CompTIA CAS-005 Practice Test 38
Question 370
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Reject modified firmware in test and verify trusted release provenance
- Require hardware-protected release keys and dual-controlled signed artifacts
- Audit signature events, expiring keys and emergency rollout exceptions
- Publish a security policy without changing exposed signing-key storage
Explanation
Correct Answer
C:Audit signature events, expiring keys and emergency rollout exceptions identifies future loss of control, changed dependencies and exceptions affecting secure update chain. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
D:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is ongoing assurance, which this alternative does not provide.
Question 371
In Manufacturing ERP operator, a security issue affects legacy application tier: flat trust permits office workstations to query production database directly. The observed evidence is that network map shows shared credentials across test and production. Operations must account for this constraint: older ERP cannot support modern client identity natively. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Trace credential reuse, database dependencies and data movement
- Stage proxy routing and credential rotation using monitored fallback
- Test permitted ERP workflows and denied office-to-database paths
- Block all database ports without mapping required legacy job dependencies
Explanation
Correct Answer
C:Test permitted ERP workflows and denied office-to-database paths tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
D:Unplanned isolation could halt critical manufacturing reconciliation. The immediate requirement for legacy application tier is verified remediation, which this alternative does not provide.
Question 372
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Disable certificate validation on the wireless controller to restore service
- Validate legitimate EAP-TLS access and reject untrusted client certificates
- Inspect server chain, client trust stores, EAP method and device certificate policy
- Stage campus supplicant updates by device cohorts before retiring old CA
Explanation
Correct Answer
B:Validate legitimate EAP-TLS access and reject untrusted client certificates tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
Question 373
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Grant permanent network access after one successful VPN connection
- Use continuous policy decisions bound to user, device health and patient context
- Stage device attestation and conditional reauthentication without breaking emergency access
- Map user-device posture, patient-record sensitivity and session transitions
Explanation
Correct Answer
D:Map user-device posture, patient-record sensitivity and session transitions connects the reported evidence (NAC logs show compliant login later used from unmanaged kiosk) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is evidence assessment, which this alternative does not provide.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
Question 374
In Regional hospital, a security issue affects trauma care portal: single regional reverse proxy is a failure domain for emergency access. The observed evidence is that failure exercise shows users lose routing despite healthy application nodes. Operations must account for this constraint: patient intake must meet 15-minute recovery requirement. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Fail an active gateway during test and measure access recovery against objective
- Architect redundant gateways across independent zones with health-based routing
- Monitor zone independence, failover success and newly shared dependencies
- Add more application servers behind the same unprotected proxy
Explanation
Correct Answer
C:Monitor zone independence, failover success and newly shared dependencies identifies future loss of control, changed dependencies and exceptions affecting trauma care portal. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves trauma care portal and failure exercise shows users lose routing despite healthy application nodes.
D:Extra compute does not remove a single network routing chokepoint. The immediate requirement for trauma care portal is ongoing assurance, which this alternative does not provide.
Question 375
In National procurement agency, a security issue affects document download gateway: encoded path traversal resolves outside public document root. The observed evidence is that test input containing encoded dot-dot path returns internal configuration snippet. Operations must account for this constraint: public registry must remain available during patch window. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Block one exact traversal string while leaving alternate encodings accepted
- Monitor rejected traversal attempts and application regression
- Trace decoding order, canonical path and filesystem privilege
- Canonicalize and confine file paths with least-privilege service account
Explanation
Correct Answer
D:Canonicalize and confine file paths with least-privilege service account is the durable measure that addresses the observed weakness: encoded path traversal resolves outside public document root. It must be enforceable while preserving the stated constraint: public registry must remain available during patch window.
Incorrect Answers
A:Single-pattern filters are easily bypassed by normalization variants. The immediate requirement for document download gateway is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
Question 376
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Trace integrity roots, replica independence and the first verified divergence
- Declare every readable file valid because its storage device is online
- Track integrity drift, verified recovery coverage and accountable restoration exceptions
- Design signed hash manifests, offline immutable masters and documented restoration authority
Explanation
Correct Answer
D:Design signed hash manifests, offline immutable masters and documented restoration authority is the durable measure that addresses the observed weakness: a destructive storage fault could corrupt rare master files with no recent integrity proofs. It must be enforceable while preserving the stated constraint: public exhibition must continue read-only.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
B:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
Question 377
In International retail group, a security issue affects security program governance: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. The observed evidence is that audit finds one reseller exception kept open after its contract expired. Operations must account for this constraint: acquired subsidiaries must preserve local lawful approvals. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Reconcile sampled migrated records to source approvals, associated controls and expiry triggers
- Migrate active exceptions after validating origin, local authority and reversible mapping
- Import all spreadsheet values as approved exceptions without provenance
- Inventory controls, obligations, exception records and overlapping legal entities
Explanation
Correct Answer
A:Reconcile sampled migrated records to source approvals, associated controls and expiry triggers tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
C:Migration cannot confer acceptance authority absent from the original decision. The immediate requirement for security program governance is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
Question 378
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Design export classification tags with approved jurisdiction- and identity-based access policy
- Audit external collaborator changes and revoke expired authorizations
- Correlate drawing classification, personnel nationality, location and contractual permits
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
Explanation
Correct Answer
A:Design export classification tags with approved jurisdiction- and identity-based access policy is the durable measure that addresses the observed weakness: contractors in multiple countries access drawings without an approved export classification. It must be enforceable while preserving the stated constraint: supplier repair deadlines are mandatory but do not override export control.
Incorrect Answers
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
D:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is durable control selection, which this alternative does not provide.
Question 379
In Energy trading consortium, a security issue affects internal price feed: vendor feed traverses shared office network without data labels or DLP. The observed evidence is that egress inventory finds regulated trading events copied to unmanaged collaboration service. Operations must account for this constraint: latency-sensitive pricing cannot rely on blanket upload blocking. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Apply data labels, controlled collaboration routes and egress DLP on actual trust boundary
- Monitor false positives and unsanctioned data destinations by owner
- Install a second WAF on the public landing page only
- Pilot sensitive-data policy with alert-only tuning then enforcement
Explanation
Correct Answer
D:Pilot sensitive-data policy with alert-only tuning then enforcement provides a governed means to introduce the chosen safeguard while respecting latency-sensitive pricing cannot rely on blanket upload blocking. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves internal price feed and egress inventory finds regulated trading events copied to unmanaged collaboration service.
C:A web edge control does not govern internal confidential data exports. The immediate requirement for internal price feed is safe implementation, which this alternative does not provide.
Question 380
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Receiver tests indicator matching with synthetic data and retains provenance
- Reassess indicator freshness and revoke obsolete intelligence
- Send raw patient records to prove the indicator is important
- Use STIX indicator package with confidence, classification and minimized fields
Explanation
Correct Answer
B:Reassess indicator freshness and revoke obsolete intelligence identifies future loss of control, changed dependencies and exceptions affecting threat intelligence sharing. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
C:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
