CompTIA CAS-005 Practice Test 43
Question 420
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Use voice similarity alone as proof of executive approval
- Assess speaker verification, source integrity and the approval boundary before assigning origin
- Track deepfake attempts, bypasses and time-to-authenticated publication
- Design out-of-band executive verification and signed release approvals
Explanation
Correct Answer
D:Design out-of-band executive verification and signed release approvals is the durable measure that addresses the observed weakness: voice-cloned executive requests urgent publication of a false safety notice. It must be enforceable while preserving the stated constraint: public warning delays could also create harm.
Incorrect Answers
A:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
Question 421
In Multinational pharmacy network, a security issue affects privileged admin access: contract support personnel keep permanent global administrator tokens. The observed evidence is that PAM session logs show logins outside authorized maintenance tickets. Operations must account for this constraint: production medication distribution must remain recoverable. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Review privileged-access exceptions and unlinked admin activity weekly
- Match privileged sessions to sponsor approvals, ticket, device and actual task
- Use just-in-time elevation with recorded sessions and scope-limited break-glass
- Rely on a monthly attestation while preserving permanent global privileges
Explanation
Correct Answer
C:Use just-in-time elevation with recorded sessions and scope-limited break-glass is the durable measure that addresses the observed weakness: contract support personnel keep permanent global administrator tokens. It must be enforceable while preserving the stated constraint: production medication distribution must remain recoverable.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
D:Administrative review does not remove exploitable standing privilege. The immediate requirement for privileged admin access is durable control selection, which this alternative does not provide.
Question 422
In International airport operator, a security issue affects baggage conveyor controls: vendor remote support shares an always-on cellular modem into operational network. The observed evidence is that network diagram lists modem outside airport change and asset inventory. Operations must account for this constraint: conveyor recovery must remain available in urgent incidents. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Map remote support path, vendor identity and reachable control endpoints
- Disable all vendor support permanently without an emergency operational route
- Replace persistent cellular connection with approved on-demand jump access
- Try remote vendor connection outside window and verify denied access
Explanation
Correct Answer
D:Try remote vendor connection outside window and verify denied access tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
B:Availability and safety still need controlled emergency maintenance. The immediate requirement for baggage conveyor controls is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
Question 423
In Public healthcare research network, a security issue affects de-identified test data: development teams copy patient tables into test environments with unclear stewardship. The observed evidence is that file inventories show identifiers in two staging buckets while production classification differs. Operations must account for this constraint: research testing must continue without exporting patient identities. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Migrate test workloads by removing real identifiers before enabling restricted synthetic fixtures
- Implement approved synthetic-data and masked-subset standards with clear data owners and lifecycle gates
- Assume staging data is exempt from data-governance policy
- Trace data creation, custody, classification and deletion duties across development and production
Explanation
Correct Answer
D:Trace data creation, custody, classification and deletion duties across development and production connects the reported evidence (file inventories show identifiers in two staging buckets while production classification differs) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves de-identified test data and file inventories show identifiers in two staging buckets while production classification differs.
C:Testing environments can expose protected information even when not customer-facing. The immediate requirement for de-identified test data is evidence assessment, which this alternative does not provide.
Question 424
In Telecom merger program, a security issue affects shared customer identity directory: newly merged help desks can reset privileged credentials across subsidiaries. The observed evidence is that interviews expose undocumented reset exceptions and a common administrator group. Operations must account for this constraint: customer authentication must stay continuous throughout merger. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Migrate administrative privileges with parallel monitoring and explicit exception expiry
- Enumerate actual reset paths, authority roles and cross-subsidiary privilege abuse cases
- Set separated reset authorization and identity-proofing controls across subsidiaries
- Draw only an external network diagram and omit human support processes
Explanation
Correct Answer
B:Enumerate actual reset paths, authority roles and cross-subsidiary privilege abuse cases connects the reported evidence (interviews expose undocumented reset exceptions and a common administrator group) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
D:Social-engineering and process paths can bypass well-segmented network controls. The immediate requirement for shared customer identity directory is evidence assessment, which this alternative does not provide.
Question 425
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Send raw patient records to prove the indicator is important
- Confirm IOC source, timestamps, confidence and relevant environment context
- Use STIX indicator package with confidence, classification and minimized fields
- Reassess indicator freshness and revoke obsolete intelligence
Explanation
Correct Answer
C:Use STIX indicator package with confidence, classification and minimized fields is the durable measure that addresses the observed weakness: partner wants raw EHR fields with an observed phishing indicator. It must be enforceable while preserving the stated constraint: privacy rules limit sharing of patient identifiers.
Incorrect Answers
A:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
Question 426
In Regional hospital consortium, a security issue affects patient telemetry exchange: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. The observed evidence is that contracts specify different deletion and legal-hold periods for two locations. Operations must account for this constraint: care teams need regulated continuity across jurisdictions. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Sample actual retention actions and hold exceptions against the relevant legal matrix
- Copy a single vendor default retention period to every hospital
- Apply policy-as-code to pilot locations under logged approval and preservation safeguards
- Map binding retention, access, breach notice and legal-hold duties per location and data type
Explanation
Correct Answer
A:Sample actual retention actions and hold exceptions against the relevant legal matrix tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Vendor defaults cannot supersede conflicting jurisdictional obligations. The immediate requirement for patient telemetry exchange is verified remediation, which this alternative does not provide.
C:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
Question 427
In International nonprofit, a security issue affects cloud bucket exposure incident: public bucket policy reveals donor-contact files. The observed evidence is that cloud audit shows anonymous object reads and recent policy edit. Operations must account for this constraint: donor assistance systems must retain approved access. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Preserve object and policy records before staged access correction
- Test anonymous denial and authorized donor-service availability
- Establish scope from object access logs, policy versions and retention evidence
- Assume encryption at rest prevents any readable anonymous access
Explanation
Correct Answer
B:Test anonymous denial and authorized donor-service availability tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
D:Provider-managed storage encryption does not replace object authorization. The immediate requirement for cloud bucket exposure incident is verified remediation, which this alternative does not provide.
Question 428
In National procurement agency, a security issue affects document download gateway: encoded path traversal resolves outside public document root. The observed evidence is that test input containing encoded dot-dot path returns internal configuration snippet. Operations must account for this constraint: public registry must remain available during patch window. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Block one exact traversal string while leaving alternate encodings accepted
- Try encoded traversal variants and confirm protected files never return
- Monitor rejected traversal attempts and application regression
- Canonicalize and confine file paths with least-privilege service account
Explanation
Correct Answer
C:Monitor rejected traversal attempts and application regression identifies future loss of control, changed dependencies and exceptions affecting document download gateway. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Single-pattern filters are easily bypassed by normalization variants. The immediate requirement for document download gateway is ongoing assurance, which this alternative does not provide.
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
Question 429
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Design automation to report unknown/unscanned separately from compliant
- Stage inventory reconciliation in CI and schedule authenticated rescan windows
- Set unscanned hosts to compliant until a high CVE is detected
- Compare scanner scope with CMDB and detect non-reporting assets
Explanation
Correct Answer
D:Compare scanner scope with CMDB and detect non-reporting assets connects the reported evidence (job aggregates only scanned assets; asset inventory has 200 missing hosts) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
C:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is evidence assessment, which this alternative does not provide.
Question 430
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Design export classification tags with approved jurisdiction- and identity-based access policy
- Apply controlled restrictions and approved exception workflow before supplier migration
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
- Correlate drawing classification, personnel nationality, location and contractual permits
Explanation
Correct Answer
D:Correlate drawing classification, personnel nationality, location and contractual permits connects the reported evidence (access reports show foreign support staff retrieving controlled CAD files) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
C:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is evidence assessment, which this alternative does not provide.
