CompTIA CAS-005 Practice Test 37
Question 360
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Map user-device posture, patient-record sensitivity and session transitions
- Track policy exceptions, reauthentication failures and untrusted device access
- Use continuous policy decisions bound to user, device health and patient context
- Grant permanent network access after one successful VPN connection
Explanation
Correct Answer
C:Use continuous policy decisions bound to user, device health and patient context is the durable measure that addresses the observed weakness: physician laptops move between wards while flat VLAN grants long-lived device trust. It must be enforceable while preserving the stated constraint: emergency clinical work must use short-lived authorized sessions.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is durable control selection, which this alternative does not provide.
Question 361
In Energy trading consortium, a security issue affects internal price feed: vendor feed traverses shared office network without data labels or DLP. The observed evidence is that egress inventory finds regulated trading events copied to unmanaged collaboration service. Operations must account for this constraint: latency-sensitive pricing cannot rely on blanket upload blocking. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Install a second WAF on the public landing page only
- Monitor false positives and unsanctioned data destinations by owner
- Apply data labels, controlled collaboration routes and egress DLP on actual trust boundary
- Classify price feed paths and map data owners, labels and egress flows
Explanation
Correct Answer
C:Apply data labels, controlled collaboration routes and egress DLP on actual trust boundary is the durable measure that addresses the observed weakness: vendor feed traverses shared office network without data labels or DLP. It must be enforceable while preserving the stated constraint: latency-sensitive pricing cannot rely on blanket upload blocking.
Incorrect Answers
A:A web edge control does not govern internal confidential data exports. The immediate requirement for internal price feed is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
Question 362
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Require strict schema and allowlisted safe deserialization types
- Identify reachable parsing endpoint, runtime and unsafe type resolution
- Monitor unsafe parser warnings and dependency drift
- Add an inbound rate limit while retaining unsafe object instantiation
Explanation
Correct Answer
A:Require strict schema and allowlisted safe deserialization types is the durable measure that addresses the observed weakness: JSON deserializer allows attacker-controlled polymorphic type. It must be enforceable while preserving the stated constraint: live booking must not suffer intrusive proof-of-concept tests.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
D:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is durable control selection, which this alternative does not provide.
Question 363
In Electronic medical record vendor, a security issue affects image conversion service: URL fetcher can request instance metadata endpoint on private network. The observed evidence is that test proxy records server request to link-local metadata address. Operations must account for this constraint: image conversion needs only authorized external media hosts. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Stage sandboxed fetching with tested proxy fallback
- Trace user-controlled URL resolution, redirects and egress privileges
- Verify URL redirection and metadata targets are blocked in test
- Filter literal metadata IP in the initial URL but allow redirects
Explanation
Correct Answer
C:Verify URL redirection and metadata targets are blocked in test tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves image conversion service and test proxy records server request to link-local metadata address.
D:Redirects and alternate name resolution can evade an initial string check. The immediate requirement for image conversion service is verified remediation, which this alternative does not provide.
Question 364
In University investment office, a security issue affects security portfolio funding: multiple high-risk initiatives exceed the annual risk-reduction budget. The observed evidence is that risk register has disparate monetary loss assumptions and untested threat probabilities. Operations must account for this constraint: finance will not approve all investments this quarter. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Fund whichever request has the highest raw technical CVSS score
- Measure realized control effectiveness and updated expected loss against the investment hypothesis
- Re-rank projects as evidence changes and escalate risk beyond delegated appetite
- Select treatment options using comparable risk reduction, dependency and appetite criteria
Explanation
Correct Answer
C:Re-rank projects as evidence changes and escalate risk beyond delegated appetite identifies future loss of control, changed dependencies and exceptions affecting security portfolio funding. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Base severity is not the same as enterprise financial and mission exposure. The immediate requirement for security portfolio funding is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
Question 365
In Regional hospital consortium, a security issue affects patient telemetry exchange: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. The observed evidence is that contracts specify different deletion and legal-hold periods for two locations. Operations must account for this constraint: care teams need regulated continuity across jurisdictions. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Copy a single vendor default retention period to every hospital
- Design jurisdiction-aware retention and access rules with owner and legal review
- Sample actual retention actions and hold exceptions against the relevant legal matrix
- Monitor regulation and partner contract changes that invalidate previous settings
Explanation
Correct Answer
D:Monitor regulation and partner contract changes that invalidate previous settings identifies future loss of control, changed dependencies and exceptions affecting patient telemetry exchange. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Vendor defaults cannot supersede conflicting jurisdictional obligations. The immediate requirement for patient telemetry exchange is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
Question 366
In Industrial turbine manufacturer, a security issue affects supplier remote access compromise: remote support token used outside approved window to change controller parameters. The observed evidence is that VPN gateway logs and PLC event record share session identifier. Operations must account for this constraint: plant control safety requires coordinated physical operations. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Preserve command records and isolate vendor entry path under plant safety approval
- Monitor emergency remote access and recurring unauthorized commands
- Delete PLC logs to hide repeated fault alerts
- Eliminate unrestricted vendor tunnel and require brokered authorized engineering sessions
Explanation
Correct Answer
A:Preserve command records and isolate vendor entry path under plant safety approval provides a governed means to introduce the chosen safeguard while respecting plant control safety requires coordinated physical operations. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
C:Erasing artifacts undermines investigation and cannot fix compromised access. The immediate requirement for supplier remote access compromise is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
Question 367
In National logistics carrier, a security issue affects container tracking APIs: API firewall blocks legitimate carrier callbacks during bursts. The observed evidence is that packet capture identifies uneven backend queues and saturated proxy tier. Operations must account for this constraint: integrations must retain authenticated callback signatures. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Stage traffic routing and queue thresholds with controlled rollback
- Load-test authorized peak bursts and verify latency and signature enforcement
- Analyze throughput, queueing and proxy-placement constraints by client and service
- Disable signature validation to improve callback throughput
Explanation
Correct Answer
B:Load-test authorized peak bursts and verify latency and signature enforcement tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves container tracking APIs and packet capture identifies uneven backend queues and saturated proxy tier.
D:Removing authentication trades availability pressure for unauthorized service access. The immediate requirement for container tracking APIs is verified remediation, which this alternative does not provide.
Question 368
In University investment office, a security issue affects security portfolio funding: multiple high-risk initiatives exceed the annual risk-reduction budget. The observed evidence is that risk register has disparate monetary loss assumptions and untested threat probabilities. Operations must account for this constraint: finance will not approve all investments this quarter. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Fund whichever request has the highest raw technical CVSS score
- Re-rank projects as evidence changes and escalate risk beyond delegated appetite
- Select treatment options using comparable risk reduction, dependency and appetite criteria
- Present staged, authorized funding tranches with defined residual-risk owners
Explanation
Correct Answer
D:Present staged, authorized funding tranches with defined residual-risk owners provides a governed means to introduce the chosen safeguard while respecting finance will not approve all investments this quarter. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Base severity is not the same as enterprise financial and mission exposure. The immediate requirement for security portfolio funding is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves security portfolio funding and risk register has disparate monetary loss assumptions and untested threat probabilities.
Question 369
In Cloud archive provider, a security issue affects cross-region object restoration: all backups replicate deletion markers instantly across both regions. The observed evidence is that restore exercise finds accidental deletes mirrored into recovery bucket. Operations must account for this constraint: contract requires 24-hour recovery-point protection. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Use versioned immutable recovery copy independent of immediate delete replication
- Delete a canary object and recover prior version inside required RPO
- Add a third synchronously mirrored bucket with identical deletion permissions
- Trend irreversible deletion events and retention-lock policy exceptions
Explanation
Correct Answer
D:Trend irreversible deletion events and retention-lock policy exceptions identifies future loss of control, changed dependencies and exceptions affecting cross-region object restoration. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
C:Mirroring the same destructive operation does not provide isolated recovery. The immediate requirement for cross-region object restoration is ongoing assurance, which this alternative does not provide.
Question 370
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Reject modified firmware in test and verify trusted release provenance
- Require hardware-protected release keys and dual-controlled signed artifacts
- Audit signature events, expiring keys and emergency rollout exceptions
- Publish a security policy without changing exposed signing-key storage
Explanation
Correct Answer
C:Audit signature events, expiring keys and emergency rollout exceptions identifies future loss of control, changed dependencies and exceptions affecting secure update chain. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
D:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is ongoing assurance, which this alternative does not provide.
