CompTIA CAS-005 Practice Test 15
Question 140
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Monitor exception rates and regression coverage through full rollout
- Deploy canary by client cohort with feature flags and rollback thresholds
- Disable authorization globally until all customers upgrade devices
- Specify version-aware authorization contract and regression tests
Explanation
Correct Answer
B:Deploy canary by client cohort with feature flags and rollback thresholds provides a governed means to introduce the chosen safeguard while respecting checkout fraud protection cannot be removed during rollout. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
C:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
Question 141
In National logistics carrier, a security issue affects container tracking APIs: API firewall blocks legitimate carrier callbacks during bursts. The observed evidence is that packet capture identifies uneven backend queues and saturated proxy tier. Operations must account for this constraint: integrations must retain authenticated callback signatures. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Stage traffic routing and queue thresholds with controlled rollback
- Disable signature validation to improve callback throughput
- Design tiered gateways with authenticated queue isolation and autoscaling
- Track gateway health and response time by authenticated partner tier
Explanation
Correct Answer
A:Stage traffic routing and queue thresholds with controlled rollback provides a governed means to introduce the chosen safeguard while respecting integrations must retain authenticated callback signatures. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Removing authentication trades availability pressure for unauthorized service access. The immediate requirement for container tracking APIs is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
Question 142
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Design export classification tags with approved jurisdiction- and identity-based access policy
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
- Test blocked and allowed retrieval paths with auditable identities and export approvals
- Audit external collaborator changes and revoke expired authorizations
Explanation
Correct Answer
D:Audit external collaborator changes and revoke expired authorizations identifies future loss of control, changed dependencies and exceptions affecting export-controlled design vault. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
B:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
Question 143
In Regional university research, a security issue affects Linux scientific servers: untrusted notebook container escapes into host-mounted model data. The observed evidence is that audit shows container user has host filesystem write on shared NFS. Operations must account for this constraint: research experiments require GPU devices. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Use least-privileged containers, read-only mounts and mandatory access controls
- Review privileged-container exemptions and policy drift
- Reconfigure orchestration and container profiles by research group under rollback
- Give every container root privileges to simplify GPU setup
Explanation
Correct Answer
C:Reconfigure orchestration and container profiles by research group under rollback provides a governed means to introduce the chosen safeguard while respecting research experiments require GPU devices. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
D:Broad privilege enlarges escape impact and is unnecessary for scoped devices. The immediate requirement for Linux scientific servers is safe implementation, which this alternative does not provide.
Question 144
In Government certificate authority, a security issue affects signing-key misuse: suspicious admin session triggers signing requests absent change ticket. The observed evidence is that HSM audit shows rapid signatures from unapproved operator credential. Operations must account for this constraint: citizen certificates must remain verifiable while compromised issuance stops. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Delete all existing certificates before determining compromise scope
- Suspend suspect signing principal and introduce dual-control HSM policy
- Monitor new signing anomalies and certificate revocation propagation
- Correlate HSM requests, operator authentication and issuance ledger
Explanation
Correct Answer
B:Suspend suspect signing principal and introduce dual-control HSM policy is the durable measure that addresses the observed weakness: suspicious admin session triggers signing requests absent change ticket. It must be enforceable while preserving the stated constraint: citizen certificates must remain verifiable while compromised issuance stops.
Incorrect Answers
A:An indiscriminate revocation can break public services without evidence. The immediate requirement for signing-key misuse is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
Question 145
In Hydroelectric power authority, a security issue affects SCADA pump controllers: legacy PLC protocol has no native authentication and cannot be patched. The observed evidence is that packet captures show engineering writes from the office VLAN. Operations must account for this constraint: floodgate safety requires deterministic traffic and manual fallback. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Monitor unauthorized engineering commands and compensating control exceptions
- Install untested endpoint antivirus directly on the PLC
- Use industrial DMZ, allowlisted engineering station and command jump server
- Test that office VLAN cannot write to PLC and manual control stays safe
Explanation
Correct Answer
A:Monitor unauthorized engineering commands and compensating control exceptions identifies future loss of control, changed dependencies and exceptions affecting SCADA pump controllers. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Unsupported software may disrupt safety control and cannot add protocol authentication. The immediate requirement for SCADA pump controllers is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves SCADA pump controllers and packet captures show engineering writes from the office VLAN.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves SCADA pump controllers and packet captures show engineering writes from the office VLAN.
Question 146
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Share through approved TAXII trust channel and logged access controls
- Confirm IOC source, timestamps, confidence and relevant environment context
- Use STIX indicator package with confidence, classification and minimized fields
- Send raw patient records to prove the indicator is important
Explanation
Correct Answer
B:Confirm IOC source, timestamps, confidence and relevant environment context connects the reported evidence (security team has IP, domain, first-seen time and unverified actor claim) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
D:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is evidence assessment, which this alternative does not provide.
Question 147
In Financial services cloud team, a security issue affects workload identity rotation: secret rotation breaks machine authentication because deployments retain old token references. The observed evidence is that CI logs show newly issued secret exists but server still reads retired key. Operations must account for this constraint: payment reconciliation depends on hourly batch jobs. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Test a batch run on newly issued credentials and denial using retired secret
- Monitor old-secret requests and unexpected vault access after rotation
- Design versioned secret retrieval with workload identity and no hard-coded runtime keys
- Extend validity of every leaked credential indefinitely for compatibility
Explanation
Correct Answer
B:Monitor old-secret requests and unexpected vault access after rotation identifies future loss of control, changed dependencies and exceptions affecting workload identity rotation. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
D:Availability exceptions cannot justify permanent compromised secret exposure. The immediate requirement for workload identity rotation is ongoing assurance, which this alternative does not provide.
Question 148
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Add more application servers behind the same unprotected proxy
- Identify dependencies, failure domains and measured recovery objectives
- Architect redundant gateways across independent zones with health-based routing
- Monitor zone independence, failover success and newly shared dependencies
Explanation
Correct Answer
C:Architect redundant gateways across independent zones with health-based routing is the durable measure that addresses the observed weakness: single regional reverse proxy is a failure domain for emergency access. It must be enforceable while preserving the stated constraint: patient intake must meet 15-minute recovery requirement.
Incorrect Answers
A:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
Question 149
In Regional water authority, a security issue affects remote telemetry service: field concentrators trust commands from a shared regional access gateway. The observed evidence is that design review finds unauthenticated actuator message forwarding behind gateway. Operations must account for this constraint: pumping safety forbids uncontrolled test shutdown. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Verify replay and unauthorized pump-command rejection in a safe test rig
- Update threat model as new partner concentrators or radio links are introduced
- Bind signed command identity to device and operator authorization at the controller
- Assume internal placement behind a VPN is equivalent to command authorization
Explanation
Correct Answer
B:Update threat model as new partner concentrators or radio links are introduced identifies future loss of control, changed dependencies and exceptions affecting remote telemetry service. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
D:Network location does not prove message authenticity or operator privilege. The immediate requirement for remote telemetry service is ongoing assurance, which this alternative does not provide.
Question 150
In Public transport operator, a security issue affects station sensor telemetry: duplicate syslog forwarding inflates attack count tenfold. The observed evidence is that same event IDs appear from primary and backup collectors. Operations must account for this constraint: station security reporting must keep both resilient collectors. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Trace event IDs, forwarding paths and source integrity
- Implement reliable deduplication on stable source ID and event identifier
- Disable the backup collector to eliminate duplicate events
- Track dedupe false merging and unexpected collector route changes
Explanation
Correct Answer
B:Implement reliable deduplication on stable source ID and event identifier is the durable measure that addresses the observed weakness: duplicate syslog forwarding inflates attack count tenfold. It must be enforceable while preserving the stated constraint: station security reporting must keep both resilient collectors.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
C:Removing resilience is unnecessary when duplicates can be normalized. The immediate requirement for station sensor telemetry is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
