CAS-005 Exam Dumps : CompTIA SecurityX Certification Exam

The technique that best addresses the issue of insider threats from employees who have individual access to encrypted material is key splitting. Here’s why:

Key Splitting: Key splitting involves dividing a cryptographic key into multiple parts anddistributing these parts among different individuals or systems. This ensures that no single individual has complete access to the key, thereby mitigating the risk of insider threats.

Increased Security: By requiring multiple parties to combine their key parts to access encrypted material, key splitting provides an additional layer of security. This approach is particularly useful in environments where sensitive data needs to be protected from unauthorized access by insiders.

Compliance and Best Practices: Key splitting aligns with best practices and regulatory requirements for handling sensitive information, ensuring that access is tightly controlled and monitored.

The CIO needs to clarify the organization’s risk appetite, which defines the level of residual risk the business is willing to accept after all mitigation measures are applied. Risk appetite reflects the balance between operational requirements, security controls, and cost constraints. In business continuity planning, risk appetite helps decision-makers determine which risks must be reduced through additional investments (e.g., redundant systems, faster recovery strategies) and which risks are tolerable based on business priorities.

Mitigation (A) refers to the strategies used to reduce risk but not the threshold of acceptable residual risk. Impact (B) and Likelihood (C) are components of risk assessment—measuring severity and probability—but they do not define acceptance criteria. Risk appetite is the guiding principle that aligns technical controls with executive tolerance for disruption or loss.

By clarifying appetite, the CIO provides the compliance team and IT leadership with a framework for designing remediation activities that ensure continuity of critical internal processes while aligning with the organization’s strategic objectives and regulatory requirements.

The best solution to reduce the likelihood of firmware-level attacks and rootkits is to implement measured boot. Measured boot is a hardware-assisted security mechanism that leverages Trusted Platform Module (TPM) and Secure Boot processes. It records cryptographic measurements of each stage of the boot process—from firmware to operating system loaders—and stores them in the TPM. Security software, such as attestation services, can then verify that the system booted into a known, trusted state. If firmware or boot-level code has been tampered with, the measurements will not match expected values, alerting administrators to compromise.

Option A (software integrity checks) validates application-level integrity but does not address firmware rootkits that load before the operating system. Option B (self-encrypting drives) protects data at rest but does not prevent rootkits. Option D (host-based encryption) ensures confidentiality but does not detect or mitigate firmware-level persistence.

Measured boot specifically targets low-level tampering, making it the most relevant control to defend against rootkits and firmware exploits.