CompTIA CAS-005 Practice Test 2
Question 10
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Quarantine divergent replicas while staging a verified master restore under change control
- Declare every readable file valid because its storage device is online
- Trace integrity roots, replica independence and the first verified divergence
- Compare cryptographic hashes of restored sample objects with authenticated baseline manifests
Explanation
Correct Answer
D:Compare cryptographic hashes of restored sample objects with authenticated baseline manifests tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
B:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
Question 11
In National patent office, a security issue affects digitally signed patent submissions: system stores hashes but cannot establish which inventor approved a filing. The observed evidence is that audit finds shared signing key used by several reviewers. Operations must account for this constraint: legal non-repudiation requires identity-bound approval. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Use a plain hash file without signer identification as evidence of inventor assent
- Trace identity proofing, signature custody and legally relevant metadata
- Review certificate revocation and signing-audit integrity
- Require individual certificate-backed digital signatures and timestamped approval logs
Explanation
Correct Answer
D:Require individual certificate-backed digital signatures and timestamped approval logs is the durable measure that addresses the observed weakness: system stores hashes but cannot establish which inventor approved a filing. It must be enforceable while preserving the stated constraint: legal non-repudiation requires identity-bound approval.
Incorrect Answers
A:Hashes detect change but do not bind approval to an accountable individual. The immediate requirement for digitally signed patent submissions is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
Question 12
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Inject forged replay messages and verify dispatch ignores them
- Introduce signed sensor telemetry with replay protection and safety validation
- Monitor replay attempts, firmware age and weak-key exceptions
- Trust all measurements solely because they use a private RF channel
Explanation
Correct Answer
C:Monitor replay attempts, firmware age and weak-key exceptions identifies future loss of control, changed dependencies and exceptions affecting rail sensor gateways. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
D:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is ongoing assurance, which this alternative does not provide.
Question 13
In Energy trading consortium, a security issue affects internal price feed: vendor feed traverses shared office network without data labels or DLP. The observed evidence is that egress inventory finds regulated trading events copied to unmanaged collaboration service. Operations must account for this constraint: latency-sensitive pricing cannot rely on blanket upload blocking. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Pilot sensitive-data policy with alert-only tuning then enforcement
- Install a second WAF on the public landing page only
- Apply data labels, controlled collaboration routes and egress DLP on actual trust boundary
- Classify price feed paths and map data owners, labels and egress flows
Explanation
Correct Answer
D:Classify price feed paths and map data owners, labels and egress flows connects the reported evidence (egress inventory finds regulated trading events copied to unmanaged collaboration service) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
B:A web edge control does not govern internal confidential data exports. The immediate requirement for internal price feed is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
Question 14
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
- Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards
- Implement prioritized checkout controls through approved deployment and supplier coordination
- Track scope changes and missed attestations under assigned compliance ownership
Explanation
Correct Answer
C:Implement prioritized checkout controls through approved deployment and supplier coordination provides a governed means to introduce the chosen safeguard while respecting payment processing cannot be interrupted for evidence review. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
Question 15
In Public transit payment system, a security issue affects secure enclave fare-key handling: terminal tamper event does not revoke stored cryptographic material. The observed evidence is that controller telemetry shows case-open sensor but fare secrets remain active. Operations must account for this constraint: stations must support safe passenger exit during tamper response. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Review tamper alerts, key-rotation exceptions and device retirement proofs
- Add a loud case-open alarm but leave fare signing keys usable
- Use tamper-responsive secure element with zeroization and audited key lifecycle
- Simulate enclosure breach and verify key invalidation and ticket policy
Explanation
Correct Answer
A:Review tamper alerts, key-rotation exceptions and device retirement proofs identifies future loss of control, changed dependencies and exceptions affecting secure enclave fare-key handling. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Detection without secret invalidation leaves a compromised terminal functional. The immediate requirement for secure enclave fare-key handling is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
Question 16
In Digital banking consortium, a security issue affects partner API gateway: a compromised supplier token may traverse a trust boundary into payment settlement. The observed evidence is that data-flow diagram shows service account can write settlements without transaction approval. Operations must account for this constraint: settlement continuity must retain independent approval. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Map actors, entry points, trust transitions and abuse cases for supplier-to-settlement writes
- Deploy least-privilege API scopes and segregated validation before onboarding suppliers
- Only scan the public gateway for well-known CVEs
- Place authorization and dual-control barriers at the settlement trust boundary
Explanation
Correct Answer
A:Map actors, entry points, trust transitions and abuse cases for supplier-to-settlement writes connects the reported evidence (data-flow diagram shows service account can write settlements without transaction approval) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
C:Vulnerability scanning alone misses abuse of legitimate delegated authority. The immediate requirement for partner API gateway is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
Question 17
In Telemedicine edge network, a security issue affects stateful firewall and IPS: asymmetric return routing bypasses inspection and drops allowed consultation sessions. The observed evidence is that flow record shows outbound path through IPS and return via separate gateway. Operations must account for this constraint: real-time clinical calls must not be interrupted in transition. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Turn off all stateful filtering to prevent call drops
- Stage route and firewall adjustments with connection-drain controls
- Monitor asymmetric paths, reset spikes and IPS policy drift
- Design symmetric routing through inspection with appropriate HA state synchronization
Explanation
Correct Answer
B:Stage route and firewall adjustments with connection-drain controls provides a governed means to introduce the chosen safeguard while respecting real-time clinical calls must not be interrupted in transition. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Bypassing inspection leaves lateral and perimeter threats unmanaged. The immediate requirement for stateful firewall and IPS is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
Question 18
In Multinational healthcare provider, a security issue affects ransomware incident evidence: file server encryption follows suspicious remote management session. The observed evidence is that memory image identifies new service and encrypted file writes. Operations must account for this constraint: patient care must continue through verified emergency services. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Reboot every server immediately before collecting volatile evidence
- Build a defensible timeline from volatile memory, endpoint events and identities
- Restore clean backups in quarantine and verify patient record integrity
- Preserve forensic images and isolate infected segments before trusted rebuild
Explanation
Correct Answer
C:Restore clean backups in quarantine and verify patient record integrity tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Uncontrolled reboot can destroy memory artifacts and repeat compromise. The immediate requirement for ransomware incident evidence is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
Question 19
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Stage sandboxed fetching with tested proxy fallback
- Filter literal metadata IP in the initial URL but allow redirects
- Enforce egress allowlist, metadata isolation and post-redirect destination checks
- Monitor rejected internal-address fetches and new egress destinations
Explanation
Correct Answer
A:Stage sandboxed fetching with tested proxy fallback provides a governed means to introduce the chosen safeguard while respecting image conversion needs only authorized external media hosts. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
Question 20
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Identify applicable age, consent, purpose and deletion requirements for each region
- Assume general platform terms authorize all future profiling of minors
- Separate necessary service processing from optional profiling with enforceable purpose limitation
- Review changes to regional law and retention of previously collected child data
Explanation
Correct Answer
C:Separate necessary service processing from optional profiling with enforceable purpose limitation is the durable measure that addresses the observed weakness: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. It must be enforceable while preserving the stated constraint: learning access must remain available without optional tracking.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
B:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
