CompTIA CAS-005 Practice Test 13
Question 120
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Architect redundant gateways across independent zones with health-based routing
- Deploy staggered failover and preserve critical session state under rollback controls
- Monitor zone independence, failover success and newly shared dependencies
- Add more application servers behind the same unprotected proxy
Explanation
Correct Answer
B:Deploy staggered failover and preserve critical session state under rollback controls provides a governed means to introduce the chosen safeguard while respecting patient intake must meet 15-minute recovery requirement. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is safe implementation, which this alternative does not provide.
Question 121
In Maritime vessel network, a security issue affects satellite beacon anomaly hunting: unusual burst traffic may be approved navigation updates or covert exfiltration. The observed evidence is that NetFlow records show long encrypted upload outside voyage schedule. Operations must account for this constraint: satellite bandwidth is safety-critical and scarce. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Deploy passive flow analytics with safe exception handling for emergency calls
- Correlate upload timing, authorized package signatures and vessel mission state
- Shut off all satellite connectivity when a large flow appears
- Validate benign chart updates and suspicious uploads in controlled vessel simulation
Explanation
Correct Answer
D:Validate benign chart updates and suspicious uploads in controlled vessel simulation tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
C:Blunt shutdown can impair navigation and emergency communications. The immediate requirement for satellite beacon anomaly hunting is verified remediation, which this alternative does not provide.
Question 122
In Utility operations network, a security issue affects DNSSEC validating resolver: secure applications intermittently fail only when one signed zone updates. The observed evidence is that resolver log shows bogus signatures after stale DS record persists at parent. Operations must account for this constraint: industrial control DNS must not resolve unsigned spoofed answers. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Correct signed key rollover and parent delegation consistency
- Disable DNSSEC validation globally to eliminate SERVFAIL
- Monitor signature expiry and failed validations by zone
- Query known signed records using validating resolver to confirm authenticated answers
Explanation
Correct Answer
C:Monitor signature expiry and failed validations by zone identifies future loss of control, changed dependencies and exceptions affecting DNSSEC validating resolver. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
B:Ignoring authentication failures trades availability for cache-poisoning risk. The immediate requirement for DNSSEC validating resolver is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
Question 123
In Telemedicine edge network, a security issue affects stateful firewall and IPS: asymmetric return routing bypasses inspection and drops allowed consultation sessions. The observed evidence is that flow record shows outbound path through IPS and return via separate gateway. Operations must account for this constraint: real-time clinical calls must not be interrupted in transition. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Trace actual bidirectional paths, session state and rule ordering
- Turn off all stateful filtering to prevent call drops
- Stage route and firewall adjustments with connection-drain controls
- Test end-to-end session continuity and malicious pattern detection across failover
Explanation
Correct Answer
D:Test end-to-end session continuity and malicious pattern detection across failover tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
B:Bypassing inspection leaves lateral and perimeter threats unmanaged. The immediate requirement for stateful firewall and IPS is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
Question 124
In Financial brokerage, a security issue affects container registry provenance: cluster deploys unsigned images from a developer mirror. The observed evidence is that admission logs show digest rewriting after the approved build. Operations must account for this constraint: risk office requires a verifiable software supply chain. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Detect registry trust change and unsigned deployment attempts per namespace
- Increase node malware scans while allowing unsigned supply-chain entry
- Trace image origin, artifact digest and policy enforcement route
- Require signed immutable images with admission verification and verified SBOM provenance
Explanation
Correct Answer
D:Require signed immutable images with admission verification and verified SBOM provenance is the durable measure that addresses the observed weakness: cluster deploys unsigned images from a developer mirror. It must be enforceable while preserving the stated constraint: risk office requires a verifiable software supply chain.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
B:Runtime scans cannot prove images were authorized or unchanged before execution. The immediate requirement for container registry provenance is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
Question 125
In National logistics carrier, a security issue affects container tracking APIs: API firewall blocks legitimate carrier callbacks during bursts. The observed evidence is that packet capture identifies uneven backend queues and saturated proxy tier. Operations must account for this constraint: integrations must retain authenticated callback signatures. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Analyze throughput, queueing and proxy-placement constraints by client and service
- Design tiered gateways with authenticated queue isolation and autoscaling
- Track gateway health and response time by authenticated partner tier
- Disable signature validation to improve callback throughput
Explanation
Correct Answer
B:Design tiered gateways with authenticated queue isolation and autoscaling is the durable measure that addresses the observed weakness: API firewall blocks legitimate carrier callbacks during bursts. It must be enforceable while preserving the stated constraint: integrations must retain authenticated callback signatures.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
D:Removing authentication trades availability pressure for unauthorized service access. The immediate requirement for container tracking APIs is durable control selection, which this alternative does not provide.
Question 126
In Municipal transport clearinghouse, a security issue affects fare reconciliation microservices: service-to-service callbacks trust caller-supplied terminal identifiers. The observed evidence is that attack tree shows potential forged credits across message queue and API endpoints. Operations must account for this constraint: fare collection cannot be disabled during the quarterly reconciliation. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Monitor emerging API routes and recurring reconciliation exceptions
- Treat authentication at the public website as proof for internal service callbacks
- Enable message validation in observe-then-enforce stages with rollback criteria
- Use server-side binding of terminal identity, signed messages and reconciliation checks
Explanation
Correct Answer
C:Enable message validation in observe-then-enforce stages with rollback criteria provides a governed means to introduce the chosen safeguard while respecting fare collection cannot be disabled during the quarterly reconciliation. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
B:Web login does not authorize independent machine-to-machine claims. The immediate requirement for fare reconciliation microservices is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
Question 127
In Regional hospital, a security issue affects central log pipeline: time drift makes correlated EDR and authentication events appear reversed. The observed evidence is that endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate. Operations must account for this constraint: incident evidence must preserve original timestamps for legal review. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Replay a known sequence and confirm causality reconstructed correctly
- Monitor time synchronization drift and cross-source correlation confidence
- Normalize event time with recorded offsets while retaining original evidence
- Declare lateral movement simply from apparent log order
Explanation
Correct Answer
B:Monitor time synchronization drift and cross-source correlation confidence identifies future loss of control, changed dependencies and exceptions affecting central log pipeline. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
D:Uncorrected clock offset can fabricate an attack sequence. The immediate requirement for central log pipeline is ongoing assurance, which this alternative does not provide.
Question 128
In Maritime vessel network, a security issue affects satellite beacon anomaly hunting: unusual burst traffic may be approved navigation updates or covert exfiltration. The observed evidence is that NetFlow records show long encrypted upload outside voyage schedule. Operations must account for this constraint: satellite bandwidth is safety-critical and scarce. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Hunt for anomalous destination and volume against a route-aware baseline
- Shut off all satellite connectivity when a large flow appears
- Deploy passive flow analytics with safe exception handling for emergency calls
- Track per-voyage anomaly trends and false suppression risk
Explanation
Correct Answer
C:Deploy passive flow analytics with safe exception handling for emergency calls provides a governed means to introduce the chosen safeguard while respecting satellite bandwidth is safety-critical and scarce. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
B:Blunt shutdown can impair navigation and emergency communications. The immediate requirement for satellite beacon anomaly hunting is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
Question 129
In Public transit payment system, a security issue affects secure enclave fare-key handling: terminal tamper event does not revoke stored cryptographic material. The observed evidence is that controller telemetry shows case-open sensor but fare secrets remain active. Operations must account for this constraint: stations must support safe passenger exit during tamper response. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Add a loud case-open alarm but leave fare signing keys usable
- Review tamper alerts, key-rotation exceptions and device retirement proofs
- Use tamper-responsive secure element with zeroization and audited key lifecycle
- Trace sensor path, key-custody boundary and secure erase trigger
Explanation
Correct Answer
C:Use tamper-responsive secure element with zeroization and audited key lifecycle is the durable measure that addresses the observed weakness: terminal tamper event does not revoke stored cryptographic material. It must be enforceable while preserving the stated constraint: stations must support safe passenger exit during tamper response.
Incorrect Answers
A:Detection without secret invalidation leaves a compromised terminal functional. The immediate requirement for secure enclave fare-key handling is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
Question 130
In Healthcare endpoint fleet, a security issue affects ransomware-resistant workstations: ordinary office process spawns PowerShell to write to a protected backup directory. The observed evidence is that EDR graph shows unsigned child process and blocked memory injection. Operations must account for this constraint: radiology scheduling must remain available during policy rollout. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Run a controlled unauthorized execution test and verify telemetry and preserved scheduling
- Pilot block mode on representative desktops with emergency application allowlist workflow
- Correlate process tree, signed binaries, host role and attempted protected writes
- Disable all PowerShell, including approved signed administration, permanently
Explanation
Correct Answer
A:Run a controlled unauthorized execution test and verify telemetry and preserved scheduling tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
D:A universal binary ban can break necessary maintenance without controlling abuse paths precisely. The immediate requirement for ransomware-resistant workstations is verified remediation, which this alternative does not provide.
