CompTIA CAS-005 Practice Test 6
Question 50
In Regional hospital, a security issue affects central log pipeline: time drift makes correlated EDR and authentication events appear reversed. The observed evidence is that endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate. Operations must account for this constraint: incident evidence must preserve original timestamps for legal review. Implementation is the remaining gate; neither another design document nor a postrelease audit replaces it. Which execution action is best?
- Declare lateral movement simply from apparent log order
- Monitor time synchronization drift and cross-source correlation confidence
- Normalize event time with recorded offsets while retaining original evidence
- Deploy clock correction and parser offset annotations by affected source
Explanation
Correct Answer
D:Deploy clock correction and parser offset annotations by affected source provides a governed means to introduce the chosen safeguard while respecting incident evidence must preserve original timestamps for legal review. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Uncorrected clock offset can fabricate an attack sequence. The immediate requirement for central log pipeline is safe implementation, which this alternative does not provide.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves central log pipeline and endpoint timestamp is seven minutes ahead of IdP while ingest time is accurate.
Question 51
In Multinational pharmacy network, a security issue affects privileged admin access: contract support personnel keep permanent global administrator tokens. The observed evidence is that PAM session logs show logins outside authorized maintenance tickets. Operations must account for this constraint: production medication distribution must remain recoverable. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Match privileged sessions to sponsor approvals, ticket, device and actual task
- Migrate standing grants to expiring delegated roles with emergency recovery test
- Attempt out-of-window admin actions and verify prompt expiry plus audit attribution
- Rely on a monthly attestation while preserving permanent global privileges
Explanation
Correct Answer
C:Attempt out-of-window admin actions and verify prompt expiry plus audit attribution tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves privileged admin access and PAM session logs show logins outside authorized maintenance tickets.
D:Administrative review does not remove exploitable standing privilege. The immediate requirement for privileged admin access is verified remediation, which this alternative does not provide.
Question 52
In Financial clearing service, a security issue affects long-lived TLS certificates: executives expect future quantum resilience while today's legacy clients cannot process new algorithms. The observed evidence is that inventory lists ECDH key exchange and several multi-year archives. Operations must account for this constraint: cross-bank interoperability must survive phased migration. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Pilot supported hybrid cryptography on noncritical links with rollback and interoperability tests
- Inventory cryptographic usage, data lifetime and quantum migration risks
- Replace every cipher tomorrow with an untested PQC library
- Measure handshake compatibility, performance and protection on approved endpoints
Explanation
Correct Answer
D:Measure handshake compatibility, performance and protection on approved endpoints tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves long-lived TLS certificates and inventory lists ECDH key exchange and several multi-year archives.
C:Abrupt migration can break critical protocols and unvalidated crypto creates new risk. The immediate requirement for long-lived TLS certificates is verified remediation, which this alternative does not provide.
Question 53
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Trust all measurements solely because they use a private RF channel
- Map message origin, command-versus-data roles and radio coverage gaps
- Introduce signed sensor telemetry with replay protection and safety validation
- Monitor replay attempts, firmware age and weak-key exceptions
Explanation
Correct Answer
C:Introduce signed sensor telemetry with replay protection and safety validation is the durable measure that addresses the observed weakness: unauthenticated telemetry messages can trigger dispatch planning errors. It must be enforceable while preserving the stated constraint: rail operating teams must retain low-latency telemetry.
Incorrect Answers
A:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is durable control selection, which this alternative does not provide.
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
Question 54
In Utility operations network, a security issue affects DNSSEC validating resolver: secure applications intermittently fail only when one signed zone updates. The observed evidence is that resolver log shows bogus signatures after stale DS record persists at parent. Operations must account for this constraint: industrial control DNS must not resolve unsigned spoofed answers. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Correct signed key rollover and parent delegation consistency
- Compare DNSKEY, DS, signature inception and resolver failure path
- Disable DNSSEC validation globally to eliminate SERVFAIL
- Coordinate zone key and registrar DS change in ordered rollout with rollback
Explanation
Correct Answer
B:Compare DNSKEY, DS, signature inception and resolver failure path connects the reported evidence (resolver log shows bogus signatures after stale DS record persists at parent) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
C:Ignoring authentication failures trades availability for cache-poisoning risk. The immediate requirement for DNSSEC validating resolver is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves DNSSEC validating resolver and resolver log shows bogus signatures after stale DS record persists at parent.
Question 55
In Global energy trading firm, a security issue affects market settlement worker: race condition allows payout before fraud hold is committed. The observed evidence is that concurrent requests produce settlement and hold records with same transaction ID. Operations must account for this constraint: financial records need atomic decision semantics. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Use atomic commit or locked state transition for settlement authorization
- Inspect transaction isolation, request timing and duplicated settlement states
- Increase CPU capacity while retaining check-then-act state updates
- Monitor inconsistent transaction histories and rollback rates
Explanation
Correct Answer
A:Use atomic commit or locked state transition for settlement authorization is the durable measure that addresses the observed weakness: race condition allows payout before fraud hold is committed. It must be enforceable while preserving the stated constraint: financial records need atomic decision semantics.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
C:Performance alone does not remove an atomicity flaw. The immediate requirement for market settlement worker is durable control selection, which this alternative does not provide.
D:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves market settlement worker and concurrent requests produce settlement and hold records with same transaction ID.
Question 56
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Migrate firmware signing to protected service with compatible staged distribution
- Audit signature events, expiring keys and emergency rollout exceptions
- Publish a security policy without changing exposed signing-key storage
- Require hardware-protected release keys and dual-controlled signed artifacts
Explanation
Correct Answer
A:Migrate firmware signing to protected service with compatible staged distribution provides a governed means to introduce the chosen safeguard while respecting devices must continue receiving urgent safety patches. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
C:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
Question 57
In Regional university research, a security issue affects Linux scientific servers: untrusted notebook container escapes into host-mounted model data. The observed evidence is that audit shows container user has host filesystem write on shared NFS. Operations must account for this constraint: research experiments require GPU devices. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Reconfigure orchestration and container profiles by research group under rollback
- Use least-privileged containers, read-only mounts and mandatory access controls
- Give every container root privileges to simplify GPU setup
- Inspect namespace, mount, privileged flag and SELinux policy decisions
Explanation
Correct Answer
D:Inspect namespace, mount, privileged flag and SELinux policy decisions connects the reported evidence (audit shows container user has host filesystem write on shared NFS) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves Linux scientific servers and audit shows container user has host filesystem write on shared NFS.
C:Broad privilege enlarges escape impact and is unnecessary for scoped devices. The immediate requirement for Linux scientific servers is evidence assessment, which this alternative does not provide.
Question 58
In Regional hospital consortium, a security issue affects patient telemetry exchange: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. The observed evidence is that contracts specify different deletion and legal-hold periods for two locations. Operations must account for this constraint: care teams need regulated continuity across jurisdictions. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Monitor regulation and partner contract changes that invalidate previous settings
- Apply policy-as-code to pilot locations under logged approval and preservation safeguards
- Copy a single vendor default retention period to every hospital
- Design jurisdiction-aware retention and access rules with owner and legal review
Explanation
Correct Answer
B:Apply policy-as-code to pilot locations under logged approval and preservation safeguards provides a governed means to introduce the chosen safeguard while respecting care teams need regulated continuity across jurisdictions. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
C:Vendor defaults cannot supersede conflicting jurisdictional obligations. The immediate requirement for patient telemetry exchange is safe implementation, which this alternative does not provide.
D:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
Question 59
In Online procurement platform, a security issue affects DMARC anti-spoofing: vendor invoices from authorized service are quarantined due to DKIM misalignment. The observed evidence is that headers show SPF passing for relay domain but DMARC failing From alignment. Operations must account for this constraint: finance must receive genuine supplier notices without spoofing bypass. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Send authorized and spoofed test messages and verify alignment enforcement
- Stage aligned signing and quarantine tuning with validated partner mail traces
- Set DMARC policy p=none permanently without fixing misalignment
- Inspect From, envelope sender, SPF domain, DKIM d= and alignment result
Explanation
Correct Answer
A:Send authorized and spoofed test messages and verify alignment enforcement tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
C:Removing enforcement masks spoofing rather than aligning the legitimate flow. The immediate requirement for DMARC anti-spoofing is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
Question 60
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Map message origin, command-versus-data roles and radio coverage gaps
- Stage key enrollment and signed-message acceptance on safe test segment
- Introduce signed sensor telemetry with replay protection and safety validation
- Trust all measurements solely because they use a private RF channel
Explanation
Correct Answer
A:Map message origin, command-versus-data roles and radio coverage gaps connects the reported evidence (captured radio packet allows forged speed sensor value) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
D:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is evidence assessment, which this alternative does not provide.
