CompTIA CAS-005 Practice Test 8
Question 70
In Regional water authority, a security issue affects remote telemetry service: field concentrators trust commands from a shared regional access gateway. The observed evidence is that design review finds unauthenticated actuator message forwarding behind gateway. Operations must account for this constraint: pumping safety forbids uncontrolled test shutdown. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Pilot authenticated command flow with staged fallback for emergency manual operation
- Bind signed command identity to device and operator authorization at the controller
- Trace STRIDE-style spoofing and tampering routes through field-controller trust boundaries
- Assume internal placement behind a VPN is equivalent to command authorization
Explanation
Correct Answer
C:Trace STRIDE-style spoofing and tampering routes through field-controller trust boundaries connects the reported evidence (design review finds unauthenticated actuator message forwarding behind gateway) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves remote telemetry service and design review finds unauthenticated actuator message forwarding behind gateway.
D:Network location does not prove message authenticity or operator privilege. The immediate requirement for remote telemetry service is evidence assessment, which this alternative does not provide.
Question 71
In Telecom merger program, a security issue affects shared customer identity directory: newly merged help desks can reset privileged credentials across subsidiaries. The observed evidence is that interviews expose undocumented reset exceptions and a common administrator group. Operations must account for this constraint: customer authentication must stay continuous throughout merger. Architects have verified the problem and must select a lasting safeguard. Which proposed design is most appropriate?
- Repeat modeling when organizational roles, support vendors or privileged endpoints change
- Draw only an external network diagram and omit human support processes
- Set separated reset authorization and identity-proofing controls across subsidiaries
- Enumerate actual reset paths, authority roles and cross-subsidiary privilege abuse cases
Explanation
Correct Answer
C:Set separated reset authorization and identity-proofing controls across subsidiaries is the durable measure that addresses the observed weakness: newly merged help desks can reset privileged credentials across subsidiaries. It must be enforceable while preserving the stated constraint: customer authentication must stay continuous throughout merger.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
B:Social-engineering and process paths can bypass well-segmented network controls. The immediate requirement for shared customer identity directory is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
Question 72
In Regional research laboratory, a security issue affects central detection fabric: cloud workload logs never reach the SIEM while perimeter alerts appear normal. The observed evidence is that collector health dashboard excludes one cloud account with sensitive samples. Operations must account for this constraint: laboratory compute bursts are unpredictable. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Enable collection in stages with bounded cost and parsing assurance
- Increase perimeter IDS sensitivity instead of collecting cloud control-plane events
- Place cloud-native audit collectors with authenticated, centralized retention
- Alert on silent source failures and adjust retention as research scope changes
Explanation
Correct Answer
A:Enable collection in stages with bounded cost and parsing assurance provides a governed means to introduce the chosen safeguard while respecting laboratory compute bursts are unpredictable. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:A louder network sensor cannot reveal omitted cloud audit activity. The immediate requirement for central detection fabric is safe implementation, which this alternative does not provide.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves central detection fabric and collector health dashboard excludes one cloud account with sensitive samples.
Question 73
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Share through approved TAXII trust channel and logged access controls
- Receiver tests indicator matching with synthetic data and retains provenance
- Send raw patient records to prove the indicator is important
- Confirm IOC source, timestamps, confidence and relevant environment context
Explanation
Correct Answer
B:Receiver tests indicator matching with synthetic data and retains provenance tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
C:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is verified remediation, which this alternative does not provide.
D:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
Question 74
In Telecom merger program, a security issue affects shared customer identity directory: newly merged help desks can reset privileged credentials across subsidiaries. The observed evidence is that interviews expose undocumented reset exceptions and a common administrator group. Operations must account for this constraint: customer authentication must stay continuous throughout merger. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Migrate administrative privileges with parallel monitoring and explicit exception expiry
- Repeat modeling when organizational roles, support vendors or privileged endpoints change
- Set separated reset authorization and identity-proofing controls across subsidiaries
- Draw only an external network diagram and omit human support processes
Explanation
Correct Answer
A:Migrate administrative privileges with parallel monitoring and explicit exception expiry provides a governed means to introduce the chosen safeguard while respecting customer authentication must stay continuous throughout merger. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
C:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves shared customer identity directory and interviews expose undocumented reset exceptions and a common administrator group.
D:Social-engineering and process paths can bypass well-segmented network controls. The immediate requirement for shared customer identity directory is safe implementation, which this alternative does not provide.
Question 75
In National patent office, a security issue affects digitally signed patent submissions: system stores hashes but cannot establish which inventor approved a filing. The observed evidence is that audit finds shared signing key used by several reviewers. Operations must account for this constraint: legal non-repudiation requires identity-bound approval. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Trace identity proofing, signature custody and legally relevant metadata
- Require individual certificate-backed digital signatures and timestamped approval logs
- Use a plain hash file without signer identification as evidence of inventor assent
- Migrate shared signing access into per-person protected key issuance
Explanation
Correct Answer
A:Trace identity proofing, signature custody and legally relevant metadata connects the reported evidence (audit finds shared signing key used by several reviewers) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
C:Hashes detect change but do not bind approval to an accountable individual. The immediate requirement for digitally signed patent submissions is evidence assessment, which this alternative does not provide.
D:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves digitally signed patent submissions and audit finds shared signing key used by several reviewers.
Question 76
In Healthcare incident response alliance, a security issue affects threat intelligence sharing: partner wants raw EHR fields with an observed phishing indicator. The observed evidence is that security team has IP, domain, first-seen time and unverified actor claim. Operations must account for this constraint: privacy rules limit sharing of patient identifiers. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Send raw patient records to prove the indicator is important
- Use STIX indicator package with confidence, classification and minimized fields
- Share through approved TAXII trust channel and logged access controls
- Reassess indicator freshness and revoke obsolete intelligence
Explanation
Correct Answer
C:Share through approved TAXII trust channel and logged access controls provides a governed means to introduce the chosen safeguard while respecting privacy rules limit sharing of patient identifiers. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Excess personal data is unnecessary for correlation and breaks minimization. The immediate requirement for threat intelligence sharing is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves threat intelligence sharing and security team has IP, domain, first-seen time and unverified actor claim.
Question 77
In Energy grid market operator, a security issue affects interconnect service mesh: trusted east-west traffic carries control requests beyond the caller's market function. The observed evidence is that service telemetry shows a reporting workload invoking command endpoints. Operations must account for this constraint: latency budgets limit heavyweight security proxies on plant links. The solution is approved and a production rollout is pending. Which change action manages availability, authorization and reversibility?
- Phase service-policy rollout with observed flows and fail-safe control paths
- Use mutual workload identities and per-operation policy at a service enforcement point
- Hide the entire mesh behind a perimeter firewall and allow internal calls
- Watch service identity rotation and cross-zone policy exceptions
Explanation
Correct Answer
A:Phase service-policy rollout with observed flows and fail-safe control paths provides a governed means to introduce the chosen safeguard while respecting latency budgets limit heavyweight security proxies on plant links. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
C:Outer perimeter trust cannot restrict lateral service-to-service privileges. The immediate requirement for interconnect service mesh is safe implementation, which this alternative does not provide.
D:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves interconnect service mesh and service telemetry shows a reporting workload invoking command endpoints.
Question 78
In Municipal property records, a security issue affects data classification program: copies of landowner identity documents have no owner tags outside primary database. The observed evidence is that object discovery finds sensitive scans in shared document stores. Operations must account for this constraint: historical record access rights vary by role and jurisdiction. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Design classification labels and role-based retention with storage DLP
- Apply tags and safe migration in controlled repository phases
- Identify all stored copies, owners, data flows and permitted use
- Encrypt only the main database while ignoring uncontrolled replicas
Explanation
Correct Answer
C:Identify all stored copies, owners, data flows and permitted use connects the reported evidence (object discovery finds sensitive scans in shared document stores) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves data classification program and object discovery finds sensitive scans in shared document stores.
D:Strong encryption on one copy does not govern replicated sensitive data. The immediate requirement for data classification program is evidence assessment, which this alternative does not provide.
Question 79
In Regional financial services, a security issue affects SOAR containment playbooks: unverified threat-intel match triggers automated network isolation of payroll servers. The observed evidence is that test playbook lacks confidence threshold and service-owner confirmation. Operations must account for this constraint: payroll uptime has a hard regulatory reporting deadline. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Track false isolations, approval latency and automation exceptions
- Set every low-confidence feed hit to automatic full network shutdown
- Gate high-impact isolation on corroboration, approval and bounded service scope
- Reconstruct alert quality, enrichment data and automation decision path
Explanation
Correct Answer
C:Gate high-impact isolation on corroboration, approval and bounded service scope is the durable measure that addresses the observed weakness: unverified threat-intel match triggers automated network isolation of payroll servers. It must be enforceable while preserving the stated constraint: payroll uptime has a hard regulatory reporting deadline.
Incorrect Answers
A:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
B:Unbounded action on uncertain indicators creates unacceptable operational disruption. The immediate requirement for SOAR containment playbooks is durable control selection, which this alternative does not provide.
D:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves SOAR containment playbooks and test playbook lacks confidence threshold and service-owner confirmation.
Question 80
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Map signing-key custody, firmware provenance and approval workflow
- Audit signature events, expiring keys and emergency rollout exceptions
- Publish a security policy without changing exposed signing-key storage
- Require hardware-protected release keys and dual-controlled signed artifacts
Explanation
Correct Answer
D:Require hardware-protected release keys and dual-controlled signed artifacts is the durable measure that addresses the observed weakness: firmware builds can be signed using a developer laptop key. It must be enforceable while preserving the stated constraint: devices must continue receiving urgent safety patches.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
C:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is durable control selection, which this alternative does not provide.
