CompTIA CAS-005 Practice Test 42
Question 410
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Design automation to report unknown/unscanned separately from compliant
- Introduce known unscanned hosts and verify they fail the compliance gate
- Monitor scanning coverage, stale exceptions and schema changes
- Set unscanned hosts to compliant until a high CVE is detected
Explanation
Correct Answer
C:Monitor scanning coverage, stale exceptions and schema changes identifies future loss of control, changed dependencies and exceptions affecting automated vulnerability exception reports. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
D:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is ongoing assurance, which this alternative does not provide.
Question 411
In Enterprise airline alliance, a security issue affects federated passenger identity: service accepts OAuth ID token as authorization to modify travel reservations. The observed evidence is that gateway trace shows audience mismatch while access token scopes are absent. Operations must account for this constraint: check-in must remain usable on partner airline identity. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Use resource-specific scoped access tokens and validate issuer/audience at API boundary
- Treat a valid user login session as permission for any partner booking update
- Track new federation trust grants and unauthorized cross-airline booking attempts
- Replay wrong-audience ID tokens against booking API and verify rejection
Explanation
Correct Answer
C:Track new federation trust grants and unauthorized cross-airline booking attempts identifies future loss of control, changed dependencies and exceptions affecting federated passenger identity. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
B:Authentication by itself does not create scoped delegated API authority. The immediate requirement for federated passenger identity is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
Question 412
In National patent office, a security issue affects digitally signed patent submissions: system stores hashes but cannot establish which inventor approved a filing. The observed evidence is that audit finds shared signing key used by several reviewers. Operations must account for this constraint: legal non-repudiation requires identity-bound approval. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Verify modified filings fail validation and approvals map to distinct signers
- Migrate shared signing access into per-person protected key issuance
- Trace identity proofing, signature custody and legally relevant metadata
- Use a plain hash file without signer identification as evidence of inventor assent
Explanation
Correct Answer
A:Verify modified filings fail validation and approvals map to distinct signers tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
D:Hashes detect change but do not bind approval to an accountable individual. The immediate requirement for digitally signed patent submissions is verified remediation, which this alternative does not provide.
Question 413
In Regional financial services, a security issue affects SOAR containment playbooks: unverified threat-intel match triggers automated network isolation of payroll servers. The observed evidence is that test playbook lacks confidence threshold and service-owner confirmation. Operations must account for this constraint: payroll uptime has a hard regulatory reporting deadline. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Set every low-confidence feed hit to automatic full network shutdown
- Feed benign and malicious events to prove safe containment and suppression behavior
- Stage playbook in simulation-only mode with auditable manual override
- Reconstruct alert quality, enrichment data and automation decision path
Explanation
Correct Answer
B:Feed benign and malicious events to prove safe containment and suppression behavior tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Unbounded action on uncertain indicators creates unacceptable operational disruption. The immediate requirement for SOAR containment playbooks is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
Question 414
In Regional financial services, a security issue affects SOAR containment playbooks: unverified threat-intel match triggers automated network isolation of payroll servers. The observed evidence is that test playbook lacks confidence threshold and service-owner confirmation. Operations must account for this constraint: payroll uptime has a hard regulatory reporting deadline. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Gate high-impact isolation on corroboration, approval and bounded service scope
- Track false isolations, approval latency and automation exceptions
- Stage playbook in simulation-only mode with auditable manual override
- Set every low-confidence feed hit to automatic full network shutdown
Explanation
Correct Answer
C:Stage playbook in simulation-only mode with auditable manual override provides a governed means to introduce the chosen safeguard while respecting payroll uptime has a hard regulatory reporting deadline. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
D:Unbounded action on uncertain indicators creates unacceptable operational disruption. The immediate requirement for SOAR containment playbooks is safe implementation, which this alternative does not provide.
Question 415
In University student portal, a security issue affects session authorization API: logged-in users can change course ID to view another student's grades. The observed evidence is that two test accounts demonstrate data access after swapping object identifier. Operations must account for this constraint: grading deadline prohibits large service outage. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Trace subject-to-object authorization at API and data layer
- Deploy authorization policy in canary cohort with audit-only fallback limited in time
- Use stronger user passwords but no object ownership enforcement
- Retest swapped IDs and legitimate instructor access for all roles
Explanation
Correct Answer
D:Retest swapped IDs and legitimate instructor access for all roles tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
C:Authentication strength does not stop an authenticated cross-user IDOR. The immediate requirement for session authorization API is verified remediation, which this alternative does not provide.
Question 416
In International retail group, a security issue affects security program governance: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. The observed evidence is that audit finds one reseller exception kept open after its contract expired. Operations must account for this constraint: acquired subsidiaries must preserve local lawful approvals. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Import all spreadsheet values as approved exceptions without provenance
- Report unowned critical exceptions and unresolved GRC mapping conflicts to governance
- Inventory controls, obligations, exception records and overlapping legal entities
- Implement a central GRC evidence map with approved local ownership and common expiry controls
Explanation
Correct Answer
D:Implement a central GRC evidence map with approved local ownership and common expiry controls is the durable measure that addresses the observed weakness: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. It must be enforceable while preserving the stated constraint: acquired subsidiaries must preserve local lawful approvals.
Incorrect Answers
A:Migration cannot confer acceptance authority absent from the original decision. The immediate requirement for security program governance is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
Question 417
In Cross-border airline ticketing, a security issue affects web booking API: JSON deserializer allows attacker-controlled polymorphic type. The observed evidence is that safe canary in test triggers unexpected class instantiation. Operations must account for this constraint: live booking must not suffer intrusive proof-of-concept tests. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Add an inbound rate limit while retaining unsafe object instantiation
- Stage parser change and dependency upgrade using canary traffic
- Feed malformed types in authorized test to verify rejection and valid booking
- Identify reachable parsing endpoint, runtime and unsafe type resolution
Explanation
Correct Answer
C:Feed malformed types in authorized test to verify rejection and valid booking tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Rate limiting is insufficient against reachable deserialization exploitation. The immediate requirement for web booking API is verified remediation, which this alternative does not provide.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves web booking API and safe canary in test triggers unexpected class instantiation.
Question 418
In Health insurance carrier, a security issue affects claims web portal: stored XSS renders HTML from adjuster notes into claimant browser. The observed evidence is that isolated test account executes harmless injected marker. Operations must account for this constraint: release freeze limits emergency customer downtime. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Deploy safe rendering through feature-flagged change with rollback
- Apply context-aware output encoding with safe HTML sanitization
- Verify rendering context, privilege exposure and evidence of persistent injection
- Rely solely on browser CSP report-only mode forever
Explanation
Correct Answer
C:Verify rendering context, privilege exposure and evidence of persistent injection connects the reported evidence (isolated test account executes harmless injected marker) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
D:Reporting violations does not correct unsafe server-side output handling. The immediate requirement for claims web portal is evidence assessment, which this alternative does not provide.
Question 419
In Energy grid market operator, a security issue affects interconnect service mesh: trusted east-west traffic carries control requests beyond the caller's market function. The observed evidence is that service telemetry shows a reporting workload invoking command endpoints. Operations must account for this constraint: latency budgets limit heavyweight security proxies on plant links. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Map service identities, target operations and exact data-flow security boundaries
- Hide the entire mesh behind a perimeter firewall and allow internal calls
- Watch service identity rotation and cross-zone policy exceptions
- Use mutual workload identities and per-operation policy at a service enforcement point
Explanation
Correct Answer
D:Use mutual workload identities and per-operation policy at a service enforcement point is the durable measure that addresses the observed weakness: trusted east-west traffic carries control requests beyond the caller's market function. It must be enforceable while preserving the stated constraint: latency budgets limit heavyweight security proxies on plant links.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
B:Outer perimeter trust cannot restrict lateral service-to-service privileges. The immediate requirement for interconnect service mesh is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
Question 420
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Use voice similarity alone as proof of executive approval
- Assess speaker verification, source integrity and the approval boundary before assigning origin
- Track deepfake attempts, bypasses and time-to-authenticated publication
- Design out-of-band executive verification and signed release approvals
Explanation
Correct Answer
D:Design out-of-band executive verification and signed release approvals is the durable measure that addresses the observed weakness: voice-cloned executive requests urgent publication of a false safety notice. It must be enforceable while preserving the stated constraint: public warning delays could also create harm.
Incorrect Answers
A:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
