CompTIA CAS-005 Practice Test 36
Question 350
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Monitor inconsistent transaction histories and rollback rates
- Increase CPU capacity while retaining check-then-act state updates
- Use atomic commit or locked state transition for settlement authorization
- Run parallel submission tests and prove one definitive settlement state
Explanation
Correct Answer
A:Monitor inconsistent transaction histories and rollback rates identifies future loss of control, changed dependencies and exceptions affecting market settlement worker. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
Question 351
In Global payment processing, a security issue affects SIEM fraud priorities: analysts rank all failed logins above active privileged changes to payout rules. The observed evidence is that event graph shows authorized batch retries and one unapproved payment-role grant. Operations must account for this constraint: service continuity requires batching legitimate payment jobs. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Suppress every privileged-change alert while reducing login noise
- Replay authorized retries and unauthorized role updates to verify ranking
- Monitor alert outcomes and false-suppression risk after workflow changes
- Apply risk-aware correlation linking role grants to payout changes and approvals
Explanation
Correct Answer
C:Monitor alert outcomes and false-suppression risk after workflow changes identifies future loss of control, changed dependencies and exceptions affecting SIEM fraud priorities. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:High-impact authorization changes cannot be ignored for cleaner metrics. The immediate requirement for SIEM fraud priorities is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
Question 352
In Industrial automation vendor, a security issue affects embedded controller firmware: field upgrade can load an unsigned image through maintenance connector. The observed evidence is that test bench accepts a modified boot image before user authentication. Operations must account for this constraint: controllers have limited CPU and safety cutovers. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Rely on checksum downloaded over plaintext as proof of firmware authenticity
- Monitor signature failures and root-of-trust inventory changes
- Anchor signature verification in protected boot hardware and anti-rollback version policy
- Load altered or downgraded firmware in test and verify boot rejection
Explanation
Correct Answer
B:Monitor signature failures and root-of-trust inventory changes identifies future loss of control, changed dependencies and exceptions affecting embedded controller firmware. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Unkeyed checksums detect corruption but not deliberate malicious replacement. The immediate requirement for embedded controller firmware is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
Question 353
In Global shipping company, a security issue affects laptop measured boot: stolen field laptops may boot malicious firmware and bypass disk trust. The observed evidence is that TPM measurements differ from approved boot baseline on one returned device. Operations must account for this constraint: offline vessel operation needs local disk availability. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Require only a BIOS setup password while leaving boot-chain trust unchecked
- Bind disk release to Secure Boot and TPM measured-boot policy
- Monitor measured-boot anomalies and approved firmware updates
- Compare TPM PCR measurements, UEFI chain and stored baseline signatures
Explanation
Correct Answer
B:Bind disk release to Secure Boot and TPM measured-boot policy is the durable measure that addresses the observed weakness: stolen field laptops may boot malicious firmware and bypass disk trust. It must be enforceable while preserving the stated constraint: offline vessel operation needs local disk availability.
Incorrect Answers
A:A setup password does not attest runtime boot components. The immediate requirement for laptop measured boot is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
Question 354
In Financial brokerage, a security issue affects cloud identity compromise hunt: a newly observed token replay technique evades old IP-reputation rules. The observed evidence is that cloud logs show same token ID used from separate devices in minutes. Operations must account for this constraint: identity analysis must avoid overblocking legitimate VPN users. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Correlate device-bound token anomalies instead of IP-only indicators
- Block every user crossing two geolocations without inspecting token identity
- Enable monitor-first hunt rule with recorded response confidence threshold
- Form hypothesis from token reuse, device registration and session timing
Explanation
Correct Answer
D:Form hypothesis from token reuse, device registration and session timing connects the reported evidence (cloud logs show same token ID used from separate devices in minutes) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
B:Geographic anomalies alone can be caused by sanctioned VPN egress. The immediate requirement for cloud identity compromise hunt is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
Question 355
In International charity, a security issue affects confidential donation analytics: organization needs public totals but transaction identifiers must not be reversible. The observed evidence is that proposal hashes low-entropy donor IDs without secret and publishes them. Operations must account for this constraint: donor privacy commitments prohibit individual tracking. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Publish raw SHA-256 hashes of predictable donor identifiers
- Test linkage attacks and sampling to verify identities cannot be recovered
- Use aggregation and irreversible privacy-preserving tokenization with access controls
- Monitor data-release combinations and reidentification complaints
Explanation
Correct Answer
D:Monitor data-release combinations and reidentification complaints identifies future loss of control, changed dependencies and exceptions affecting confidential donation analytics. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Hashing guessable IDs does not ensure anonymity against dictionary attacks. The immediate requirement for confidential donation analytics is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
Question 356
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Identify which sessions lacked ephemeral key exchange and exposure window
- Require authenticated ephemeral key agreement with forward secrecy and modern AEAD
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
- Monitor fallback cipher negotiations and expired certificates
Explanation
Correct Answer
B:Require authenticated ephemeral key agreement with forward secrecy and modern AEAD is the durable measure that addresses the observed weakness: old TLS gateway permits session replay from captured traffic after server key theft. It must be enforceable while preserving the stated constraint: recorded patient conversations must remain confidential long-term.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
C:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
Question 357
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Treat valid certificate dates as proof that it has not been revoked
- Exercise revoked certificates and simulated OCSP failure against privileged path
- Monitor revocation freshness, cert expiry and CA responder resiliency
- Require fail-closed revocation for privileged APIs and isolated low-risk browsing availability
Explanation
Correct Answer
C:Monitor revocation freshness, cert expiry and CA responder resiliency identifies future loss of control, changed dependencies and exceptions affecting certificate revocation checks. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
Question 358
In Regional bank, a security issue affects TLS partner gateway: client and server negotiate no shared cipher after a partner hardening change. The observed evidence is that handshake trace shows client offered only obsolete suites while server requires TLS 1.3. Operations must account for this constraint: payment APIs may not downgrade to known-weak cryptography. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Upgrade or configure supported modern TLS suites with authenticated endpoints
- Monitor handshake failures and upcoming cryptographic deprecations
- Capture handshake confirming mutual allowed cipher and reject old protocol fallback
- Re-enable SSLv3 for universal interoperability
Explanation
Correct Answer
B:Monitor handshake failures and upcoming cryptographic deprecations identifies future loss of control, changed dependencies and exceptions affecting TLS partner gateway. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
D:Obsolete protocol downgrade sacrifices required confidentiality and integrity. The immediate requirement for TLS partner gateway is ongoing assurance, which this alternative does not provide.
Question 359
In Global investment firm, a security issue affects multi-cloud audit collectors: temporary cloud role permits unrestricted key export across accounts. The observed evidence is that cloud inventory reveals one vendor automation identity with broad key permissions. Operations must account for this constraint: regulatory retention demands immutable logs. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Attempt cross-account key export and prove deny with logged identity
- Alert on changes to role trust and anomalous key-access approvals
- Put all cloud keys in the vendor's shared administrative account
- Use workload federation with least-privilege key operations and customer-controlled KMS policies
Explanation
Correct Answer
B:Alert on changes to role trust and anomalous key-access approvals identifies future loss of control, changed dependencies and exceptions affecting multi-cloud audit collectors. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
C:Shared high-privilege custody increases cross-tenant compromise impact. The immediate requirement for multi-cloud audit collectors is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves multi-cloud audit collectors and cloud inventory reveals one vendor automation identity with broad key permissions.
Question 360
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Map user-device posture, patient-record sensitivity and session transitions
- Track policy exceptions, reauthentication failures and untrusted device access
- Use continuous policy decisions bound to user, device health and patient context
- Grant permanent network access after one successful VPN connection
Explanation
Correct Answer
C:Use continuous policy decisions bound to user, device health and patient context is the durable measure that addresses the observed weakness: physician laptops move between wards while flat VLAN grants long-lived device trust. It must be enforceable while preserving the stated constraint: emergency clinical work must use short-lived authorized sessions.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is durable control selection, which this alternative does not provide.
