CompTIA CAS-005 Practice Test 44
Question 430
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Design export classification tags with approved jurisdiction- and identity-based access policy
- Apply controlled restrictions and approved exception workflow before supplier migration
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
- Correlate drawing classification, personnel nationality, location and contractual permits
Explanation
Correct Answer
D:Correlate drawing classification, personnel nationality, location and contractual permits connects the reported evidence (access reports show foreign support staff retrieving controlled CAD files) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
C:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is evidence assessment, which this alternative does not provide.
Question 431
In Cloud archive provider, a security issue affects cross-region object restoration: all backups replicate deletion markers instantly across both regions. The observed evidence is that restore exercise finds accidental deletes mirrored into recovery bucket. Operations must account for this constraint: contract requires 24-hour recovery-point protection. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Enable object retention and cross-account recovery with authorized break-glass
- Trace replication and deletion propagation across regional trust paths
- Add a third synchronously mirrored bucket with identical deletion permissions
- Delete a canary object and recover prior version inside required RPO
Explanation
Correct Answer
D:Delete a canary object and recover prior version inside required RPO tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cross-region object restoration and restore exercise finds accidental deletes mirrored into recovery bucket.
C:Mirroring the same destructive operation does not provide isolated recovery. The immediate requirement for cross-region object restoration is verified remediation, which this alternative does not provide.
Question 432
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Increase CPU capacity while retaining check-then-act state updates
- Inspect transaction isolation, request timing and duplicated settlement states
- Run parallel submission tests and prove one definitive settlement state
- Stage concurrency controls and reconciliation of pending transactions
Explanation
Correct Answer
C:Run parallel submission tests and prove one definitive settlement state tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is verified remediation, which this alternative does not provide.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
Question 433
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Test denial of unauthorized bulk export and integrity of retained evidence
- Correlate identity, query history, DLP hashes and chain of custody
- Disable all audit logging to reduce storage during investigation
- Preserve immutable log copy and suspend only implicated export sessions
Explanation
Correct Answer
A:Test denial of unauthorized bulk export and integrity of retained evidence tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
C:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
Question 434
In Municipal property records, a security issue affects data classification program: copies of landowner identity documents have no owner tags outside primary database. The observed evidence is that object discovery finds sensitive scans in shared document stores. Operations must account for this constraint: historical record access rights vary by role and jurisdiction. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Encrypt only the main database while ignoring uncontrolled replicas
- Design classification labels and role-based retention with storage DLP
- Monitor new unlabeled assets and ownerless retention exceptions
- Identify all stored copies, owners, data flows and permitted use
Explanation
Correct Answer
B:Design classification labels and role-based retention with storage DLP is the durable measure that addresses the observed weakness: copies of landowner identity documents have no owner tags outside primary database. It must be enforceable while preserving the stated constraint: historical record access rights vary by role and jurisdiction.
Incorrect Answers
A:Strong encryption on one copy does not govern replicated sensitive data. The immediate requirement for data classification program is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
Question 435
In Financial services SaaS, a security issue affects cloud audit trail: one tenant stops reporting access logs after a role update. The observed evidence is that ingestion dashboard shows no events though client API traffic persists. Operations must account for this constraint: financial audit retention cannot have silent gaps. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Treat absence of alerts as evidence the tenant has no incidents
- Restore audit connector with least-privilege service role and staged resync
- Reconcile event sources with API activity, subscription permissions and connector health
- Generate test access events and verify exact tenant attribution in SIEM
Explanation
Correct Answer
D:Generate test access events and verify exact tenant attribution in SIEM tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Telemetry omission does not imply absence of malicious activity. The immediate requirement for cloud audit trail is verified remediation, which this alternative does not provide.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cloud audit trail and ingestion dashboard shows no events though client API traffic persists.
Question 436
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Require authenticated ephemeral key agreement with forward secrecy and modern AEAD
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
- Compromise test server key and confirm prior recorded sessions stay confidential
- Monitor fallback cipher negotiations and expired certificates
Explanation
Correct Answer
D:Monitor fallback cipher negotiations and expired certificates identifies future loss of control, changed dependencies and exceptions affecting session key compromise. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
B:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
Question 437
In Regional hospital, a security issue affects central log pipeline: time drift makes correlated EDR and authentication events appear reversed. The observed evidence is that endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate. Operations must account for this constraint: incident evidence must preserve original timestamps for legal review. The decision is now about a preventive or corrective security architecture, not investigation or rollout. What should be chosen?
- Normalize event time with recorded offsets while retaining original evidence
- Monitor time synchronization drift and cross-source correlation confidence
- Declare lateral movement simply from apparent log order
- Compare source clocks, timezones, ingest time and NTP health before causality claims
Explanation
Correct Answer
A:Normalize event time with recorded offsets while retaining original evidence is the durable measure that addresses the observed weakness: time drift makes correlated EDR and authentication events appear reversed. It must be enforceable while preserving the stated constraint: incident evidence must preserve original timestamps for legal review.
Incorrect Answers
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
C:Uncorrected clock offset can fabricate an attack sequence. The immediate requirement for central log pipeline is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
Question 438
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Introduce known unscanned hosts and verify they fail the compliance gate
- Stage inventory reconciliation in CI and schedule authenticated rescan windows
- Compare scanner scope with CMDB and detect non-reporting assets
- Set unscanned hosts to compliant until a high CVE is detected
Explanation
Correct Answer
A:Introduce known unscanned hosts and verify they fail the compliance gate tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
D:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is verified remediation, which this alternative does not provide.
Question 439
In Regional hospital consortium, a security issue affects patient telemetry exchange: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. The observed evidence is that contracts specify different deletion and legal-hold periods for two locations. Operations must account for this constraint: care teams need regulated continuity across jurisdictions. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Design jurisdiction-aware retention and access rules with owner and legal review
- Copy a single vendor default retention period to every hospital
- Monitor regulation and partner contract changes that invalidate previous settings
- Map binding retention, access, breach notice and legal-hold duties per location and data type
Explanation
Correct Answer
A:Design jurisdiction-aware retention and access rules with owner and legal review is the durable measure that addresses the observed weakness: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. It must be enforceable while preserving the stated constraint: care teams need regulated continuity across jurisdictions.
Incorrect Answers
B:Vendor defaults cannot supersede conflicting jurisdictional obligations. The immediate requirement for patient telemetry exchange is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
Question 440
In Regional savings cooperative, a security issue affects branch risk-exception approvals: branch managers waive sensitive-data controls without a delegated authority matrix. The observed evidence is that three exceptions show contradictory signatures and no expiry. Operations must account for this constraint: board retains decisions beyond financial tolerance. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Make the CISO sole risk acceptor for every branch exception
- Track overdue approvals and tolerance breaches by accountable branch and enterprise owner
- Pilot the approval workflow in two branches with recorded escalation and rollback of legacy delegation
- Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance
Explanation
Correct Answer
C:Pilot the approval workflow in two branches with recorded escalation and rollback of legacy delegation provides a governed means to introduce the chosen safeguard while respecting board retains decisions beyond financial tolerance. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:A security function can advise but cannot unilaterally own the business consequence. The immediate requirement for branch risk-exception approvals is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
