CompTIA CAS-005 Practice Test 23
Question 220
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Apply only per-IP rate limiting to the exposed endpoint
- Enforce object-level authorization in function and least-privilege backing store access
- Monitor authorization failure trends and new unreviewed API routes
- Roll out authorized request checks with tenant canaries and rollback plan
Explanation
Correct Answer
D:Roll out authorized request checks with tenant canaries and rollback plan provides a governed means to introduce the chosen safeguard while respecting low-latency publishing cannot depend on manual review for each request. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
Question 221
In Education examination system, a security issue affects accessibility features: security acceptance lacks testable criteria for protected alternate-format submissions. The observed evidence is that requirements say only secure and accessible without threat or failure thresholds. Operations must account for this constraint: exam accommodations must not leak candidate identity. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Integrate accessible security test cases into SDLC and release gates
- Declare completion when product backlog stories are closed
- Define acceptance tests for authorization, data minimization and accessible flows
- Elicit measurable access, integrity and accessibility requirements from affected owners
Explanation
Correct Answer
D:Elicit measurable access, integrity and accessibility requirements from affected owners connects the reported evidence (requirements say only secure and accessible without threat or failure thresholds) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
B:Task completion does not demonstrate testable privacy or accessibility outcomes. The immediate requirement for accessibility features is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
Question 222
In Industrial manufacturing group, a security issue affects factory edge applications: east-west traffic bypasses inline inspection due to missing sensor placement. The observed evidence is that traffic maps show undetected production-to-office flows on a flat segment. Operations must account for this constraint: robotics control traffic cannot tolerate inline latency spikes. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Install monitoring incrementally under plant change windows
- Insert an inline IPS into every deterministic robot-control link
- Replay test traffic and prove representative lateral events reach collectors
- Capture required plant flows and nonintrusive sensor vantage points
Explanation
Correct Answer
C:Replay test traffic and prove representative lateral events reach collectors tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
B:Aggressive in-path inspection can endanger real-time industrial availability. The immediate requirement for factory edge applications is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
Question 223
In Financial services SaaS, a security issue affects cloud audit trail: one tenant stops reporting access logs after a role update. The observed evidence is that ingestion dashboard shows no events though client API traffic persists. Operations must account for this constraint: financial audit retention cannot have silent gaps. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Add signed ingestion heartbeat and independently monitored failure escalation
- Treat absence of alerts as evidence the tenant has no incidents
- Generate test access events and verify exact tenant attribution in SIEM
- Trend source silence and unresolved collection gaps by owner
Explanation
Correct Answer
D:Trend source silence and unresolved collection gaps by owner identifies future loss of control, changed dependencies and exceptions affecting cloud audit trail. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
B:Telemetry omission does not imply absence of malicious activity. The immediate requirement for cloud audit trail is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
Question 224
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Identify dependencies, failure domains and measured recovery objectives
- Add more application servers behind the same unprotected proxy
- Architect redundant gateways across independent zones with health-based routing
- Deploy staggered failover and preserve critical session state under rollback controls
Explanation
Correct Answer
A:Identify dependencies, failure domains and measured recovery objectives connects the reported evidence (failure exercise shows users lose routing despite healthy application nodes) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
Question 225
In Regional hospital, a security issue affects central log pipeline: time drift makes correlated EDR and authentication events appear reversed. The observed evidence is that endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate. Operations must account for this constraint: incident evidence must preserve original timestamps for legal review. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Deploy clock correction and parser offset annotations by affected source
- Declare lateral movement simply from apparent log order
- Replay a known sequence and confirm causality reconstructed correctly
- Compare source clocks, timezones, ingest time and NTP health before causality claims
Explanation
Correct Answer
C:Replay a known sequence and confirm causality reconstructed correctly tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
B:Uncorrected clock offset can fabricate an attack sequence. The immediate requirement for central log pipeline is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
Question 226
In Global logistics broker, a security issue affects cross-border shipment metadata: partner processor moves customer data to an unapproved country and subcontractor. The observed evidence is that processing records show new storage region and an undisclosed subprocessor. Operations must account for this constraint: shipment tracking must remain functional during remediation. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Require region-pinned processing with enforceable subcontractor controls and audit rights
- Rely solely on the prime provider's marketing claim of global compliance
- Continuously review provider drift and reassess risk when legal or supplier conditions change
- Map legally applicable location restrictions and full downstream processing and access paths
Explanation
Correct Answer
A:Require region-pinned processing with enforceable subcontractor controls and audit rights is the durable measure that addresses the observed weakness: partner processor moves customer data to an unapproved country and subcontractor. It must be enforceable while preserving the stated constraint: shipment tracking must remain functional during remediation.
Incorrect Answers
B:A generic assurance statement does not establish location or subcontractor compliance. The immediate requirement for cross-border shipment metadata is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
Question 227
In Healthcare endpoint fleet, a security issue affects ransomware-resistant workstations: ordinary office process spawns PowerShell to write to a protected backup directory. The observed evidence is that EDR graph shows unsigned child process and blocked memory injection. Operations must account for this constraint: radiology scheduling must remain available during policy rollout. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Track policy exceptions, suspicious process ancestry and response latency
- Disable all PowerShell, including approved signed administration, permanently
- Correlate process tree, signed binaries, host role and attempted protected writes
- Use application control and EDR prevention for untrusted process chains
Explanation
Correct Answer
D:Use application control and EDR prevention for untrusted process chains is the durable measure that addresses the observed weakness: ordinary office process spawns PowerShell to write to a protected backup directory. It must be enforceable while preserving the stated constraint: radiology scheduling must remain available during policy rollout.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
B:A universal binary ban can break necessary maintenance without controlling abuse paths precisely. The immediate requirement for ransomware-resistant workstations is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
Question 228
In Regional industrial consortium, a security issue affects OT threat-hunting program: outside feed labels new PLC malware but local asset inventory differs. The observed evidence is that feed has stale hashes and no confidence score for installed controller models. Operations must account for this constraint: active scan could disrupt safety-critical controllers. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Deploy destructive malware samples directly on production PLCs
- Pilot SIEM correlation on archived OT logs and approved passive sensors
- Monitor new vendor advisories and changes in local controller inventory
- Build hypothesis-driven passive hunt for command sequences and unauthorized firmware events
Explanation
Correct Answer
B:Pilot SIEM correlation on archived OT logs and approved passive sensors provides a governed means to introduce the chosen safeguard while respecting active scan could disrupt safety-critical controllers. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Aggressive testing can damage physical processes and misstate threat applicability. The immediate requirement for OT threat-hunting program is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
Question 229
In Cloud healthcare startup, a security issue affects IaC security baselines: new test accounts repeatedly expose storage buckets to public network. The observed evidence is that Terraform diff shows unrestricted policy reintroduced by shared module. Operations must account for this constraint: developers need safe self-service environments. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Encode least-privilege baseline and policy-as-code checks into approved module
- Introduce IaC gate with tested exception approvals and staged account rollout
- Trace inherited module outputs and drift origin from deployment records
- Only run a monthly manual cloud console review
Explanation
Correct Answer
C:Trace inherited module outputs and drift origin from deployment records connects the reported evidence (Terraform diff shows unrestricted policy reintroduced by shared module) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves IaC security baselines and Terraform diff shows unrestricted policy reintroduced by shared module.
D:A delayed scan permits new insecure deployments between audits. The immediate requirement for IaC security baselines is evidence assessment, which this alternative does not provide.
Question 230
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Track integrity drift, verified recovery coverage and accountable restoration exceptions
- Declare every readable file valid because its storage device is online
- Design signed hash manifests, offline immutable masters and documented restoration authority
- Quarantine divergent replicas while staging a verified master restore under change control
Explanation
Correct Answer
D:Quarantine divergent replicas while staging a verified master restore under change control provides a governed means to introduce the chosen safeguard while respecting public exhibition must continue read-only. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
B:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
