CompTIA CAS-005 Practice Test 17
Question 160
In Multinational financial group, a security issue affects remote worker SASE access: users receive full office-subnet access after VPN authentication. The observed evidence is that incident simulation shows credential theft permits database traversal. Operations must account for this constraint: remote onboarding must support unmanaged personal devices only for public apps. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Verify unmanaged device cannot reach privileged data while managed device can
- Monitor policy decisions and stale application access after job changes
- Allow all traffic from a corporate VPN address as trusted
- Use app-specific SASE access with device-aware policy and no default LAN route
Explanation
Correct Answer
B:Monitor policy decisions and stale application access after job changes identifies future loss of control, changed dependencies and exceptions affecting remote worker SASE access. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
C:IP-based location says little about subject, device and object authorization. The immediate requirement for remote worker SASE access is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves remote worker SASE access and incident simulation shows credential theft permits database traversal.
Question 161
In Global investment firm, a security issue affects multi-cloud audit collectors: temporary cloud role permits unrestricted key export across accounts. The observed evidence is that cloud inventory reveals one vendor automation identity with broad key permissions. Operations must account for this constraint: regulatory retention demands immutable logs. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Put all cloud keys in the vendor's shared administrative account
- Roll out per-account trust restrictions and rotate exposed vendor credentials
- Alert on changes to role trust and anomalous key-access approvals
- Use workload federation with least-privilege key operations and customer-controlled KMS policies
Explanation
Correct Answer
B:Roll out per-account trust restrictions and rotate exposed vendor credentials provides a governed means to introduce the chosen safeguard while respecting regulatory retention demands immutable logs. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Shared high-privilege custody increases cross-tenant compromise impact. The immediate requirement for multi-cloud audit collectors is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
Question 162
In Public health laboratory, a security issue affects federated staff identity: SAML assertions from regional provider omit audience restrictions. The observed evidence is that test user logs in to the wrong relying party with valid generic assertion. Operations must account for this constraint: diagnostic labs require interagency SSO. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Track anomalous relying-party usage and expired federation certificates
- Inspect issuer, audience, recipient, signature validation and trust metadata
- Accept any correctly signed SAML token regardless of intended audience
- Bind assertions to designated relying party and trusted issuer with least-privilege roles
Explanation
Correct Answer
D:Bind assertions to designated relying party and trusted issuer with least-privilege roles is the durable measure that addresses the observed weakness: SAML assertions from regional provider omit audience restrictions. It must be enforceable while preserving the stated constraint: diagnostic labs require interagency SSO.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
C:Signature alone does not prove the assertion was issued for this service. The immediate requirement for federated staff identity is durable control selection, which this alternative does not provide.
Question 163
In Maritime cargo operator, a security issue affects port cybersecurity procedures: terminal teams treat suggested guidance as mandatory while ignoring incident reporting standards. The observed evidence is that operators cite three inconsistent copies of the same response document. Operations must account for this constraint: ships must retain emergency communications during changeover. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Publish another checklist without defining its approval authority
- Create an approved document hierarchy and clear reporting responsibility for port and vessel roles
- Transition documents by critical-port phase with accountable acknowledgments and emergency fallback
- Map which requirements are policy, mandatory standard, operational procedure or advisory guideline
Explanation
Correct Answer
D:Map which requirements are policy, mandatory standard, operational procedure or advisory guideline connects the reported evidence (operators cite three inconsistent copies of the same response document) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:More documents do not clarify what is binding or who may waive it. The immediate requirement for port cybersecurity procedures is evidence assessment, which this alternative does not provide.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
Question 164
In Telemedicine edge network, a security issue affects stateful firewall and IPS: asymmetric return routing bypasses inspection and drops allowed consultation sessions. The observed evidence is that flow record shows outbound path through IPS and return via separate gateway. Operations must account for this constraint: real-time clinical calls must not be interrupted in transition. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Turn off all stateful filtering to prevent call drops
- Monitor asymmetric paths, reset spikes and IPS policy drift
- Trace actual bidirectional paths, session state and rule ordering
- Design symmetric routing through inspection with appropriate HA state synchronization
Explanation
Correct Answer
D:Design symmetric routing through inspection with appropriate HA state synchronization is the durable measure that addresses the observed weakness: asymmetric return routing bypasses inspection and drops allowed consultation sessions. It must be enforceable while preserving the stated constraint: real-time clinical calls must not be interrupted in transition.
Incorrect Answers
A:Bypassing inspection leaves lateral and perimeter threats unmanaged. The immediate requirement for stateful firewall and IPS is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
Question 165
In Municipal citizen portal, a security issue affects build promotion approvals: developers can bypass production review by merging to an unprotected branch. The observed evidence is that pipeline audit shows direct deployment from a personal token. Operations must account for this constraint: citizen services cannot tolerate untested hotfixes. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Add SAST findings to the pipeline but retain unapproved deployment access
- Require protected branches, signed commits and segregated deployment approval
- Track bypass attempts, privileged token expiry and emergency releases
- Stage service-account rotation and gate enforcement with emergency release path
Explanation
Correct Answer
D:Stage service-account rotation and gate enforcement with emergency release path provides a governed means to introduce the chosen safeguard while respecting citizen services cannot tolerate untested hotfixes. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Code scanning does not replace release authorization controls. The immediate requirement for build promotion approvals is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
Question 166
In Global logistics broker, a security issue affects cross-border shipment metadata: partner processor moves customer data to an unapproved country and subcontractor. The observed evidence is that processing records show new storage region and an undisclosed subprocessor. Operations must account for this constraint: shipment tracking must remain functional during remediation. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Continuously review provider drift and reassess risk when legal or supplier conditions change
- Rely solely on the prime provider's marketing claim of global compliance
- Check actual object-location logs, subprocessor records and cross-border transfer proofs
- Require region-pinned processing with enforceable subcontractor controls and audit rights
Explanation
Correct Answer
A:Continuously review provider drift and reassess risk when legal or supplier conditions change identifies future loss of control, changed dependencies and exceptions affecting cross-border shipment metadata. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A generic assurance statement does not establish location or subcontractor compliance. The immediate requirement for cross-border shipment metadata is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
Question 167
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Assume general platform terms authorize all future profiling of minors
- Review changes to regional law and retention of previously collected child data
- Separate necessary service processing from optional profiling with enforceable purpose limitation
- Test denial and withdrawal of consent to confirm analytics stops without denying core learning
Explanation
Correct Answer
B:Review changes to regional law and retention of previously collected child data identifies future loss of control, changed dependencies and exceptions affecting minor account onboarding. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
Question 168
In International retail payment processor, a security issue affects high-volume data encryption: team proposes independent key for every field despite HSM throughput limits. The observed evidence is that latency test shows key-management calls dominate checkout path. Operations must account for this constraint: card processing cannot expose payment data to application operators. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Measure key lifecycle, CPU/HSM costs and protection boundaries
- Use envelope encryption with DEKs wrapped by protected KEKs and AEAD metadata
- Store the master KEK alongside the ciphertext in application configuration
- Introduce key caching within strict expiry and auditable rotation policy
Explanation
Correct Answer
A:Measure key lifecycle, CPU/HSM costs and protection boundaries connects the reported evidence (latency test shows key-management calls dominate checkout path) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
C:Co-location of KEK collapses the intended protection boundary. The immediate requirement for high-volume data encryption is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves high-volume data encryption and latency test shows key-management calls dominate checkout path.
Question 169
In Medical research consortium, a security issue affects encrypted collaborative analytics: partners need aggregate genomic statistics but cannot disclose underlying records. The observed evidence is that design proposals include copying every member's raw samples to one vendor. Operations must account for this constraint: law prohibits unapproved sharing of identifiable genetics. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Monitor query abuse and changing partner membership
- Evaluate homomorphic or secure multiparty computation with access-limited output
- Compare aggregate accuracy, leakage resistance and runtime on approved data
- Use only TLS while centrally collecting raw sensitive data
Explanation
Correct Answer
A:Monitor query abuse and changing partner membership identifies future loss of control, changed dependencies and exceptions affecting encrypted collaborative analytics. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
D:Transport encryption does not eliminate disclosure to the receiving service. The immediate requirement for encrypted collaborative analytics is ongoing assurance, which this alternative does not provide.
Question 170
In Public healthcare research network, a security issue affects de-identified test data: development teams copy patient tables into test environments with unclear stewardship. The observed evidence is that file inventories show identifiers in two staging buckets while production classification differs. Operations must account for this constraint: research testing must continue without exporting patient identities. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Trace data creation, custody, classification and deletion duties across development and production
- Inspect sample test environments and retention logs for identifiers, access and secure disposal
- Migrate test workloads by removing real identifiers before enabling restricted synthetic fixtures
- Assume staging data is exempt from data-governance policy
Explanation
Correct Answer
B:Inspect sample test environments and retention logs for identifiers, access and secure disposal tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
D:Testing environments can expose protected information even when not customer-facing. The immediate requirement for de-identified test data is verified remediation, which this alternative does not provide.
