CompTIA CAS-005 Practice Test 27
Question 260
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Disable certificate validation on the wireless controller to restore service
- Deploy approved current CA chain and certificate lifecycle automation with client trust pinning
- Track expiring trust anchors and device enrollment exceptions
- Validate legitimate EAP-TLS access and reject untrusted client certificates
Explanation
Correct Answer
C:Track expiring trust anchors and device enrollment exceptions identifies future loss of control, changed dependencies and exceptions affecting 802.1X certificate authentication. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
Question 261
In International nonprofit, a security issue affects cloud bucket exposure incident: public bucket policy reveals donor-contact files. The observed evidence is that cloud audit shows anonymous object reads and recent policy edit. Operations must account for this constraint: donor assistance systems must retain approved access. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Test anonymous denial and authorized donor-service availability
- Monitor bucket policy drift and future exposure indicators
- Remove public access and require approved scoped identity permissions
- Assume encryption at rest prevents any readable anonymous access
Explanation
Correct Answer
B:Monitor bucket policy drift and future exposure indicators identifies future loss of control, changed dependencies and exceptions affecting cloud bucket exposure incident. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
D:Provider-managed storage encryption does not replace object authorization. The immediate requirement for cloud bucket exposure incident is ongoing assurance, which this alternative does not provide.
Question 262
In Global investment firm, a security issue affects multi-cloud audit collectors: temporary cloud role permits unrestricted key export across accounts. The observed evidence is that cloud inventory reveals one vendor automation identity with broad key permissions. Operations must account for this constraint: regulatory retention demands immutable logs. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Put all cloud keys in the vendor's shared administrative account
- Attempt cross-account key export and prove deny with logged identity
- Enumerate trust policies, permission bindings and key-management ownership across tenants
- Roll out per-account trust restrictions and rotate exposed vendor credentials
Explanation
Correct Answer
B:Attempt cross-account key export and prove deny with logged identity tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Shared high-privilege custody increases cross-tenant compromise impact. The immediate requirement for multi-cloud audit collectors is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
Question 263
In Municipal property records, a security issue affects data classification program: copies of landowner identity documents have no owner tags outside primary database. The observed evidence is that object discovery finds sensitive scans in shared document stores. Operations must account for this constraint: historical record access rights vary by role and jurisdiction. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Encrypt only the main database while ignoring uncontrolled replicas
- Apply tags and safe migration in controlled repository phases
- Design classification labels and role-based retention with storage DLP
- Monitor new unlabeled assets and ownerless retention exceptions
Explanation
Correct Answer
B:Apply tags and safe migration in controlled repository phases provides a governed means to introduce the chosen safeguard while respecting historical record access rights vary by role and jurisdiction. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Strong encryption on one copy does not govern replicated sensitive data. The immediate requirement for data classification program is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
Question 264
In Financial services cloud team, a security issue affects workload identity rotation: secret rotation breaks machine authentication because deployments retain old token references. The observed evidence is that CI logs show newly issued secret exists but server still reads retired key. Operations must account for this constraint: payment reconciliation depends on hourly batch jobs. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Test a batch run on newly issued credentials and denial using retired secret
- Correlate credential ID, vault version, deployment rollout and authentication failures
- Stage rotation by updating consumers before retiring old version under controlled overlap
- Extend validity of every leaked credential indefinitely for compatibility
Explanation
Correct Answer
A:Test a batch run on newly issued credentials and denial using retired secret tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
D:Availability exceptions cannot justify permanent compromised secret exposure. The immediate requirement for workload identity rotation is verified remediation, which this alternative does not provide.
Question 265
In Municipal emergency dispatch, a security issue affects network sensor visibility: central dashboard reports green though one dispatch VLAN has no network tap. The observed evidence is that port mirror audit shows sensor attached only to office VLAN. Operations must account for this constraint: emergency-radio traffic requires nonintrusive collection. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Deploy passive network taps for dispatch segment without inline control
- Increase IDS signatures on the office segment
- Alert on sensor silence and changes in mirror-port configuration
- Inventory protected paths, missing VLANs and sensor placement evidence
Explanation
Correct Answer
A:Deploy passive network taps for dispatch segment without inline control is the durable measure that addresses the observed weakness: central dashboard reports green though one dispatch VLAN has no network tap. It must be enforceable while preserving the stated constraint: emergency-radio traffic requires nonintrusive collection.
Incorrect Answers
B:Signatures cannot inspect traffic that never reaches the sensor. The immediate requirement for network sensor visibility is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves network sensor visibility and port mirror audit shows sensor attached only to office VLAN.
Question 266
In Clinical laboratory, a security issue affects obsolete analyzer integration: unsupported Windows host controls diagnostic analyzer with no vendor patch path. The observed evidence is that scan flags old SMB service exposed to general office subnet. Operations must account for this constraint: diagnostic runs cannot be interrupted for operating-system migration. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Force immediate unsupported OS upgrade on live clinical controller
- Test authorized specimen results and blocked lateral SMB sessions
- Move traffic through segregation with clinical signoff and safe rollback
- Map exact analyzer dependencies, clinical safety and network exposure
Explanation
Correct Answer
B:Test authorized specimen results and blocked lateral SMB sessions tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Unvalidated upgrades can disrupt calibrated medical equipment. The immediate requirement for obsolete analyzer integration is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
Question 267
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Require strict schema and allowlisted safe deserialization types
- Stage parser change and dependency upgrade using canary traffic
- Add an inbound rate limit while retaining unsafe object instantiation
- Monitor unsafe parser warnings and dependency drift
Explanation
Correct Answer
B:Stage parser change and dependency upgrade using canary traffic provides a governed means to introduce the chosen safeguard while respecting live booking must not suffer intrusive proof-of-concept tests. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
C:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
Question 268
In National insurance firm, a security issue affects remote browser isolation: claims adjusters open untrusted documents that trigger embedded downloads and macros. The observed evidence is that sandbox trace shows script creation during external document preview. Operations must account for this constraint: legitimate adjusters need read-only document review. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Test active-document payloads and confirm no endpoint process or token access
- Use isolated browser/document rendering with restricted download and application control
- Only increase email spam scoring but allow local macro execution
- Monitor isolation bypasses and unsafe document execution trends
Explanation
Correct Answer
D:Monitor isolation bypasses and unsafe document execution trends identifies future loss of control, changed dependencies and exceptions affecting remote browser isolation. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
C:Filtering alone cannot neutralize documents already received and opened. The immediate requirement for remote browser isolation is ongoing assurance, which this alternative does not provide.
Question 269
In University investment office, a security issue affects security portfolio funding: multiple high-risk initiatives exceed the annual risk-reduction budget. The observed evidence is that risk register has disparate monetary loss assumptions and untested threat probabilities. Operations must account for this constraint: finance will not approve all investments this quarter. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Normalize exposure, uncertainty, existing controls and extreme-but-plausible loss scenarios
- Re-rank projects as evidence changes and escalate risk beyond delegated appetite
- Fund whichever request has the highest raw technical CVSS score
- Select treatment options using comparable risk reduction, dependency and appetite criteria
Explanation
Correct Answer
D:Select treatment options using comparable risk reduction, dependency and appetite criteria is the durable measure that addresses the observed weakness: multiple high-risk initiatives exceed the annual risk-reduction budget. It must be enforceable while preserving the stated constraint: finance will not approve all investments this quarter.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
C:Base severity is not the same as enterprise financial and mission exposure. The immediate requirement for security portfolio funding is durable control selection, which this alternative does not provide.
Question 270
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Exercise revoked certificates and simulated OCSP failure against privileged path
- Treat valid certificate dates as proof that it has not been revoked
- Trace revocation response, chain validation and which routes require privileged certificate auth
- Stage OCSP stapling and deny-by-default policy with pretested emergency certificate route
Explanation
Correct Answer
A:Exercise revoked certificates and simulated OCSP failure against privileged path tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
