CompTIA CAS-005 Practice Test 45
Question 440
In Regional savings cooperative, a security issue affects branch risk-exception approvals: branch managers waive sensitive-data controls without a delegated authority matrix. The observed evidence is that three exceptions show contradictory signatures and no expiry. Operations must account for this constraint: board retains decisions beyond financial tolerance. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Make the CISO sole risk acceptor for every branch exception
- Track overdue approvals and tolerance breaches by accountable branch and enterprise owner
- Pilot the approval workflow in two branches with recorded escalation and rollback of legacy delegation
- Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance
Explanation
Correct Answer
C:Pilot the approval workflow in two branches with recorded escalation and rollback of legacy delegation provides a governed means to introduce the chosen safeguard while respecting board retains decisions beyond financial tolerance. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:A security function can advise but cannot unilaterally own the business consequence. The immediate requirement for branch risk-exception approvals is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
Question 441
In Aerospace component maker, a security issue affects export-controlled design vault: contractors in multiple countries access drawings without an approved export classification. The observed evidence is that access reports show foreign support staff retrieving controlled CAD files. Operations must account for this constraint: supplier repair deadlines are mandatory but do not override export control. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Treat strong TLS encryption as permission for any foreign contractor to receive drawings
- Test blocked and allowed retrieval paths with auditable identities and export approvals
- Correlate drawing classification, personnel nationality, location and contractual permits
- Apply controlled restrictions and approved exception workflow before supplier migration
Explanation
Correct Answer
B:Test blocked and allowed retrieval paths with auditable identities and export approvals tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Confidential transport does not create legal authorization to export regulated data. The immediate requirement for export-controlled design vault is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves export-controlled design vault and access reports show foreign support staff retrieving controlled CAD files.
Question 442
In Health insurance carrier, a security issue affects claims web portal: stored XSS renders HTML from adjuster notes into claimant browser. The observed evidence is that isolated test account executes harmless injected marker. Operations must account for this constraint: release freeze limits emergency customer downtime. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Rely solely on browser CSP report-only mode forever
- Deploy safe rendering through feature-flagged change with rollback
- Verify rendering context, privilege exposure and evidence of persistent injection
- Retest recorded injection and legitimate formatted notes across browser clients
Explanation
Correct Answer
D:Retest recorded injection and legitimate formatted notes across browser clients tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Reporting violations does not correct unsafe server-side output handling. The immediate requirement for claims web portal is verified remediation, which this alternative does not provide.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
Question 443
In Industrial automation vendor, a security issue affects embedded controller firmware: field upgrade can load an unsigned image through maintenance connector. The observed evidence is that test bench accepts a modified boot image before user authentication. Operations must account for this constraint: controllers have limited CPU and safety cutovers. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Anchor signature verification in protected boot hardware and anti-rollback version policy
- Monitor signature failures and root-of-trust inventory changes
- Inspect firmware trust root, update transport and immutable boot state
- Rely on checksum downloaded over plaintext as proof of firmware authenticity
Explanation
Correct Answer
A:Anchor signature verification in protected boot hardware and anti-rollback version policy is the durable measure that addresses the observed weakness: field upgrade can load an unsigned image through maintenance connector. It must be enforceable while preserving the stated constraint: controllers have limited CPU and safety cutovers.
Incorrect Answers
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves embedded controller firmware and test bench accepts a modified boot image before user authentication.
D:Unkeyed checksums detect corruption but not deliberate malicious replacement. The immediate requirement for embedded controller firmware is durable control selection, which this alternative does not provide.
Question 444
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Use atomic commit or locked state transition for settlement authorization
- Stage concurrency controls and reconciliation of pending transactions
- Increase CPU capacity while retaining check-then-act state updates
- Inspect transaction isolation, request timing and duplicated settlement states
Explanation
Correct Answer
D:Inspect transaction isolation, request timing and duplicated settlement states connects the reported evidence (concurrent requests produce settlement and hold records with same transaction ID) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
C:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is evidence assessment, which this alternative does not provide.
Question 445
In Enterprise airline alliance, a security issue affects federated passenger identity: service accepts OAuth ID token as authorization to modify travel reservations. The observed evidence is that gateway trace shows audience mismatch while access token scopes are absent. Operations must account for this constraint: check-in must remain usable on partner airline identity. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Inspect token type, issuer, audience, scopes and resource-server validation errors
- Roll out dual-token handling with staged client compatibility and deny-by-default endpoints
- Use resource-specific scoped access tokens and validate issuer/audience at API boundary
- Treat a valid user login session as permission for any partner booking update
Explanation
Correct Answer
A:Inspect token type, issuer, audience, scopes and resource-server validation errors connects the reported evidence (gateway trace shows audience mismatch while access token scopes are absent) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves federated passenger identity and gateway trace shows audience mismatch while access token scopes are absent.
D:Authentication by itself does not create scoped delegated API authority. The immediate requirement for federated passenger identity is evidence assessment, which this alternative does not provide.
Question 446
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Disable authorization globally until all customers upgrade devices
- Specify version-aware authorization contract and regression tests
- Monitor exception rates and regression coverage through full rollout
- Check legitimate and forbidden checkout paths for both client versions
Explanation
Correct Answer
C:Monitor exception rates and regression coverage through full rollout identifies future loss of control, changed dependencies and exceptions affecting feature canary deployment. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is ongoing assurance, which this alternative does not provide.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
Question 447
In Global logistics broker, a security issue affects cross-border shipment metadata: partner processor moves customer data to an unapproved country and subcontractor. The observed evidence is that processing records show new storage region and an undisclosed subprocessor. Operations must account for this constraint: shipment tracking must remain functional during remediation. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Map legally applicable location restrictions and full downstream processing and access paths
- Require region-pinned processing with enforceable subcontractor controls and audit rights
- Rely solely on the prime provider's marketing claim of global compliance
- Apply approved region restrictions and temporary least-data sharing before partner cutover
Explanation
Correct Answer
A:Map legally applicable location restrictions and full downstream processing and access paths connects the reported evidence (processing records show new storage region and an undisclosed subprocessor) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
C:A generic assurance statement does not establish location or subcontractor compliance. The immediate requirement for cross-border shipment metadata is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
Question 448
In Regional research laboratory, a security issue affects central detection fabric: cloud workload logs never reach the SIEM while perimeter alerts appear normal. The observed evidence is that collector health dashboard excludes one cloud account with sensitive samples. Operations must account for this constraint: laboratory compute bursts are unpredictable. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Map all relevant log sources, classifications and collection blind spots
- Generate controlled cloud events and verify end-to-end timestamps in SIEM
- Increase perimeter IDS sensitivity instead of collecting cloud control-plane events
- Enable collection in stages with bounded cost and parsing assurance
Explanation
Correct Answer
B:Generate controlled cloud events and verify end-to-end timestamps in SIEM tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
C:A louder network sensor cannot reveal omitted cloud audit activity. The immediate requirement for central detection fabric is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
Question 449
In Municipal transport clearinghouse, a security issue affects fare reconciliation microservices: service-to-service callbacks trust caller-supplied terminal identifiers. The observed evidence is that attack tree shows potential forged credits across message queue and API endpoints. Operations must account for this constraint: fare collection cannot be disabled during the quarterly reconciliation. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Use server-side binding of terminal identity, signed messages and reconciliation checks
- Monitor emerging API routes and recurring reconciliation exceptions
- Treat authentication at the public website as proof for internal service callbacks
- Submit forged terminal claims in test to verify rejection and preserved audit evidence
Explanation
Correct Answer
B:Monitor emerging API routes and recurring reconciliation exceptions identifies future loss of control, changed dependencies and exceptions affecting fare reconciliation microservices. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
C:Web login does not authorize independent machine-to-machine claims. The immediate requirement for fare reconciliation microservices is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves fare reconciliation microservices and attack tree shows potential forged credits across message queue and API endpoints.
Question 450
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Require fail-closed revocation for privileged APIs and isolated low-risk browsing availability
- Treat valid certificate dates as proof that it has not been revoked
- Stage OCSP stapling and deny-by-default policy with pretested emergency certificate route
- Trace revocation response, chain validation and which routes require privileged certificate auth
Explanation
Correct Answer
D:Trace revocation response, chain validation and which routes require privileged certificate auth connects the reported evidence (mTLS logs show soft-fail despite policy requiring hard fail for privileged paths) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
B:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
