CompTIA CAS-005 Practice Test 34
Question 330
In Global shipping company, a security issue affects laptop measured boot: stolen field laptops may boot malicious firmware and bypass disk trust. The observed evidence is that TPM measurements differ from approved boot baseline on one returned device. Operations must account for this constraint: offline vessel operation needs local disk availability. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Require only a BIOS setup password while leaving boot-chain trust unchecked
- Compare TPM PCR measurements, UEFI chain and stored baseline signatures
- Deploy firmware baseline and recovery key escrow with staged compatibility checks
- Try unauthorized firmware change and verify secret unseal refusal and recovery path
Explanation
Correct Answer
D:Try unauthorized firmware change and verify secret unseal refusal and recovery path tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A setup password does not attest runtime boot components. The immediate requirement for laptop measured boot is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
Question 331
In Financial clearing service, a security issue affects long-lived TLS certificates: executives expect future quantum resilience while today's legacy clients cannot process new algorithms. The observed evidence is that inventory lists ECDH key exchange and several multi-year archives. Operations must account for this constraint: cross-bank interoperability must survive phased migration. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Track algorithm deprecation and key lifetime across archive systems
- Replace every cipher tomorrow with an untested PQC library
- Design crypto-agile negotiation and hybrid PQC evaluation for long-lived confidentiality
- Pilot supported hybrid cryptography on noncritical links with rollback and interoperability tests
Explanation
Correct Answer
D:Pilot supported hybrid cryptography on noncritical links with rollback and interoperability tests provides a governed means to introduce the chosen safeguard while respecting cross-bank interoperability must survive phased migration. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
B:Abrupt migration can break critical protocols and unvalidated crypto creates new risk. The immediate requirement for long-lived TLS certificates is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
Question 332
In National insurance firm, a security issue affects remote browser isolation: claims adjusters open untrusted documents that trigger embedded downloads and macros. The observed evidence is that sandbox trace shows script creation during external document preview. Operations must account for this constraint: legitimate adjusters need read-only document review. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Monitor isolation bypasses and unsafe document execution trends
- Deploy isolation to high-risk document sources with audited bypass request path
- Use isolated browser/document rendering with restricted download and application control
- Only increase email spam scoring but allow local macro execution
Explanation
Correct Answer
B:Deploy isolation to high-risk document sources with audited bypass request path provides a governed means to introduce the chosen safeguard while respecting legitimate adjusters need read-only document review. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
D:Filtering alone cannot neutralize documents already received and opened. The immediate requirement for remote browser isolation is safe implementation, which this alternative does not provide.
Question 333
In Cross-border e-learning consortium, a security issue affects teacher privileged access: new teachers inherit broad tenant admin rights after self-provisioning. The observed evidence is that audit shows two schools' student records accessible to an unrelated teacher. Operations must account for this constraint: legitimate course access must be usable across campuses. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Map teacher assignments, requested privileges and protected tenant objects
- Assume school email domain membership authorizes all student records
- Stage role remapping and revoke standing admin while preserving approved course access
- Enforce least-privilege scoped roles with separation of provisioning and privileged approval
Explanation
Correct Answer
A:Map teacher assignments, requested privileges and protected tenant objects connects the reported evidence (audit shows two schools' student records accessible to an unrelated teacher) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Domain membership is weaker than course-specific object authorization. The immediate requirement for teacher privileged access is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
Question 334
In Municipal water operations, a security issue affects smart-meter firmware telemetry: vendor aggregator asks for full device-control subnet access to collect counters. The observed evidence is that architecture shows shared broker between read telemetry and valve commands. Operations must account for this constraint: meter ingestion must survive a cellular disconnect. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Review device attestation and unauthorized zone-crossing telemetry
- Separate read-only meter data flows from actuator control and verify identities
- Trust every authenticated device for all controls in the plant subnet
- Define a narrow data perimeter and separate read-only trust zone with signed telemetry
Explanation
Correct Answer
D:Define a narrow data perimeter and separate read-only trust zone with signed telemetry is the durable measure that addresses the observed weakness: vendor aggregator asks for full device-control subnet access to collect counters. It must be enforceable while preserving the stated constraint: meter ingestion must survive a cellular disconnect.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
C:Device presence does not imply approval to execute high-risk actuation. The immediate requirement for smart-meter firmware telemetry is durable control selection, which this alternative does not provide.
Question 335
In National government identity office, a security issue affects HSM-backed signing service: private signing keys stored in software on an administrator VM. The observed evidence is that forensic artifact shows exportable key in a backup image. Operations must account for this constraint: citizen credential issuance must support rapid recovery. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Attempt key export and confirm protected signing plus audited approvals
- Review HSM role changes, key rotation and recovery ceremony evidence
- Generate nonexportable keys inside FIPS-validated HSM with dual-control operations
- Encrypt a file containing the same exportable signing key using a shared password
Explanation
Correct Answer
B:Review HSM role changes, key rotation and recovery ceremony evidence identifies future loss of control, changed dependencies and exceptions affecting HSM-backed signing service. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
D:Software encryption does not create nonexportable key custody. The immediate requirement for HSM-backed signing service is ongoing assurance, which this alternative does not provide.
Question 336
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Implement prioritized checkout controls through approved deployment and supplier coordination
- Determine what controls and data paths belong to merchant versus processor under applicable obligations
- Check live payment-script inventory and control evidence instead of relying on unrelated SOC report text
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
Explanation
Correct Answer
C:Check live payment-script inventory and control evidence instead of relying on unrelated SOC report text tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
D:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is verified remediation, which this alternative does not provide.
Question 337
In Public health laboratory, a security issue affects federated staff identity: SAML assertions from regional provider omit audience restrictions. The observed evidence is that test user logs in to the wrong relying party with valid generic assertion. Operations must account for this constraint: diagnostic labs require interagency SSO. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Track anomalous relying-party usage and expired federation certificates
- Accept any correctly signed SAML token regardless of intended audience
- Bind assertions to designated relying party and trusted issuer with least-privilege roles
- Replay wrong-audience assertion and verify rejection and correct SSO flow
Explanation
Correct Answer
A:Track anomalous relying-party usage and expired federation certificates identifies future loss of control, changed dependencies and exceptions affecting federated staff identity. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Signature alone does not prove the assertion was issued for this service. The immediate requirement for federated staff identity is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
Question 338
In Public health laboratory, a security issue affects federated staff identity: SAML assertions from regional provider omit audience restrictions. The observed evidence is that test user logs in to the wrong relying party with valid generic assertion. Operations must account for this constraint: diagnostic labs require interagency SSO. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Update federation metadata and enforce attribute scope under staged tenant rollout
- Bind assertions to designated relying party and trusted issuer with least-privilege roles
- Accept any correctly signed SAML token regardless of intended audience
- Track anomalous relying-party usage and expired federation certificates
Explanation
Correct Answer
A:Update federation metadata and enforce attribute scope under staged tenant rollout provides a governed means to introduce the chosen safeguard while respecting diagnostic labs require interagency SSO. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
C:Signature alone does not prove the assertion was issued for this service. The immediate requirement for federated staff identity is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves federated staff identity and test user logs in to the wrong relying party with valid generic assertion.
Question 339
In Multinational healthcare provider, a security issue affects ransomware incident evidence: file server encryption follows suspicious remote management session. The observed evidence is that memory image identifies new service and encrypted file writes. Operations must account for this constraint: patient care must continue through verified emergency services. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Remove malicious persistence and segregate compromised credentials
- Reboot every server immediately before collecting volatile evidence
- Build a defensible timeline from volatile memory, endpoint events and identities
- Preserve forensic images and isolate infected segments before trusted rebuild
Explanation
Correct Answer
C:Build a defensible timeline from volatile memory, endpoint events and identities connects the reported evidence (memory image identifies new service and encrypted file writes) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
B:Uncontrolled reboot can destroy memory artifacts and repeat compromise. The immediate requirement for ransomware incident evidence is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
Question 340
In Global payment processing, a security issue affects SIEM fraud priorities: analysts rank all failed logins above active privileged changes to payout rules. The observed evidence is that event graph shows authorized batch retries and one unapproved payment-role grant. Operations must account for this constraint: service continuity requires batching legitimate payment jobs. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Suppress every privileged-change alert while reducing login noise
- Replay authorized retries and unauthorized role updates to verify ranking
- Correlate identity, source behavior, business criticality and authorization evidence
- Stage alert changes using known-good payment batches as tuning baseline
Explanation
Correct Answer
B:Replay authorized retries and unauthorized role updates to verify ranking tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:High-impact authorization changes cannot be ignored for cleaner metrics. The immediate requirement for SIEM fraud priorities is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
