CompTIA CAS-005 Practice Test 7
Question 60
In Transportation telemetry consortium, a security issue affects rail sensor gateways: unauthenticated telemetry messages can trigger dispatch planning errors. The observed evidence is that captured radio packet allows forged speed sensor value. Operations must account for this constraint: rail operating teams must retain low-latency telemetry. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Map message origin, command-versus-data roles and radio coverage gaps
- Stage key enrollment and signed-message acceptance on safe test segment
- Introduce signed sensor telemetry with replay protection and safety validation
- Trust all measurements solely because they use a private RF channel
Explanation
Correct Answer
A:Map message origin, command-versus-data roles and radio coverage gaps connects the reported evidence (captured radio packet allows forged speed sensor value) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves rail sensor gateways and captured radio packet allows forged speed sensor value.
D:Radio channel privacy is not sufficient for data origin and freshness. The immediate requirement for rail sensor gateways is evidence assessment, which this alternative does not provide.
Question 61
In Financial brokerage, a security issue affects cloud identity compromise hunt: a newly observed token replay technique evades old IP-reputation rules. The observed evidence is that cloud logs show same token ID used from separate devices in minutes. Operations must account for this constraint: identity analysis must avoid overblocking legitimate VPN users. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Track token reuse patterns and hypothesis outcomes as identity providers change
- Correlate device-bound token anomalies instead of IP-only indicators
- Block every user crossing two geolocations without inspecting token identity
- Enable monitor-first hunt rule with recorded response confidence threshold
Explanation
Correct Answer
D:Enable monitor-first hunt rule with recorded response confidence threshold provides a governed means to introduce the chosen safeguard while respecting identity analysis must avoid overblocking legitimate VPN users. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
C:Geographic anomalies alone can be caused by sanctioned VPN egress. The immediate requirement for cloud identity compromise hunt is safe implementation, which this alternative does not provide.
Question 62
In National hospital chain, a security issue affects clinical device Zero Trust rollout: physician laptops move between wards while flat VLAN grants long-lived device trust. The observed evidence is that NAC logs show compliant login later used from unmanaged kiosk. Operations must account for this constraint: emergency clinical work must use short-lived authorized sessions. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Use continuous policy decisions bound to user, device health and patient context
- Track policy exceptions, reauthentication failures and untrusted device access
- Test posture degradation and role changes to prove session authorization is revoked
- Grant permanent network access after one successful VPN connection
Explanation
Correct Answer
B:Track policy exceptions, reauthentication failures and untrusted device access identifies future loss of control, changed dependencies and exceptions affecting clinical device Zero Trust rollout. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves clinical device Zero Trust rollout and NAC logs show compliant login later used from unmanaged kiosk.
D:Initial network admission does not prove ongoing access context. The immediate requirement for clinical device Zero Trust rollout is ongoing assurance, which this alternative does not provide.
Question 63
In National government identity office, a security issue affects HSM-backed signing service: private signing keys stored in software on an administrator VM. The observed evidence is that forensic artifact shows exportable key in a backup image. Operations must account for this constraint: citizen credential issuance must support rapid recovery. The proposed fix is live. What should the assurance team verify before signing off remediation?
- Migrate signing under a controlled trust transition with offline root backup
- Trace key generation, export paths, operator privileges and signing audit
- Attempt key export and confirm protected signing plus audited approvals
- Encrypt a file containing the same exportable signing key using a shared password
Explanation
Correct Answer
C:Attempt key export and confirm protected signing plus audited approvals tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves HSM-backed signing service and forensic artifact shows exportable key in a backup image.
D:Software encryption does not create nonexportable key custody. The immediate requirement for HSM-backed signing service is verified remediation, which this alternative does not provide.
Question 64
In Maritime cargo operator, a security issue affects port cybersecurity procedures: terminal teams treat suggested guidance as mandatory while ignoring incident reporting standards. The observed evidence is that operators cite three inconsistent copies of the same response document. Operations must account for this constraint: ships must retain emergency communications during changeover. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Observe a drill to establish whether crews follow the mandated reporting steps and escalation thresholds
- Create an approved document hierarchy and clear reporting responsibility for port and vessel roles
- Publish another checklist without defining its approval authority
- Review document exceptions and update owners when terminal technology or law changes
Explanation
Correct Answer
D:Review document exceptions and update owners when terminal technology or law changes identifies future loss of control, changed dependencies and exceptions affecting port cybersecurity procedures. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves port cybersecurity procedures and operators cite three inconsistent copies of the same response document.
C:More documents do not clarify what is binding or who may waive it. The immediate requirement for port cybersecurity procedures is ongoing assurance, which this alternative does not provide.
Question 65
In Manufacturing ERP operator, a security issue affects legacy application tier: flat trust permits office workstations to query production database directly. The observed evidence is that network map shows shared credentials across test and production. Operations must account for this constraint: older ERP cannot support modern client identity natively. After a successful go-live, the accountable owner must watch for recurring exposure. Which monitoring action best does that?
- Review new data paths and privileged session patterns for policy drift
- Test permitted ERP workflows and denied office-to-database paths
- Block all database ports without mapping required legacy job dependencies
- Introduce application proxy and segmented database access with distinct service identities
Explanation
Correct Answer
A:Review new data paths and privileged session patterns for policy drift identifies future loss of control, changed dependencies and exceptions affecting legacy application tier. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
C:Unplanned isolation could halt critical manufacturing reconciliation. The immediate requirement for legacy application tier is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves legacy application tier and network map shows shared credentials across test and production.
Question 66
In University student portal, a security issue affects session authorization API: logged-in users can change course ID to view another student's grades. The observed evidence is that two test accounts demonstrate data access after swapping object identifier. Operations must account for this constraint: grading deadline prohibits large service outage. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Retest swapped IDs and legitimate instructor access for all roles
- Use stronger user passwords but no object ownership enforcement
- Track denied cross-student requests and owner mapping exceptions
- Enforce per-object ownership check on every grade request
Explanation
Correct Answer
C:Track denied cross-student requests and owner mapping exceptions identifies future loss of control, changed dependencies and exceptions affecting session authorization API. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
B:Authentication strength does not stop an authenticated cross-user IDOR. The immediate requirement for session authorization API is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves session authorization API and two test accounts demonstrate data access after swapping object identifier.
Question 67
In Government certificate authority, a security issue affects signing-key misuse: suspicious admin session triggers signing requests absent change ticket. The observed evidence is that HSM audit shows rapid signatures from unapproved operator credential. Operations must account for this constraint: citizen certificates must remain verifiable while compromised issuance stops. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Delete all existing certificates before determining compromise scope
- Preserve signed log chain and rotate subordinate keys under emergency CA procedure
- Suspend suspect signing principal and introduce dual-control HSM policy
- Monitor new signing anomalies and certificate revocation propagation
Explanation
Correct Answer
B:Preserve signed log chain and rotate subordinate keys under emergency CA procedure provides a governed means to introduce the chosen safeguard while respecting citizen certificates must remain verifiable while compromised issuance stops. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:An indiscriminate revocation can break public services without evidence. The immediate requirement for signing-key misuse is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
Question 68
In Insurance payment gateway, a security issue affects third-party software component: vendor library update introduces a vulnerable parser with transitive dependencies. The observed evidence is that build manifest references unsigned artifact outside the approved package registry. Operations must account for this constraint: release pipeline must preserve traceable supplier integrity. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Implement trusted registry pinning and automated policy checks in CI
- Rely only on a successful dynamic penetration scan of the interface
- Require SBOM, signed provenance and SCA policy gates before release
- Identify reachable transitive packages, provenance and affected build versions
Explanation
Correct Answer
D:Identify reachable transitive packages, provenance and affected build versions connects the reported evidence (build manifest references unsigned artifact outside the approved package registry) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
B:A scan may miss vulnerable transitive code and cannot prove provenance. The immediate requirement for third-party software component is evidence assessment, which this alternative does not provide.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves third-party software component and build manifest references unsigned artifact outside the approved package registry.
Question 69
In Government certificate authority, a security issue affects signing-key misuse: suspicious admin session triggers signing requests absent change ticket. The observed evidence is that HSM audit shows rapid signatures from unapproved operator credential. Operations must account for this constraint: citizen certificates must remain verifiable while compromised issuance stops. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Preserve signed log chain and rotate subordinate keys under emergency CA procedure
- Correlate HSM requests, operator authentication and issuance ledger
- Suspend suspect signing principal and introduce dual-control HSM policy
- Delete all existing certificates before determining compromise scope
Explanation
Correct Answer
B:Correlate HSM requests, operator authentication and issuance ledger connects the reported evidence (HSM audit shows rapid signatures from unapproved operator credential) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves signing-key misuse and HSM audit shows rapid signatures from unapproved operator credential.
D:An indiscriminate revocation can break public services without evidence. The immediate requirement for signing-key misuse is evidence assessment, which this alternative does not provide.
Question 70
In Regional water authority, a security issue affects remote telemetry service: field concentrators trust commands from a shared regional access gateway. The observed evidence is that design review finds unauthenticated actuator message forwarding behind gateway. Operations must account for this constraint: pumping safety forbids uncontrolled test shutdown. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Pilot authenticated command flow with staged fallback for emergency manual operation
- Bind signed command identity to device and operator authorization at the controller
- Trace STRIDE-style spoofing and tampering routes through field-controller trust boundaries
- Assume internal placement behind a VPN is equivalent to command authorization
Explanation
Correct Answer
C:Trace STRIDE-style spoofing and tampering routes through field-controller trust boundaries connects the reported evidence (design review finds unauthenticated actuator message forwarding behind gateway) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
D:Network location does not prove message authenticity or operator privilege. The immediate requirement for remote telemetry service is evidence assessment, which this alternative does not provide.
