CompTIA CAS-005 Practice Test 28
Question 270
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Exercise revoked certificates and simulated OCSP failure against privileged path
- Treat valid certificate dates as proof that it has not been revoked
- Trace revocation response, chain validation and which routes require privileged certificate auth
- Stage OCSP stapling and deny-by-default policy with pretested emergency certificate route
Explanation
Correct Answer
A:Exercise revoked certificates and simulated OCSP failure against privileged path tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
Question 271
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Disable authorization globally until all customers upgrade devices
- Check legitimate and forbidden checkout paths for both client versions
- Deploy canary by client cohort with feature flags and rollback thresholds
- Distinguish compatibility failures from authorization bypasses in client flows
Explanation
Correct Answer
B:Check legitimate and forbidden checkout paths for both client versions tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
Question 272
In Regional water authority, a security issue affects remote telemetry service: field concentrators trust commands from a shared regional access gateway. The observed evidence is that design review finds unauthenticated actuator message forwarding behind gateway. Operations must account for this constraint: pumping safety forbids uncontrolled test shutdown. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Assume internal placement behind a VPN is equivalent to command authorization
- Verify replay and unauthorized pump-command rejection in a safe test rig
- Trace STRIDE-style spoofing and tampering routes through field-controller trust boundaries
- Pilot authenticated command flow with staged fallback for emergency manual operation
Explanation
Correct Answer
B:Verify replay and unauthorized pump-command rejection in a safe test rig tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Network location does not prove message authenticity or operator privilege. The immediate requirement for remote telemetry service is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
Question 273
In Medical research consortium, a security issue affects encrypted collaborative analytics: partners need aggregate genomic statistics but cannot disclose underlying records. The observed evidence is that design proposals include copying every member's raw samples to one vendor. Operations must account for this constraint: law prohibits unapproved sharing of identifiable genetics. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Monitor query abuse and changing partner membership
- Evaluate homomorphic or secure multiparty computation with access-limited output
- Use only TLS while centrally collecting raw sensitive data
- Determine computation and data-exposure goals and adversarial trust assumptions
Explanation
Correct Answer
B:Evaluate homomorphic or secure multiparty computation with access-limited output is the durable measure that addresses the observed weakness: partners need aggregate genomic statistics but cannot disclose underlying records. It must be enforceable while preserving the stated constraint: law prohibits unapproved sharing of identifiable genetics.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
C:Transport encryption does not eliminate disclosure to the receiving service. The immediate requirement for encrypted collaborative analytics is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
Question 274
In Financial services chatbot, a security issue affects internal AI agent payments tool: assistant has broad money-transfer permission while retrieved emails supply payment instructions. The observed evidence is that dry run shows model proposes transfer from an untrusted email thread. Operations must account for this constraint: finance staff need read-only analysis without autonomous payment authorization. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Separate read-only analysis identity from payment execution with hard business approval
- Map agent-to-payment permissions and which untrusted messages can influence actions
- Audit agent permissions, tool calls and model updates for excessive agency
- Warn users that AI can make mistakes but keep unrestricted transfer tokens
Explanation
Correct Answer
A:Separate read-only analysis identity from payment execution with hard business approval is the durable measure that addresses the observed weakness: assistant has broad money-transfer permission while retrieved emails supply payment instructions. It must be enforceable while preserving the stated constraint: finance staff need read-only analysis without autonomous payment authorization.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
D:Awareness notices do not enforce authorization at the payment API. The immediate requirement for internal AI agent payments tool is durable control selection, which this alternative does not provide.
Question 275
In Global investment firm, a security issue affects multi-cloud audit collectors: temporary cloud role permits unrestricted key export across accounts. The observed evidence is that cloud inventory reveals one vendor automation identity with broad key permissions. Operations must account for this constraint: regulatory retention demands immutable logs. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Put all cloud keys in the vendor's shared administrative account
- Use workload federation with least-privilege key operations and customer-controlled KMS policies
- Enumerate trust policies, permission bindings and key-management ownership across tenants
- Roll out per-account trust restrictions and rotate exposed vendor credentials
Explanation
Correct Answer
C:Enumerate trust policies, permission bindings and key-management ownership across tenants connects the reported evidence (cloud inventory reveals one vendor automation identity with broad key permissions) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Shared high-privilege custody increases cross-tenant compromise impact. The immediate requirement for multi-cloud audit collectors is evidence assessment, which this alternative does not provide.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
Question 276
In Municipal water operations, a security issue affects smart-meter firmware telemetry: vendor aggregator asks for full device-control subnet access to collect counters. The observed evidence is that architecture shows shared broker between read telemetry and valve commands. Operations must account for this constraint: meter ingestion must survive a cellular disconnect. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Define a narrow data perimeter and separate read-only trust zone with signed telemetry
- Exercise rogue meter publisher and confirm command paths remain denied
- Review device attestation and unauthorized zone-crossing telemetry
- Trust every authenticated device for all controls in the plant subnet
Explanation
Correct Answer
C:Review device attestation and unauthorized zone-crossing telemetry identifies future loss of control, changed dependencies and exceptions affecting smart-meter firmware telemetry. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
D:Device presence does not imply approval to execute high-risk actuation. The immediate requirement for smart-meter firmware telemetry is ongoing assurance, which this alternative does not provide.
Question 277
In Education examination system, a security issue affects accessibility features: security acceptance lacks testable criteria for protected alternate-format submissions. The observed evidence is that requirements say only secure and accessible without threat or failure thresholds. Operations must account for this constraint: exam accommodations must not leak candidate identity. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Monitor failures and update acceptance tests when devices or policies change
- Declare completion when product backlog stories are closed
- Define acceptance tests for authorization, data minimization and accessible flows
- Elicit measurable access, integrity and accessibility requirements from affected owners
Explanation
Correct Answer
C:Define acceptance tests for authorization, data minimization and accessible flows is the durable measure that addresses the observed weakness: security acceptance lacks testable criteria for protected alternate-format submissions. It must be enforceable while preserving the stated constraint: exam accommodations must not leak candidate identity.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
B:Task completion does not demonstrate testable privacy or accessibility outcomes. The immediate requirement for accessibility features is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves accessibility features and requirements say only secure and accessible without threat or failure thresholds.
Question 278
In Regional savings cooperative, a security issue affects branch risk-exception approvals: branch managers waive sensitive-data controls without a delegated authority matrix. The observed evidence is that three exceptions show contradictory signatures and no expiry. Operations must account for this constraint: board retains decisions beyond financial tolerance. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Map each exception to the approved charter, risk owner, decision limit and affected data
- Pilot the approval workflow in two branches with recorded escalation and rollback of legacy delegation
- Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance
- Make the CISO sole risk acceptor for every branch exception
Explanation
Correct Answer
A:Map each exception to the approved charter, risk owner, decision limit and affected data connects the reported evidence (three exceptions show contradictory signatures and no expiry) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
D:A security function can advise but cannot unilaterally own the business consequence. The immediate requirement for branch risk-exception approvals is evidence assessment, which this alternative does not provide.
Question 279
In Manufacturing ERP operator, a security issue affects legacy application tier: flat trust permits office workstations to query production database directly. The observed evidence is that network map shows shared credentials across test and production. Operations must account for this constraint: older ERP cannot support modern client identity natively. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Block all database ports without mapping required legacy job dependencies
- Stage proxy routing and credential rotation using monitored fallback
- Trace credential reuse, database dependencies and data movement
- Introduce application proxy and segmented database access with distinct service identities
Explanation
Correct Answer
C:Trace credential reuse, database dependencies and data movement connects the reported evidence (network map shows shared credentials across test and production) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Unplanned isolation could halt critical manufacturing reconciliation. The immediate requirement for legacy application tier is evidence assessment, which this alternative does not provide.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
Question 280
In Enterprise airline alliance, a security issue affects federated passenger identity: service accepts OAuth ID token as authorization to modify travel reservations. The observed evidence is that gateway trace shows audience mismatch while access token scopes are absent. Operations must account for this constraint: check-in must remain usable on partner airline identity. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Inspect token type, issuer, audience, scopes and resource-server validation errors
- Roll out dual-token handling with staged client compatibility and deny-by-default endpoints
- Treat a valid user login session as permission for any partner booking update
- Replay wrong-audience ID tokens against booking API and verify rejection
Explanation
Correct Answer
D:Replay wrong-audience ID tokens against booking API and verify rejection tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
C:Authentication by itself does not create scoped delegated API authority. The immediate requirement for federated passenger identity is verified remediation, which this alternative does not provide.
