CompTIA CAS-005 Practice Test 11
Question 100
In Multinational financial group, a security issue affects remote worker SASE access: users receive full office-subnet access after VPN authentication. The observed evidence is that incident simulation shows credential theft permits database traversal. Operations must account for this constraint: remote onboarding must support unmanaged personal devices only for public apps. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Use app-specific SASE access with device-aware policy and no default LAN route
- Migrate public and privileged applications through isolated policy rings
- Allow all traffic from a corporate VPN address as trusted
- Monitor policy decisions and stale application access after job changes
Explanation
Correct Answer
B:Migrate public and privileged applications through isolated policy rings provides a governed means to introduce the chosen safeguard while respecting remote onboarding must support unmanaged personal devices only for public apps. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
C:IP-based location says little about subject, device and object authorization. The immediate requirement for remote worker SASE access is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
Question 101
In Healthcare AI documentation service, a security issue affects clinical note summarizer: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. The observed evidence is that red-team canary text in reference document triggers an unauthorized export suggestion. Operations must account for this constraint: clinical editing must remain available without third-party data disclosure. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Rely on a system prompt saying never disclose patient data as the sole protection
- Trace retrieval-to-tool trust boundary and identify untrusted document instructions
- Deploy prompt guardrails with approval for high-risk tool calls and rollback-safe logging
- Inject controlled malicious note text to verify the assistant cannot export records
Explanation
Correct Answer
D:Inject controlled malicious note text to verify the assistant cannot export records tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Natural-language guidance cannot reliably enforce external tool authorization. The immediate requirement for clinical note summarizer is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
Question 102
In National government identity office, a security issue affects HSM-backed signing service: private signing keys stored in software on an administrator VM. The observed evidence is that forensic artifact shows exportable key in a backup image. Operations must account for this constraint: citizen credential issuance must support rapid recovery. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Encrypt a file containing the same exportable signing key using a shared password
- Generate nonexportable keys inside FIPS-validated HSM with dual-control operations
- Review HSM role changes, key rotation and recovery ceremony evidence
- Trace key generation, export paths, operator privileges and signing audit
Explanation
Correct Answer
B:Generate nonexportable keys inside FIPS-validated HSM with dual-control operations is the durable measure that addresses the observed weakness: private signing keys stored in software on an administrator VM. It must be enforceable while preserving the stated constraint: citizen credential issuance must support rapid recovery.
Incorrect Answers
A:Software encryption does not create nonexportable key custody. The immediate requirement for HSM-backed signing service is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
Question 103
In Financial brokerage, a security issue affects container registry provenance: cluster deploys unsigned images from a developer mirror. The observed evidence is that admission logs show digest rewriting after the approved build. Operations must account for this constraint: risk office requires a verifiable software supply chain. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Increase node malware scans while allowing unsigned supply-chain entry
- Enforce admission deny in monitored canary namespaces before rollout
- Require signed immutable images with admission verification and verified SBOM provenance
- Detect registry trust change and unsigned deployment attempts per namespace
Explanation
Correct Answer
B:Enforce admission deny in monitored canary namespaces before rollout provides a governed means to introduce the chosen safeguard while respecting risk office requires a verifiable software supply chain. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Runtime scans cannot prove images were authorized or unchanged before execution. The immediate requirement for container registry provenance is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
Question 104
In International charity, a security issue affects confidential donation analytics: organization needs public totals but transaction identifiers must not be reversible. The observed evidence is that proposal hashes low-entropy donor IDs without secret and publishes them. Operations must account for this constraint: donor privacy commitments prohibit individual tracking. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Evaluate reidentification risk and identifier entropy of planned release
- Test linkage attacks and sampling to verify identities cannot be recovered
- Pilot publication of aggregate statistics following disclosure review
- Publish raw SHA-256 hashes of predictable donor identifiers
Explanation
Correct Answer
B:Test linkage attacks and sampling to verify identities cannot be recovered tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
D:Hashing guessable IDs does not ensure anonymity against dictionary attacks. The immediate requirement for confidential donation analytics is verified remediation, which this alternative does not provide.
Question 105
In International charity, a security issue affects confidential donation analytics: organization needs public totals but transaction identifiers must not be reversible. The observed evidence is that proposal hashes low-entropy donor IDs without secret and publishes them. Operations must account for this constraint: donor privacy commitments prohibit individual tracking. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Monitor data-release combinations and reidentification complaints
- Evaluate reidentification risk and identifier entropy of planned release
- Use aggregation and irreversible privacy-preserving tokenization with access controls
- Publish raw SHA-256 hashes of predictable donor identifiers
Explanation
Correct Answer
C:Use aggregation and irreversible privacy-preserving tokenization with access controls is the durable measure that addresses the observed weakness: organization needs public totals but transaction identifiers must not be reversible. It must be enforceable while preserving the stated constraint: donor privacy commitments prohibit individual tracking.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
D:Hashing guessable IDs does not ensure anonymity against dictionary attacks. The immediate requirement for confidential donation analytics is durable control selection, which this alternative does not provide.
Question 106
In Insurance payment gateway, a security issue affects third-party software component: vendor library update introduces a vulnerable parser with transitive dependencies. The observed evidence is that build manifest references unsigned artifact outside the approved package registry. Operations must account for this constraint: release pipeline must preserve traceable supplier integrity. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Rely only on a successful dynamic penetration scan of the interface
- Require SBOM, signed provenance and SCA policy gates before release
- Rebuild a test artifact and verify vulnerable dependencies are rejected
- Continuously compare deployed SBOMs with new advisories and patch ownership
Explanation
Correct Answer
D:Continuously compare deployed SBOMs with new advisories and patch ownership identifies future loss of control, changed dependencies and exceptions affecting third-party software component. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A scan may miss vulnerable transitive code and cannot prove provenance. The immediate requirement for third-party software component is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
Question 107
In International airport operator, a security issue affects baggage conveyor controls: vendor remote support shares an always-on cellular modem into operational network. The observed evidence is that network diagram lists modem outside airport change and asset inventory. Operations must account for this constraint: conveyor recovery must remain available in urgent incidents. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Map remote support path, vendor identity and reachable control endpoints
- Replace persistent cellular connection with approved on-demand jump access
- Use brokered time-bound remote access through industrial DMZ with session recording
- Disable all vendor support permanently without an emergency operational route
Explanation
Correct Answer
A:Map remote support path, vendor identity and reachable control endpoints connects the reported evidence (network diagram lists modem outside airport change and asset inventory) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
D:Availability and safety still need controlled emergency maintenance. The immediate requirement for baggage conveyor controls is evidence assessment, which this alternative does not provide.
Question 108
In Municipal emergency dispatch, a security issue affects network sensor visibility: central dashboard reports green though one dispatch VLAN has no network tap. The observed evidence is that port mirror audit shows sensor attached only to office VLAN. Operations must account for this constraint: emergency-radio traffic requires nonintrusive collection. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Generate known test connection and confirm matching source, destination and timing
- Introduce mirrored feeds and validate capture authorization with operations
- Increase IDS signatures on the office segment
- Inventory protected paths, missing VLANs and sensor placement evidence
Explanation
Correct Answer
A:Generate known test connection and confirm matching source, destination and timing tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
C:Signatures cannot inspect traffic that never reaches the sensor. The immediate requirement for network sensor visibility is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
Question 109
In Financial clearing service, a security issue affects long-lived TLS certificates: executives expect future quantum resilience while today's legacy clients cannot process new algorithms. The observed evidence is that inventory lists ECDH key exchange and several multi-year archives. Operations must account for this constraint: cross-bank interoperability must survive phased migration. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Inventory cryptographic usage, data lifetime and quantum migration risks
- Design crypto-agile negotiation and hybrid PQC evaluation for long-lived confidentiality
- Pilot supported hybrid cryptography on noncritical links with rollback and interoperability tests
- Replace every cipher tomorrow with an untested PQC library
Explanation
Correct Answer
A:Inventory cryptographic usage, data lifetime and quantum migration risks connects the reported evidence (inventory lists ECDH key exchange and several multi-year archives) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
D:Abrupt migration can break critical protocols and unvalidated crypto creates new risk. The immediate requirement for long-lived TLS certificates is evidence assessment, which this alternative does not provide.
Question 110
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Monitor rejected internal-address fetches and new egress destinations
- Filter literal metadata IP in the initial URL but allow redirects
- Verify URL redirection and metadata targets are blocked in test
- Enforce egress allowlist, metadata isolation and post-redirect destination checks
Explanation
Correct Answer
A:Monitor rejected internal-address fetches and new egress destinations identifies future loss of control, changed dependencies and exceptions affecting image conversion service. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
