CompTIA CAS-005 Practice Test 3
Question 20
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Identify applicable age, consent, purpose and deletion requirements for each region
- Assume general platform terms authorize all future profiling of minors
- Separate necessary service processing from optional profiling with enforceable purpose limitation
- Review changes to regional law and retention of previously collected child data
Explanation
Correct Answer
C:Separate necessary service processing from optional profiling with enforceable purpose limitation is the durable measure that addresses the observed weakness: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. It must be enforceable while preserving the stated constraint: learning access must remain available without optional tracking.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
B:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
Question 21
In Cross-border e-learning consortium, a security issue affects teacher privileged access: new teachers inherit broad tenant admin rights after self-provisioning. The observed evidence is that audit shows two schools' student records accessible to an unrelated teacher. Operations must account for this constraint: legitimate course access must be usable across campuses. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Stage role remapping and revoke standing admin while preserving approved course access
- Enforce least-privilege scoped roles with separation of provisioning and privileged approval
- Review role drift and orphaned privileges after teacher departures
- Assume school email domain membership authorizes all student records
Explanation
Correct Answer
A:Stage role remapping and revoke standing admin while preserving approved course access provides a governed means to introduce the chosen safeguard while respecting legitimate course access must be usable across campuses. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
D:Domain membership is weaker than course-specific object authorization. The immediate requirement for teacher privileged access is safe implementation, which this alternative does not provide.
Question 22
In Financial services cloud team, a security issue affects workload identity rotation: secret rotation breaks machine authentication because deployments retain old token references. The observed evidence is that CI logs show newly issued secret exists but server still reads retired key. Operations must account for this constraint: payment reconciliation depends on hourly batch jobs. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Stage rotation by updating consumers before retiring old version under controlled overlap
- Extend validity of every leaked credential indefinitely for compatibility
- Design versioned secret retrieval with workload identity and no hard-coded runtime keys
- Correlate credential ID, vault version, deployment rollout and authentication failures
Explanation
Correct Answer
D:Correlate credential ID, vault version, deployment rollout and authentication failures connects the reported evidence (CI logs show newly issued secret exists but server still reads retired key) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
B:Availability exceptions cannot justify permanent compromised secret exposure. The immediate requirement for workload identity rotation is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
Question 23
In Maritime cargo operator, a security issue affects port cybersecurity procedures: terminal teams treat suggested guidance as mandatory while ignoring incident reporting standards. The observed evidence is that operators cite three inconsistent copies of the same response document. Operations must account for this constraint: ships must retain emergency communications during changeover. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Observe a drill to establish whether crews follow the mandated reporting steps and escalation thresholds
- Transition documents by critical-port phase with accountable acknowledgments and emergency fallback
- Map which requirements are policy, mandatory standard, operational procedure or advisory guideline
- Publish another checklist without defining its approval authority
Explanation
Correct Answer
A:Observe a drill to establish whether crews follow the mandated reporting steps and escalation thresholds tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
D:More documents do not clarify what is binding or who may waive it. The immediate requirement for port cybersecurity procedures is verified remediation, which this alternative does not provide.
Question 24
In Public transit payment system, a security issue affects secure enclave fare-key handling: terminal tamper event does not revoke stored cryptographic material. The observed evidence is that controller telemetry shows case-open sensor but fare secrets remain active. Operations must account for this constraint: stations must support safe passenger exit during tamper response. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Introduce tamper handling on test terminals with fail-safe passenger operation
- Trace sensor path, key-custody boundary and secure erase trigger
- Add a loud case-open alarm but leave fare signing keys usable
- Simulate enclosure breach and verify key invalidation and ticket policy
Explanation
Correct Answer
D:Simulate enclosure breach and verify key invalidation and ticket policy tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves secure enclave fare-key handling and controller telemetry shows case-open sensor but fare secrets remain active.
C:Detection without secret invalidation leaves a compromised terminal functional. The immediate requirement for secure enclave fare-key handling is verified remediation, which this alternative does not provide.
Question 25
In National government identity office, a security issue affects HSM-backed signing service: private signing keys stored in software on an administrator VM. The observed evidence is that forensic artifact shows exportable key in a backup image. Operations must account for this constraint: citizen credential issuance must support rapid recovery. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Generate nonexportable keys inside FIPS-validated HSM with dual-control operations
- Review HSM role changes, key rotation and recovery ceremony evidence
- Migrate signing under a controlled trust transition with offline root backup
- Encrypt a file containing the same exportable signing key using a shared password
Explanation
Correct Answer
C:Migrate signing under a controlled trust transition with offline root backup provides a governed means to introduce the chosen safeguard while respecting citizen credential issuance must support rapid recovery. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
D:Software encryption does not create nonexportable key custody. The immediate requirement for HSM-backed signing service is safe implementation, which this alternative does not provide.
Question 26
In Financial services SaaS, a security issue affects cloud audit trail: one tenant stops reporting access logs after a role update. The observed evidence is that ingestion dashboard shows no events though client API traffic persists. Operations must account for this constraint: financial audit retention cannot have silent gaps. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Restore audit connector with least-privilege service role and staged resync
- Add signed ingestion heartbeat and independently monitored failure escalation
- Reconcile event sources with API activity, subscription permissions and connector health
- Treat absence of alerts as evidence the tenant has no incidents
Explanation
Correct Answer
C:Reconcile event sources with API activity, subscription permissions and connector health connects the reported evidence (ingestion dashboard shows no events though client API traffic persists) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
D:Telemetry omission does not imply absence of malicious activity. The immediate requirement for cloud audit trail is evidence assessment, which this alternative does not provide.
Question 27
In Public health laboratory, a security issue affects federated staff identity: SAML assertions from regional provider omit audience restrictions. The observed evidence is that test user logs in to the wrong relying party with valid generic assertion. Operations must account for this constraint: diagnostic labs require interagency SSO. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Inspect issuer, audience, recipient, signature validation and trust metadata
- Update federation metadata and enforce attribute scope under staged tenant rollout
- Accept any correctly signed SAML token regardless of intended audience
- Replay wrong-audience assertion and verify rejection and correct SSO flow
Explanation
Correct Answer
D:Replay wrong-audience assertion and verify rejection and correct SSO flow tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
C:Signature alone does not prove the assertion was issued for this service. The immediate requirement for federated staff identity is verified remediation, which this alternative does not provide.
Question 28
In Municipal water operations, a security issue affects smart-meter firmware telemetry: vendor aggregator asks for full device-control subnet access to collect counters. The observed evidence is that architecture shows shared broker between read telemetry and valve commands. Operations must account for this constraint: meter ingestion must survive a cellular disconnect. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Deploy gateway policies with offline telemetry buffer and blocked actuator access
- Define a narrow data perimeter and separate read-only trust zone with signed telemetry
- Trust every authenticated device for all controls in the plant subnet
- Separate read-only meter data flows from actuator control and verify identities
Explanation
Correct Answer
D:Separate read-only meter data flows from actuator control and verify identities connects the reported evidence (architecture shows shared broker between read telemetry and valve commands) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
C:Device presence does not imply approval to execute high-risk actuation. The immediate requirement for smart-meter firmware telemetry is evidence assessment, which this alternative does not provide.
Question 29
In Online procurement platform, a security issue affects DMARC anti-spoofing: vendor invoices from authorized service are quarantined due to DKIM misalignment. The observed evidence is that headers show SPF passing for relay domain but DMARC failing From alignment. Operations must account for this constraint: finance must receive genuine supplier notices without spoofing bypass. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Stage aligned signing and quarantine tuning with validated partner mail traces
- Configure aligned DKIM signing for authorized invoice sender and strict DMARC
- Monitor DMARC aggregate reports, failure reasons and new legitimate senders
- Set DMARC policy p=none permanently without fixing misalignment
Explanation
Correct Answer
A:Stage aligned signing and quarantine tuning with validated partner mail traces provides a governed means to introduce the chosen safeguard while respecting finance must receive genuine supplier notices without spoofing bypass. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
D:Removing enforcement masks spoofing rather than aligning the legitimate flow. The immediate requirement for DMARC anti-spoofing is safe implementation, which this alternative does not provide.
Question 30
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Add more application servers behind the same unprotected proxy
- Identify dependencies, failure domains and measured recovery objectives
- Fail an active gateway during test and measure access recovery against objective
- Deploy staggered failover and preserve critical session state under rollback controls
Explanation
Correct Answer
C:Fail an active gateway during test and measure access recovery against objective tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
