CompTIA CAS-005 Practice Test 14
Question 130
In Healthcare endpoint fleet, a security issue affects ransomware-resistant workstations: ordinary office process spawns PowerShell to write to a protected backup directory. The observed evidence is that EDR graph shows unsigned child process and blocked memory injection. Operations must account for this constraint: radiology scheduling must remain available during policy rollout. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Run a controlled unauthorized execution test and verify telemetry and preserved scheduling
- Pilot block mode on representative desktops with emergency application allowlist workflow
- Correlate process tree, signed binaries, host role and attempted protected writes
- Disable all PowerShell, including approved signed administration, permanently
Explanation
Correct Answer
A:Run a controlled unauthorized execution test and verify telemetry and preserved scheduling tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
D:A universal binary ban can break necessary maintenance without controlling abuse paths precisely. The immediate requirement for ransomware-resistant workstations is verified remediation, which this alternative does not provide.
Question 131
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Trace backup trust paths and estimate credible simultaneous production and backup loss
- Restore representative substation configurations in isolation and measure actual recovery time
- Roll out detached recovery credentials and immutable storage without interrupting control operations
- Purchase more snapshots under the same compromised production credentials
Explanation
Correct Answer
B:Restore representative substation configurations in isolation and measure actual recovery time tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
D:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is verified remediation, which this alternative does not provide.
Question 132
In Healthcare endpoint fleet, a security issue affects ransomware-resistant workstations: ordinary office process spawns PowerShell to write to a protected backup directory. The observed evidence is that EDR graph shows unsigned child process and blocked memory injection. Operations must account for this constraint: radiology scheduling must remain available during policy rollout. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Pilot block mode on representative desktops with emergency application allowlist workflow
- Correlate process tree, signed binaries, host role and attempted protected writes
- Use application control and EDR prevention for untrusted process chains
- Disable all PowerShell, including approved signed administration, permanently
Explanation
Correct Answer
B:Correlate process tree, signed binaries, host role and attempted protected writes connects the reported evidence (EDR graph shows unsigned child process and blocked memory injection) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
D:A universal binary ban can break necessary maintenance without controlling abuse paths precisely. The immediate requirement for ransomware-resistant workstations is evidence assessment, which this alternative does not provide.
Question 133
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Audit external collaborator changes and revoke expired authorizations
- Apply controlled restrictions and approved exception workflow before supplier migration
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
- Design export classification tags with approved jurisdiction- and identity-based access policy
Explanation
Correct Answer
B:Apply controlled restrictions and approved exception workflow before supplier migration provides a governed means to introduce the chosen safeguard while respecting supplier repair deadlines are mandatory but do not override export control. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
C:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
Question 134
In Public healthcare research network, a security issue affects de-identified test data: development teams copy patient tables into test environments with unclear stewardship. The observed evidence is that file inventories show identifiers in two staging buckets while production classification differs. Operations must account for this constraint: research testing must continue without exporting patient identities. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Measure unauthorized staging copies and overdue deletion exceptions by responsible data owner
- Implement approved synthetic-data and masked-subset standards with clear data owners and lifecycle gates
- Migrate test workloads by removing real identifiers before enabling restricted synthetic fixtures
- Assume staging data is exempt from data-governance policy
Explanation
Correct Answer
C:Migrate test workloads by removing real identifiers before enabling restricted synthetic fixtures provides a governed means to introduce the chosen safeguard while respecting research testing must continue without exporting patient identities. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
D:Testing environments can expose protected information even when not customer-facing. The immediate requirement for de-identified test data is safe implementation, which this alternative does not provide.
Question 135
In National patent office, a security issue affects digitally signed patent submissions: system stores hashes but cannot establish which inventor approved a filing. The observed evidence is that audit finds shared signing key used by several reviewers. Operations must account for this constraint: legal non-repudiation requires identity-bound approval. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Require individual certificate-backed digital signatures and timestamped approval logs
- Migrate shared signing access into per-person protected key issuance
- Use a plain hash file without signer identification as evidence of inventor assent
- Review certificate revocation and signing-audit integrity
Explanation
Correct Answer
B:Migrate shared signing access into per-person protected key issuance provides a governed means to introduce the chosen safeguard while respecting legal non-repudiation requires identity-bound approval. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
C:Hashes detect change but do not bind approval to an accountable individual. The immediate requirement for digitally signed patent submissions is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
Question 136
In International retail payment processor, a security issue affects high-volume data encryption: team proposes independent key for every field despite HSM throughput limits. The observed evidence is that latency test shows key-management calls dominate checkout path. Operations must account for this constraint: card processing cannot expose payment data to application operators. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Store the master KEK alongside the ciphertext in application configuration
- Measure key lifecycle, CPU/HSM costs and protection boundaries
- Introduce key caching within strict expiry and auditable rotation policy
- Test decrypt authorization, tamper detection and throughput at peak load
Explanation
Correct Answer
D:Test decrypt authorization, tamper detection and throughput at peak load tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Co-location of KEK collapses the intended protection boundary. The immediate requirement for high-volume data encryption is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
Question 137
In Maritime cargo operator, a security issue affects port cybersecurity procedures: terminal teams treat suggested guidance as mandatory while ignoring incident reporting standards. The observed evidence is that operators cite three inconsistent copies of the same response document. Operations must account for this constraint: ships must retain emergency communications during changeover. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Create an approved document hierarchy and clear reporting responsibility for port and vessel roles
- Publish another checklist without defining its approval authority
- Map which requirements are policy, mandatory standard, operational procedure or advisory guideline
- Review document exceptions and update owners when terminal technology or law changes
Explanation
Correct Answer
A:Create an approved document hierarchy and clear reporting responsibility for port and vessel roles is the durable measure that addresses the observed weakness: terminal teams treat suggested guidance as mandatory while ignoring incident reporting standards. It must be enforceable while preserving the stated constraint: ships must retain emergency communications during changeover.
Incorrect Answers
B:More documents do not clarify what is binding or who may waive it. The immediate requirement for port cybersecurity procedures is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
Question 138
In Medical research consortium, a security issue affects encrypted collaborative analytics: partners need aggregate genomic statistics but cannot disclose underlying records. The observed evidence is that design proposals include copying every member's raw samples to one vendor. Operations must account for this constraint: law prohibits unapproved sharing of identifiable genetics. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Determine computation and data-exposure goals and adversarial trust assumptions
- Pilot limited encrypted aggregation under legal and technical controls
- Evaluate homomorphic or secure multiparty computation with access-limited output
- Use only TLS while centrally collecting raw sensitive data
Explanation
Correct Answer
A:Determine computation and data-exposure goals and adversarial trust assumptions connects the reported evidence (design proposals include copying every member's raw samples to one vendor) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
D:Transport encryption does not eliminate disclosure to the receiving service. The immediate requirement for encrypted collaborative analytics is evidence assessment, which this alternative does not provide.
Question 139
In Municipal transport clearinghouse, a security issue affects fare reconciliation microservices: service-to-service callbacks trust caller-supplied terminal identifiers. The observed evidence is that attack tree shows potential forged credits across message queue and API endpoints. Operations must account for this constraint: fare collection cannot be disabled during the quarterly reconciliation. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Identify forgery paths, data-flow trust boundaries and financial abuse objectives
- Treat authentication at the public website as proof for internal service callbacks
- Use server-side binding of terminal identity, signed messages and reconciliation checks
- Monitor emerging API routes and recurring reconciliation exceptions
Explanation
Correct Answer
C:Use server-side binding of terminal identity, signed messages and reconciliation checks is the durable measure that addresses the observed weakness: service-to-service callbacks trust caller-supplied terminal identifiers. It must be enforceable while preserving the stated constraint: fare collection cannot be disabled during the quarterly reconciliation.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
B:Web login does not authorize independent machine-to-machine claims. The immediate requirement for fare reconciliation microservices is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
Question 140
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Monitor exception rates and regression coverage through full rollout
- Deploy canary by client cohort with feature flags and rollback thresholds
- Disable authorization globally until all customers upgrade devices
- Specify version-aware authorization contract and regression tests
Explanation
Correct Answer
B:Deploy canary by client cohort with feature flags and rollback thresholds provides a governed means to introduce the chosen safeguard while respecting checkout fraud protection cannot be removed during rollout. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
C:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
