CompTIA SecurityX (CASP+) practice questions.

A CISO is selecting a quantitative risk-assessment methodology that produces a dollar-denominated loss-distribution curve rather than a single ALE point estimate. Which methodology fits?

A government contractor must transition cryptographic systems toward quantum-resistant algorithms over the next 24 months. Which NIST-selected algorithm family is the canonical fit for key encapsulation?

A team is hardening their CI/CD pipeline against supply-chain attacks. They want a build-attestation framework that produces signed provenance per artifact. Which standard fits?

A detection engineer must prioritize patching across 5000 vulnerabilities. They want to weight by likelihood of exploitation. Which scoring system is specifically designed to predict exploitation likelihood?

An IR team needs to preserve volatile evidence on a running server before powering it down for forensic imaging. Which capture order best matches forensic best practice?

A SaaS provider is implementing zero trust per NIST SP 800-207. Which combination best describes the components of the architecture's enforcement plane?