CompTIA CAS-005 Practice Test 33
Question 320
In Healthcare AI documentation service, a security issue affects clinical note summarizer: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. The observed evidence is that red-team canary text in reference document triggers an unauthorized export suggestion. Operations must account for this constraint: clinical editing must remain available without third-party data disclosure. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Review model, tool and retrieval changes for newly opened agent permissions
- Rely on a system prompt saying never disclose patient data as the sole protection
- Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy
- Trace retrieval-to-tool trust boundary and identify untrusted document instructions
Explanation
Correct Answer
C:Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy is the durable measure that addresses the observed weakness: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. It must be enforceable while preserving the stated constraint: clinical editing must remain available without third-party data disclosure.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
B:Natural-language guidance cannot reliably enforce external tool authorization. The immediate requirement for clinical note summarizer is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
Question 321
In Healthcare AI documentation service, a security issue affects clinical note summarizer: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. The observed evidence is that red-team canary text in reference document triggers an unauthorized export suggestion. Operations must account for this constraint: clinical editing must remain available without third-party data disclosure. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Deploy prompt guardrails with approval for high-risk tool calls and rollback-safe logging
- Rely on a system prompt saying never disclose patient data as the sole protection
- Trace retrieval-to-tool trust boundary and identify untrusted document instructions
- Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy
Explanation
Correct Answer
C:Trace retrieval-to-tool trust boundary and identify untrusted document instructions connects the reported evidence (red-team canary text in reference document triggers an unauthorized export suggestion) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
B:Natural-language guidance cannot reliably enforce external tool authorization. The immediate requirement for clinical note summarizer is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
Question 322
In Financial services chatbot, a security issue affects internal AI agent payments tool: assistant has broad money-transfer permission while retrieved emails supply payment instructions. The observed evidence is that dry run shows model proposes transfer from an untrusted email thread. Operations must account for this constraint: finance staff need read-only analysis without autonomous payment authorization. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Warn users that AI can make mistakes but keep unrestricted transfer tokens
- Deploy allowlisted tools and an independent human confirmation for each value transfer
- Replay adversarial invoice messages and prove no unsanctioned transfer occurs
- Map agent-to-payment permissions and which untrusted messages can influence actions
Explanation
Correct Answer
C:Replay adversarial invoice messages and prove no unsanctioned transfer occurs tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Awareness notices do not enforce authorization at the payment API. The immediate requirement for internal AI agent payments tool is verified remediation, which this alternative does not provide.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
Question 323
In Medical research consortium, a security issue affects encrypted collaborative analytics: partners need aggregate genomic statistics but cannot disclose underlying records. The observed evidence is that design proposals include copying every member's raw samples to one vendor. Operations must account for this constraint: law prohibits unapproved sharing of identifiable genetics. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Evaluate homomorphic or secure multiparty computation with access-limited output
- Use only TLS while centrally collecting raw sensitive data
- Monitor query abuse and changing partner membership
- Pilot limited encrypted aggregation under legal and technical controls
Explanation
Correct Answer
D:Pilot limited encrypted aggregation under legal and technical controls provides a governed means to introduce the chosen safeguard while respecting law prohibits unapproved sharing of identifiable genetics. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
B:Transport encryption does not eliminate disclosure to the receiving service. The immediate requirement for encrypted collaborative analytics is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves encrypted collaborative analytics and design proposals include copying every member's raw samples to one vendor.
Question 324
In National insurance firm, a security issue affects remote browser isolation: claims adjusters open untrusted documents that trigger embedded downloads and macros. The observed evidence is that sandbox trace shows script creation during external document preview. Operations must account for this constraint: legitimate adjusters need read-only document review. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Only increase email spam scoring but allow local macro execution
- Monitor isolation bypasses and unsafe document execution trends
- Map document-origin trust and generated process behavior on endpoints
- Use isolated browser/document rendering with restricted download and application control
Explanation
Correct Answer
D:Use isolated browser/document rendering with restricted download and application control is the durable measure that addresses the observed weakness: claims adjusters open untrusted documents that trigger embedded downloads and macros. It must be enforceable while preserving the stated constraint: legitimate adjusters need read-only document review.
Incorrect Answers
A:Filtering alone cannot neutralize documents already received and opened. The immediate requirement for remote browser isolation is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
Question 325
In Regional industrial consortium, a security issue affects OT threat-hunting program: outside feed labels new PLC malware but local asset inventory differs. The observed evidence is that feed has stale hashes and no confidence score for installed controller models. Operations must account for this constraint: active scan could disrupt safety-critical controllers. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Pilot SIEM correlation on archived OT logs and approved passive sensors
- Compare intelligence provenance, affected firmware and actual installed assets
- Build hypothesis-driven passive hunt for command sequences and unauthorized firmware events
- Deploy destructive malware samples directly on production PLCs
Explanation
Correct Answer
B:Compare intelligence provenance, affected firmware and actual installed assets connects the reported evidence (feed has stale hashes and no confidence score for installed controller models) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
D:Aggressive testing can damage physical processes and misstate threat applicability. The immediate requirement for OT threat-hunting program is evidence assessment, which this alternative does not provide.
Question 326
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Publish a security policy without changing exposed signing-key storage
- Reject modified firmware in test and verify trusted release provenance
- Migrate firmware signing to protected service with compatible staged distribution
- Map signing-key custody, firmware provenance and approval workflow
Explanation
Correct Answer
B:Reject modified firmware in test and verify trusted release provenance tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
Question 327
In Industrial manufacturing group, a security issue affects factory edge applications: east-west traffic bypasses inline inspection due to missing sensor placement. The observed evidence is that traffic maps show undetected production-to-office flows on a flat segment. Operations must account for this constraint: robotics control traffic cannot tolerate inline latency spikes. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Track sensor blind spots and newly added production interfaces
- Place passive taps at boundary and selective enforcement on non-real-time interfaces
- Install monitoring incrementally under plant change windows
- Insert an inline IPS into every deterministic robot-control link
Explanation
Correct Answer
C:Install monitoring incrementally under plant change windows provides a governed means to introduce the chosen safeguard while respecting robotics control traffic cannot tolerate inline latency spikes. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves factory edge applications and traffic maps show undetected production-to-office flows on a flat segment.
D:Aggressive in-path inspection can endanger real-time industrial availability. The immediate requirement for factory edge applications is safe implementation, which this alternative does not provide.
Question 328
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Identify which sessions lacked ephemeral key exchange and exposure window
- Roll out compatible modern TLS profiles with staged client updates
- Require authenticated ephemeral key agreement with forward secrecy and modern AEAD
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
Explanation
Correct Answer
A:Identify which sessions lacked ephemeral key exchange and exposure window connects the reported evidence (packet lab reproduces decryption of historical weak RSA-key-exchange sessions) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
D:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is evidence assessment, which this alternative does not provide.
Question 329
In Online procurement platform, a security issue affects DMARC anti-spoofing: vendor invoices from authorized service are quarantined due to DKIM misalignment. The observed evidence is that headers show SPF passing for relay domain but DMARC failing From alignment. Operations must account for this constraint: finance must receive genuine supplier notices without spoofing bypass. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Set DMARC policy p=none permanently without fixing misalignment
- Inspect From, envelope sender, SPF domain, DKIM d= and alignment result
- Configure aligned DKIM signing for authorized invoice sender and strict DMARC
- Stage aligned signing and quarantine tuning with validated partner mail traces
Explanation
Correct Answer
B:Inspect From, envelope sender, SPF domain, DKIM d= and alignment result connects the reported evidence (headers show SPF passing for relay domain but DMARC failing From alignment) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Removing enforcement masks spoofing rather than aligning the legitimate flow. The immediate requirement for DMARC anti-spoofing is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
Question 330
In Global shipping company, a security issue affects laptop measured boot: stolen field laptops may boot malicious firmware and bypass disk trust. The observed evidence is that TPM measurements differ from approved boot baseline on one returned device. Operations must account for this constraint: offline vessel operation needs local disk availability. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Require only a BIOS setup password while leaving boot-chain trust unchecked
- Compare TPM PCR measurements, UEFI chain and stored baseline signatures
- Deploy firmware baseline and recovery key escrow with staged compatibility checks
- Try unauthorized firmware change and verify secret unseal refusal and recovery path
Explanation
Correct Answer
D:Try unauthorized firmware change and verify secret unseal refusal and recovery path tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A setup password does not attest runtime boot components. The immediate requirement for laptop measured boot is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
