CAS-005 Exam Dumps : CompTIA SecurityX Certification Exam

The best solution is to implement authentication for API requests and apply appropriate rate limiting (C). Authentication ensures that only authorized customers or systems can access the API, while rate limiting helps prevent denial-of-service (DoS)-like conditions and cost inflation from excessive or malicious requests. This addresses both the security (unauthorized access) and cost issues (serverless billing based on execution).

Option A (digital certificates) is a strong control for authentication but may introduce unnecessary complexity and does not address rate abuse directly. Option B (rate limits with IP reputation checks) is useful but insufficient—malicious actors may rotate through new IPs not yet flagged. Option D (regional restrictions) might reduce some noise traffic but risks blocking legitimate global users and is not scalable for a modern cloud service.

CAS-005 highlights securing APIs with authentication, authorization, and throttling as best practices. Thus, the combined approach of API authentication plus rate limiting is the most comprehensive and effective solution.

A crisis management plan defines coordinated communication and response strategies for high-profile incidents that may harm an organization’s public reputation and shareholder confidence. CAS-005 GRC content includes crisis communication planning for regulatory compliance and public relations in the wake of breaches.

A Data Subject Access Request (A) addresses individual data rights, not overall crisis handling.

Business Impact Analysis (B) helps assess potential operational and financial impacts but does not manage public perception during an incident.

Supply chain management (C) is preventative for vendor risks, not responsive to current crises.

A. Implementing allow lists: Allow lists (whitelisting) restrict network communication to only authorized devices and applications, significantly reducing the attack surface by ensuring that only pre-approved traffic is permitted.

F. Implementing a site-to-site IPSec VPN: A site-to-site VPN provides a secure, encrypted tunnel for data transmission between the OT systems and the vendor, protecting the data from interception and tampering during transit.

Other options:

B. Monitoring network behavior: While useful for detecting anomalies, it does not proactively reduce the risk of compromise or sabotage.

C. Encrypting data at rest: Important for protecting data stored on devices, but does not address network communication risks.

D. Performing boot integrity checks: Ensures the integrity of the system at startup but does not protect ongoing network communications.

E. Executing daily health checks: Useful for maintaining system health but does not directly reduce the risk of network-based compromise or sabotage.