CompTIA CAS-005 Practice Test 30
Question 290
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Trace backup trust paths and estimate credible simultaneous production and backup loss
- Design isolated immutable backup copies with separate recovery identity and tested recovery objectives
- Purchase more snapshots under the same compromised production credentials
- Retest survivability after identity changes and track recovery gap against tolerance
Explanation
Correct Answer
B:Design isolated immutable backup copies with separate recovery identity and tested recovery objectives is the durable measure that addresses the observed weakness: connected backups share credentials with production and could be encrypted during ransomware. It must be enforceable while preserving the stated constraint: grid restoration has strict four-hour service objective.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
C:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
Question 291
In National logistics carrier, a security issue affects container tracking APIs: API firewall blocks legitimate carrier callbacks during bursts. The observed evidence is that packet capture identifies uneven backend queues and saturated proxy tier. Operations must account for this constraint: integrations must retain authenticated callback signatures. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Stage traffic routing and queue thresholds with controlled rollback
- Analyze throughput, queueing and proxy-placement constraints by client and service
- Disable signature validation to improve callback throughput
- Design tiered gateways with authenticated queue isolation and autoscaling
Explanation
Correct Answer
B:Analyze throughput, queueing and proxy-placement constraints by client and service connects the reported evidence (packet capture identifies uneven backend queues and saturated proxy tier) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
C:Removing authentication trades availability pressure for unauthorized service access. The immediate requirement for container tracking APIs is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
Question 292
In Cloud archive provider, a security issue affects cross-region object restoration: all backups replicate deletion markers instantly across both regions. The observed evidence is that restore exercise finds accidental deletes mirrored into recovery bucket. Operations must account for this constraint: contract requires 24-hour recovery-point protection. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Use versioned immutable recovery copy independent of immediate delete replication
- Add a third synchronously mirrored bucket with identical deletion permissions
- Enable object retention and cross-account recovery with authorized break-glass
- Trend irreversible deletion events and retention-lock policy exceptions
Explanation
Correct Answer
C:Enable object retention and cross-account recovery with authorized break-glass provides a governed means to introduce the chosen safeguard while respecting contract requires 24-hour recovery-point protection. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
B:Mirroring the same destructive operation does not provide isolated recovery. The immediate requirement for cross-region object restoration is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
Question 293
In Municipal citizen portal, a security issue affects build promotion approvals: developers can bypass production review by merging to an unprotected branch. The observed evidence is that pipeline audit shows direct deployment from a personal token. Operations must account for this constraint: citizen services cannot tolerate untested hotfixes. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Attempt an unauthorized promotion and confirm independent approval blocks it
- Require protected branches, signed commits and segregated deployment approval
- Track bypass attempts, privileged token expiry and emergency releases
- Add SAST findings to the pipeline but retain unapproved deployment access
Explanation
Correct Answer
C:Track bypass attempts, privileged token expiry and emergency releases identifies future loss of control, changed dependencies and exceptions affecting build promotion approvals. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
D:Code scanning does not replace release authorization controls. The immediate requirement for build promotion approvals is ongoing assurance, which this alternative does not provide.
Question 294
In Regional bank, a security issue affects TLS partner gateway: client and server negotiate no shared cipher after a partner hardening change. The observed evidence is that handshake trace shows client offered only obsolete suites while server requires TLS 1.3. Operations must account for this constraint: payment APIs may not downgrade to known-weak cryptography. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Monitor handshake failures and upcoming cryptographic deprecations
- Upgrade or configure supported modern TLS suites with authenticated endpoints
- Compare supported protocol versions, cipher suites and certificate chain on both ends
- Re-enable SSLv3 for universal interoperability
Explanation
Correct Answer
B:Upgrade or configure supported modern TLS suites with authenticated endpoints is the durable measure that addresses the observed weakness: client and server negotiate no shared cipher after a partner hardening change. It must be enforceable while preserving the stated constraint: payment APIs may not downgrade to known-weak cryptography.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
D:Obsolete protocol downgrade sacrifices required confidentiality and integrity. The immediate requirement for TLS partner gateway is durable control selection, which this alternative does not provide.
Question 295
In Energy trading consortium, a security issue affects internal price feed: vendor feed traverses shared office network without data labels or DLP. The observed evidence is that egress inventory finds regulated trading events copied to unmanaged collaboration service. Operations must account for this constraint: latency-sensitive pricing cannot rely on blanket upload blocking. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Install a second WAF on the public landing page only
- Apply data labels, controlled collaboration routes and egress DLP on actual trust boundary
- Monitor false positives and unsanctioned data destinations by owner
- Test approved feed delivery and unauthorized bulk export with representative labels
Explanation
Correct Answer
C:Monitor false positives and unsanctioned data destinations by owner identifies future loss of control, changed dependencies and exceptions affecting internal price feed. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A web edge control does not govern internal confidential data exports. The immediate requirement for internal price feed is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
Question 296
In Financial brokerage, a security issue affects container registry provenance: cluster deploys unsigned images from a developer mirror. The observed evidence is that admission logs show digest rewriting after the approved build. Operations must account for this constraint: risk office requires a verifiable software supply chain. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Trace image origin, artifact digest and policy enforcement route
- Enforce admission deny in monitored canary namespaces before rollout
- Try unsigned and digest-swapped images and verify rejection by policy
- Increase node malware scans while allowing unsigned supply-chain entry
Explanation
Correct Answer
C:Try unsigned and digest-swapped images and verify rejection by policy tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
D:Runtime scans cannot prove images were authorized or unchanged before execution. The immediate requirement for container registry provenance is verified remediation, which this alternative does not provide.
Question 297
In Public transit fare network, a security issue affects contactless validation: one central certificate service can halt all station validators on outage. The observed evidence is that recent test shows otherwise healthy validators cannot cache authorized local decisions. Operations must account for this constraint: offline tickets must expire safely and prevent duplicate redemption. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Permit unlimited local ticket acceptance when the central service fails
- Monitor offline token abuse, reconciliation gaps and certificate service health
- Introduce bounded signed offline entitlements with replay controls and central reconciliation
- Pilot short-lived offline authorizations in limited stations with tamper-safe fallback
Explanation
Correct Answer
D:Pilot short-lived offline authorizations in limited stations with tamper-safe fallback provides a governed means to introduce the chosen safeguard while respecting offline tickets must expire safely and prevent duplicate redemption. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Unbounded offline acceptance defeats fraud and expiry controls. The immediate requirement for contactless validation is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
Question 298
In Multinational pharmacy network, a security issue affects privileged admin access: contract support personnel keep permanent global administrator tokens. The observed evidence is that PAM session logs show logins outside authorized maintenance tickets. Operations must account for this constraint: production medication distribution must remain recoverable. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Use just-in-time elevation with recorded sessions and scope-limited break-glass
- Attempt out-of-window admin actions and verify prompt expiry plus audit attribution
- Rely on a monthly attestation while preserving permanent global privileges
- Review privileged-access exceptions and unlinked admin activity weekly
Explanation
Correct Answer
D:Review privileged-access exceptions and unlinked admin activity weekly identifies future loss of control, changed dependencies and exceptions affecting privileged admin access. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
C:Administrative review does not remove exploitable standing privilege. The immediate requirement for privileged admin access is ongoing assurance, which this alternative does not provide.
Question 299
In Global retail chain, a security issue affects mobile point-of-sale endpoints: lost devices retain local cached payment support credentials. The observed evidence is that MDM inventory shows unencrypted cache and delayed wipe acknowledgment. Operations must account for this constraint: stores must process legitimate transactions offline for short periods. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Treat a screen lock as sufficient protection for permanently cached secrets
- Push managed device profiles and scoped remote revocation while preserving offline safety
- Use hardware-backed encryption and short-lived offline transaction entitlements
- Trace device custody, credential expiry, local cache and synchronization states
Explanation
Correct Answer
D:Trace device custody, credential expiry, local cache and synchronization states connects the reported evidence (MDM inventory shows unencrypted cache and delayed wipe acknowledgment) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:UI locking alone cannot protect offline credentials against device extraction. The immediate requirement for mobile point-of-sale endpoints is evidence assessment, which this alternative does not provide.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
Question 300
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Preserve immutable log copy and suspend only implicated export sessions
- Correlate identity, query history, DLP hashes and chain of custody
- Revoke unauthorized sharing and enforce purpose-scoped database export rights
- Disable all audit logging to reduce storage during investigation
Explanation
Correct Answer
B:Correlate identity, query history, DLP hashes and chain of custody connects the reported evidence (database audit and DLP alert identify same query session) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
D:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is evidence assessment, which this alternative does not provide.
