CompTIA CAS-005 Practice Test 20
Question 190
In Enterprise airline alliance, a security issue affects federated passenger identity: service accepts OAuth ID token as authorization to modify travel reservations. The observed evidence is that gateway trace shows audience mismatch while access token scopes are absent. Operations must account for this constraint: check-in must remain usable on partner airline identity. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Inspect token type, issuer, audience, scopes and resource-server validation errors
- Use resource-specific scoped access tokens and validate issuer/audience at API boundary
- Track new federation trust grants and unauthorized cross-airline booking attempts
- Treat a valid user login session as permission for any partner booking update
Explanation
Correct Answer
B:Use resource-specific scoped access tokens and validate issuer/audience at API boundary is the durable measure that addresses the observed weakness: service accepts OAuth ID token as authorization to modify travel reservations. It must be enforceable while preserving the stated constraint: check-in must remain usable on partner airline identity.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
D:Authentication by itself does not create scoped delegated API authority. The immediate requirement for federated passenger identity is durable control selection, which this alternative does not provide.
Question 191
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Disable all audit logging to reduce storage during investigation
- Correlate identity, query history, DLP hashes and chain of custody
- Revoke unauthorized sharing and enforce purpose-scoped database export rights
- Track sensitive data exports and personnel-access offboarding gaps
Explanation
Correct Answer
C:Revoke unauthorized sharing and enforce purpose-scoped database export rights is the durable measure that addresses the observed weakness: large exports precede employee departure and newly created external share. It must be enforceable while preserving the stated constraint: regulated trading records require immutable legal hold.
Incorrect Answers
A:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
Question 192
In Regional financial services, a security issue affects SOAR containment playbooks: unverified threat-intel match triggers automated network isolation of payroll servers. The observed evidence is that test playbook lacks confidence threshold and service-owner confirmation. Operations must account for this constraint: payroll uptime has a hard regulatory reporting deadline. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Stage playbook in simulation-only mode with auditable manual override
- Reconstruct alert quality, enrichment data and automation decision path
- Gate high-impact isolation on corroboration, approval and bounded service scope
- Set every low-confidence feed hit to automatic full network shutdown
Explanation
Correct Answer
B:Reconstruct alert quality, enrichment data and automation decision path connects the reported evidence (test playbook lacks confidence threshold and service-owner confirmation) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
D:Unbounded action on uncertain indicators creates unacceptable operational disruption. The immediate requirement for SOAR containment playbooks is evidence assessment, which this alternative does not provide.
Question 193
In Financial brokerage, a security issue affects cloud identity compromise hunt: a newly observed token replay technique evades old IP-reputation rules. The observed evidence is that cloud logs show same token ID used from separate devices in minutes. Operations must account for this constraint: identity analysis must avoid overblocking legitimate VPN users. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Enable monitor-first hunt rule with recorded response confidence threshold
- Replay simulated token theft to test signal and sanctioned VPN exclusion
- Block every user crossing two geolocations without inspecting token identity
- Form hypothesis from token reuse, device registration and session timing
Explanation
Correct Answer
B:Replay simulated token theft to test signal and sanctioned VPN exclusion tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
C:Geographic anomalies alone can be caused by sanctioned VPN egress. The immediate requirement for cloud identity compromise hunt is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
Question 194
In Cloud healthcare startup, a security issue affects IaC security baselines: new test accounts repeatedly expose storage buckets to public network. The observed evidence is that Terraform diff shows unrestricted policy reintroduced by shared module. Operations must account for this constraint: developers need safe self-service environments. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Encode least-privilege baseline and policy-as-code checks into approved module
- Only run a monthly manual cloud console review
- Provision representative test environment and verify public access denied
- Monitor drift signals and policy exceptions on each merge
Explanation
Correct Answer
D:Monitor drift signals and policy exceptions on each merge identifies future loss of control, changed dependencies and exceptions affecting IaC security baselines. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
B:A delayed scan permits new insecure deployments between audits. The immediate requirement for IaC security baselines is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
Question 195
In Public health laboratory, a security issue affects federated staff identity: SAML assertions from regional provider omit audience restrictions. The observed evidence is that test user logs in to the wrong relying party with valid generic assertion. Operations must account for this constraint: diagnostic labs require interagency SSO. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Update federation metadata and enforce attribute scope under staged tenant rollout
- Accept any correctly signed SAML token regardless of intended audience
- Bind assertions to designated relying party and trusted issuer with least-privilege roles
- Inspect issuer, audience, recipient, signature validation and trust metadata
Explanation
Correct Answer
D:Inspect issuer, audience, recipient, signature validation and trust metadata connects the reported evidence (test user logs in to the wrong relying party with valid generic assertion) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
B:Signature alone does not prove the assertion was issued for this service. The immediate requirement for federated staff identity is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
Question 196
In Public healthcare research network, a security issue affects de-identified test data: development teams copy patient tables into test environments with unclear stewardship. The observed evidence is that file inventories show identifiers in two staging buckets while production classification differs. Operations must account for this constraint: research testing must continue without exporting patient identities. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Implement approved synthetic-data and masked-subset standards with clear data owners and lifecycle gates
- Trace data creation, custody, classification and deletion duties across development and production
- Measure unauthorized staging copies and overdue deletion exceptions by responsible data owner
- Assume staging data is exempt from data-governance policy
Explanation
Correct Answer
A:Implement approved synthetic-data and masked-subset standards with clear data owners and lifecycle gates is the durable measure that addresses the observed weakness: development teams copy patient tables into test environments with unclear stewardship. It must be enforceable while preserving the stated constraint: research testing must continue without exporting patient identities.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
D:Testing environments can expose protected information even when not customer-facing. The immediate requirement for de-identified test data is durable control selection, which this alternative does not provide.
Question 197
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Test denial and withdrawal of consent to confirm analytics stops without denying core learning
- Introduce region-specific consent gates and rollback-safe tracking disablement
- Identify applicable age, consent, purpose and deletion requirements for each region
- Assume general platform terms authorize all future profiling of minors
Explanation
Correct Answer
A:Test denial and withdrawal of consent to confirm analytics stops without denying core learning tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
D:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is verified remediation, which this alternative does not provide.
Question 198
In Multinational healthcare provider, a security issue affects ransomware incident evidence: file server encryption follows suspicious remote management session. The observed evidence is that memory image identifies new service and encrypted file writes. Operations must account for this constraint: patient care must continue through verified emergency services. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Track reentry indicators and lessons-learned control owners
- Build a defensible timeline from volatile memory, endpoint events and identities
- Remove malicious persistence and segregate compromised credentials
- Reboot every server immediately before collecting volatile evidence
Explanation
Correct Answer
C:Remove malicious persistence and segregate compromised credentials is the durable measure that addresses the observed weakness: file server encryption follows suspicious remote management session. It must be enforceable while preserving the stated constraint: patient care must continue through verified emergency services.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
D:Uncontrolled reboot can destroy memory artifacts and repeat compromise. The immediate requirement for ransomware incident evidence is durable control selection, which this alternative does not provide.
Question 199
In Municipal property records, a security issue affects data classification program: copies of landowner identity documents have no owner tags outside primary database. The observed evidence is that object discovery finds sensitive scans in shared document stores. Operations must account for this constraint: historical record access rights vary by role and jurisdiction. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Encrypt only the main database while ignoring uncontrolled replicas
- Sample access and retention results across primary and replicated document stores
- Apply tags and safe migration in controlled repository phases
- Identify all stored copies, owners, data flows and permitted use
Explanation
Correct Answer
B:Sample access and retention results across primary and replicated document stores tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Strong encryption on one copy does not govern replicated sensitive data. The immediate requirement for data classification program is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
Question 200
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Design isolated immutable backup copies with separate recovery identity and tested recovery objectives
- Purchase more snapshots under the same compromised production credentials
- Retest survivability after identity changes and track recovery gap against tolerance
- Restore representative substation configurations in isolation and measure actual recovery time
Explanation
Correct Answer
C:Retest survivability after identity changes and track recovery gap against tolerance identifies future loss of control, changed dependencies and exceptions affecting substation recovery planning. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
B:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
