CompTIA CAS-005 Practice Test 21
Question 200
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Design isolated immutable backup copies with separate recovery identity and tested recovery objectives
- Purchase more snapshots under the same compromised production credentials
- Retest survivability after identity changes and track recovery gap against tolerance
- Restore representative substation configurations in isolation and measure actual recovery time
Explanation
Correct Answer
C:Retest survivability after identity changes and track recovery gap against tolerance identifies future loss of control, changed dependencies and exceptions affecting substation recovery planning. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
B:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
Question 201
In National retail bank, a security issue affects remote-access SIEM: VPN failure alerts vanish after source changed its syslog format. The observed evidence is that parser counter drops while device log volume is unchanged. Operations must account for this constraint: security monitoring must not block legitimate remote sessions. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Increase alert severity on all remaining logs without restoring parser coverage
- Inject controlled VPN denial events and verify normalized SIEM fields
- Use version-aware parsing and ingestion-health alerts for missing fields
- Monitor source silence and schema drift per VPN device
Explanation
Correct Answer
D:Monitor source silence and schema drift per VPN device identifies future loss of control, changed dependencies and exceptions affecting remote-access SIEM. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Louder alerts do not recover unseen VPN events. The immediate requirement for remote-access SIEM is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
Question 202
In Cross-border e-learning consortium, a security issue affects teacher privileged access: new teachers inherit broad tenant admin rights after self-provisioning. The observed evidence is that audit shows two schools' student records accessible to an unrelated teacher. Operations must account for this constraint: legitimate course access must be usable across campuses. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Test newly provisioned users against cross-school records and admin endpoints
- Stage role remapping and revoke standing admin while preserving approved course access
- Map teacher assignments, requested privileges and protected tenant objects
- Assume school email domain membership authorizes all student records
Explanation
Correct Answer
A:Test newly provisioned users against cross-school records and admin endpoints tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
D:Domain membership is weaker than course-specific object authorization. The immediate requirement for teacher privileged access is verified remediation, which this alternative does not provide.
Question 203
In Global payment processing, a security issue affects SIEM fraud priorities: analysts rank all failed logins above active privileged changes to payout rules. The observed evidence is that event graph shows authorized batch retries and one unapproved payment-role grant. Operations must account for this constraint: service continuity requires batching legitimate payment jobs. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Apply risk-aware correlation linking role grants to payout changes and approvals
- Stage alert changes using known-good payment batches as tuning baseline
- Correlate identity, source behavior, business criticality and authorization evidence
- Suppress every privileged-change alert while reducing login noise
Explanation
Correct Answer
C:Correlate identity, source behavior, business criticality and authorization evidence connects the reported evidence (event graph shows authorized batch retries and one unapproved payment-role grant) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
D:High-impact authorization changes cannot be ignored for cleaner metrics. The immediate requirement for SIEM fraud priorities is evidence assessment, which this alternative does not provide.
Question 204
In Municipal emergency dispatch, a security issue affects network sensor visibility: central dashboard reports green though one dispatch VLAN has no network tap. The observed evidence is that port mirror audit shows sensor attached only to office VLAN. Operations must account for this constraint: emergency-radio traffic requires nonintrusive collection. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Deploy passive network taps for dispatch segment without inline control
- Generate known test connection and confirm matching source, destination and timing
- Increase IDS signatures on the office segment
- Alert on sensor silence and changes in mirror-port configuration
Explanation
Correct Answer
D:Alert on sensor silence and changes in mirror-port configuration identifies future loss of control, changed dependencies and exceptions affecting network sensor visibility. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
C:Signatures cannot inspect traffic that never reaches the sensor. The immediate requirement for network sensor visibility is ongoing assurance, which this alternative does not provide.
Question 205
In Insurance payment gateway, a security issue affects third-party software component: vendor library update introduces a vulnerable parser with transitive dependencies. The observed evidence is that build manifest references unsigned artifact outside the approved package registry. Operations must account for this constraint: release pipeline must preserve traceable supplier integrity. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Continuously compare deployed SBOMs with new advisories and patch ownership
- Require SBOM, signed provenance and SCA policy gates before release
- Identify reachable transitive packages, provenance and affected build versions
- Rely only on a successful dynamic penetration scan of the interface
Explanation
Correct Answer
B:Require SBOM, signed provenance and SCA policy gates before release is the durable measure that addresses the observed weakness: vendor library update introduces a vulnerable parser with transitive dependencies. It must be enforceable while preserving the stated constraint: release pipeline must preserve traceable supplier integrity.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
D:A scan may miss vulnerable transitive code and cannot prove provenance. The immediate requirement for third-party software component is durable control selection, which this alternative does not provide.
Question 206
In Regional industrial consortium, a security issue affects OT threat-hunting program: outside feed labels new PLC malware but local asset inventory differs. The observed evidence is that feed has stale hashes and no confidence score for installed controller models. Operations must account for this constraint: active scan could disrupt safety-critical controllers. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Compare intelligence provenance, affected firmware and actual installed assets
- Check whether matched PLC commands correlate with maintenance approvals
- Pilot SIEM correlation on archived OT logs and approved passive sensors
- Deploy destructive malware samples directly on production PLCs
Explanation
Correct Answer
B:Check whether matched PLC commands correlate with maintenance approvals tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
D:Aggressive testing can damage physical processes and misstate threat applicability. The immediate requirement for OT threat-hunting program is verified remediation, which this alternative does not provide.
Question 207
In Clinical laboratory, a security issue affects obsolete analyzer integration: unsupported Windows host controls diagnostic analyzer with no vendor patch path. The observed evidence is that scan flags old SMB service exposed to general office subnet. Operations must account for this constraint: diagnostic runs cannot be interrupted for operating-system migration. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Isolate analyzer behind protocol allowlist and monitored transfer gateway
- Review restricted host use and compensating controls while replacement is planned
- Force immediate unsupported OS upgrade on live clinical controller
- Test authorized specimen results and blocked lateral SMB sessions
Explanation
Correct Answer
B:Review restricted host use and compensating controls while replacement is planned identifies future loss of control, changed dependencies and exceptions affecting obsolete analyzer integration. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
C:Unvalidated upgrades can disrupt calibrated medical equipment. The immediate requirement for obsolete analyzer integration is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
Question 208
In Public-sector mail service, a security issue affects email campaign threat hunt: attackers rotate domains while reusing invoice-lure attachment behavior. The observed evidence is that mail metadata shows consistent MIME pattern and payload sandbox indicator. Operations must account for this constraint: legitimate invoices arrive from many changing supplier domains. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Compare campaign TTPs, file behavior and observable reliability
- Review new payload families, stale rules and intelligence source quality
- Develop Sigma/YARA detections based on distinctive behavior rather than a single domain
- Block only the first observed sender domain and call the campaign eradicated
Explanation
Correct Answer
C:Develop Sigma/YARA detections based on distinctive behavior rather than a single domain is the durable measure that addresses the observed weakness: attackers rotate domains while reusing invoice-lure attachment behavior. It must be enforceable while preserving the stated constraint: legitimate invoices arrive from many changing supplier domains.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
D:Infrastructure changes can evade brittle single-IOC hunting. The immediate requirement for email campaign threat hunt is durable control selection, which this alternative does not provide.
Question 209
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Stage sandboxed fetching with tested proxy fallback
- Enforce egress allowlist, metadata isolation and post-redirect destination checks
- Trace user-controlled URL resolution, redirects and egress privileges
- Filter literal metadata IP in the initial URL but allow redirects
Explanation
Correct Answer
C:Trace user-controlled URL resolution, redirects and egress privileges connects the reported evidence (test proxy records server request to link-local metadata address) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is evidence assessment, which this alternative does not provide.
Question 210
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Require authenticated ephemeral key agreement with forward secrecy and modern AEAD
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
- Monitor fallback cipher negotiations and expired certificates
- Roll out compatible modern TLS profiles with staged client updates
Explanation
Correct Answer
D:Roll out compatible modern TLS profiles with staged client updates provides a governed means to introduce the chosen safeguard while respecting recorded patient conversations must remain confidential long-term. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
B:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
