CompTIA CAS-005 Practice Test 47
Question 460
In National retail bank, a security issue affects remote-access SIEM: VPN failure alerts vanish after source changed its syslog format. The observed evidence is that parser counter drops while device log volume is unchanged. Operations must account for this constraint: security monitoring must not block legitimate remote sessions. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Increase alert severity on all remaining logs without restoring parser coverage
- Compare raw syslog payloads, field parser mapping and ingestion loss periods
- Use version-aware parsing and ingestion-health alerts for missing fields
- Monitor source silence and schema drift per VPN device
Explanation
Correct Answer
C:Use version-aware parsing and ingestion-health alerts for missing fields is the durable measure that addresses the observed weakness: VPN failure alerts vanish after source changed its syslog format. It must be enforceable while preserving the stated constraint: security monitoring must not block legitimate remote sessions.
Incorrect Answers
A:Louder alerts do not recover unseen VPN events. The immediate requirement for remote-access SIEM is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves remote-access SIEM and parser counter drops while device log volume is unchanged.
Question 461
In European university, a security issue affects automated vulnerability exception reports: weekly report marks devices compliant when the scanner missed them entirely. The observed evidence is that job aggregates only scanned assets; asset inventory has 200 missing hosts. Operations must account for this constraint: research assets may be offline during scheduled scans. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Monitor scanning coverage, stale exceptions and schema changes
- Design automation to report unknown/unscanned separately from compliant
- Compare scanner scope with CMDB and detect non-reporting assets
- Set unscanned hosts to compliant until a high CVE is detected
Explanation
Correct Answer
B:Design automation to report unknown/unscanned separately from compliant is the durable measure that addresses the observed weakness: weekly report marks devices compliant when the scanner missed them entirely. It must be enforceable while preserving the stated constraint: research assets may be offline during scheduled scans.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves automated vulnerability exception reports and job aggregates only scanned assets; asset inventory has 200 missing hosts.
D:Absence of results is not proof of secure configuration. The immediate requirement for automated vulnerability exception reports is durable control selection, which this alternative does not provide.
Question 462
In Financial brokerage, a security issue affects cloud identity compromise hunt: a newly observed token replay technique evades old IP-reputation rules. The observed evidence is that cloud logs show same token ID used from separate devices in minutes. Operations must account for this constraint: identity analysis must avoid overblocking legitimate VPN users. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Track token reuse patterns and hypothesis outcomes as identity providers change
- Block every user crossing two geolocations without inspecting token identity
- Form hypothesis from token reuse, device registration and session timing
- Correlate device-bound token anomalies instead of IP-only indicators
Explanation
Correct Answer
D:Correlate device-bound token anomalies instead of IP-only indicators is the durable measure that addresses the observed weakness: a newly observed token replay technique evades old IP-reputation rules. It must be enforceable while preserving the stated constraint: identity analysis must avoid overblocking legitimate VPN users.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
B:Geographic anomalies alone can be caused by sanctioned VPN egress. The immediate requirement for cloud identity compromise hunt is durable control selection, which this alternative does not provide.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
Question 463
In Regional financial services, a security issue affects SOAR containment playbooks: unverified threat-intel match triggers automated network isolation of payroll servers. The observed evidence is that test playbook lacks confidence threshold and service-owner confirmation. Operations must account for this constraint: payroll uptime has a hard regulatory reporting deadline. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Feed benign and malicious events to prove safe containment and suppression behavior
- Track false isolations, approval latency and automation exceptions
- Gate high-impact isolation on corroboration, approval and bounded service scope
- Set every low-confidence feed hit to automatic full network shutdown
Explanation
Correct Answer
B:Track false isolations, approval latency and automation exceptions identifies future loss of control, changed dependencies and exceptions affecting SOAR containment playbooks. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
D:Unbounded action on uncertain indicators creates unacceptable operational disruption. The immediate requirement for SOAR containment playbooks is ongoing assurance, which this alternative does not provide.
Question 464
In Municipal property records, a security issue affects data classification program: copies of landowner identity documents have no owner tags outside primary database. The observed evidence is that object discovery finds sensitive scans in shared document stores. Operations must account for this constraint: historical record access rights vary by role and jurisdiction. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Monitor new unlabeled assets and ownerless retention exceptions
- Sample access and retention results across primary and replicated document stores
- Encrypt only the main database while ignoring uncontrolled replicas
- Design classification labels and role-based retention with storage DLP
Explanation
Correct Answer
A:Monitor new unlabeled assets and ownerless retention exceptions identifies future loss of control, changed dependencies and exceptions affecting data classification program. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
C:Strong encryption on one copy does not govern replicated sensitive data. The immediate requirement for data classification program is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
Question 465
In Digital banking consortium, a security issue affects partner API gateway: a compromised supplier token may traverse a trust boundary into payment settlement. The observed evidence is that data-flow diagram shows service account can write settlements without transaction approval. Operations must account for this constraint: settlement continuity must retain independent approval. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Place authorization and dual-control barriers at the settlement trust boundary
- Map actors, entry points, trust transitions and abuse cases for supplier-to-settlement writes
- Revisit threat model after partner interface or identity trust changes
- Only scan the public gateway for well-known CVEs
Explanation
Correct Answer
A:Place authorization and dual-control barriers at the settlement trust boundary is the durable measure that addresses the observed weakness: a compromised supplier token may traverse a trust boundary into payment settlement. It must be enforceable while preserving the stated constraint: settlement continuity must retain independent approval.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves partner API gateway and data-flow diagram shows service account can write settlements without transaction approval.
D:Vulnerability scanning alone misses abuse of legitimate delegated authority. The immediate requirement for partner API gateway is durable control selection, which this alternative does not provide.
Question 466
In Public-sector mail service, a security issue affects email campaign threat hunt: attackers rotate domains while reusing invoice-lure attachment behavior. The observed evidence is that mail metadata shows consistent MIME pattern and payload sandbox indicator. Operations must account for this constraint: legitimate invoices arrive from many changing supplier domains. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Develop Sigma/YARA detections based on distinctive behavior rather than a single domain
- Block only the first observed sender domain and call the campaign eradicated
- Review new payload families, stale rules and intelligence source quality
- Replay verified malicious and legitimate invoice samples to check precision
Explanation
Correct Answer
C:Review new payload families, stale rules and intelligence source quality identifies future loss of control, changed dependencies and exceptions affecting email campaign threat hunt. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
B:Infrastructure changes can evade brittle single-IOC hunting. The immediate requirement for email campaign threat hunt is ongoing assurance, which this alternative does not provide.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
Question 467
In International nonprofit, a security issue affects cloud bucket exposure incident: public bucket policy reveals donor-contact files. The observed evidence is that cloud audit shows anonymous object reads and recent policy edit. Operations must account for this constraint: donor assistance systems must retain approved access. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Establish scope from object access logs, policy versions and retention evidence
- Remove public access and require approved scoped identity permissions
- Assume encryption at rest prevents any readable anonymous access
- Preserve object and policy records before staged access correction
Explanation
Correct Answer
A:Establish scope from object access logs, policy versions and retention evidence connects the reported evidence (cloud audit shows anonymous object reads and recent policy edit) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
C:Provider-managed storage encryption does not replace object authorization. The immediate requirement for cloud bucket exposure incident is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves cloud bucket exposure incident and cloud audit shows anonymous object reads and recent policy edit.
Question 468
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Introduce region-specific consent gates and rollback-safe tracking disablement
- Review changes to regional law and retention of previously collected child data
- Separate necessary service processing from optional profiling with enforceable purpose limitation
- Assume general platform terms authorize all future profiling of minors
Explanation
Correct Answer
A:Introduce region-specific consent gates and rollback-safe tracking disablement provides a governed means to introduce the chosen safeguard while respecting learning access must remain available without optional tracking. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
D:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is safe implementation, which this alternative does not provide.
Question 469
In Cross-border e-learning consortium, a security issue affects teacher privileged access: new teachers inherit broad tenant admin rights after self-provisioning. The observed evidence is that audit shows two schools' student records accessible to an unrelated teacher. Operations must account for this constraint: legitimate course access must be usable across campuses. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Test newly provisioned users against cross-school records and admin endpoints
- Assume school email domain membership authorizes all student records
- Enforce least-privilege scoped roles with separation of provisioning and privileged approval
- Review role drift and orphaned privileges after teacher departures
Explanation
Correct Answer
D:Review role drift and orphaned privileges after teacher departures identifies future loss of control, changed dependencies and exceptions affecting teacher privileged access. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
B:Domain membership is weaker than course-specific object authorization. The immediate requirement for teacher privileged access is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves teacher privileged access and audit shows two schools' student records accessible to an unrelated teacher.
Question 470
In Financial services cloud team, a security issue affects workload identity rotation: secret rotation breaks machine authentication because deployments retain old token references. The observed evidence is that CI logs show newly issued secret exists but server still reads retired key. Operations must account for this constraint: payment reconciliation depends on hourly batch jobs. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Extend validity of every leaked credential indefinitely for compatibility
- Monitor old-secret requests and unexpected vault access after rotation
- Correlate credential ID, vault version, deployment rollout and authentication failures
- Design versioned secret retrieval with workload identity and no hard-coded runtime keys
Explanation
Correct Answer
D:Design versioned secret retrieval with workload identity and no hard-coded runtime keys is the durable measure that addresses the observed weakness: secret rotation breaks machine authentication because deployments retain old token references. It must be enforceable while preserving the stated constraint: payment reconciliation depends on hourly batch jobs.
Incorrect Answers
A:Availability exceptions cannot justify permanent compromised secret exposure. The immediate requirement for workload identity rotation is durable control selection, which this alternative does not provide.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
C:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves workload identity rotation and CI logs show newly issued secret exists but server still reads retired key.
