CompTIA CAS-005 Practice Test 10
Question 90
In International retail group, a security issue affects security program governance: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. The observed evidence is that audit finds one reseller exception kept open after its contract expired. Operations must account for this constraint: acquired subsidiaries must preserve local lawful approvals. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Inventory controls, obligations, exception records and overlapping legal entities
- Migrate active exceptions after validating origin, local authority and reversible mapping
- Implement a central GRC evidence map with approved local ownership and common expiry controls
- Import all spreadsheet values as approved exceptions without provenance
Explanation
Correct Answer
A:Inventory controls, obligations, exception records and overlapping legal entities connects the reported evidence (audit finds one reseller exception kept open after its contract expired) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
D:Migration cannot confer acceptance authority absent from the original decision. The immediate requirement for security program governance is evidence assessment, which this alternative does not provide.
Question 91
In Multinational financial group, a security issue affects remote worker SASE access: users receive full office-subnet access after VPN authentication. The observed evidence is that incident simulation shows credential theft permits database traversal. Operations must account for this constraint: remote onboarding must support unmanaged personal devices only for public apps. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Map identities, device posture, application sensitivity and access intersections
- Monitor policy decisions and stale application access after job changes
- Use app-specific SASE access with device-aware policy and no default LAN route
- Allow all traffic from a corporate VPN address as trusted
Explanation
Correct Answer
C:Use app-specific SASE access with device-aware policy and no default LAN route is the durable measure that addresses the observed weakness: users receive full office-subnet access after VPN authentication. It must be enforceable while preserving the stated constraint: remote onboarding must support unmanaged personal devices only for public apps.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
D:IP-based location says little about subject, device and object authorization. The immediate requirement for remote worker SASE access is durable control selection, which this alternative does not provide.
Question 92
In Energy trading consortium, a security issue affects internal price feed: vendor feed traverses shared office network without data labels or DLP. The observed evidence is that egress inventory finds regulated trading events copied to unmanaged collaboration service. Operations must account for this constraint: latency-sensitive pricing cannot rely on blanket upload blocking. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Pilot sensitive-data policy with alert-only tuning then enforcement
- Classify price feed paths and map data owners, labels and egress flows
- Install a second WAF on the public landing page only
- Test approved feed delivery and unauthorized bulk export with representative labels
Explanation
Correct Answer
D:Test approved feed delivery and unauthorized bulk export with representative labels tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
C:A web edge control does not govern internal confidential data exports. The immediate requirement for internal price feed is verified remediation, which this alternative does not provide.
Question 93
In Aviation maintenance provider, a security issue affects contractor certificate access: outsourced engineers authenticate successfully but see unrelated aircraft service logs. The observed evidence is that claims carry vendor role without aircraft assignment attribute. Operations must account for this constraint: emergency repair authorization must remain auditable. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Use ABAC based on current aircraft assignment with central policy decision and enforcement
- Deploy certificate-bound conditional access and time-limited assignment grants
- Review stale assignments, certificate expiry and exceptional repair access
- Create an unrestricted contractor role for faster incident response
Explanation
Correct Answer
B:Deploy certificate-bound conditional access and time-limited assignment grants provides a governed means to introduce the chosen safeguard while respecting emergency repair authorization must remain auditable. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
D:Authentication does not justify organization-wide authorization. The immediate requirement for contractor certificate access is safe implementation, which this alternative does not provide.
Question 94
In Municipal emergency dispatch, a security issue affects network sensor visibility: central dashboard reports green though one dispatch VLAN has no network tap. The observed evidence is that port mirror audit shows sensor attached only to office VLAN. Operations must account for this constraint: emergency-radio traffic requires nonintrusive collection. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Introduce mirrored feeds and validate capture authorization with operations
- Increase IDS signatures on the office segment
- Deploy passive network taps for dispatch segment without inline control
- Alert on sensor silence and changes in mirror-port configuration
Explanation
Correct Answer
A:Introduce mirrored feeds and validate capture authorization with operations provides a governed means to introduce the chosen safeguard while respecting emergency-radio traffic requires nonintrusive collection. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Signatures cannot inspect traffic that never reaches the sensor. The immediate requirement for network sensor visibility is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
Question 95
In Public transport operator, a security issue affects station sensor telemetry: duplicate syslog forwarding inflates attack count tenfold. The observed evidence is that same event IDs appear from primary and backup collectors. Operations must account for this constraint: station security reporting must keep both resilient collectors. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Implement reliable deduplication on stable source ID and event identifier
- Trace event IDs, forwarding paths and source integrity
- Enable dedupe pipeline with preserved raw evidence and reversible transforms
- Disable the backup collector to eliminate duplicate events
Explanation
Correct Answer
B:Trace event IDs, forwarding paths and source integrity connects the reported evidence (same event IDs appear from primary and backup collectors) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
D:Removing resilience is unnecessary when duplicates can be normalized. The immediate requirement for station sensor telemetry is evidence assessment, which this alternative does not provide.
Question 96
In Global shipping company, a security issue affects laptop measured boot: stolen field laptops may boot malicious firmware and bypass disk trust. The observed evidence is that TPM measurements differ from approved boot baseline on one returned device. Operations must account for this constraint: offline vessel operation needs local disk availability. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Try unauthorized firmware change and verify secret unseal refusal and recovery path
- Monitor measured-boot anomalies and approved firmware updates
- Bind disk release to Secure Boot and TPM measured-boot policy
- Require only a BIOS setup password while leaving boot-chain trust unchecked
Explanation
Correct Answer
B:Monitor measured-boot anomalies and approved firmware updates identifies future loss of control, changed dependencies and exceptions affecting laptop measured boot. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
D:A setup password does not attest runtime boot components. The immediate requirement for laptop measured boot is ongoing assurance, which this alternative does not provide.
Question 97
In Cloud healthcare startup, a security issue affects IaC security baselines: new test accounts repeatedly expose storage buckets to public network. The observed evidence is that Terraform diff shows unrestricted policy reintroduced by shared module. Operations must account for this constraint: developers need safe self-service environments. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Trace inherited module outputs and drift origin from deployment records
- Encode least-privilege baseline and policy-as-code checks into approved module
- Only run a monthly manual cloud console review
- Monitor drift signals and policy exceptions on each merge
Explanation
Correct Answer
B:Encode least-privilege baseline and policy-as-code checks into approved module is the durable measure that addresses the observed weakness: new test accounts repeatedly expose storage buckets to public network. It must be enforceable while preserving the stated constraint: developers need safe self-service environments.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
C:A delayed scan permits new insecure deployments between audits. The immediate requirement for IaC security baselines is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
Question 98
In Municipal emergency dispatch, a security issue affects network sensor visibility: central dashboard reports green though one dispatch VLAN has no network tap. The observed evidence is that port mirror audit shows sensor attached only to office VLAN. Operations must account for this constraint: emergency-radio traffic requires nonintrusive collection. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Deploy passive network taps for dispatch segment without inline control
- Increase IDS signatures on the office segment
- Inventory protected paths, missing VLANs and sensor placement evidence
- Introduce mirrored feeds and validate capture authorization with operations
Explanation
Correct Answer
C:Inventory protected paths, missing VLANs and sensor placement evidence connects the reported evidence (port mirror audit shows sensor attached only to office VLAN) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
B:Signatures cannot inspect traffic that never reaches the sensor. The immediate requirement for network sensor visibility is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
Question 99
In University student portal, a security issue affects session authorization API: logged-in users can change course ID to view another student's grades. The observed evidence is that two test accounts demonstrate data access after swapping object identifier. Operations must account for this constraint: grading deadline prohibits large service outage. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Enforce per-object ownership check on every grade request
- Use stronger user passwords but no object ownership enforcement
- Track denied cross-student requests and owner mapping exceptions
- Trace subject-to-object authorization at API and data layer
Explanation
Correct Answer
A:Enforce per-object ownership check on every grade request is the durable measure that addresses the observed weakness: logged-in users can change course ID to view another student's grades. It must be enforceable while preserving the stated constraint: grading deadline prohibits large service outage.
Incorrect Answers
B:Authentication strength does not stop an authenticated cross-user IDOR. The immediate requirement for session authorization API is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
Question 100
In Multinational financial group, a security issue affects remote worker SASE access: users receive full office-subnet access after VPN authentication. The observed evidence is that incident simulation shows credential theft permits database traversal. Operations must account for this constraint: remote onboarding must support unmanaged personal devices only for public apps. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Use app-specific SASE access with device-aware policy and no default LAN route
- Migrate public and privileged applications through isolated policy rings
- Allow all traffic from a corporate VPN address as trusted
- Monitor policy decisions and stale application access after job changes
Explanation
Correct Answer
B:Migrate public and privileged applications through isolated policy rings provides a governed means to introduce the chosen safeguard while respecting remote onboarding must support unmanaged personal devices only for public apps. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
C:IP-based location says little about subject, device and object authorization. The immediate requirement for remote worker SASE access is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
