CompTIA CAS-005 Practice Test 39
Question 380
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Receiver tests indicator matching with synthetic data and retains provenance
- Reassess indicator freshness and revoke obsolete intelligence
- Send raw patient records to prove the indicator is important
- Use STIX indicator package with confidence, classification and minimized fields
Explanation
Correct Answer
B:Reassess indicator freshness and revoke obsolete intelligence identifies future loss of control, changed dependencies and exceptions affecting threat intelligence sharing. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
C:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
Question 381
In Healthcare AI documentation service, a security issue affects clinical note summarizer: retrieved notes can carry prompt instructions that request bulk export to an outside endpoint. The observed evidence is that red-team canary text in reference document triggers an unauthorized export suggestion. Operations must account for this constraint: clinical editing must remain available without third-party data disclosure. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Deploy prompt guardrails with approval for high-risk tool calls and rollback-safe logging
- Review model, tool and retrieval changes for newly opened agent permissions
- Rely on a system prompt saying never disclose patient data as the sole protection
- Separate source text from instructions; enforce least-privilege tool allowlists and data egress policy
Explanation
Correct Answer
A:Deploy prompt guardrails with approval for high-risk tool calls and rollback-safe logging provides a governed means to introduce the chosen safeguard while respecting clinical editing must remain available without third-party data disclosure. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
C:Natural-language guidance cannot reliably enforce external tool authorization. The immediate requirement for clinical note summarizer is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves clinical note summarizer and red-team canary text in reference document triggers an unauthorized export suggestion.
Question 382
In Healthcare endpoint fleet, a security issue affects ransomware-resistant workstations: ordinary office process spawns PowerShell to write to a protected backup directory. The observed evidence is that EDR graph shows unsigned child process and blocked memory injection. Operations must account for this constraint: radiology scheduling must remain available during policy rollout. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Track policy exceptions, suspicious process ancestry and response latency
- Disable all PowerShell, including approved signed administration, permanently
- Use application control and EDR prevention for untrusted process chains
- Run a controlled unauthorized execution test and verify telemetry and preserved scheduling
Explanation
Correct Answer
A:Track policy exceptions, suspicious process ancestry and response latency identifies future loss of control, changed dependencies and exceptions affecting ransomware-resistant workstations. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A universal binary ban can break necessary maintenance without controlling abuse paths precisely. The immediate requirement for ransomware-resistant workstations is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves ransomware-resistant workstations and EDR graph shows unsigned child process and blocked memory injection.
Question 383
In Industrial turbine manufacturer, a security issue affects supplier remote access compromise: remote support token used outside approved window to change controller parameters. The observed evidence is that VPN gateway logs and PLC event record share session identifier. Operations must account for this constraint: plant control safety requires coordinated physical operations. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Preserve command records and isolate vendor entry path under plant safety approval
- Eliminate unrestricted vendor tunnel and require brokered authorized engineering sessions
- Delete PLC logs to hide repeated fault alerts
- Correlate vendor identity, remote session, commands and controller state
Explanation
Correct Answer
D:Correlate vendor identity, remote session, commands and controller state connects the reported evidence (VPN gateway logs and PLC event record share session identifier) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves supplier remote access compromise and VPN gateway logs and PLC event record share session identifier.
C:Erasing artifacts undermines investigation and cannot fix compromised access. The immediate requirement for supplier remote access compromise is evidence assessment, which this alternative does not provide.
Question 384
In Health insurance carrier, a security issue affects claims web portal: stored XSS renders HTML from adjuster notes into claimant browser. The observed evidence is that isolated test account executes harmless injected marker. Operations must account for this constraint: release freeze limits emergency customer downtime. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Verify rendering context, privilege exposure and evidence of persistent injection
- Monitor injection attempts and new editor features
- Rely solely on browser CSP report-only mode forever
- Apply context-aware output encoding with safe HTML sanitization
Explanation
Correct Answer
D:Apply context-aware output encoding with safe HTML sanitization is the durable measure that addresses the observed weakness: stored XSS renders HTML from adjuster notes into claimant browser. It must be enforceable while preserving the stated constraint: release freeze limits emergency customer downtime.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
C:Reporting violations does not correct unsafe server-side output handling. The immediate requirement for claims web portal is durable control selection, which this alternative does not provide.
Question 385
In Industrial sensor SaaS, a security issue affects customer-managed cloud data keys: tenant onboarding creates provider-managed keys despite contractual customer control. The observed evidence is that audit shows key policy permits provider support decrypt without tenant approval. Operations must account for this constraint: critical sensor alerts cannot pause during key migration. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Stage re-encryption and deny stale provider key usage with recovery fallback
- Treat provider-managed encryption at rest as equivalent to customer-held key authority
- Report drift in key policy and overdue grant revocations to tenant owners
- Adopt customer-controlled keys with tenant-approved decrypt grants and rotation policies
Explanation
Correct Answer
A:Stage re-encryption and deny stale provider key usage with recovery fallback provides a governed means to introduce the chosen safeguard while respecting critical sensor alerts cannot pause during key migration. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Encrypted storage does not imply customer control over decryption authority. The immediate requirement for customer-managed cloud data keys is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves customer-managed cloud data keys and audit shows key policy permits provider support decrypt without tenant approval.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves customer-managed cloud data keys and audit shows key policy permits provider support decrypt without tenant approval.
Question 386
In National procurement agency, a security issue affects document download gateway: encoded path traversal resolves outside public document root. The observed evidence is that test input containing encoded dot-dot path returns internal configuration snippet. Operations must account for this constraint: public registry must remain available during patch window. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Monitor rejected traversal attempts and application regression
- Block one exact traversal string while leaving alternate encodings accepted
- Stage gateway validation and legacy URL compatibility under change control
- Canonicalize and confine file paths with least-privilege service account
Explanation
Correct Answer
C:Stage gateway validation and legacy URL compatibility under change control provides a governed means to introduce the chosen safeguard while respecting public registry must remain available during patch window. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
B:Single-pattern filters are easily bypassed by normalization variants. The immediate requirement for document download gateway is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
Question 387
In Health insurance carrier, a security issue affects claims web portal: stored XSS renders HTML from adjuster notes into claimant browser. The observed evidence is that isolated test account executes harmless injected marker. Operations must account for this constraint: release freeze limits emergency customer downtime. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Apply context-aware output encoding with safe HTML sanitization
- Rely solely on browser CSP report-only mode forever
- Retest recorded injection and legitimate formatted notes across browser clients
- Monitor injection attempts and new editor features
Explanation
Correct Answer
D:Monitor injection attempts and new editor features identifies future loss of control, changed dependencies and exceptions affecting claims web portal. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
B:Reporting violations does not correct unsafe server-side output handling. The immediate requirement for claims web portal is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
Question 388
In Utility operations network, a security issue affects DNSSEC validating resolver: secure applications intermittently fail only when one signed zone updates. The observed evidence is that resolver log shows bogus signatures after stale DS record persists at parent. Operations must account for this constraint: industrial control DNS must not resolve unsigned spoofed answers. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Compare DNSKEY, DS, signature inception and resolver failure path
- Correct signed key rollover and parent delegation consistency
- Monitor signature expiry and failed validations by zone
- Disable DNSSEC validation globally to eliminate SERVFAIL
Explanation
Correct Answer
B:Correct signed key rollover and parent delegation consistency is the durable measure that addresses the observed weakness: secure applications intermittently fail only when one signed zone updates. It must be enforceable while preserving the stated constraint: industrial control DNS must not resolve unsigned spoofed answers.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
D:Ignoring authentication failures trades availability for cache-poisoning risk. The immediate requirement for DNSSEC validating resolver is durable control selection, which this alternative does not provide.
Question 389
In Cross-border e-learning consortium, a security issue affects teacher privileged access: new teachers inherit broad tenant admin rights after self-provisioning. The observed evidence is that audit shows two schools' student records accessible to an unrelated teacher. Operations must account for this constraint: legitimate course access must be usable across campuses. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Assume school email domain membership authorizes all student records
- Map teacher assignments, requested privileges and protected tenant objects
- Review role drift and orphaned privileges after teacher departures
- Enforce least-privilege scoped roles with separation of provisioning and privileged approval
Explanation
Correct Answer
D:Enforce least-privilege scoped roles with separation of provisioning and privileged approval is the durable measure that addresses the observed weakness: new teachers inherit broad tenant admin rights after self-provisioning. It must be enforceable while preserving the stated constraint: legitimate course access must be usable across campuses.
Incorrect Answers
A:Domain membership is weaker than course-specific object authorization. The immediate requirement for teacher privileged access is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
Question 390
In Regional industrial consortium, a security issue affects OT threat-hunting program: outside feed labels new PLC malware but local asset inventory differs. The observed evidence is that feed has stale hashes and no confidence score for installed controller models. Operations must account for this constraint: active scan could disrupt safety-critical controllers. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Monitor new vendor advisories and changes in local controller inventory
- Deploy destructive malware samples directly on production PLCs
- Build hypothesis-driven passive hunt for command sequences and unauthorized firmware events
- Check whether matched PLC commands correlate with maintenance approvals
Explanation
Correct Answer
A:Monitor new vendor advisories and changes in local controller inventory identifies future loss of control, changed dependencies and exceptions affecting OT threat-hunting program. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Aggressive testing can damage physical processes and misstate threat applicability. The immediate requirement for OT threat-hunting program is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
