CompTIA CAS-005 Practice Test 1
Question 1
In Medical research consortium, a security issue affects encrypted collaborative analytics: partners need aggregate genomic statistics but cannot disclose underlying records. The observed evidence is that design proposals include copying every member's raw samples to one vendor. Operations must account for this constraint: law prohibits unapproved sharing of identifiable genetics. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Determine computation and data-exposure goals and adversarial trust assumptions
- Pilot limited encrypted aggregation under legal and technical controls
- Compare aggregate accuracy, leakage resistance and runtime on approved data
- Use only TLS while centrally collecting raw sensitive data
Explanation
Correct Answer
C:Compare aggregate accuracy, leakage resistance and runtime on approved data tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
D:Transport encryption does not eliminate disclosure to the receiving service. The immediate requirement for encrypted collaborative analytics is verified remediation, which this alternative does not provide.
Question 2
In International retail payment processor, a security issue affects high-volume data encryption: team proposes independent key for every field despite HSM throughput limits. The observed evidence is that latency test shows key-management calls dominate checkout path. Operations must account for this constraint: card processing cannot expose payment data to application operators. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Store the master KEK alongside the ciphertext in application configuration
- Use envelope encryption with DEKs wrapped by protected KEKs and AEAD metadata
- Measure key lifecycle, CPU/HSM costs and protection boundaries
- Track wrap-key access, rotation and ciphertext integrity failures
Explanation
Correct Answer
B:Use envelope encryption with DEKs wrapped by protected KEKs and AEAD metadata is the durable measure that addresses the observed weakness: team proposes independent key for every field despite HSM throughput limits. It must be enforceable while preserving the stated constraint: card processing cannot expose payment data to application operators.
Incorrect Answers
A:Co-location of KEK collapses the intended protection boundary. The immediate requirement for high-volume data encryption is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
Question 3
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Monitor rejected internal-address fetches and new egress destinations
- Enforce egress allowlist, metadata isolation and post-redirect destination checks
- Trace user-controlled URL resolution, redirects and egress privileges
- Filter literal metadata IP in the initial URL but allow redirects
Explanation
Correct Answer
B:Enforce egress allowlist, metadata isolation and post-redirect destination checks is the durable measure that addresses the observed weakness: URL fetcher can request instance metadata endpoint on private network. It must be enforceable while preserving the stated constraint: image conversion needs only authorized external media hosts.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is durable control selection, which this alternative does not provide.
Question 4
In Industrial manufacturing group, a security issue affects factory edge applications: east-west traffic bypasses inline inspection due to missing sensor placement. The observed evidence is that traffic maps show undetected production-to-office flows on a flat segment. Operations must account for this constraint: robotics control traffic cannot tolerate inline latency spikes. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Insert an inline IPS into every deterministic robot-control link
- Place passive taps at boundary and selective enforcement on non-real-time interfaces
- Install monitoring incrementally under plant change windows
- Capture required plant flows and nonintrusive sensor vantage points
Explanation
Correct Answer
D:Capture required plant flows and nonintrusive sensor vantage points connects the reported evidence (traffic maps show undetected production-to-office flows on a flat segment) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Aggressive in-path inspection can endanger real-time industrial availability. The immediate requirement for factory edge applications is evidence assessment, which this alternative does not provide.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
Question 5
In Energy grid market operator, a security issue affects interconnect service mesh: trusted east-west traffic carries control requests beyond the caller's market function. The observed evidence is that service telemetry shows a reporting workload invoking command endpoints. Operations must account for this constraint: latency budgets limit heavyweight security proxies on plant links. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Hide the entire mesh behind a perimeter firewall and allow internal calls
- Map service identities, target operations and exact data-flow security boundaries
- Phase service-policy rollout with observed flows and fail-safe control paths
- Use mutual workload identities and per-operation policy at a service enforcement point
Explanation
Correct Answer
B:Map service identities, target operations and exact data-flow security boundaries connects the reported evidence (service telemetry shows a reporting workload invoking command endpoints) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Outer perimeter trust cannot restrict lateral service-to-service privileges. The immediate requirement for interconnect service mesh is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
Question 6
In Financial brokerage, a security issue affects container registry provenance: cluster deploys unsigned images from a developer mirror. The observed evidence is that admission logs show digest rewriting after the approved build. Operations must account for this constraint: risk office requires a verifiable software supply chain. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Try unsigned and digest-swapped images and verify rejection by policy
- Increase node malware scans while allowing unsigned supply-chain entry
- Require signed immutable images with admission verification and verified SBOM provenance
- Detect registry trust change and unsigned deployment attempts per namespace
Explanation
Correct Answer
D:Detect registry trust change and unsigned deployment attempts per namespace identifies future loss of control, changed dependencies and exceptions affecting container registry provenance. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
B:Runtime scans cannot prove images were authorized or unchanged before execution. The immediate requirement for container registry provenance is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
Question 7
In Global retail chain, a security issue affects mobile point-of-sale endpoints: lost devices retain local cached payment support credentials. The observed evidence is that MDM inventory shows unencrypted cache and delayed wipe acknowledgment. Operations must account for this constraint: stores must process legitimate transactions offline for short periods. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Use hardware-backed encryption and short-lived offline transaction entitlements
- Treat a screen lock as sufficient protection for permanently cached secrets
- Monitor unmanaged devices, stale offline grants and wipe confirmation
- Trace device custody, credential expiry, local cache and synchronization states
Explanation
Correct Answer
A:Use hardware-backed encryption and short-lived offline transaction entitlements is the durable measure that addresses the observed weakness: lost devices retain local cached payment support credentials. It must be enforceable while preserving the stated constraint: stores must process legitimate transactions offline for short periods.
Incorrect Answers
B:UI locking alone cannot protect offline credentials against device extraction. The immediate requirement for mobile point-of-sale endpoints is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
Question 8
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Design isolated immutable backup copies with separate recovery identity and tested recovery objectives
- Roll out detached recovery credentials and immutable storage without interrupting control operations
- Purchase more snapshots under the same compromised production credentials
- Trace backup trust paths and estimate credible simultaneous production and backup loss
Explanation
Correct Answer
D:Trace backup trust paths and estimate credible simultaneous production and backup loss connects the reported evidence (restore exercise finds cloud snapshots accessible from compromised domain admin session) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
C:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is evidence assessment, which this alternative does not provide.
Question 9
In Utility operations network, a security issue affects DNSSEC validating resolver: secure applications intermittently fail only when one signed zone updates. The observed evidence is that resolver log shows bogus signatures after stale DS record persists at parent. Operations must account for this constraint: industrial control DNS must not resolve unsigned spoofed answers. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Query known signed records using validating resolver to confirm authenticated answers
- Coordinate zone key and registrar DS change in ordered rollout with rollback
- Disable DNSSEC validation globally to eliminate SERVFAIL
- Compare DNSKEY, DS, signature inception and resolver failure path
Explanation
Correct Answer
A:Query known signed records using validating resolver to confirm authenticated answers tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
C:Ignoring authentication failures trades availability for cache-poisoning risk. The immediate requirement for DNSSEC validating resolver is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
Question 10
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Quarantine divergent replicas while staging a verified master restore under change control
- Declare every readable file valid because its storage device is online
- Trace integrity roots, replica independence and the first verified divergence
- Compare cryptographic hashes of restored sample objects with authenticated baseline manifests
Explanation
Correct Answer
D:Compare cryptographic hashes of restored sample objects with authenticated baseline manifests tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
B:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
