CompTIA CAS-005 Practice Test 41
Question 400
In Payment platform network, a security issue affects merchant tokenization assurance: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. The observed evidence is that assurance coverage omits script integrity and browser collection path. Operations must account for this constraint: payment processing cannot be interrupted for evidence review. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Determine what controls and data paths belong to merchant versus processor under applicable obligations
- Accept a service provider's SOC 2 report as complete proof of all PCI DSS obligations
- Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards
- Track scope changes and missed attestations under assigned compliance ownership
Explanation
Correct Answer
C:Design a control-to-evidence map including checkout integrity, contractual split and compensating safeguards is the durable measure that addresses the observed weakness: a provider supplies SOC 2 report but merchant PCI DSS scope includes a separate checkout script. It must be enforceable while preserving the stated constraint: payment processing cannot be interrupted for evidence review.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
B:Assurance scope and security-control applicability are not interchangeable. The immediate requirement for merchant tokenization assurance is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves merchant tokenization assurance and assurance coverage omits script integrity and browser collection path.
Question 401
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Increase CPU capacity while retaining check-then-act state updates
- Use atomic commit or locked state transition for settlement authorization
- Monitor inconsistent transaction histories and rollback rates
- Stage concurrency controls and reconciliation of pending transactions
Explanation
Correct Answer
D:Stage concurrency controls and reconciliation of pending transactions provides a governed means to introduce the chosen safeguard while respecting financial records need atomic decision semantics. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
Question 402
In Multinational healthcare provider, a security issue affects ransomware incident evidence: file server encryption follows suspicious remote management session. The observed evidence is that memory image identifies new service and encrypted file writes. Operations must account for this constraint: patient care must continue through verified emergency services. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Track reentry indicators and lessons-learned control owners
- Reboot every server immediately before collecting volatile evidence
- Remove malicious persistence and segregate compromised credentials
- Restore clean backups in quarantine and verify patient record integrity
Explanation
Correct Answer
A:Track reentry indicators and lessons-learned control owners identifies future loss of control, changed dependencies and exceptions affecting ransomware incident evidence. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Uncontrolled reboot can destroy memory artifacts and repeat compromise. The immediate requirement for ransomware incident evidence is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves ransomware incident evidence and memory image identifies new service and encrypted file writes.
Question 403
In Global industrial supplier, a security issue affects signed maintenance automation: PowerShell job downloads configuration from unsigned public repository. The observed evidence is that runbook shows shell executes remote code as a domain admin. Operations must account for this constraint: legacy plants allow only restricted maintenance windows. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Use signed packaged scripts from controlled repository with least-privilege service account
- Move scheduled tasks to signed-artifact execution and audited maintenance approval
- Track unauthorized script attempts, signing-key custody and job failures
- Obfuscate downloaded script text before running it as domain admin
Explanation
Correct Answer
B:Move scheduled tasks to signed-artifact execution and audited maintenance approval provides a governed means to introduce the chosen safeguard while respecting legacy plants allow only restricted maintenance windows. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves signed maintenance automation and runbook shows shell executes remote code as a domain admin.
D:Obfuscation hides code but neither proves origin nor limits privilege. The immediate requirement for signed maintenance automation is safe implementation, which this alternative does not provide.
Question 404
In Aviation maintenance provider, a security issue affects contractor certificate access: outsourced engineers authenticate successfully but see unrelated aircraft service logs. The observed evidence is that claims carry vendor role without aircraft assignment attribute. Operations must account for this constraint: emergency repair authorization must remain auditable. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Create an unrestricted contractor role for faster incident response
- Trace subject attributes, resource ownership and when vendor assignments are valid
- Deploy certificate-bound conditional access and time-limited assignment grants
- Use ABAC based on current aircraft assignment with central policy decision and enforcement
Explanation
Correct Answer
B:Trace subject attributes, resource ownership and when vendor assignments are valid connects the reported evidence (claims carry vendor role without aircraft assignment attribute) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Authentication does not justify organization-wide authorization. The immediate requirement for contractor certificate access is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves contractor certificate access and claims carry vendor role without aircraft assignment attribute.
Question 405
In Retail fraud analytics vendor, a security issue affects claims model training pipeline: contractor can poison labeled training rows without independent provenance. The observed evidence is that version control shows unreviewed data-label changes before a model drift spike. Operations must account for this constraint: fraud detection must not silently block legitimate purchases. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Reproduce baseline metrics and adversarial label-poisoning tests on held-out samples
- Identify data provenance, attacker influence on labels and downstream decision effects
- Add more output filtering while leaving the training data channel untrusted
- Roll out gated training dataset promotion and clean-data rollback under owner approval
Explanation
Correct Answer
A:Reproduce baseline metrics and adversarial label-poisoning tests on held-out samples tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
C:Output-only checks do not repair compromised model inputs. The immediate requirement for claims model training pipeline is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
Question 406
In Financial services SaaS, a security issue affects cloud audit trail: one tenant stops reporting access logs after a role update. The observed evidence is that ingestion dashboard shows no events though client API traffic persists. Operations must account for this constraint: financial audit retention cannot have silent gaps. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Treat absence of alerts as evidence the tenant has no incidents
- Add signed ingestion heartbeat and independently monitored failure escalation
- Restore audit connector with least-privilege service role and staged resync
- Trend source silence and unresolved collection gaps by owner
Explanation
Correct Answer
C:Restore audit connector with least-privilege service role and staged resync provides a governed means to introduce the chosen safeguard while respecting financial audit retention cannot have silent gaps. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Telemetry omission does not imply absence of malicious activity. The immediate requirement for cloud audit trail is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
Question 407
In Utility operations network, a security issue affects DNSSEC validating resolver: secure applications intermittently fail only when one signed zone updates. The observed evidence is that resolver log shows bogus signatures after stale DS record persists at parent. Operations must account for this constraint: industrial control DNS must not resolve unsigned spoofed answers. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Correct signed key rollover and parent delegation consistency
- Disable DNSSEC validation globally to eliminate SERVFAIL
- Coordinate zone key and registrar DS change in ordered rollout with rollback
- Monitor signature expiry and failed validations by zone
Explanation
Correct Answer
C:Coordinate zone key and registrar DS change in ordered rollout with rollback provides a governed means to introduce the chosen safeguard while respecting industrial control DNS must not resolve unsigned spoofed answers. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
B:Ignoring authentication failures trades availability for cache-poisoning risk. The immediate requirement for DNSSEC validating resolver is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
Question 408
In Public transit fare network, a security issue affects contactless validation: one central certificate service can halt all station validators on outage. The observed evidence is that recent test shows otherwise healthy validators cannot cache authorized local decisions. Operations must account for this constraint: offline tickets must expire safely and prevent duplicate redemption. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Monitor offline token abuse, reconciliation gaps and certificate service health
- Permit unlimited local ticket acceptance when the central service fails
- Introduce bounded signed offline entitlements with replay controls and central reconciliation
- Determine authorization dependencies, offline validity and replay failure modes
Explanation
Correct Answer
C:Introduce bounded signed offline entitlements with replay controls and central reconciliation is the durable measure that addresses the observed weakness: one central certificate service can halt all station validators on outage. It must be enforceable while preserving the stated constraint: offline tickets must expire safely and prevent duplicate redemption.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
B:Unbounded offline acceptance defeats fraud and expiry controls. The immediate requirement for contactless validation is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves contactless validation and recent test shows otherwise healthy validators cannot cache authorized local decisions.
Question 409
In Consumer video platform, a security issue affects serverless media processing: function has default outbound access and can retrieve unrelated customer buckets. The observed evidence is that trace shows public trigger supplying storage key outside its user's namespace. Operations must account for this constraint: uploads must continue without long-running servers. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Trace event identity, function token privileges and object authorization boundary
- Bind function privileges to per-user object path and minimal egress destinations
- Use WAF filtering alone on upload URL while keeping broad backend IAM
- Track token scopes, denied cross-tenant reads and function configuration drift
Explanation
Correct Answer
B:Bind function privileges to per-user object path and minimal egress destinations is the durable measure that addresses the observed weakness: function has default outbound access and can retrieve unrelated customer buckets. It must be enforceable while preserving the stated constraint: uploads must continue without long-running servers.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
C:Edge input filtering cannot replace resource authorization enforced in cloud. The immediate requirement for serverless media processing is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
Question 410
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Design automation to report unknown/unscanned separately from compliant
- Introduce known unscanned hosts and verify they fail the compliance gate
- Monitor scanning coverage, stale exceptions and schema changes
- Set unscanned hosts to compliant until a high CVE is detected
Explanation
Correct Answer
C:Monitor scanning coverage, stale exceptions and schema changes identifies future loss of control, changed dependencies and exceptions affecting automated vulnerability exception reports. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
D:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is ongoing assurance, which this alternative does not provide.
