Free practice quiz
CASP Prep Course (CASP): free quiz
10 questions from the program. See your score right away, then unlock the explanation of every answer.
- Question 1 of 10
A senior cybersecurity practitioner at a regulated enterprise confirms that an employee account exfiltrated sensitive files to a personal cloud drive. Leadership asks the practitioner to decide whether the activity is criminal, terminate the employee, and accept the residual business risk of keeping the affected system online. What is the most appropriate response within the CASP practitioner role?
C is correct. A CASP-level practitioner assesses, documents, preserves evidence, recommends containment, and coordinates with proper authorities. B is tempting because insider incidents may involve discipline or law enforcement, but criminal determinations and termination are legal/HR decisions. A is tempting because technical staff understand the risk, but final risk acceptance belongs to authorized business leadership. D is incorrect because disabling monitoring can harm evidence integrity and detection; privilege decisions should be coordinated with counsel without undermining security operations.
- Question 2 of 10
A CASP review team lacks current official subobjectives and weighting for a course update. As the senior cybersecurity practitioner advising candidates, which planning approach best supports exam-relevant preparation without overstating authority?
D is correct. When official subobjectives are unavailable, provisional, broad, exam-relevant domains prevent unsupported claims while preserving balanced coverage of architecture, risk, operations, and governance. A is tempting because prior blueprints may be useful context, but treating them as current official weighting is misleading. B is tempting for technical practice, but CASP-level preparation emphasizes architecture and decision-making, not isolated vendor syntax. C is tempting because governance matters, but the practitioner should map concepts and advise verification, not wait for legal approval of study content.
- Question 3 of 10
A cloud workload shows anomalous outbound traffic after a new partner API integration. The stem includes SIEM alerts, a pending audit deadline, and pressure from an app owner to disable egress filtering. Using a Task-Fact-Rule-Execute approach, what should the senior cybersecurity practitioner do first?
Option A is correct because the framework starts by clarifying the task, then separates facts from distractors, applies policy or incident-response rules, and executes a defensible action such as containment with evidence preservation. Option C is tempting due to business pressure, but it weakens control without approved risk acceptance. Option B is tempting because reporting may matter, but the practitioner should not seek a legal conclusion before documenting facts and coordinating appropriately. Option D is tempting because technical depth is valuable, but deep analysis before triage can delay containment and decision-making.
- Question 4 of 10
A financial services firm is redesigning access to a high-value payment application after a phishing incident. The current design relies on VPN access plus application passwords. Which architecture best demonstrates defense in depth while reducing single points of security failure?
Option C is correct because it layers preventive, detective, and data-protective controls across identity, endpoint, network, application, and data layers, reducing dependence on any single control. Option A improves one preventive control but leaves VPN and password compromise as major single points of failure. Option B strengthens identity but weakens endpoint assurance by allowing unmanaged devices. Option D adds a perimeter control but removes detective visibility, undermining defense in depth. A mature design should use overlapping controls matched to business criticality and threat exposure.
- Question 5 of 10
A regulated enterprise hosts payment applications in a hybrid environment. User workstations, application servers, database servers, and administrative tools currently share broad routing through core firewalls. Recent testing shows a compromised workstation can reach database management ports. As the senior cybersecurity practitioner, which segmentation design best reduces lateral movement while preserving required application flows?
Option B is best because it combines zoning, microsegmentation principles, least-privilege connectivity, and validation of allowed flows. Option D is tempting because VLANs create separation, but broad inter-VLAN permits preserve lateral movement. Option B improves ingress protection, but it does not control east-west traffic or isolate the management plane. Option D may improve hosting control, but a private subnet with unrestricted VPN reachability extends the flat network into cloud. Effective segmentation requires policy boundaries that permit only required paths and continuous testing of those controls.
- Question 6 of 10
A team is designing a new internet-facing API that will process regulated customer records. As the senior cybersecurity practitioner reviewing the design before coding begins, which recommendation best applies secure development principles to reduce exploitability before deployment?
Option D is correct because secure development should define requirements at design time using threat modeling, data sensitivity, abuse cases, least privilege, input validation, secure defaults, and fail-safe behavior. Option B is tempting because a WAF is useful, but it is a compensating control, not a substitute for design-time requirements. Option B improves availability superficially but violates least privilege and increases blast radius. Option C is risky because production monitoring cannot replace preventive secure design. NIST SSDF and OWASP ASVS emphasize building security requirements into software before release.
- Question 7 of 10
An enterprise uses a SaaS customer portal. The provider maintains the application code, hosting platform, and physical data centers. A review finds that external sharing links are enabled by default, privileged users lack MFA, and sensitive exports are stored without customer-managed retention rules. Which responsibility assignment best addresses the control gap?
C is correct: in SaaS, the provider manages infrastructure and application operations, but the customer commonly remains accountable for data, identities, access policy, and tenant configuration. D overassigns customer-configurable controls to the provider. A changes service model but increases, not decreases, customer responsibility. B is premature; risk acceptance requires authorized governance after feasible remediation is evaluated.
- Question 8 of 10
An enterprise runs mixed-trust workloads on a shared virtualization cluster. A review finds that the hypervisor management console is reachable from the general user VLAN, snapshots are stored on a shared datastore, and VM templates are maintained by the platform team. Which recommendation should be prioritized to reduce the risk of broad compromise through the virtualization layer?
Management-plane exposure is the highest-priority risk because compromise can affect many hosts and workloads. Segmentation, strong authentication, least-privilege administration, controlled access paths, and logging directly reduce that blast radius. Snapshot encryption is important for confidentiality but does not address administrative takeover. Guest EDR improves workload detection but may not see hypervisor or management-plane abuse. Template signing protects image integrity, but a compromised management interface could still deploy or alter workloads at scale.
- Question 9 of 10
A manufacturing plant has legacy PLCs supporting a 24/7 packaging line. Vulnerability scans found outdated firmware, but the operations manager reports that unplanned controller reboots could create safety hazards and missed shipment commitments. As the senior cybersecurity practitioner, which recommendation best addresses OT environment constraints while reducing risk?
A is correct because OT risk reduction must preserve safety and availability: passive discovery limits protocol disruption, owner validation improves asset accuracy, testing reduces unintended effects, and approved windows respect process constraints. C is tempting for visibility, but active authenticated scanning can disrupt fragile industrial devices. B is tempting because patching reduces exposure, but immediate updates can create unsafe downtime without testing and change control. D is tempting as segmentation, but permanent isolation and deferred patching leave unmanaged residual risk; compensating controls and risk-based remediation are still needed.
- Question 10 of 10
A global manufacturer is redesigning authentication for remote privileged access to hybrid cloud administration consoles. Admins are frequent spear-phishing targets, travel internationally, and sometimes lose devices. The CISO wants the strongest practical assurance without relying on reusable secrets. Which recommendation best aligns factor strength, threat model, and recovery risk?
FIDO2/WebAuthn provides phishing-resistant, verifier-impersonation-resistant authentication, appropriate for high-risk privileged access. Contextual signals improve detection but should supplement, not replace, strong factors; recovery must be controlled because weak reset paths can bypass MFA. Complex passwords and geoblocking still rely on reusable secrets and brittle location assumptions. SMS OTP is susceptible to interception, SIM swap, and phishing. Push MFA is stronger than passwords but can be phished or abused through fatigue, and email-based recovery is a weak bypass for privileged accounts.
See why each answer is right or wrong
Enter your email to unlock the explanation of every question, free.