CompTIA CAS-005 Practice Test 26
Question 250
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Require strict schema and allowlisted safe deserialization types
- Add an inbound rate limit while retaining unsafe object instantiation
- Feed malformed types in authorized test to verify rejection and valid booking
- Monitor unsafe parser warnings and dependency drift
Explanation
Correct Answer
D:Monitor unsafe parser warnings and dependency drift identifies future loss of control, changed dependencies and exceptions affecting web booking API. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
B:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
Question 251
In Telecom merger program, a security issue affects shared customer identity directory: newly merged help desks can reset privileged credentials across subsidiaries. The observed evidence is that interviews expose undocumented reset exceptions and a common administrator group. Operations must account for this constraint: customer authentication must stay continuous throughout merger. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Migrate administrative privileges with parallel monitoring and explicit exception expiry
- Draw only an external network diagram and omit human support processes
- Exercise unauthorized reset attempts across both subsidiaries with transaction audit
- Enumerate actual reset paths, authority roles and cross-subsidiary privilege abuse cases
Explanation
Correct Answer
C:Exercise unauthorized reset attempts across both subsidiaries with transaction audit tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
B:Social-engineering and process paths can bypass well-segmented network controls. The immediate requirement for shared customer identity directory is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
Question 252
In Aviation maintenance provider, a security issue affects contractor certificate access: outsourced engineers authenticate successfully but see unrelated aircraft service logs. The observed evidence is that claims carry vendor role without aircraft assignment attribute. Operations must account for this constraint: emergency repair authorization must remain auditable. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Create an unrestricted contractor role for faster incident response
- Test contractor denial against unassigned aircraft while preserving signed repair access
- Deploy certificate-bound conditional access and time-limited assignment grants
- Trace subject attributes, resource ownership and when vendor assignments are valid
Explanation
Correct Answer
B:Test contractor denial against unassigned aircraft while preserving signed repair access tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Authentication does not justify organization-wide authorization. The immediate requirement for contractor certificate access is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
Question 253
In Financial services cloud team, a security issue affects workload identity rotation: secret rotation breaks machine authentication because deployments retain old token references. The observed evidence is that CI logs show newly issued secret exists but server still reads retired key. Operations must account for this constraint: payment reconciliation depends on hourly batch jobs. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Extend validity of every leaked credential indefinitely for compatibility
- Monitor old-secret requests and unexpected vault access after rotation
- Stage rotation by updating consumers before retiring old version under controlled overlap
- Design versioned secret retrieval with workload identity and no hard-coded runtime keys
Explanation
Correct Answer
C:Stage rotation by updating consumers before retiring old version under controlled overlap provides a governed means to introduce the chosen safeguard while respecting payment reconciliation depends on hourly batch jobs. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Availability exceptions cannot justify permanent compromised secret exposure. The immediate requirement for workload identity rotation is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
Question 254
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Identify reachable parsing endpoint, runtime and unsafe type resolution
- Stage parser change and dependency upgrade using canary traffic
- Add an inbound rate limit while retaining unsafe object instantiation
- Require strict schema and allowlisted safe deserialization types
Explanation
Correct Answer
A:Identify reachable parsing endpoint, runtime and unsafe type resolution connects the reported evidence (safe canary in test triggers unexpected class instantiation) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
C:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
Question 255
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Analyze token claims, object tenancy and cloud gateway-to-function trust
- Test cross-tenant object reads and report exact denied trace identifiers
- Apply only per-IP rate limiting to the exposed endpoint
- Roll out authorized request checks with tenant canaries and rollback plan
Explanation
Correct Answer
B:Test cross-tenant object reads and report exact denied trace identifiers tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
C:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
Question 256
In Manufacturing ERP operator, a security issue affects legacy application tier: flat trust permits office workstations to query production database directly. The observed evidence is that network map shows shared credentials across test and production. Operations must account for this constraint: older ERP cannot support modern client identity natively. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Block all database ports without mapping required legacy job dependencies
- Introduce application proxy and segmented database access with distinct service identities
- Trace credential reuse, database dependencies and data movement
- Review new data paths and privileged session patterns for policy drift
Explanation
Correct Answer
B:Introduce application proxy and segmented database access with distinct service identities is the durable measure that addresses the observed weakness: flat trust permits office workstations to query production database directly. It must be enforceable while preserving the stated constraint: older ERP cannot support modern client identity natively.
Incorrect Answers
A:Unplanned isolation could halt critical manufacturing reconciliation. The immediate requirement for legacy application tier is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
Question 257
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Trace revocation response, chain validation and which routes require privileged certificate auth
- Treat valid certificate dates as proof that it has not been revoked
- Require fail-closed revocation for privileged APIs and isolated low-risk browsing availability
- Monitor revocation freshness, cert expiry and CA responder resiliency
Explanation
Correct Answer
C:Require fail-closed revocation for privileged APIs and isolated low-risk browsing availability is the durable measure that addresses the observed weakness: public gateway accepts revoked operator certificate during an OCSP outage. It must be enforceable while preserving the stated constraint: customer read-only service must remain available during CA outages.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
B:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
Question 258
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Assess speaker verification, source integrity and the approval boundary before assigning origin
- Use voice similarity alone as proof of executive approval
- Introduce a rapid dual-verifier emergency publication workflow with fallback
- Design out-of-band executive verification and signed release approvals
Explanation
Correct Answer
A:Assess speaker verification, source integrity and the approval boundary before assigning origin connects the reported evidence (call recording contradicts authenticated approval channel and contact ledger) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
Question 259
In Regional bank, a security issue affects TLS partner gateway: client and server negotiate no shared cipher after a partner hardening change. The observed evidence is that handshake trace shows client offered only obsolete suites while server requires TLS 1.3. Operations must account for this constraint: payment APIs may not downgrade to known-weak cryptography. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Re-enable SSLv3 for universal interoperability
- Stage partner client update and controlled negotiation testing before cutover
- Capture handshake confirming mutual allowed cipher and reject old protocol fallback
- Compare supported protocol versions, cipher suites and certificate chain on both ends
Explanation
Correct Answer
C:Capture handshake confirming mutual allowed cipher and reject old protocol fallback tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Obsolete protocol downgrade sacrifices required confidentiality and integrity. The immediate requirement for TLS partner gateway is verified remediation, which this alternative does not provide.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
Question 260
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Disable certificate validation on the wireless controller to restore service
- Deploy approved current CA chain and certificate lifecycle automation with client trust pinning
- Track expiring trust anchors and device enrollment exceptions
- Validate legitimate EAP-TLS access and reject untrusted client certificates
Explanation
Correct Answer
C:Track expiring trust anchors and device enrollment exceptions identifies future loss of control, changed dependencies and exceptions affecting 802.1X certificate authentication. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
