CompTIA CAS-005 Practice Test 32
Question 310
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Grant permanent network access after one successful VPN connection
- Test posture degradation and role changes to prove session authorization is revoked
- Map user-device posture, patient-record sensitivity and session transitions
- Stage device attestation and conditional reauthentication without breaking emergency access
Explanation
Correct Answer
B:Test posture degradation and role changes to prove session authorization is revoked tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
Question 311
In Municipal transport clearinghouse, a security issue affects fare reconciliation microservices: service-to-service callbacks trust caller-supplied terminal identifiers. The observed evidence is that attack tree shows potential forged credits across message queue and API endpoints. Operations must account for this constraint: fare collection cannot be disabled during the quarterly reconciliation. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Identify forgery paths, data-flow trust boundaries and financial abuse objectives
- Use server-side binding of terminal identity, signed messages and reconciliation checks
- Enable message validation in observe-then-enforce stages with rollback criteria
- Treat authentication at the public website as proof for internal service callbacks
Explanation
Correct Answer
A:Identify forgery paths, data-flow trust boundaries and financial abuse objectives connects the reported evidence (attack tree shows potential forged credits across message queue and API endpoints) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
D:Web login does not authorize independent machine-to-machine claims. The immediate requirement for fare reconciliation microservices is evidence assessment, which this alternative does not provide.
Question 312
In Digital banking consortium, a security issue affects partner API gateway: a compromised supplier token may traverse a trust boundary into payment settlement. The observed evidence is that data-flow diagram shows service account can write settlements without transaction approval. Operations must account for this constraint: settlement continuity must retain independent approval. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Attempt controlled cross-boundary settlement changes to demonstrate denials and audit trails
- Only scan the public gateway for well-known CVEs
- Map actors, entry points, trust transitions and abuse cases for supplier-to-settlement writes
- Deploy least-privilege API scopes and segregated validation before onboarding suppliers
Explanation
Correct Answer
A:Attempt controlled cross-boundary settlement changes to demonstrate denials and audit trails tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Vulnerability scanning alone misses abuse of legitimate delegated authority. The immediate requirement for partner API gateway is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
Question 313
In Insurance payment gateway, a security issue affects third-party software component: vendor library update introduces a vulnerable parser with transitive dependencies. The observed evidence is that build manifest references unsigned artifact outside the approved package registry. Operations must account for this constraint: release pipeline must preserve traceable supplier integrity. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Identify reachable transitive packages, provenance and affected build versions
- Rely only on a successful dynamic penetration scan of the interface
- Implement trusted registry pinning and automated policy checks in CI
- Rebuild a test artifact and verify vulnerable dependencies are rejected
Explanation
Correct Answer
D:Rebuild a test artifact and verify vulnerable dependencies are rejected tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
B:A scan may miss vulnerable transitive code and cannot prove provenance. The immediate requirement for third-party software component is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
Question 314
In Maritime vessel network, a security issue affects satellite beacon anomaly hunting: unusual burst traffic may be approved navigation updates or covert exfiltration. The observed evidence is that NetFlow records show long encrypted upload outside voyage schedule. Operations must account for this constraint: satellite bandwidth is safety-critical and scarce. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Shut off all satellite connectivity when a large flow appears
- Correlate upload timing, authorized package signatures and vessel mission state
- Hunt for anomalous destination and volume against a route-aware baseline
- Deploy passive flow analytics with safe exception handling for emergency calls
Explanation
Correct Answer
B:Correlate upload timing, authorized package signatures and vessel mission state connects the reported evidence (NetFlow records show long encrypted upload outside voyage schedule) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Blunt shutdown can impair navigation and emergency communications. The immediate requirement for satellite beacon anomaly hunting is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
Question 315
In Industrial turbine manufacturer, a security issue affects supplier remote access compromise: remote support token used outside approved window to change controller parameters. The observed evidence is that VPN gateway logs and PLC event record share session identifier. Operations must account for this constraint: plant control safety requires coordinated physical operations. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Test restored safe parameters and that unauthorized sessions are denied
- Preserve command records and isolate vendor entry path under plant safety approval
- Delete PLC logs to hide repeated fault alerts
- Correlate vendor identity, remote session, commands and controller state
Explanation
Correct Answer
A:Test restored safe parameters and that unauthorized sessions are denied tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
C:Erasing artifacts undermines investigation and cannot fix compromised access. The immediate requirement for supplier remote access compromise is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
Question 316
In Maritime vessel network, a security issue affects satellite beacon anomaly hunting: unusual burst traffic may be approved navigation updates or covert exfiltration. The observed evidence is that NetFlow records show long encrypted upload outside voyage schedule. Operations must account for this constraint: satellite bandwidth is safety-critical and scarce. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Hunt for anomalous destination and volume against a route-aware baseline
- Shut off all satellite connectivity when a large flow appears
- Correlate upload timing, authorized package signatures and vessel mission state
- Track per-voyage anomaly trends and false suppression risk
Explanation
Correct Answer
A:Hunt for anomalous destination and volume against a route-aware baseline is the durable measure that addresses the observed weakness: unusual burst traffic may be approved navigation updates or covert exfiltration. It must be enforceable while preserving the stated constraint: satellite bandwidth is safety-critical and scarce.
Incorrect Answers
B:Blunt shutdown can impair navigation and emergency communications. The immediate requirement for satellite beacon anomaly hunting is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves satellite beacon anomaly hunting and NetFlow records show long encrypted upload outside voyage schedule.
Question 317
In Hospital data warehouse, a security issue affects encrypted retired SSD drives: equipment disposal includes encrypted drives whose keys remain in active KMS. The observed evidence is that asset ledger shows storage encryption but no recorded key-destruction approval. Operations must account for this constraint: disposal must prove patient records are unrecoverable. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Execute decommissioning and key destruction with independent witness and asset match
- Mark the drive wiped after deleting filesystem directory pointers
- Attempt recovery and inspect KMS destruction logs and remaining replicas
- Identify drive key hierarchy, residual replicas and regulatory retention obligations
Explanation
Correct Answer
C:Attempt recovery and inspect KMS destruction logs and remaining replicas tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
B:Filesystem deletion does not invalidate encryption keys or all residual data. The immediate requirement for encrypted retired SSD drives is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
Question 318
In Hospital data warehouse, a security issue affects encrypted retired SSD drives: equipment disposal includes encrypted drives whose keys remain in active KMS. The observed evidence is that asset ledger shows storage encryption but no recorded key-destruction approval. Operations must account for this constraint: disposal must prove patient records are unrecoverable. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Identify drive key hierarchy, residual replicas and regulatory retention obligations
- Define cryptographic erase by destroying all applicable data-encryption keys under approval
- Execute decommissioning and key destruction with independent witness and asset match
- Mark the drive wiped after deleting filesystem directory pointers
Explanation
Correct Answer
A:Identify drive key hierarchy, residual replicas and regulatory retention obligations connects the reported evidence (asset ledger shows storage encryption but no recorded key-destruction approval) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
D:Filesystem deletion does not invalidate encryption keys or all residual data. The immediate requirement for encrypted retired SSD drives is evidence assessment, which this alternative does not provide.
Question 319
In Retail fraud analytics vendor, a security issue affects claims model training pipeline: contractor can poison labeled training rows without independent provenance. The observed evidence is that version control shows unreviewed data-label changes before a model drift spike. Operations must account for this constraint: fraud detection must not silently block legitimate purchases. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Roll out gated training dataset promotion and clean-data rollback under owner approval
- Identify data provenance, attacker influence on labels and downstream decision effects
- Add more output filtering while leaving the training data channel untrusted
- Require signed dataset lineage, controlled label changes and integrity-based retraining gates
Explanation
Correct Answer
B:Identify data provenance, attacker influence on labels and downstream decision effects connects the reported evidence (version control shows unreviewed data-label changes before a model drift spike) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
C:Output-only checks do not repair compromised model inputs. The immediate requirement for claims model training pipeline is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
Question 320
In Healthcare AI documentation service, a security issue affects clinical note summarizer: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. The observed evidence is that red-team canary text in reference document triggers an unauthorized export suggestion. Operations must account for this constraint: clinical editing must remain available without third-party data disclosure. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Review model, tool and retrieval changes for newly opened agent permissions
- Rely on a system prompt saying never disclose patient data as the sole protection
- Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy
- Trace retrieval-to-tool trust boundary and identify untrusted document instructions
Explanation
Correct Answer
C:Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy is the durable measure that addresses the observed weakness: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. It must be enforceable while preserving the stated constraint: clinical editing must remain available without third-party data disclosure.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
B:Natural-language guidance cannot reliably enforce external tool authorization. The immediate requirement for clinical note summarizer is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
