CompTIA CAS-005 Practice Test 16
Question 150
In Public transport operator, a security issue affects station sensor telemetry: duplicate syslog forwarding inflates attack count tenfold. The observed evidence is that same event IDs appear from primary and backup collectors. Operations must account for this constraint: station security reporting must keep both resilient collectors. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Trace event IDs, forwarding paths and source integrity
- Implement reliable deduplication on stable source ID and event identifier
- Disable the backup collector to eliminate duplicate events
- Track dedupe false merging and unexpected collector route changes
Explanation
Correct Answer
B:Implement reliable deduplication on stable source ID and event identifier is the durable measure that addresses the observed weakness: duplicate syslog forwarding inflates attack count tenfold. It must be enforceable while preserving the stated constraint: station security reporting must keep both resilient collectors.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
C:Removing resilience is unnecessary when duplicates can be normalized. The immediate requirement for station sensor telemetry is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
Question 151
In Hydroelectric power authority, a security issue affects SCADA pump controllers: legacy PLC protocol has no native authentication and cannot be patched. The observed evidence is that packet captures show engineering writes from the office VLAN. Operations must account for this constraint: floodgate safety requires deterministic traffic and manual fallback. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Inventory controller command paths, supported protocols and safety impact
- Install untested endpoint antivirus directly on the PLC
- Use industrial DMZ, allowlisted engineering station and command jump server
- Introduce passive monitoring and a scheduled controlled cutover with operations
Explanation
Correct Answer
A:Inventory controller command paths, supported protocols and safety impact connects the reported evidence (packet captures show engineering writes from the office VLAN) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Unsupported software may disrupt safety control and cannot add protocol authentication. The immediate requirement for SCADA pump controllers is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves SCADA pump controllers and packet captures show engineering writes from the office VLAN.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves SCADA pump controllers and packet captures show engineering writes from the office VLAN.
Question 152
In Aviation maintenance provider, a security issue affects contractor certificate access: outsourced engineers authenticate successfully but see unrelated aircraft service logs. The observed evidence is that claims carry vendor role without aircraft assignment attribute. Operations must account for this constraint: emergency repair authorization must remain auditable. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Test contractor denial against unassigned aircraft while preserving signed repair access
- Use ABAC based on current aircraft assignment with central policy decision and enforcement
- Create an unrestricted contractor role for faster incident response
- Review stale assignments, certificate expiry and exceptional repair access
Explanation
Correct Answer
D:Review stale assignments, certificate expiry and exceptional repair access identifies future loss of control, changed dependencies and exceptions affecting contractor certificate access. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
C:Authentication does not justify organization-wide authorization. The immediate requirement for contractor certificate access is ongoing assurance, which this alternative does not provide.
Question 153
In National government identity office, a security issue affects HSM-backed signing service: private signing keys stored in software on an administrator VM. The observed evidence is that forensic artifact shows exportable key in a backup image. Operations must account for this constraint: citizen credential issuance must support rapid recovery. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Generate nonexportable keys inside FIPS-validated HSM with dual-control operations
- Encrypt a file containing the same exportable signing key using a shared password
- Trace key generation, export paths, operator privileges and signing audit
- Migrate signing under a controlled trust transition with offline root backup
Explanation
Correct Answer
C:Trace key generation, export paths, operator privileges and signing audit connects the reported evidence (forensic artifact shows exportable key in a backup image) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
B:Software encryption does not create nonexportable key custody. The immediate requirement for HSM-backed signing service is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
Question 154
In Government certificate authority, a security issue affects signing-key misuse: suspicious admin session triggers signing requests absent change ticket. The observed evidence is that HSM audit shows rapid signatures from unapproved operator credential. Operations must account for this constraint: citizen certificates must remain verifiable while compromised issuance stops. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Delete all existing certificates before determining compromise scope
- Correlate HSM requests, operator authentication and issuance ledger
- Preserve signed log chain and rotate subordinate keys under emergency CA procedure
- Verify unauthorized signing blocked and unaffected certificates validate
Explanation
Correct Answer
D:Verify unauthorized signing blocked and unaffected certificates validate tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:An indiscriminate revocation can break public services without evidence. The immediate requirement for signing-key misuse is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
Question 155
In Financial clearing service, a security issue affects long-lived TLS certificates: executives expect future quantum resilience while today's legacy clients cannot process new algorithms. The observed evidence is that inventory lists ECDH key exchange and several multi-year archives. Operations must account for this constraint: cross-bank interoperability must survive phased migration. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Measure handshake compatibility, performance and protection on approved endpoints
- Design crypto-agile negotiation and hybrid PQC evaluation for long-lived confidentiality
- Replace every cipher tomorrow with an untested PQC library
- Track algorithm deprecation and key lifetime across archive systems
Explanation
Correct Answer
D:Track algorithm deprecation and key lifetime across archive systems identifies future loss of control, changed dependencies and exceptions affecting long-lived TLS certificates. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
C:Abrupt migration can break critical protocols and unvalidated crypto creates new risk. The immediate requirement for long-lived TLS certificates is ongoing assurance, which this alternative does not provide.
Question 156
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Use continuous policy decisions bound to user, device health and patient context
- Track policy exceptions, reauthentication failures and untrusted device access
- Stage device attestation and conditional reauthentication without breaking emergency access
- Grant permanent network access after one successful VPN connection
Explanation
Correct Answer
C:Stage device attestation and conditional reauthentication without breaking emergency access provides a governed means to introduce the chosen safeguard while respecting emergency clinical work must use short-lived authorized sessions. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is safe implementation, which this alternative does not provide.
Question 157
In Public transit fare network, a security issue affects contactless validation: one central certificate service can halt all station validators on outage. The observed evidence is that recent test shows otherwise healthy validators cannot cache authorized local decisions. Operations must account for this constraint: offline tickets must expire safely and prevent duplicate redemption. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Introduce bounded signed offline entitlements with replay controls and central reconciliation
- Pilot short-lived offline authorizations in limited stations with tamper-safe fallback
- Determine authorization dependencies, offline validity and replay failure modes
- Permit unlimited local ticket acceptance when the central service fails
Explanation
Correct Answer
C:Determine authorization dependencies, offline validity and replay failure modes connects the reported evidence (recent test shows otherwise healthy validators cannot cache authorized local decisions) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
D:Unbounded offline acceptance defeats fraud and expiry controls. The immediate requirement for contactless validation is evidence assessment, which this alternative does not provide.
Question 158
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Identify which sessions lacked ephemeral key exchange and exposure window
- Roll out compatible modern TLS profiles with staged client updates
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
- Compromise test server key and confirm prior recorded sessions stay confidential
Explanation
Correct Answer
D:Compromise test server key and confirm prior recorded sessions stay confidential tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
C:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is verified remediation, which this alternative does not provide.
Question 159
In Hospital data warehouse, a security issue affects encrypted retired SSD drives: equipment disposal includes encrypted drives whose keys remain in active KMS. The observed evidence is that asset ledger shows storage encryption but no recorded key-destruction approval. Operations must account for this constraint: disposal must prove patient records are unrecoverable. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Mark the drive wiped after deleting filesystem directory pointers
- Define cryptographic erase by destroying all applicable data-encryption keys under approval
- Identify drive key hierarchy, residual replicas and regulatory retention obligations
- Audit orphaned keys and disposal exceptions across media inventory
Explanation
Correct Answer
B:Define cryptographic erase by destroying all applicable data-encryption keys under approval is the durable measure that addresses the observed weakness: equipment disposal includes encrypted drives whose keys remain in active KMS. It must be enforceable while preserving the stated constraint: disposal must prove patient records are unrecoverable.
Incorrect Answers
A:Filesystem deletion does not invalidate encryption keys or all residual data. The immediate requirement for encrypted retired SSD drives is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
Question 160
In Multinational financial group, a security issue affects remote worker SASE access: users receive full office-subnet access after VPN authentication. The observed evidence is that incident simulation shows credential theft permits database traversal. Operations must account for this constraint: remote onboarding must support unmanaged personal devices only for public apps. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Verify unmanaged device cannot reach privileged data while managed device can
- Monitor policy decisions and stale application access after job changes
- Allow all traffic from a corporate VPN address as trusted
- Use app-specific SASE access with device-aware policy and no default LAN route
Explanation
Correct Answer
B:Monitor policy decisions and stale application access after job changes identifies future loss of control, changed dependencies and exceptions affecting remote worker SASE access. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
C:IP-based location says little about subject, device and object authorization. The immediate requirement for remote worker SASE access is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
