CompTIA CAS-005 Practice Test 9
Question 80
In Medical device vendor, a security issue affects secure update chain: firmware builds can be signed using a developer laptop key. The observed evidence is that release record has no HSM-backed signing evidence or independent approval. Operations must account for this constraint: devices must continue receiving urgent safety patches. The affected path has been established. What durable design addresses the underlying exposure without sacrificing required operations?
- Map signing-key custody, firmware provenance and approval workflow
- Audit signature events, expiring keys and emergency rollout exceptions
- Publish a security policy without changing exposed signing-key storage
- Require hardware-protected release keys and dual-controlled signed artifacts
Explanation
Correct Answer
D:Require hardware-protected release keys and dual-controlled signed artifacts is the durable measure that addresses the observed weakness: firmware builds can be signed using a developer laptop key. It must be enforceable while preserving the stated constraint: devices must continue receiving urgent safety patches.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves secure update chain and release record has no HSM-backed signing evidence or independent approval.
C:Policy text cannot physically protect keys on a compromised workstation. The immediate requirement for secure update chain is durable control selection, which this alternative does not provide.
Question 81
In National insurance firm, a security issue affects remote browser isolation: claims adjusters open untrusted documents that trigger embedded downloads and macros. The observed evidence is that sandbox trace shows script creation during external document preview. Operations must account for this constraint: legitimate adjusters need read-only document review. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Use isolated browser/document rendering with restricted download and application control
- Map document-origin trust and generated process behavior on endpoints
- Deploy isolation to high-risk document sources with audited bypass request path
- Only increase email spam scoring but allow local macro execution
Explanation
Correct Answer
B:Map document-origin trust and generated process behavior on endpoints connects the reported evidence (sandbox trace shows script creation during external document preview) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
D:Filtering alone cannot neutralize documents already received and opened. The immediate requirement for remote browser isolation is evidence assessment, which this alternative does not provide.
Question 82
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Apply only per-IP rate limiting to the exposed endpoint
- Monitor authorization failure trends and new unreviewed API routes
- Test cross-tenant object reads and report exact denied trace identifiers
- Enforce object-level authorization in function and least-privilege backing store access
Explanation
Correct Answer
B:Monitor authorization failure trends and new unreviewed API routes identifies future loss of control, changed dependencies and exceptions affecting cloud API exposure. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
Question 83
In Financial brokerage, a security issue affects cloud identity compromise hunt: a newly observed token replay technique evades old IP-reputation rules. The observed evidence is that cloud logs show same token ID used from separate devices in minutes. Operations must account for this constraint: identity analysis must avoid overblocking legitimate VPN users. The control passed its initial acceptance test. Which continuing oversight best reveals drift or new exceptions?
- Replay simulated token theft to test signal and sanctioned VPN exclusion
- Track token reuse patterns and hypothesis outcomes as identity providers change
- Block every user crossing two geolocations without inspecting token identity
- Correlate device-bound token anomalies instead of IP-only indicators
Explanation
Correct Answer
B:Track token reuse patterns and hypothesis outcomes as identity providers change identifies future loss of control, changed dependencies and exceptions affecting cloud identity compromise hunt. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
C:Geographic anomalies alone can be caused by sanctioned VPN egress. The immediate requirement for cloud identity compromise hunt is ongoing assurance, which this alternative does not provide.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves cloud identity compromise hunt and cloud logs show same token ID used from separate devices in minutes.
Question 84
In Regional hospital consortium, a security issue affects patient telemetry exchange: clinical partners demand one retention rule despite incompatible jurisdiction-specific privacy obligations. The observed evidence is that contracts specify different deletion and legal-hold periods for two locations. Operations must account for this constraint: care teams need regulated continuity across jurisdictions. The change board needs a verified failure path before authorizing a permanent control. Which investigation supplies the most relevant evidence?
- Map binding retention, access, breach notice and legal-hold duties per location and data type
- Apply policy-as-code to pilot locations under logged approval and preservation safeguards
- Design jurisdiction-aware retention and access rules with owner and legal review
- Copy a single vendor default retention period to every hospital
Explanation
Correct Answer
A:Map binding retention, access, breach notice and legal-hold duties per location and data type connects the reported evidence (contracts specify different deletion and legal-hold periods for two locations) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves patient telemetry exchange and contracts specify different deletion and legal-hold periods for two locations.
D:Vendor defaults cannot supersede conflicting jurisdictional obligations. The immediate requirement for patient telemetry exchange is evidence assessment, which this alternative does not provide.
Question 85
In Telemedicine edge network, a security issue affects stateful firewall and IPS: asymmetric return routing bypasses inspection and drops allowed consultation sessions. The observed evidence is that flow record shows outbound path through IPS and return via separate gateway. Operations must account for this constraint: real-time clinical calls must not be interrupted in transition. What ongoing evidence will show whether changed identities, dependencies or environments weaken the security decision?
- Test end-to-end session continuity and malicious pattern detection across failover
- Design symmetric routing through inspection with appropriate HA state synchronization
- Monitor asymmetric paths, reset spikes and IPS policy drift
- Turn off all stateful filtering to prevent call drops
Explanation
Correct Answer
C:Monitor asymmetric paths, reset spikes and IPS policy drift identifies future loss of control, changed dependencies and exceptions affecting stateful firewall and IPS. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
B:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves stateful firewall and IPS and flow record shows outbound path through IPS and return via separate gateway.
D:Bypassing inspection leaves lateral and perimeter threats unmanaged. The immediate requirement for stateful firewall and IPS is ongoing assurance, which this alternative does not provide.
Question 86
In Global payment processing, a security issue affects SIEM fraud priorities: analysts rank all failed logins above active privileged changes to payout rules. The observed evidence is that event graph shows authorized batch retries and one unapproved payment-role grant. Operations must account for this constraint: service continuity requires batching legitimate payment jobs. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Apply risk-aware correlation linking role grants to payout changes and approvals
- Monitor alert outcomes and false-suppression risk after workflow changes
- Suppress every privileged-change alert while reducing login noise
- Stage alert changes using known-good payment batches as tuning baseline
Explanation
Correct Answer
D:Stage alert changes using known-good payment batches as tuning baseline provides a governed means to introduce the chosen safeguard while respecting service continuity requires batching legitimate payment jobs. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
B:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves SIEM fraud priorities and event graph shows authorized batch retries and one unapproved payment-role grant.
C:High-impact authorization changes cannot be ignored for cleaner metrics. The immediate requirement for SIEM fraud priorities is safe implementation, which this alternative does not provide.
Question 87
In National insurance firm, a security issue affects remote browser isolation: claims adjusters open untrusted documents that trigger embedded downloads and macros. The observed evidence is that sandbox trace shows script creation during external document preview. Operations must account for this constraint: legitimate adjusters need read-only document review. The change has been implemented and its ticket closed. Which technical check would establish that the original issue is actually controlled?
- Test active-document payloads and confirm no endpoint process or token access
- Map document-origin trust and generated process behavior on endpoints
- Only increase email spam scoring but allow local macro execution
- Deploy isolation to high-risk document sources with audited bypass request path
Explanation
Correct Answer
A:Test active-document payloads and confirm no endpoint process or token access tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
C:Filtering alone cannot neutralize documents already received and opened. The immediate requirement for remote browser isolation is verified remediation, which this alternative does not provide.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves remote browser isolation and sandbox trace shows script creation during external document preview.
Question 88
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Inspect server chain, client trust stores, EAP method and device certificate policy
- Track expiring trust anchors and device enrollment exceptions
- Deploy approved current CA chain and certificate lifecycle automation with client trust pinning
- Disable certificate validation on the wireless controller to restore service
Explanation
Correct Answer
C:Deploy approved current CA chain and certificate lifecycle automation with client trust pinning is the durable measure that addresses the observed weakness: campus devices fail network admission after CA certificate rollover. It must be enforceable while preserving the stated constraint: lab instruments lack unattended manual logon.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
B:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
D:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is durable control selection, which this alternative does not provide.
Question 89
In Public university identity office, a security issue affects 802.1X certificate authentication: campus devices fail network admission after CA certificate rollover. The observed evidence is that RADIUS records show chain validation error on endpoints with old trust bundle. Operations must account for this constraint: lab instruments lack unattended manual logon. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Deploy approved current CA chain and certificate lifecycle automation with client trust pinning
- Disable certificate validation on the wireless controller to restore service
- Stage campus supplicant updates by device cohorts before retiring old CA
- Inspect server chain, client trust stores, EAP method and device certificate policy
Explanation
Correct Answer
D:Inspect server chain, client trust stores, EAP method and device certificate policy connects the reported evidence (RADIUS records show chain validation error on endpoints with old trust bundle) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
B:Removing trust checks permits unauthorized authentication to the campus. The immediate requirement for 802.1X certificate authentication is evidence assessment, which this alternative does not provide.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves 802.1X certificate authentication and RADIUS records show chain validation error on endpoints with old trust bundle.
Question 90
In International retail group, a security issue affects security program governance: subsidiaries record vendor exemptions in unrelated spreadsheets and never reconcile risk acceptance. The observed evidence is that audit finds one reseller exception kept open after its contract expired. Operations must account for this constraint: acquired subsidiaries must preserve local lawful approvals. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Inventory controls, obligations, exception records and overlapping legal entities
- Migrate active exceptions after validating origin, local authority and reversible mapping
- Implement a central GRC evidence map with approved local ownership and common expiry controls
- Import all spreadsheet values as approved exceptions without provenance
Explanation
Correct Answer
A:Inventory controls, obligations, exception records and overlapping legal entities connects the reported evidence (audit finds one reseller exception kept open after its contract expired) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves security program governance and audit finds one reseller exception kept open after its contract expired.
D:Migration cannot confer acceptance authority absent from the original decision. The immediate requirement for security program governance is evidence assessment, which this alternative does not provide.
