CompTIA CAS-005 Practice Test 25
Question 240
In Education examination system, a security issue affects accessibility features: security acceptance lacks testable criteria for protected alternate-format submissions. The observed evidence is that requirements say only secure and accessible without threat or failure thresholds. Operations must account for this constraint: exam accommodations must not leak candidate identity. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Elicit measurable access, integrity and accessibility requirements from affected owners
- Exercise authorized and unauthorized accommodation workflows and verify traceable acceptance
- Integrate accessible security test cases into SDLC and release gates
- Declare completion when product backlog stories are closed
Explanation
Correct Answer
B:Exercise authorized and unauthorized accommodation workflows and verify traceable acceptance tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
D:Task completion does not demonstrate testable privacy or accessibility outcomes. The immediate requirement for accessibility features is verified remediation, which this alternative does not provide.
Question 241
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Use voice similarity alone as proof of executive approval
- Track deepfake attempts, bypasses and time-to-authenticated publication
- Introduce a rapid dual-verifier emergency publication workflow with fallback
- Design out-of-band executive verification and signed release approvals
Explanation
Correct Answer
C:Introduce a rapid dual-verifier emergency publication workflow with fallback provides a governed means to introduce the chosen safeguard while respecting public warning delays could also create harm. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
Question 242
In Industrial manufacturing group, a security issue affects factory edge applications: east-west traffic bypasses inline inspection due to missing sensor placement. The observed evidence is that traffic maps show undetected production-to-office flows on a flat segment. Operations must account for this constraint: robotics control traffic cannot tolerate inline latency spikes. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Insert an inline IPS into every deterministic robot-control link
- Place passive taps at boundary and selective enforcement on non-real-time interfaces
- Track sensor blind spots and newly added production interfaces
- Capture required plant flows and nonintrusive sensor vantage points
Explanation
Correct Answer
B:Place passive taps at boundary and selective enforcement on non-real-time interfaces is the durable measure that addresses the observed weakness: east-west traffic bypasses inline inspection due to missing sensor placement. It must be enforceable while preserving the stated constraint: robotics control traffic cannot tolerate inline latency spikes.
Incorrect Answers
A:Aggressive in-path inspection can endanger real-time industrial availability. The immediate requirement for factory edge applications is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
Question 243
In Industrial turbine manufacturer, a security issue affects supplier remote access compromise: remote support token used outside approved window to change controller parameters. The observed evidence is that VPN gateway logs and PLC event record share session identifier. Operations must account for this constraint: plant control safety requires coordinated physical operations. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Delete PLC logs to hide repeated fault alerts
- Eliminate unrestricted vendor tunnel and require brokered authorized engineering sessions
- Correlate vendor identity, remote session, commands and controller state
- Monitor emergency remote access and recurring unauthorized commands
Explanation
Correct Answer
B:Eliminate unrestricted vendor tunnel and require brokered authorized engineering sessions is the durable measure that addresses the observed weakness: remote support token used outside approved window to change controller parameters. It must be enforceable while preserving the stated constraint: plant control safety requires coordinated physical operations.
Incorrect Answers
A:Erasing artifacts undermines investigation and cannot fix compromised access. The immediate requirement for supplier remote access compromise is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
Question 244
In Industrial sensor SaaS, a security issue affects customer-managed cloud data keys: tenant onboarding creates provider-managed keys despite contractual customer control. The observed evidence is that audit shows key policy permits provider support decrypt without tenant approval. Operations must account for this constraint: critical sensor alerts cannot pause during key migration. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Adopt customer-controlled keys with tenant-approved decrypt grants and rotation policies
- Inventory key custody, encrypt/decrypt grants and support exception paths
- Stage re-encryption and deny stale provider key usage with recovery fallback
- Treat provider-managed encryption at rest as equivalent to customer-held key authority
Explanation
Correct Answer
B:Inventory key custody, encrypt/decrypt grants and support exception paths connects the reported evidence (audit shows key policy permits provider support decrypt without tenant approval) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves customer-managed cloud data keys and audit shows key policy permits provider support decrypt without tenant approval.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves customer-managed cloud data keys and audit shows key policy permits provider support decrypt without tenant approval.
D:Encrypted storage does not imply customer control over decryption authority. The immediate requirement for customer-managed cloud data keys is evidence assessment, which this alternative does not provide.
Question 245
In Energy grid market operator, a security issue affects interconnect service mesh: trusted east-west traffic carries control requests beyond the caller's market function. The observed evidence is that service telemetry shows a reporting workload invoking command endpoints. Operations must account for this constraint: latency budgets limit heavyweight security proxies on plant links. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Map service identities, target operations and exact data-flow security boundaries
- Test disallowed reporting-to-control calls while measuring latency budgets
- Hide the entire mesh behind a perimeter firewall and allow internal calls
- Phase service-policy rollout with observed flows and fail-safe control paths
Explanation
Correct Answer
B:Test disallowed reporting-to-control calls while measuring latency budgets tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
C:Outer perimeter trust cannot restrict lateral service-to-service privileges. The immediate requirement for interconnect service mesh is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
Question 246
In Industrial automation vendor, a security issue affects embedded controller firmware: field upgrade can load an unsigned image through maintenance connector. The observed evidence is that test bench accepts a modified boot image before user authentication. Operations must account for this constraint: controllers have limited CPU and safety cutovers. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Stage signed firmware updates with safe recovery partition and maintenance authorization
- Anchor signature verification in protected boot hardware and anti-rollback version policy
- Rely on checksum downloaded over plaintext as proof of firmware authenticity
- Inspect firmware trust root, update transport and immutable boot state
Explanation
Correct Answer
D:Inspect firmware trust root, update transport and immutable boot state connects the reported evidence (test bench accepts a modified boot image before user authentication) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
C:Unkeyed checksums detect corruption but not deliberate malicious replacement. The immediate requirement for embedded controller firmware is evidence assessment, which this alternative does not provide.
Question 247
In Consumer video platform, a security issue affects serverless media processing: function has default outbound access and can retrieve unrelated customer buckets. The observed evidence is that trace shows public trigger supplying storage key outside its user's namespace. Operations must account for this constraint: uploads must continue without long-running servers. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Track token scopes, denied cross-tenant reads and function configuration drift
- Bind function privileges to per-user object path and minimal egress destinations
- Use WAF filtering alone on upload URL while keeping broad backend IAM
- Deploy narrowed IAM and secret rotation via canary function aliases
Explanation
Correct Answer
D:Deploy narrowed IAM and secret rotation via canary function aliases provides a governed means to introduce the chosen safeguard while respecting uploads must continue without long-running servers. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
C:Edge input filtering cannot replace resource authorization enforced in cloud. The immediate requirement for serverless media processing is safe implementation, which this alternative does not provide.
Question 248
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Enforce object-level authorization in function and least-privilege backing store access
- Monitor authorization failure trends and new unreviewed API routes
- Analyze token claims, object tenancy and cloud gateway-to-function trust
- Apply only per-IP rate limiting to the exposed endpoint
Explanation
Correct Answer
A:Enforce object-level authorization in function and least-privilege backing store access is the durable measure that addresses the observed weakness: production endpoint lacks per-user object authorization after a serverless migration. It must be enforceable while preserving the stated constraint: low-latency publishing cannot depend on manual review for each request.
Incorrect Answers
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
D:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is durable control selection, which this alternative does not provide.
Question 249
In Regional university research, a security issue affects Linux scientific servers: untrusted notebook container escapes into host-mounted model data. The observed evidence is that audit shows container user has host filesystem write on shared NFS. Operations must account for this constraint: research experiments require GPU devices. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Use least-privileged containers, read-only mounts and mandatory access controls
- Inspect namespace, mount, privileged flag and SELinux policy decisions
- Review privileged-container exemptions and policy drift
- Give every container root privileges to simplify GPU setup
Explanation
Correct Answer
A:Use least-privileged containers, read-only mounts and mandatory access controls is the durable measure that addresses the observed weakness: untrusted notebook container escapes into host-mounted model data. It must be enforceable while preserving the stated constraint: research experiments require GPU devices.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
D:Broad privilege enlarges escape impact and is unnecessary for scoped devices. The immediate requirement for Linux scientific servers is durable control selection, which this alternative does not provide.
Question 250
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Require strict schema and allowlisted safe deserialization types
- Add an inbound rate limit while retaining unsafe object instantiation
- Feed malformed types in authorized test to verify rejection and valid booking
- Monitor unsafe parser warnings and dependency drift
Explanation
Correct Answer
D:Monitor unsafe parser warnings and dependency drift identifies future loss of control, changed dependencies and exceptions affecting web booking API. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
B:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
