CompTIA CAS-005 Practice Test 31
Question 300
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Preserve immutable log copy and suspend only implicated export sessions
- Correlate identity, query history, DLP hashes and chain of custody
- Revoke unauthorized sharing and enforce purpose-scoped database export rights
- Disable all audit logging to reduce storage during investigation
Explanation
Correct Answer
B:Correlate identity, query history, DLP hashes and chain of custody connects the reported evidence (database audit and DLP alert identify same query session) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
D:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is evidence assessment, which this alternative does not provide.
Question 301
In International nonprofit, a security issue affects cloud bucket exposure incident: public bucket policy reveals donor-contact files. The observed evidence is that cloud audit shows anonymous object reads and recent policy edit. Operations must account for this constraint: donor assistance systems must retain approved access. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Assume encryption at rest prevents any readable anonymous access
- Monitor bucket policy drift and future exposure indicators
- Remove public access and require approved scoped identity permissions
- Establish scope from object access logs, policy versions and retention evidence
Explanation
Correct Answer
C:Remove public access and require approved scoped identity permissions is the durable measure that addresses the observed weakness: public bucket policy reveals donor-contact files. It must be enforceable while preserving the stated constraint: donor assistance systems must retain approved access.
Incorrect Answers
A:Provider-managed storage encryption does not replace object authorization. The immediate requirement for cloud bucket exposure incident is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
Question 302
In Global industrial supplier, a security issue affects signed maintenance automation: PowerShell job downloads configuration from unsigned public repository. The observed evidence is that runbook shows shell executes remote code as a domain admin. Operations must account for this constraint: legacy plants allow only restricted maintenance windows. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Move scheduled tasks to signed-artifact execution and audited maintenance approval
- Trace script source, signature validation and effective execution privileges
- Obfuscate downloaded script text before running it as domain admin
- Use signed packaged scripts from controlled repository with least-privilege service account
Explanation
Correct Answer
B:Trace script source, signature validation and effective execution privileges connects the reported evidence (runbook shows shell executes remote code as a domain admin) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
C:Obfuscation hides code but neither proves origin nor limits privilege. The immediate requirement for signed maintenance automation is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
Question 303
In Financial services chatbot, a security issue affects internal AI agent payments tool: assistant has broad money-transfer permission while retrieved emails supply payment instructions. The observed evidence is that dry run shows model proposes transfer from an untrusted email thread. Operations must account for this constraint: finance staff need read-only analysis without autonomous payment authorization. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Separate read-only analysis identity from payment execution with hard business approval
- Warn users that AI can make mistakes but keep unrestricted transfer tokens
- Audit agent permissions, tool calls and model updates for excessive agency
- Replay adversarial invoice messages and prove no unsanctioned transfer occurs
Explanation
Correct Answer
C:Audit agent permissions, tool calls and model updates for excessive agency identifies future loss of control, changed dependencies and exceptions affecting internal AI agent payments tool. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
B:Awareness notices do not enforce authorization at the payment API. The immediate requirement for internal AI agent payments tool is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
Question 304
In Regional research laboratory, a security issue affects central detection fabric: cloud workload logs never reach the SIEM while perimeter alerts appear normal. The observed evidence is that collector health dashboard excludes one cloud account with sensitive samples. Operations must account for this constraint: laboratory compute bursts are unpredictable. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Enable collection in stages with bounded cost and parsing assurance
- Map all relevant log sources, classifications and collection blind spots
- Place cloud-native audit collectors with authenticated, centralized retention
- Increase perimeter IDS sensitivity instead of collecting cloud control-plane events
Explanation
Correct Answer
B:Map all relevant log sources, classifications and collection blind spots connects the reported evidence (collector health dashboard excludes one cloud account with sensitive samples) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
D:A louder network sensor cannot reveal omitted cloud audit activity. The immediate requirement for central detection fabric is evidence assessment, which this alternative does not provide.
Question 305
In International retail group, a security issue affects security program governance: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. The observed evidence is that audit finds one reseller exception kept open after its contract expired. Operations must account for this constraint: acquired subsidiaries must preserve local lawful approvals. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Migrate active exceptions after validating origin, local authority and reversible mapping
- Import all spreadsheet values as approved exceptions without provenance
- Report unowned critical exceptions and unresolved GRC mapping conflicts to governance
- Implement a central GRC evidence map with approved local ownership and common expiry controls
Explanation
Correct Answer
A:Migrate active exceptions after validating origin, local authority and reversible mapping provides a governed means to introduce the chosen safeguard while respecting acquired subsidiaries must preserve local lawful approvals. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Migration cannot confer acceptance authority absent from the original decision. The immediate requirement for security program governance is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
Question 306
In National retail bank, a security issue affects remote-access SIEM: VPN failure alerts vanish after source changed its syslog format. The observed evidence is that parser counter drops while device log volume is unchanged. Operations must account for this constraint: security monitoring must not block legitimate remote sessions. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Increase alert severity on all remaining logs without restoring parser coverage
- Stage parser change against stored event samples before live enablement
- Use version-aware parsing and ingestion-health alerts for missing fields
- Compare raw syslog payloads, field parser mapping and ingestion loss periods
Explanation
Correct Answer
D:Compare raw syslog payloads, field parser mapping and ingestion loss periods connects the reported evidence (parser counter drops while device log volume is unchanged) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Louder alerts do not recover unseen VPN events. The immediate requirement for remote-access SIEM is evidence assessment, which this alternative does not provide.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
Question 307
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Monitor replay attempts, firmware age and weak-key exceptions
- Introduce signed sensor telemetry with replay protection and safety validation
- Stage key enrollment and signed-message acceptance on safe test segment
- Trust all measurements solely because they use a private RF channel
Explanation
Correct Answer
C:Stage key enrollment and signed-message acceptance on safe test segment provides a governed means to introduce the chosen safeguard while respecting rail operating teams must retain low-latency telemetry. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
D:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is safe implementation, which this alternative does not provide.
Question 308
In Cloud archive provider, a security issue affects cross-region object restoration: all backups replicate deletion markers instantly across both regions. The observed evidence is that restore exercise finds accidental deletes mirrored into recovery bucket. Operations must account for this constraint: contract requires 24-hour recovery-point protection. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Trace replication and deletion propagation across regional trust paths
- Trend irreversible deletion events and retention-lock policy exceptions
- Use versioned immutable recovery copy independent of immediate delete replication
- Add a third synchronously mirrored bucket with identical deletion permissions
Explanation
Correct Answer
C:Use versioned immutable recovery copy independent of immediate delete replication is the durable measure that addresses the observed weakness: all backups replicate deletion markers instantly across both regions. It must be enforceable while preserving the stated constraint: contract requires 24-hour recovery-point protection.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
D:Mirroring the same destructive operation does not provide isolated recovery. The immediate requirement for cross-region object restoration is durable control selection, which this alternative does not provide.
Question 309
In Regional university research, a security issue affects Linux scientific servers: untrusted notebook container escapes into host-mounted model data. The observed evidence is that audit shows container user has host filesystem write on shared NFS. Operations must account for this constraint: research experiments require GPU devices. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Try unauthorized host-write and GPU-use operations and confirm enforced boundaries
- Use least-privileged containers, read-only mounts and mandatory access controls
- Give every container root privileges to simplify GPU setup
- Review privileged-container exemptions and policy drift
Explanation
Correct Answer
D:Review privileged-container exemptions and policy drift identifies future loss of control, changed dependencies and exceptions affecting Linux scientific servers. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
C:Broad privilege enlarges escape impact and is unnecessary for scoped devices. The immediate requirement for Linux scientific servers is ongoing assurance, which this alternative does not provide.
Question 310
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Grant permanent network access after one successful VPN connection
- Test posture degradation and role changes to prove session authorization is revoked
- Map user-device posture, patient-record sensitivity and session transitions
- Stage device attestation and conditional reauthentication without breaking emergency access
Explanation
Correct Answer
B:Test posture degradation and role changes to prove session authorization is revoked tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
