CompTIA CAS-005 Practice Test 50
Question 490
In Hospital data warehouse, a security issue affects encrypted retired SSD drives: equipment disposal includes encrypted drives whose keys remain in active KMS. The observed evidence is that asset ledger shows storage encryption but no recorded key-destruction approval. Operations must account for this constraint: disposal must prove patient records are unrecoverable. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Audit orphaned keys and disposal exceptions across media inventory
- Mark the drive wiped after deleting filesystem directory pointers
- Define cryptographic erase by destroying all applicable data-encryption keys under approval
- Attempt recovery and inspect KMS destruction logs and remaining replicas
Explanation
Correct Answer
A:Audit orphaned keys and disposal exceptions across media inventory identifies future loss of control, changed dependencies and exceptions affecting encrypted retired SSD drives. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:Filesystem deletion does not invalidate encryption keys or all residual data. The immediate requirement for encrypted retired SSD drives is ongoing assurance, which this alternative does not provide.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
D:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves encrypted retired SSD drives and asset ledger shows storage encryption but no recorded key-destruction approval.
Question 491
In International charity, a security issue affects confidential donation analytics: organization needs public totals but transaction identifiers must not be reversible. The observed evidence is that proposal hashes low-entropy donor IDs without secret and publishes them. Operations must account for this constraint: donor privacy commitments prohibit individual tracking. The team is authorized to introduce the selected control. Which implementation method best honors the stated constraint?
- Pilot publication of aggregate statistics following disclosure review
- Publish raw SHA-256 hashes of predictable donor identifiers
- Use aggregation and irreversible privacy-preserving tokenization with access controls
- Monitor data-release combinations and reidentification complaints
Explanation
Correct Answer
A:Pilot publication of aggregate statistics following disclosure review provides a governed means to introduce the chosen safeguard while respecting donor privacy commitments prohibit individual tracking. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Hashing guessable IDs does not ensure anonymity against dictionary attacks. The immediate requirement for confidential donation analytics is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
Question 492
In Multinational pharmacy network, a security issue affects privileged admin access: contract support personnel keep permanent global administrator tokens. The observed evidence is that PAM session logs show logins outside authorized maintenance tickets. Operations must account for this constraint: production medication distribution must remain recoverable. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Match privileged sessions to sponsor approvals, ticket, device and actual task
- Migrate standing grants to expiring delegated roles with emergency recovery test
- Use just-in-time elevation with recorded sessions and scope-limited break-glass
- Rely on a monthly attestation while preserving permanent global privileges
Explanation
Correct Answer
A:Match privileged sessions to sponsor approvals, ticket, device and actual task connects the reported evidence (PAM session logs show logins outside authorized maintenance tickets) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
D:Administrative review does not remove exploitable standing privilege. The immediate requirement for privileged admin access is evidence assessment, which this alternative does not provide.
Question 493
In Public-sector mail service, a security issue affects email campaign threat hunt: attackers rotate domains while reusing invoice-lure attachment behavior. The observed evidence is that mail metadata shows consistent MIME pattern and payload sandbox indicator. Operations must account for this constraint: legitimate invoices arrive from many changing supplier domains. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Compare campaign TTPs, file behavior and observable reliability
- Stage detection across sandbox and historical mail logs with false-positive assessment
- Develop Sigma/YARA detections based on distinctive behavior rather than a single domain
- Block only the first observed sender domain and call the campaign eradicated
Explanation
Correct Answer
A:Compare campaign TTPs, file behavior and observable reliability connects the reported evidence (mail metadata shows consistent MIME pattern and payload sandbox indicator) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
D:Infrastructure changes can evade brittle single-IOC hunting. The immediate requirement for email campaign threat hunt is evidence assessment, which this alternative does not provide.
Question 494
In Regional savings cooperative, a security issue affects branch risk-exception approvals: branch managers waive sensitive-data controls without a delegated authority matrix. The observed evidence is that three exceptions show contradictory signatures and no expiry. Operations must account for this constraint: board retains decisions beyond financial tolerance. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Track overdue approvals and tolerance breaches by accountable branch and enterprise owner
- Make the CISO sole risk acceptor for every branch exception
- Sample approved and rejected exceptions for actual signatures, expiry and compensating evidence
- Set a RACI matrix and threshold-based approval policy separating operational exceptions from enterprise acceptance
Explanation
Correct Answer
A:Track overdue approvals and tolerance breaches by accountable branch and enterprise owner identifies future loss of control, changed dependencies and exceptions affecting branch risk-exception approvals. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A security function can advise but cannot unilaterally own the business consequence. The immediate requirement for branch risk-exception approvals is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves branch risk-exception approvals and three exceptions show contradictory signatures and no expiry.
Question 495
In International airport operator, a security issue affects baggage conveyor controls: vendor remote support shares an always-on cellular modem into operational network. The observed evidence is that network diagram lists modem outside airport change and asset inventory. Operations must account for this constraint: conveyor recovery must remain available in urgent incidents. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Use brokered time-bound remote access through industrial DMZ with session recording
- Track modem inventory and privileged vendor sessions
- Try remote vendor connection outside window and verify denied access
- Disable all vendor support permanently without an emergency operational route
Explanation
Correct Answer
B:Track modem inventory and privileged vendor sessions identifies future loss of control, changed dependencies and exceptions affecting baggage conveyor controls. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
D:Availability and safety still need controlled emergency maintenance. The immediate requirement for baggage conveyor controls is ongoing assurance, which this alternative does not provide.
Question 496
In International e-commerce retailer, a security issue affects feature canary deployment: new authorization filter blocked valid purchases during last rollout. The observed evidence is that logs show legacy clients missing a recently mandatory header. Operations must account for this constraint: checkout fraud protection cannot be removed during rollout. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Specify version-aware authorization contract and regression tests
- Deploy canary by client cohort with feature flags and rollback thresholds
- Distinguish compatibility failures from authorization bypasses in client flows
- Disable authorization globally until all customers upgrade devices
Explanation
Correct Answer
C:Distinguish compatibility failures from authorization bypasses in client flows connects the reported evidence (logs show legacy clients missing a recently mandatory header) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves feature canary deployment and logs show legacy clients missing a recently mandatory header.
D:Removing checks would expose account ownership across client versions. The immediate requirement for feature canary deployment is evidence assessment, which this alternative does not provide.
Question 497
In Public-sector mail service, a security issue affects email campaign threat hunt: attackers rotate domains while reusing invoice-lure attachment behavior. The observed evidence is that mail metadata shows consistent MIME pattern and payload sandbox indicator. Operations must account for this constraint: legitimate invoices arrive from many changing supplier domains. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Compare campaign TTPs, file behavior and observable reliability
- Replay verified malicious and legitimate invoice samples to check precision
- Block only the first observed sender domain and call the campaign eradicated
- Stage detection across sandbox and historical mail logs with false-positive assessment
Explanation
Correct Answer
B:Replay verified malicious and legitimate invoice samples to check precision tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
C:Infrastructure changes can evade brittle single-IOC hunting. The immediate requirement for email campaign threat hunt is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves email campaign threat hunt and mail metadata shows consistent MIME pattern and payload sandbox indicator.
Question 498
In Regional bank, a security issue affects TLS partner gateway: client and server negotiate no shared cipher after a partner hardening change. The observed evidence is that handshake trace shows client offered only obsolete suites while server requires TLS 1.3. Operations must account for this constraint: payment APIs may not downgrade to known-weak cryptography. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Re-enable SSLv3 for universal interoperability
- Upgrade or configure supported modern TLS suites with authenticated endpoints
- Stage partner client update and controlled negotiation testing before cutover
- Monitor handshake failures and upcoming cryptographic deprecations
Explanation
Correct Answer
C:Stage partner client update and controlled negotiation testing before cutover provides a governed means to introduce the chosen safeguard while respecting payment APIs may not downgrade to known-weak cryptography. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Obsolete protocol downgrade sacrifices required confidentiality and integrity. The immediate requirement for TLS partner gateway is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves TLS partner gateway and handshake trace shows client offered only obsolete suites while server requires TLS 1.3.
Question 499
In International airport operator, a security issue affects baggage conveyor controls: vendor remote support shares an always-on cellular modem into operational network. The observed evidence is that network diagram lists modem outside airport change and asset inventory. Operations must account for this constraint: conveyor recovery must remain available in urgent incidents. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Disable all vendor support permanently without an emergency operational route
- Replace persistent cellular connection with approved on-demand jump access
- Track modem inventory and privileged vendor sessions
- Use brokered time-bound remote access through industrial DMZ with session recording
Explanation
Correct Answer
B:Replace persistent cellular connection with approved on-demand jump access provides a governed means to introduce the chosen safeguard while respecting conveyor recovery must remain available in urgent incidents. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Availability and safety still need controlled emergency maintenance. The immediate requirement for baggage conveyor controls is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves baggage conveyor controls and network diagram lists modem outside airport change and asset inventory.
Question 500
In Financial brokerage, a security issue affects container registry provenance: cluster deploys unsigned images from a developer mirror. The observed evidence is that admission logs show digest rewriting after the approved build. Operations must account for this constraint: risk office requires a verifiable software supply chain. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Require signed immutable images with admission verification and verified SBOM provenance
- Enforce admission deny in monitored canary namespaces before rollout
- Increase node malware scans while allowing unsigned supply-chain entry
- Trace image origin, artifact digest and policy enforcement route
Explanation
Correct Answer
D:Trace image origin, artifact digest and policy enforcement route connects the reported evidence (admission logs show digest rewriting after the approved build) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves container registry provenance and admission logs show digest rewriting after the approved build.
C:Runtime scans cannot prove images were authorized or unchanged before execution. The immediate requirement for container registry provenance is evidence assessment, which this alternative does not provide.
