CompTIA CAS-005 Practice Test 40
Question 390
In Regional industrial consortium, a security issue affects OT threat-hunting program: outside feed labels new PLC malware but local asset inventory differs. The observed evidence is that feed has stale hashes and no confidence score for installed controller models. Operations must account for this constraint: active scan could disrupt safety-critical controllers. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Monitor new vendor advisories and changes in local controller inventory
- Deploy destructive malware samples directly on production PLCs
- Build hypothesis-driven passive hunt for command sequences and unauthorized firmware events
- Check whether matched PLC commands correlate with maintenance approvals
Explanation
Correct Answer
A:Monitor new vendor advisories and changes in local controller inventory identifies future loss of control, changed dependencies and exceptions affecting OT threat-hunting program. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Aggressive testing can damage physical processes and misstate threat applicability. The immediate requirement for OT threat-hunting program is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves OT threat-hunting program and feed has stale hashes and no confidence score for installed controller models.
Question 391
In Digital banking consortium, a security issue affects partner API gateway: a compromised supplier token may traverse a trust boundary into payment settlement. The observed evidence is that data-flow diagram shows service account can write settlements without transaction approval. Operations must account for this constraint: settlement continuity must retain independent approval. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Revisit threat model after partner interface or identity trust changes
- Only scan the public gateway for well-known CVEs
- Attempt controlled cross-boundary settlement changes to demonstrate denials and audit trails
- Place authorization and dual-control barriers at the settlement trust boundary
Explanation
Correct Answer
A:Revisit threat model after partner interface or identity trust changes identifies future loss of control, changed dependencies and exceptions affecting partner API gateway. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Vulnerability scanning alone misses abuse of legitimate delegated authority. The immediate requirement for partner API gateway is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
Question 392
In Global industrial supplier, a security issue affects signed maintenance automation: PowerShell job downloads configuration from unsigned public repository. The observed evidence is that runbook shows shell executes remote code as a domain admin. Operations must account for this constraint: legacy plants allow only restricted maintenance windows. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Obfuscate downloaded script text before running it as domain admin
- Use signed packaged scripts from controlled repository with least-privilege service account
- Track unauthorized script attempts, signing-key custody and job failures
- Trace script source, signature validation and effective execution privileges
Explanation
Correct Answer
B:Use signed packaged scripts from controlled repository with least-privilege service account is the durable measure that addresses the observed weakness: PowerShell job downloads configuration from unsigned public repository. It must be enforceable while preserving the stated constraint: legacy plants allow only restricted maintenance windows.
Incorrect Answers
A:Obfuscation hides code but neither proves origin nor limits privilege. The immediate requirement for signed maintenance automation is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
Question 393
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
- Implement prioritized checkout controls through approved deployment and supplier coordination
- Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards
- Determine what controls and data paths belong to merchant versus processor under applicable obligations
Explanation
Correct Answer
D:Determine what controls and data paths belong to merchant versus processor under applicable obligations connects the reported evidence (assurance coverage omits script integrity and browser collection path) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is evidence assessment, which this alternative does not provide.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
Question 394
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Map signing-key custody, firmware provenance and approval workflow
- Require hardware-protected release keys and dual-controlled signed artifacts
- Publish a security policy without changing exposed signing-key storage
- Migrate firmware signing to protected service with compatible staged distribution
Explanation
Correct Answer
A:Map signing-key custody, firmware provenance and approval workflow connects the reported evidence (release record has no HSM-backed signing evidence or independent approval) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
C:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
Question 395
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Stage campus supplicant updates by device cohorts before retiring old CA
- Track expiring trust anchors and device enrollment exceptions
- Disable certificate validation on the wireless controller to restore service
- Deploy approved current CA chain and certificate lifecycle automation with client trust pinning
Explanation
Correct Answer
A:Stage campus supplicant updates by device cohorts before retiring old CA provides a governed means to introduce the chosen safeguard while respecting lab instruments lack unattended manual logon. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
C:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
Question 396
In Global retail chain, a security issue affects mobile point-of-sale endpoints: lost devices retain local cached payment support credentials. The observed evidence is that MDM inventory shows unencrypted cache and delayed wipe acknowledgment. Operations must account for this constraint: stores must process legitimate transactions offline for short periods. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Treat a screen lock as sufficient protection for permanently cached secrets
- Monitor unmanaged devices, stale offline grants and wipe confirmation
- Simulate device loss and verify cached keys become unusable after revocation window
- Use hardware-backed encryption and short-lived offline transaction entitlements
Explanation
Correct Answer
B:Monitor unmanaged devices, stale offline grants and wipe confirmation identifies future loss of control, changed dependencies and exceptions affecting mobile point-of-sale endpoints. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:UI locking alone cannot protect offline credentials against device extraction. The immediate requirement for mobile point-of-sale endpoints is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves mobile point-of-sale endpoints and MDM inventory shows unencrypted cache and delayed wipe acknowledgment.
Question 397
In Financial services chatbot, a security issue affects internal AI agent payments tool: assistant has broad money-transfer permission while retrieved emails supply payment instructions. The observed evidence is that dry run shows model proposes transfer from an untrusted email thread. Operations must account for this constraint: finance staff need read-only analysis without autonomous payment authorization. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Audit agent permissions, tool calls and model updates for excessive agency
- Warn users that AI can make mistakes but keep unrestricted transfer tokens
- Deploy allowlisted tools and an independent human confirmation for each value transfer
- Separate read-only analysis identity from payment execution with hard business approval
Explanation
Correct Answer
C:Deploy allowlisted tools and an independent human confirmation for each value transfer provides a governed means to introduce the chosen safeguard while respecting finance staff need read-only analysis without autonomous payment authorization. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
B:Awareness notices do not enforce authorization at the payment API. The immediate requirement for internal AI agent payments tool is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves internal AI agent payments tool and dry run shows model proposes transfer from an untrusted email thread.
Question 398
In Global shipping company, a security issue affects laptop measured boot: stolen field laptops may boot malicious firmware and bypass disk trust. The observed evidence is that TPM measurements differ from approved boot baseline on one returned device. Operations must account for this constraint: offline vessel operation needs local disk availability. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Monitor measured-boot anomalies and approved firmware updates
- Require only a BIOS setup password while leaving boot-chain trust unchecked
- Deploy firmware baseline and recovery key escrow with staged compatibility checks
- Bind disk release to Secure Boot and TPM measured-boot policy
Explanation
Correct Answer
C:Deploy firmware baseline and recovery key escrow with staged compatibility checks provides a governed means to introduce the chosen safeguard while respecting offline vessel operation needs local disk availability. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
B:A setup password does not attest runtime boot components. The immediate requirement for laptop measured boot is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves laptop measured boot and TPM measurements differ from approved boot baseline on one returned device.
Question 399
In Municipal water operations, a security issue affects smart-meter firmware telemetry: vendor aggregator asks for full device-control subnet access to collect counters. The observed evidence is that architecture shows shared broker between read telemetry and valve commands. Operations must account for this constraint: meter ingestion must survive a cellular disconnect. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Deploy gateway policies with offline telemetry buffer and blocked actuator access
- Separate read-only meter data flows from actuator control and verify identities
- Exercise rogue meter publisher and confirm command paths remain denied
- Trust every authenticated device for all controls in the plant subnet
Explanation
Correct Answer
C:Exercise rogue meter publisher and confirm command paths remain denied tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves smart-meter firmware telemetry and architecture shows shared broker between read telemetry and valve commands.
D:Device presence does not imply approval to execute high-risk actuation. The immediate requirement for smart-meter firmware telemetry is verified remediation, which this alternative does not provide.
Question 400
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Determine what controls and data paths belong to merchant versus processor under applicable obligations
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
- Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards
- Track scope changes and missed attestations under assigned compliance ownership
Explanation
Correct Answer
C:Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards is the durable measure that addresses the observed weakness: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. It must be enforceable while preserving the stated constraint: payment processing cannot be interrupted for evidence review.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
B:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
