CompTIA Advanced Security Practitioner - CAS-001 Exam Questions [2026]

QUESTION NO: 1
The Chief Information Security Officer (CISO) regularly receives reports of a single department repeatedly violating the corporate security policy. The head of the department in question informs the CISO that the offending behaviors are a result of necessary business activities. The CISO assigns a junior security administrator to solve the issue. Which of the following is the BEST course of action for the junior security administrator to take?

A. Work with the department head to find an acceptable way to change the business needs so the department no longer violates the corporate security policy. B. Work with the CISO and department head to create an SLA specifying the response times of the IT security department when incidents are reported. C. Draft an MOU for the department head and CISO to approve, documenting the limits of the necessary behavior, and actions to be taken by both teams. D. Draft an RFP for the purchase of a COTS product or consulting services to solve the problem through implementation of technical controls.

Correct Answer: C

QUESTION NO: 2
During a specific incident response and recovery process action, the response team determines that it must first speak to the person ultimately responsible for the data. With whom should the response team speak FIRST?

A. Data User B. Data Owner C. Business Owner D. Data Custodian

Correct Answer: B

QUESTION NO: 3
On Monday, the Chief Information Officer (CIO) of a state agency received an e-discovery request for the release of all emails sent and received by the agency board of directors for the past five years. The CIO has contacted the email administrator and asked the administrator to provide the requested information by end of day on Friday. Which of the following has the GREATEST impact on the ability to fulfill the e-discovery request?

A. Data retention policy B. Backup software and hardware C. Data recovery procedures D. Email encryption software

Correct Answer: A

QUESTION NO: 4
A security administrator is shown the following log excerpt from a Unix system:
2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2
2013 Oct 10 07:14:57 web14 sshd[1635]: Failed password for root from 198.51.100.23 port 37915 ssh2
2013 Oct 10 07:14:58 web14 sshd[1638]: Failed password for root from 198.51.100.23 port 37916 ssh2
2013 Oct 10 07:15:59 web14 sshd[1640]: Failed password for root from 198.51.100.23 port 37918 ssh2
2013 Oct 10 07:16:00 web14 sshd[1641]: Failed password for root from 198.51.100.23 port 37920 ssh2
2013 Oct 10 07:16:00 web14 sshd[1642]: Successful login for root from 198.51.100.23 port 37924 ssh2
Which of the following is the MOST likely explanation of what is occurring and the BEST immediate response? (Select TWO).

A. A remote attacker has compromised the private key of the root account. B. An authorized administrator has logged into the root account remotely. C. The administrator should disable remote root logins. D. Change the root password immediately to a password not found in a dictionary. E. A remote attacker has compromised the root account using a buffer overflow in sshd. F. A remote attacker has guessed the root password using a dictionary attack. G. Isolate the system immediately and begin forensic analysis on the host. H. Use iptables to immediately DROP connections from the IP 198.51.100.23.

Correct Answer: F,G

QUESTION NO: 5
The <nameID> element in SAML can be provided in which of the following predefined formats? (Select TWO).

A. WWN record name B. EV certificate OID extension C. Kerberos principal name D. X.509 subject name E. PTR DNS record

Correct Answer: C,D

QUESTION NO: 6
Which of the following refers to programs running in an isolated space to run untested code and prevents the code from making permanent changes to the OS kernel and other data on the host machine?

A. Input Validation B. Application hardening C. Code signing D. Application sandboxing

Correct Answer: D

QUESTION NO: 7
At one time, security architecture best practices led to networks with a limited number (1-3) of network access points. This restriction allowed for the concentration of security resources and resulted in a well defined attack surface. The introduction of wireless networks, highly portable network devices, and cloud service providers has rendered the network boundary and attack surface increasingly porous. This evolution of the security architecture has led to which of the following?

A. Increased business capabilities and increased security risks with a lower TCO and smaller physical footprint on the corporate network. B. Increased business capabilities and increased security risks with a higher TCO and a larger physical footprint. C. Decreased business capabilities and increased security risks with a lower TCO and increased logical footprint due to virtualization. D. Increased security capabilities, the same amount of security risks and a higher TCO but a smaller corporate datacenter on average.

Correct Answer: B

QUESTION NO: 8
An administrator receives a notification from legal that an investigation is being performed on members of the finance department. As a precaution, legal has advised a legal hold on all documents for an unspecified period of time. Which of the following policies will MOST likely be violated? (Select TWO).

A. Data Retention Policy B. Data Storage Policy C. Corporate Privacy Policy D. Corporate Confidentiality Policy E. Data Breach Mitigation Policy

Correct Answer: A,B

QUESTION NO: 9
The security administrator is responsible for the confidentiality of all corporate data. The company's servers are located in a datacenter run by a different vendor. The vendor datacenter hosts servers for many different clients, all of whom have access to the datacenter. None of the racks are physically secured. Recently, the company has been the victim of several attacks involving data injection and exfiltatration. The security administrator suspects these attacks are due to several new network based attacks facilitated by having physical access to a system. Which of the following BEST describes how to adapt to the threat?

A. Apply port security to all switches, switch to SCP, and implement IPSec tunnels between devices. B. Apply port security to all routers, switch to telnet, and implement point to point VPNs on all servers. C. Apply two factor authentication, require point to point VPNs, and enable log auditing on all devices. D. Apply three factor authentication, implement IPSec, and enable SNMP.

Correct Answer: A

QUESTION NO: 10
A helpdesk manager at a financial company has received multiple reports from employees and customers that their phone calls sound metallic on the voice system. The helpdesk has been using VoIP lines encrypted from the handset to the PBX for several years. Which of the following should be done to address this issue for the future?

A. Traffic shaping B. SIP session tagging and QoS C. Lower encryption setting D. A dedicated VLAN

Correct Answer: D

QUESTION NO: 11
When attending the latest security conference, an information security administrator noticed only a few people carrying a laptop around. Most other attendees only carried their smartphones.
Which of the following would impact the security of conference's resources?

A. Physical security may need to be increased to deter or prevent theft of mobile devices. B. Network security may need to be increased by reducing the number of available physical network jacks. C. Wireless network security may need to be decreased to allow for increased access of mobile devices. D. Wireless network security may need to be increased to decrease access of mobile devices.

Correct Answer: B

QUESTION NO: 12
Which of the following BEST explains SAML?

A. An XML and SOAP-based protocol, which enables the use of PKI for code signing and SSO by using SSL and SSH to establish a trust model. B. A security attestation model built on XML and SOAP-based services, which allows for the exchange of A&A data between systems and supports Federated Identity Management. C. A security model built on the transfer of assertions over XML and SOAP-based protocols, which allows for seamless SSO and the open exchange of data. D. A security verification model built on SSO and SSL-based services, which allows for the exchange of PKI data between users and supports XACML.

Correct Answer: B