thinQmaster — free preview
SecurityX (CASP+) (CAS-005). Set it up and run it.
This is not a sample sheet — it is the application, running. Pick
your mode, your length, your domain, the same way you would inside the full title.
Study mode marks each answer and tells you why the right one is right and why each
wrong one is wrong; Simulation puts a clock on it and chooses each question from
whatever you are weakest in. No account, no e-mail address, no card.
Free · nothing to sign up for
The five questions
1. Refer to the exhibit. With a limited remediation budget this quarter, security leadership must treat one risk first. Weighing residual score against business exposure, which entry most justifies immediate additional investment?
- A. R-11, because phishing remains the single most common initial attack vector
- B. R-14, since any loss of an unencrypted mobile device is reportable
- C. R-07, whose high residual score reflects an unverified backup control
- D. R-19, because it currently has no mitigating control applied at all
Correct answer: C.
R-07 combines the highest residual score with critical business impact and a control known to be ineffective, so additional investment here reduces the most real exposure per dollar. Prioritization weighs residual risk against impact, not any single field.
Why the others are wrong. R-11 has a low residual score of 5 and is already well controlled. R-14 is minor at residual 2 and already encrypted. R-19 lacks a control but its residual score and impact are lower than R-07's; absence of a control is not the same as the greatest remaining exposure.
2. A company accumulated petabytes of analytics data in one cloud and now finds moving it elsewhere slow and expensive. Which two factors most directly create this lock-in? (Choose two.)
- A. The provider's use of standard TLS 1.3 for data in transit
- B. Data gravity pulling compute and services toward the stored data
- C. Server-side encryption with customer-managed keys
- D. Multi-factor authentication required on the management console
- E. Egress data-transfer charges that scale with the volume moved out
Correct answer: B.
Large data stores attract the compute and services that use them (data gravity) while providers charge egress fees that grow with volume, so both the pull of dependent workloads and the cost of moving data out entrench the customer.
Why the others are wrong. TLS 1.3 for transit is a transport choice with no bearing on portability. Customer-managed encryption keys actually ease migration by keeping key control with the customer. Console MFA is an access control unrelated to how hard or costly relocating the data is, so none of the three create lock-in.
3. A payment database is valued at $2 million; analysts expect one breach every five years destroying 30% of its value. A proposed control costs $150,000 per year. What is the soundest decision?
- A. Deploy the control, since any reduction in breach likelihood is worthwhile
- B. Deploy the control and accept the residual risk as immaterial
- C. Transfer the entire risk to a cyber-insurance policy at any premium
- D. Reject or renegotiate the control; its annual cost exceeds the ALE
Correct answer: D.
The ALE is $120,000 (SLE of $600,000 times an ARO of 0.2), so a $150,000 control costs more than the expected annual loss it prevents. A rational program does not spend above the ALE and instead renegotiates or finds a cheaper option.
Why the others are wrong. Deploying because any risk reduction is worthwhile ignores cost-benefit and overspends. Accepting residual risk as immaterial skips the calculation entirely. Transferring at any premium repeats the same error of paying more than the exposure is worth; insurance should still be priced against the ALE.
4. A firm moves an application from an IaaS virtual machine to an equivalent SaaS offering and reviews which controls it still owns. Under SaaS, which responsibility clearly shifts to the provider?
- A. Guest operating system patching and hardening
- B. Classification and access governance of the stored data
- C. Configuration of the application's role assignments
- D. Lifecycle management of the users it provisions
Correct answer: A.
Under SaaS the provider operates the whole stack up to the application, so guest OS patching and hardening move to them, while the customer keeps data classification, identity, and access decisions regardless of model.
Why the others are wrong. Data classification and access governance stay the customer's duty in every cloud model because only the customer knows the data's sensitivity. Configuring application role assignments and managing the user lifecycle are identity tasks the customer always owns, so none of those transfer to a SaaS provider.
5. A payments API must encrypt cardholder data and detect any tampering with the ciphertext in a single operation, without adding a separate MAC step. Which AES mode fits?
- A. AES-CBC
- B. AES-CTR
- C. AES-ECB
- D. AES-GCM
Correct answer: D.
AES-GCM is an authenticated-encryption (AEAD) mode that produces confidentiality and an integrity/authentication tag in one pass, so tampering is detected without a separate MAC, exactly matching the stated single-operation requirement.
Why the others are wrong. AES-CBC provides confidentiality only and needs a separate HMAC to detect tampering, defeating the single-operation goal. AES-CTR likewise offers no built-in integrity. AES-ECB is worse: it leaks plaintext patterns block by block and also provides no authentication of the ciphertext.
6. Refer to the exhibit. A SOC analyst reviews this correlated single-account chain from authentication, cloud, and proxy sources. What best describes what has occurred?
- A. Session token theft followed by OAuth persistence and mailbox exfiltration
- B. A false positive caused by a corporate VPN egress node in Singapore
- C. A password-spray attempt that MFA successfully blocked at the second login
- D. Routine mailbox synchronization performed by a sanctioned mobile client
Correct answer: A.
Impossible travel with MFA already satisfied points to a stolen session or token rather than password guessing, the OAuth grant establishes persistence, and the bulk Graph read plus 1.2 GB egress is the exfiltration stage of one account takeover.
Why the others are wrong. A VPN egress would not produce a Boston-to-Singapore jump in three minutes with a new OAuth grant and mass mailbox read. MFA did not block anything here; it passed, which is the tell. And a sanctioned sync client does not consent to a new high-scope app and immediately push over a gigabyte outbound.
7. A board sets a broad statement that the firm will pursue moderate cybersecurity risk to enable growth, then defines a specific maximum of four hours of unplanned downtime per quarter. The four-hour figure represents what?
- A. Risk tolerance
- B. Risk appetite
- C. Residual risk
- D. Inherent risk
Correct answer: A.
Risk tolerance is the specific, quantified boundary of acceptable deviation for a given objective; the measurable four-hour downtime limit is exactly that threshold, whereas the broad growth statement expresses the higher-level appetite.
Why the others are wrong. Risk appetite is the general willingness the broad statement conveys, not the specific number. Residual risk is exposure remaining after controls, and inherent risk is exposure before controls; neither describes a board-set acceptable-deviation threshold for downtime.
8. A bank runs regulated workloads across two cloud providers and struggles with inconsistent guardrails, drifting configurations, and duplicated policy. What best establishes consistent governance without blocking either platform's native services?
- A. Replace both providers' native tools with a third-party portal only
- B. Standardize on a single provider and migrate the second cloud's workloads
- C. Adopt a cloud-agnostic policy-as-code layer enforced in each provider's control plane
- D. Route all provider APIs through one broker that rewrites every request
Correct answer: C.
Policy-as-code expressed once and enforced through each provider's native control plane gives consistent guardrails and drift detection while still allowing each platform's own services, meeting the multi-cloud governance goal without vendor consolidation.
Why the others are wrong. Standardizing on one provider abandons the deliberate multi-cloud strategy and its resilience. A single request-rewriting broker becomes a fragile bottleneck and single point of failure. A third-party portal hiding native tooling adds lock-in and blocks the platform features teams need, defeating the reason for multi-cloud.
