CompTIA CAS-005 Practice Test 46
Question 450
In Insurance claims processor, a security issue affects certificate revocation checks: public gateway accepts revoked operator certificate during an OCSP outage. The observed evidence is that mTLS logs show soft-fail despite policy requiring hard fail for privileged paths. Operations must account for this constraint: customer read-only service must remain available during CA outages. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Require fail-closed revocation for privileged APIs and isolated low-risk browsing availability
- Treat valid certificate dates as proof that it has not been revoked
- Stage OCSP stapling and deny-by-default policy with pretested emergency certificate route
- Trace revocation response, chain validation and which routes require privileged certificate auth
Explanation
Correct Answer
D:Trace revocation response, chain validation and which routes require privileged certificate auth connects the reported evidence (mTLS logs show soft-fail despite policy requiring hard fail for privileged paths) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
B:Expiry is independent of explicit revocation and compromise. The immediate requirement for certificate revocation checks is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves certificate revocation checks and mTLS logs show soft-fail despite policy requiring hard fail for privileged paths.
Question 451
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Introduce a rapid dual-verifier emergency publication workflow with fallback
- Use voice similarity alone as proof of executive approval
- Assess speaker verification, source integrity and the approval boundary before assigning origin
- Run a controlled synthetic-audio exercise to test rejection and timely real approvals
Explanation
Correct Answer
D:Run a controlled synthetic-audio exercise to test rejection and timely real approvals tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
B:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
Question 452
In Regional electric utility, a security issue affects substation recovery planning: connected backups share credentials with production and could be encrypted during ransomware. The observed evidence is that restore exercise finds cloud snapshots accessible from compromised domain admin session. Operations must account for this constraint: grid restoration has strict four-hour service objective. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Purchase more snapshots under the same compromised production credentials
- Roll out detached recovery credentials and immutable storage without interrupting control operations
- Design isolated immutable backup copies with separate recovery identity and tested recovery objectives
- Retest survivability after identity changes and track recovery gap against tolerance
Explanation
Correct Answer
B:Roll out detached recovery credentials and immutable storage without interrupting control operations provides a governed means to introduce the chosen safeguard while respecting grid restoration has strict four-hour service objective. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Quantity of reachable copies does not provide recovery independence. The immediate requirement for substation recovery planning is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves substation recovery planning and restore exercise finds cloud snapshots accessible from compromised domain admin session.
Question 453
In Health insurance carrier, a security issue affects claims web portal: stored XSS renders HTML from adjuster notes into claimant browser. The observed evidence is that isolated test account executes harmless injected marker. Operations must account for this constraint: release freeze limits emergency customer downtime. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Deploy safe rendering through feature-flagged change with rollback
- Monitor injection attempts and new editor features
- Rely solely on browser CSP report-only mode forever
- Apply context-aware output encoding with safe HTML sanitization
Explanation
Correct Answer
A:Deploy safe rendering through feature-flagged change with rollback provides a governed means to introduce the chosen safeguard while respecting release freeze limits emergency customer downtime. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
C:Reporting violations does not correct unsafe server-side output handling. The immediate requirement for claims web portal is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves claims web portal and isolated test account executes harmless injected marker.
Question 454
In National procurement agency, a security issue affects document download gateway: encoded path traversal resolves outside public document root. The observed evidence is that test input containing encoded dot-dot path returns internal configuration snippet. Operations must account for this constraint: public registry must remain available during patch window. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Stage gateway validation and legacy URL compatibility under change control
- Try encoded traversal variants and confirm protected files never return
- Trace decoding order, canonical path and filesystem privilege
- Block one exact traversal string while leaving alternate encodings accepted
Explanation
Correct Answer
B:Try encoded traversal variants and confirm protected files never return tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves document download gateway and test input containing encoded dot-dot path returns internal configuration snippet.
D:Single-pattern filters are easily bypassed by normalization variants. The immediate requirement for document download gateway is verified remediation, which this alternative does not provide.
Question 455
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Stage inventory reconciliation in CI and schedule authenticated rescan windows
- Monitor scanning coverage, stale exceptions and schema changes
- Design automation to report unknown/unscanned separately from compliant
- Set unscanned hosts to compliant until a high CVE is detected
Explanation
Correct Answer
A:Stage inventory reconciliation in CI and schedule authenticated rescan windows provides a governed means to introduce the chosen safeguard while respecting research assets may be offline during scheduled scans. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
D:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is safe implementation, which this alternative does not provide.
Question 456
In Consumer video platform, a security issue affects serverless media processing: function has default outbound access and can retrieve unrelated customer buckets. The observed evidence is that trace shows public trigger supplying storage key outside its user's namespace. Operations must account for this constraint: uploads must continue without long-running servers. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Bind function privileges to per-user object path and minimal egress destinations
- Use WAF filtering alone on upload URL while keeping broad backend IAM
- Test malicious object key requests and legitimate uploads across tenant boundaries
- Track token scopes, denied cross-tenant reads and function configuration drift
Explanation
Correct Answer
D:Track token scopes, denied cross-tenant reads and function configuration drift identifies future loss of control, changed dependencies and exceptions affecting serverless media processing. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
B:Edge input filtering cannot replace resource authorization enforced in cloud. The immediate requirement for serverless media processing is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves serverless media processing and trace shows public trigger supplying storage key outside its user's namespace.
Question 457
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Track integrity drift, verified recovery coverage and accountable restoration exceptions
- Design signed hash manifests, offline immutable masters and documented restoration authority
- Declare every readable file valid because its storage device is online
- Compare cryptographic hashes of restored sample objects with authenticated baseline manifests
Explanation
Correct Answer
A:Track integrity drift, verified recovery coverage and accountable restoration exceptions identifies future loss of control, changed dependencies and exceptions affecting historic media preservation. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
C:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
Question 458
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Revoke unauthorized sharing and enforce purpose-scoped database export rights
- Disable all audit logging to reduce storage during investigation
- Preserve immutable log copy and suspend only implicated export sessions
- Track sensitive data exports and personnel-access offboarding gaps
Explanation
Correct Answer
C:Preserve immutable log copy and suspend only implicated export sessions provides a governed means to introduce the chosen safeguard while respecting regulated trading records require immutable legal hold. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
B:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
Question 459
In Media authenticity newsroom, a security issue affects AI-assisted crisis announcements: voice-cloned executive requests urgent publication of a false safety notice. The observed evidence is that call recording contradicts authenticated approval channel and contact ledger. Operations must account for this constraint: public warning delays could also create harm. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Design out-of-band executive verification and signed release approvals
- Use voice similarity alone as proof of executive approval
- Track deepfake attempts, bypasses and time-to-authenticated publication
- Run a controlled synthetic-audio exercise to test rejection and timely real approvals
Explanation
Correct Answer
C:Track deepfake attempts, bypasses and time-to-authenticated publication identifies future loss of control, changed dependencies and exceptions affecting AI-assisted crisis announcements. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
B:Realistic synthetic speech defeats recognition-based identity confidence. The immediate requirement for AI-assisted crisis announcements is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves AI-assisted crisis announcements and call recording contradicts authenticated approval channel and contact ledger.
Question 460
In National retail bank, a security issue affects remote-access SIEM: VPN failure alerts vanish after source changed its syslog format. The observed evidence is that parser counter drops while device log volume is unchanged. Operations must account for this constraint: security monitoring must not block legitimate remote sessions. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Increase alert severity on all remaining logs without restoring parser coverage
- Compare raw syslog payloads, field parser mapping and ingestion loss periods
- Use version-aware parsing and ingestion-health alerts for missing fields
- Monitor source silence and schema drift per VPN device
Explanation
Correct Answer
C:Use version-aware parsing and ingestion-health alerts for missing fields is the durable measure that addresses the observed weakness: VPN failure alerts vanish after source changed its syslog format. It must be enforceable while preserving the stated constraint: security monitoring must not block legitimate remote sessions.
Incorrect Answers
A:Louder alerts do not recover unseen VPN events. The immediate requirement for remote-access SIEM is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
