing VPN concentrators, the organization achieves secure cross-site redundancy, supports operational continuity in case of controller outages, and does so in a cost-effective manner aligned with common OT security practices.

Understanding Business Impact Analysis (BIA):

ABIA assesses the effects of disruptionsto an organization's operations.

It helpsprioritize resourcesbased on the potential impact ofdowntime, compliance issues, and critical processes.

Why Options B, C, and F are Correct:

B (Applicable contract obligations)→ Many companies havelegal and compliance obligationsregarding downtime, availability, and SLAs. This information helps determine whatrisk levelsare acceptable.

C (Costs associated with downtime)→ BIA quantifies the financial impact of system failures. Knowinglost revenue, regulatory fines, and recovery costshelps in planning.

F (Critical processes)→ Identifyingcore business processesallows an organization toprioritize recoveryeffortsandmaintain operational continuity.

Why Other Options Are Incorrect:

A (Inventory details)→ While useful for asset management, it doesnot directly impact business continuity planning.

D (Network diagrams)→ These help in security architecture but arenot directly related to the financial/business impact analysis.

E (Contingency plans)→ BIA isperformed before contingency planningto identifywhat needs protection.

The best solution to reduce the likelihood of firmware-level attacks and rootkits is to implement measured boot. Measured boot is a hardware-assisted security mechanism that leverages Trusted Platform Module (TPM) and Secure Boot processes. It records cryptographic measurements of each stage of the boot process—from firmware to operating system loaders—and stores them in the TPM. Security software, such as attestation services, can then verify that the system booted into a known, trusted state. If firmware or boot-level code has been tampered with, the measurements will not match expected values, alerting administrators to compromise.

Option A (software integrity checks) validates application-level integrity but does not address firmware rootkits that load before the operating system. Option B (self-encrypting drives) protects data at rest but does not prevent rootkits. Option D (host-based encryption) ensures confidentiality but does not detect or mitigate firmware-level persistence.

Measured boot specifically targets low-level tampering, making it the most relevant control to defend against rootkits and firmware exploits.

The SIEM already contains multiple events that, if correlated, would have indicated an active attack sequence on VM001—such as denied connections, IPS alerts, malware detection, and then an allowed connection. CAS-005 Security Operations objectives emphasize log correlation as a way to enhance detection by linking related events across different time stamps and data sources into a single, higher-confidence alert.

Option A (adding EDR logs) could add visibility but does not address the need to connect existing events for earlier detection.

Option C (improving parsing) ensures readability but does not create actionable alerts.

Option D (creating a new malware detection rule) is redundant since malware detection already appeared in logs; the issue was the lack of correlation to act on it in time.

By correlating IDS, IPS, firewall, and malware detection logs, the SIEM can raise a higher-priority alert before the attack is completed.

SecurityX CAS-005 exam content emphasizes integrating security into the SDLC and using automated tools to identify vulnerabilities early.

Software dependency management solutions track and analyze libraries and components for known vulnerabilities before deployment, using vulnerability databases such as NVD or OSS Index.

IAST scanning still requires the application to be running and may detect issues later.

WAF policies help block attacks in production but do not prevent vulnerable code from being deployed.

SIEM monitoring is reactive and identifies issues after they occur.By detecting vulnerable dependencies early, software dependency management solutions prevent late-stage deployment delays and reduce security risk.

RACI matrix(Responsible, Accountable, Consulted, Informed) is used for role mapping across the project lifecycle.

CMDB is a configuration inventory; ITIL is a framework. Recall trees are for disaster recovery/business continuity.

FromCAS-005, Domain 1: Security Governance and Compliance:

“The RACI matrix is essential in role assignment and accountability for software development and operational processes.”