CompTIA CAS-005 Practice Test 12
Question 110
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Monitor rejected internal-address fetches and new egress destinations
- Filter literal metadata IP in the initial URL but allow redirects
- Verify URL redirection and metadata targets are blocked in test
- Enforce egress allowlist, metadata isolation and post-redirect destination checks
Explanation
Correct Answer
A:Monitor rejected internal-address fetches and new egress destinations identifies future loss of control, changed dependencies and exceptions affecting image conversion service. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
Question 111
In Cloud archive provider, a security issue affects cross-region object restoration: all backups replicate deletion markers instantly across both regions. The observed evidence is that restore exercise finds accidental deletes mirrored into recovery bucket. Operations must account for this constraint: contract requires 24-hour recovery-point protection. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Trace replication and deletion propagation across regional trust paths
- Enable object retention and cross-account recovery with authorized break-glass
- Use versioned immutable recovery copy independent of immediate delete replication
- Add a third synchronously mirrored bucket with identical deletion permissions
Explanation
Correct Answer
A:Trace replication and deletion propagation across regional trust paths connects the reported evidence (restore exercise finds accidental deletes mirrored into recovery bucket) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
D:Mirroring the same destructive operation does not provide isolated recovery. The immediate requirement for cross-region object restoration is evidence assessment, which this alternative does not provide.
Question 112
In Municipal transport clearinghouse, a security issue affects fare reconciliation microservices: service-to-service callbacks trust caller-supplied terminal identifiers. The observed evidence is that attack tree shows potential forged credits across message queue and API endpoints. Operations must account for this constraint: fare collection cannot be disabled during the quarterly reconciliation. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Submit forged terminal claims in test to verify rejection and preserved audit evidence
- Treat authentication at the public website as proof for internal service callbacks
- Identify forgery paths, data-flow trust boundaries and financial abuse objectives
- Enable message validation in observe-then-enforce stages with rollback criteria
Explanation
Correct Answer
A:Submit forged terminal claims in test to verify rejection and preserved audit evidence tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Web login does not authorize independent machine-to-machine claims. The immediate requirement for fare reconciliation microservices is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
Question 113
In Maritime vessel network, a security issue affects satellite beacon anomaly hunting: unusual burst traffic may be approved navigation updates or covert exfiltration. The observed evidence is that NetFlow records show long encrypted upload outside voyage schedule. Operations must account for this constraint: satellite bandwidth is safety-critical and scarce. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Hunt for anomalous destination and volume against a route-aware baseline
- Shut off all satellite connectivity when a large flow appears
- Track per-voyage anomaly trends and false suppression risk
- Validate benign chart updates and suspicious uploads in controlled vessel simulation
Explanation
Correct Answer
C:Track per-voyage anomaly trends and false suppression risk identifies future loss of control, changed dependencies and exceptions affecting satellite beacon anomaly hunting. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
B:Blunt shutdown can impair navigation and emergency communications. The immediate requirement for satellite beacon anomaly hunting is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
Question 114
In Industrial turbine manufacturer, a security issue affects supplier remote access compromise: remote support token used outside approved window to change controller parameters. The observed evidence is that VPN gateway logs and PLC event record share session identifier. Operations must account for this constraint: plant control safety requires coordinated physical operations. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Delete PLC logs to hide repeated fault alerts
- Test restored safe parameters and that unauthorized sessions are denied
- Eliminate unrestricted vendor tunnel and require brokered authorized engineering sessions
- Monitor emergency remote access and recurring unauthorized commands
Explanation
Correct Answer
D:Monitor emergency remote access and recurring unauthorized commands identifies future loss of control, changed dependencies and exceptions affecting supplier remote access compromise. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Erasing artifacts undermines investigation and cannot fix compromised access. The immediate requirement for supplier remote access compromise is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
Question 115
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Inject forged replay messages and verify dispatch ignores them
- Map message origin, command-versus-data roles and radio coverage gaps
- Trust all measurements solely because they use a private RF channel
- Stage key enrollment and signed-message acceptance on safe test segment
Explanation
Correct Answer
A:Inject forged replay messages and verify dispatch ignores them tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
C:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
Question 116
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Analyze token claims, object tenancy and cloud gateway-to-function trust
- Roll out authorized request checks with tenant canaries and rollback plan
- Enforce object-level authorization in function and least-privilege backing store access
- Apply only per-IP rate limiting to the exposed endpoint
Explanation
Correct Answer
A:Analyze token claims, object tenancy and cloud gateway-to-function trust connects the reported evidence (logs show access by valid token to another account's draft documents) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
D:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is evidence assessment, which this alternative does not provide.
Question 117
In Regional hospital, a security issue affects central log pipeline: time drift makes correlated EDR and authentication events appear reversed. The observed evidence is that endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate. Operations must account for this constraint: incident evidence must preserve original timestamps for legal review. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Normalize event time with recorded offsets while retaining original evidence
- Deploy clock correction and parser offset annotations by affected source
- Declare lateral movement simply from apparent log order
- Compare source clocks, timezones, ingest time and NTP health before causality claims
Explanation
Correct Answer
D:Compare source clocks, timezones, ingest time and NTP health before causality claims connects the reported evidence (endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
C:Uncorrected clock offset can fabricate an attack sequence. The immediate requirement for central log pipeline is evidence assessment, which this alternative does not provide.
Question 118
In Public healthcare research network, a security issue affects de-identified test data: development teams copy patient tables into test environments with unclear stewardship. The observed evidence is that file inventories show identifiers in two staging buckets while production classification differs. Operations must account for this constraint: research testing must continue without exporting patient identities. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Inspect sample test environments and retention logs for identifiers, access and secure disposal
- Measure unauthorized staging copies and overdue deletion exceptions by responsible data owner
- Assume staging data is exempt from data-governance policy
- Implement approved synthetic-data and masked-subset standards with clear data owners and lifecycle gates
Explanation
Correct Answer
B:Measure unauthorized staging copies and overdue deletion exceptions by responsible data owner identifies future loss of control, changed dependencies and exceptions affecting de-identified test data. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
C:Testing environments can expose protected information even when not customer-facing. The immediate requirement for de-identified test data is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
Question 119
In Clinical laboratory, a security issue affects obsolete analyzer integration: unsupported Windows host controls diagnostic analyzer with no vendor patch path. The observed evidence is that scan flags old SMB service exposed to general office subnet. Operations must account for this constraint: diagnostic runs cannot be interrupted for operating-system migration. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Force immediate unsupported OS upgrade on live clinical controller
- Move traffic through segregation with clinical signoff and safe rollback
- Isolate analyzer behind protocol allowlist and monitored transfer gateway
- Review restricted host use and compensating controls while replacement is planned
Explanation
Correct Answer
B:Move traffic through segregation with clinical signoff and safe rollback provides a governed means to introduce the chosen safeguard while respecting diagnostic runs cannot be interrupted for operating-system migration. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Unvalidated upgrades can disrupt calibrated medical equipment. The immediate requirement for obsolete analyzer integration is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
Question 120
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Architect redundant gateways across independent zones with health-based routing
- Deploy staggered failover and preserve critical session state under rollback controls
- Monitor zone independence, failover success and newly shared dependencies
- Add more application servers behind the same unprotected proxy
Explanation
Correct Answer
B:Deploy staggered failover and preserve critical session state under rollback controls provides a governed means to introduce the chosen safeguard while respecting patient intake must meet 15-minute recovery requirement. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is safe implementation, which this alternative does not provide.
