CompTIA CAS-005 Practice Test 35
Question 340
In Global payment processing, a security issue affects SIEM fraud priorities: analysts rank all failed logins above active privileged changes to payout rules. The observed evidence is that event graph shows authorized batch retries and one unapproved payment-role grant. Operations must account for this constraint: service continuity requires batching legitimate payment jobs. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Suppress every privileged-change alert while reducing login noise
- Replay authorized retries and unauthorized role updates to verify ranking
- Correlate identity, source behavior, business criticality and authorization evidence
- Stage alert changes using known-good payment batches as tuning baseline
Explanation
Correct Answer
B:Replay authorized retries and unauthorized role updates to verify ranking tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:High-impact authorization changes cannot be ignored for cleaner metrics. The immediate requirement for SIEM fraud priorities is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
Question 341
In Telecom merger program, a security issue affects shared customer identity directory: newly merged help desks can reset privileged credentials across subsidiaries. The observed evidence is that interviews expose undocumented reset exceptions and a common administrator group. Operations must account for this constraint: customer authentication must stay continuous throughout merger. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Exercise unauthorized reset attempts across both subsidiaries with transaction audit
- Set separated reset authorization and identity-proofing controls across subsidiaries
- Repeat modeling when organizational roles, support vendors or privileged endpoints change
- Draw only an external network diagram and omit human support processes
Explanation
Correct Answer
C:Repeat modeling when organizational roles, support vendors or privileged endpoints change identifies future loss of control, changed dependencies and exceptions affecting shared customer identity directory. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
D:Social-engineering and process paths can bypass well-segmented network controls. The immediate requirement for shared customer identity directory is ongoing assurance, which this alternative does not provide.
Question 342
In University investment office, a security issue affects security portfolio funding: multiple high-risk initiatives exceed the annual risk-reduction budget. The observed evidence is that risk register has disparate monetary loss assumptions and untested threat probabilities. Operations must account for this constraint: finance will not approve all investments this quarter. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Fund whichever request has the highest raw technical CVSS score
- Normalize exposure, uncertainty, existing controls and extreme-but-plausible loss scenarios
- Measure realized control effectiveness and updated expected loss against the investment hypothesis
- Present staged, authorized funding tranches with defined residual-risk owners
Explanation
Correct Answer
C:Measure realized control effectiveness and updated expected loss against the investment hypothesis tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Base severity is not the same as enterprise financial and mission exposure. The immediate requirement for security portfolio funding is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
Question 343
In National patent office, a security issue affects digitally signed patent submissions: system stores hashes but cannot establish which inventor approved a filing. The observed evidence is that audit finds shared signing key used by several reviewers. Operations must account for this constraint: legal non-repudiation requires identity-bound approval. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Use a plain hash file without signer identification as evidence of inventor assent
- Review certificate revocation and signing-audit integrity
- Verify modified filings fail validation and approvals map to distinct signers
- Require individual certificate-backed digital signatures and timestamped approval logs
Explanation
Correct Answer
B:Review certificate revocation and signing-audit integrity identifies future loss of control, changed dependencies and exceptions affecting digitally signed patent submissions. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Hashes detect change but do not bind approval to an accountable individual. The immediate requirement for digitally signed patent submissions is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
Question 344
In Public transport operator, a security issue affects station sensor telemetry: duplicate syslog forwarding inflates attack count tenfold. The observed evidence is that same event IDs appear from primary and backup collectors. Operations must account for this constraint: station security reporting must keep both resilient collectors. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Implement reliable deduplication on stable source ID and event identifier
- Disable the backup collector to eliminate duplicate events
- Compare source event cardinality to normalized alert count during failover
- Track dedupe false merging and unexpected collector route changes
Explanation
Correct Answer
D:Track dedupe false merging and unexpected collector route changes identifies future loss of control, changed dependencies and exceptions affecting station sensor telemetry. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
B:Removing resilience is unnecessary when duplicates can be normalized. The immediate requirement for station sensor telemetry is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves station sensor telemetry and same event IDs appear from primary and backup collectors.
Question 345
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Disable authorization globally until all customers upgrade devices
- Distinguish compatibility failures from authorization bypasses in client flows
- Monitor exception rates and regression coverage through full rollout
- Specify version-aware authorization contract and regression tests
Explanation
Correct Answer
D:Specify version-aware authorization contract and regression tests is the durable measure that addresses the observed weakness: new authorization filter blocked valid purchases during last rollout. It must be enforceable while preserving the stated constraint: checkout fraud protection cannot be removed during rollout.
Incorrect Answers
A:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
Question 346
In Retail fraud analytics vendor, a security issue affects claims model training pipeline: contractor can poison labeled training rows without independent provenance. The observed evidence is that version control shows unreviewed data-label changes before a model drift spike. Operations must account for this constraint: fraud detection must not silently block legitimate purchases. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Track drift, poisoning indicators and training approval exceptions across releases
- Identify data provenance, attacker influence on labels and downstream decision effects
- Add more output filtering while leaving the training data channel untrusted
- Require signed dataset lineage, controlled label changes and integrity-based retraining gates
Explanation
Correct Answer
D:Require signed dataset lineage, controlled label changes and integrity-based retraining gates is the durable measure that addresses the observed weakness: contractor can poison labeled training rows without independent provenance. It must be enforceable while preserving the stated constraint: fraud detection must not silently block legitimate purchases.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
C:Output-only checks do not repair compromised model inputs. The immediate requirement for claims model training pipeline is durable control selection, which this alternative does not provide.
Question 347
In Online procurement platform, a security issue affects DMARC anti-spoofing: vendor invoices from authorized service are quarantined due to DKIM misalignment. The observed evidence is that headers show SPF passing for relay domain but DMARC failing From alignment. Operations must account for this constraint: finance must receive genuine supplier notices without spoofing bypass. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Monitor DMARC aggregate reports, failure reasons and new legitimate senders
- Set DMARC policy p=none permanently without fixing misalignment
- Configure aligned DKIM signing for authorized invoice sender and strict DMARC
- Send authorized and spoofed test messages and verify alignment enforcement
Explanation
Correct Answer
A:Monitor DMARC aggregate reports, failure reasons and new legitimate senders identifies future loss of control, changed dependencies and exceptions affecting DMARC anti-spoofing. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Removing enforcement masks spoofing rather than aligning the legitimate flow. The immediate requirement for DMARC anti-spoofing is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
Question 348
In Regional research laboratory, a security issue affects central detection fabric: cloud workload logs never reach the SIEM while perimeter alerts appear normal. The observed evidence is that collector health dashboard excludes one cloud account with sensitive samples. Operations must account for this constraint: laboratory compute bursts are unpredictable. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Alert on silent source failures and adjust retention as research scope changes
- Increase perimeter IDS sensitivity instead of collecting cloud control-plane events
- Map all relevant log sources, classifications and collection blind spots
- Place cloud-native audit collectors with authenticated, centralized retention
Explanation
Correct Answer
D:Place cloud-native audit collectors with authenticated, centralized retention is the durable measure that addresses the observed weakness: cloud workload logs never reach the SIEM while perimeter alerts appear normal. It must be enforceable while preserving the stated constraint: laboratory compute bursts are unpredictable.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
B:A louder network sensor cannot reveal omitted cloud audit activity. The immediate requirement for central detection fabric is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
Question 349
In University student portal, a security issue affects session authorization API: logged-in users can change course ID to view another student's grades. The observed evidence is that two test accounts demonstrate data access after swapping object identifier. Operations must account for this constraint: grading deadline prohibits large service outage. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Trace subject-to-object authorization at API and data layer
- Deploy authorization policy in canary cohort with audit-only fallback limited in time
- Enforce per-object ownership check on every grade request
- Use stronger user passwords but no object ownership enforcement
Explanation
Correct Answer
A:Trace subject-to-object authorization at API and data layer connects the reported evidence (two test accounts demonstrate data access after swapping object identifier) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
D:Authentication strength does not stop an authenticated cross-user IDOR. The immediate requirement for session authorization API is evidence assessment, which this alternative does not provide.
Question 350
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Monitor inconsistent transaction histories and rollback rates
- Increase CPU capacity while retaining check-then-act state updates
- Use atomic commit or locked state transition for settlement authorization
- Run parallel submission tests and prove one definitive settlement state
Explanation
Correct Answer
A:Monitor inconsistent transaction histories and rollback rates identifies future loss of control, changed dependencies and exceptions affecting market settlement worker. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
