CompTIA CAS-005 Practice Test 19
Question 180
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
- Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards
- Track scope changes and missed attestations under assigned compliance ownership
- Check live payment-script inventory and control evidence instead of relying on unrelated SOC report text
Explanation
Correct Answer
C:Track scope changes and missed attestations under assigned compliance ownership identifies future loss of control, changed dependencies and exceptions affecting merchant tokenization assurance. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
Question 181
In Regional university research, a security issue affects Linux scientific servers: untrusted notebook container escapes into host-mounted model data. The observed evidence is that audit shows container user has host filesystem write on shared NFS. Operations must account for this constraint: research experiments require GPU devices. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Reconfigure orchestration and container profiles by research group under rollback
- Give every container root privileges to simplify GPU setup
- Try unauthorized host-write and GPU-use operations and confirm enforced boundaries
- Inspect namespace, mount, privileged flag and SELinux policy decisions
Explanation
Correct Answer
C:Try unauthorized host-write and GPU-use operations and confirm enforced boundaries tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
B:Broad privilege enlarges escape impact and is unnecessary for scoped devices. The immediate requirement for Linux scientific servers is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
Question 182
In Public transit payment system, a security issue affects secure enclave fare-key handling: terminal tamper event does not revoke stored cryptographic material. The observed evidence is that controller telemetry shows case-open sensor but fare secrets remain active. Operations must account for this constraint: stations must support safe passenger exit during tamper response. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Introduce tamper handling on test terminals with fail-safe passenger operation
- Trace sensor path, key-custody boundary and secure erase trigger
- Use tamper-responsive secure element with zeroization and audited key lifecycle
- Add a loud case-open alarm but leave fare signing keys usable
Explanation
Correct Answer
B:Trace sensor path, key-custody boundary and secure erase trigger connects the reported evidence (controller telemetry shows case-open sensor but fare secrets remain active) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
D:Detection without secret invalidation leaves a compromised terminal functional. The immediate requirement for secure enclave fare-key handling is evidence assessment, which this alternative does not provide.
Question 183
In Public transport operator, a security issue affects station sensor telemetry: duplicate syslog forwarding inflates attack count tenfold. The observed evidence is that same event IDs appear from primary and backup collectors. Operations must account for this constraint: station security reporting must keep both resilient collectors. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Compare source event cardinality to normalized alert count during failover
- Disable the backup collector to eliminate duplicate events
- Enable dedupe pipeline with preserved raw evidence and reversible transforms
- Trace event IDs, forwarding paths and source integrity
Explanation
Correct Answer
A:Compare source event cardinality to normalized alert count during failover tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Removing resilience is unnecessary when duplicates can be normalized. The immediate requirement for station sensor telemetry is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
Question 184
In Hospital data warehouse, a security issue affects encrypted retired SSD drives: equipment disposal includes encrypted drives whose keys remain in active KMS. The observed evidence is that asset ledger shows storage encryption but no recorded key-destruction approval. Operations must account for this constraint: disposal must prove patient records are unrecoverable. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Audit orphaned keys and disposal exceptions across media inventory
- Define cryptographic erase by destroying all applicable data-encryption keys under approval
- Mark the drive wiped after deleting filesystem directory pointers
- Execute decommissioning and key destruction with independent witness and asset match
Explanation
Correct Answer
D:Execute decommissioning and key destruction with independent witness and asset match provides a governed means to introduce the chosen safeguard while respecting disposal must prove patient records are unrecoverable. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
C:Filesystem deletion does not invalidate encryption keys or all residual data. The immediate requirement for encrypted retired SSD drives is safe implementation, which this alternative does not provide.
Question 185
In Telemedicine edge network, a security issue affects stateful firewall and IPS: asymmetric return routing bypasses inspection and drops allowed consultation sessions. The observed evidence is that flow record shows outbound path through IPS and return via separate gateway. Operations must account for this constraint: real-time clinical calls must not be interrupted in transition. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Stage route and firewall adjustments with connection-drain controls
- Trace actual bidirectional paths, session state and rule ordering
- Design symmetric routing through inspection with appropriate HA state synchronization
- Turn off all stateful filtering to prevent call drops
Explanation
Correct Answer
B:Trace actual bidirectional paths, session state and rule ordering connects the reported evidence (flow record shows outbound path through IPS and return via separate gateway) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
D:Bypassing inspection leaves lateral and perimeter threats unmanaged. The immediate requirement for stateful firewall and IPS is evidence assessment, which this alternative does not provide.
Question 186
In Financial services chatbot, a security issue affects internal AI agent payments tool: assistant has broad money-transfer permission while retrieved emails supply payment instructions. The observed evidence is that dry run shows model proposes transfer from an untrusted email thread. Operations must account for this constraint: finance staff need read-only analysis without autonomous payment authorization. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Deploy allowlisted tools and an independent human confirmation for each value transfer
- Separate read-only analysis identity from payment execution with hard business approval
- Warn users that AI can make mistakes but keep unrestricted transfer tokens
- Map agent-to-payment permissions and which untrusted messages can influence actions
Explanation
Correct Answer
D:Map agent-to-payment permissions and which untrusted messages can influence actions connects the reported evidence (dry run shows model proposes transfer from an untrusted email thread) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
C:Awareness notices do not enforce authorization at the payment API. The immediate requirement for internal AI agent payments tool is evidence assessment, which this alternative does not provide.
Question 187
In Cloud healthcare startup, a security issue affects IaC security baselines: new test accounts repeatedly expose storage buckets to public network. The observed evidence is that Terraform diff shows unrestricted policy reintroduced by shared module. Operations must account for this constraint: developers need safe self-service environments. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Encode least-privilege baseline and policy-as-code checks into approved module
- Monitor drift signals and policy exceptions on each merge
- Introduce IaC gate with tested exception approvals and staged account rollout
- Only run a monthly manual cloud console review
Explanation
Correct Answer
C:Introduce IaC gate with tested exception approvals and staged account rollout provides a governed means to introduce the chosen safeguard while respecting developers need safe self-service environments. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
D:A delayed scan permits new insecure deployments between audits. The immediate requirement for IaC security baselines is safe implementation, which this alternative does not provide.
Question 188
In Regional savings cooperative, a security issue affects branch risk-exception approvals: branch managers waive sensitive-data controls without a delegated authority matrix. The observed evidence is that three exceptions show contradictory signatures and no expiry. Operations must account for this constraint: board retains decisions beyond financial tolerance. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance
- Map each exception to the approved charter, risk owner, decision limit and affected data
- Track overdue approvals and tolerance breaches by accountable branch and enterprise owner
- Make the CISO sole risk acceptor for every branch exception
Explanation
Correct Answer
A:Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance is the durable measure that addresses the observed weakness: branch managers waive sensitive-data controls without a delegated authority matrix. It must be enforceable while preserving the stated constraint: board retains decisions beyond financial tolerance.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
D:A security function can advise but cannot unilaterally own the business consequence. The immediate requirement for branch risk-exception approvals is durable control selection, which this alternative does not provide.
Question 189
In University student portal, a security issue affects session authorization API: logged-in users can change course ID to view another student's grades. The observed evidence is that two test accounts demonstrate data access after swapping object identifier. Operations must account for this constraint: grading deadline prohibits large service outage. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Deploy authorization policy in canary cohort with audit-only fallback limited in time
- Enforce per-object ownership check on every grade request
- Track denied cross-student requests and owner mapping exceptions
- Use stronger user passwords but no object ownership enforcement
Explanation
Correct Answer
A:Deploy authorization policy in canary cohort with audit-only fallback limited in time provides a governed means to introduce the chosen safeguard while respecting grading deadline prohibits large service outage. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
D:Authentication strength does not stop an authenticated cross-user IDOR. The immediate requirement for session authorization API is safe implementation, which this alternative does not provide.
Question 190
In Enterprise airline alliance, a security issue affects federated passenger identity: service accepts OAuth ID token as authorization to modify travel reservations. The observed evidence is that gateway trace shows audience mismatch while access token scopes are absent. Operations must account for this constraint: check-in must remain usable on partner airline identity. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Inspect token type, issuer, audience, scopes and resource-server validation errors
- Use resource-specific scoped access tokens and validate issuer/audience at API boundary
- Track new federation trust grants and unauthorized cross-airline booking attempts
- Treat a valid user login session as permission for any partner booking update
Explanation
Correct Answer
B:Use resource-specific scoped access tokens and validate issuer/audience at API boundary is the durable measure that addresses the observed weakness: service accepts OAuth ID token as authorization to modify travel reservations. It must be enforceable while preserving the stated constraint: check-in must remain usable on partner airline identity.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
D:Authentication by itself does not create scoped delegated API authority. The immediate requirement for federated passenger identity is durable control selection, which this alternative does not provide.
