CompTIA CAS-005 Practice Test 1

Question 1

A developer clones production customer data into a shared QA tenant. Which control or decision MOST directly resolves the stated gap?

Use masked or synthetic data and restrict nonproduction access.
Apply a defined retention and secure-disposal lifecycle to snapshots.
Supply representative tokenized test fixtures rather than live card data.
Sanitize test outputs and secure the artifact repository.

Explanation

Correct Answer

Testing value can be preserved without exposing raw customers. The controlling fact is: A developer clones production customer data into a shared QA tenant.

Incorrect Answers

The current facts call for this action: use masked or synthetic data and restrict nonproduction access.

Functional realism does not require real payment identifiers. The scenario does not present the alternate condition: a test engineer needs realistic payment behavior and requests complete primary account numbers. The proper immediate action is to use masked or synthetic data and restrict nonproduction access.

The reported condition calls for this action: Use masked or synthetic data and restrict nonproduction access.

Question 2

An insurer's security policy names a required outcome but teams need a precise password rotation procedure. What is the appropriate security response for this scenario?

Separate optional guidance from binding policies and standards before approval.
Publish an approved procedure detailing accountable steps and evidence.
Assign policy ownership and execute the documented change and approval cycle.
Issue a measurable enterprise encryption standard with scoped exceptions.

Explanation

Correct Answer

A policy states intent; a procedure defines repeatable execution. The controlling fact is: An insurer's security policy names a required outcome but teams need a precise password rotation procedure.

Incorrect Answers

Separating optional guidance from binding policies and standards would not publish an approved procedure detailing accountable steps and evidence.

Governed revision keeps policy aligned to binding requirements. The scenario does not present the alternate condition: a regional law changes how customer records must be handled and a policy owner is absent. The proper immediate action is to publish an approved procedure detailing accountable steps and evidence.

The reported condition calls for this action: Publish an approved procedure detailing accountable steps and evidence.

Question 3

Executives expect risk signoff from a SOC operator who can recommend but cannot accept risk. What should the enterprise security architect or analyst do NEXT?

Record decisions, owners and follow-up dates in committee governance records.
Resolve to one accountable role and identify consulted responders.
Assign risk acceptance to the authorized accountable business owner.
Document decision rights, service obligations and escalation ownership.

Explanation

Correct Answer

Technical advice is not the same as ownership of enterprise risk. The controlling fact is: Executives expect risk signoff from a SOC operator who can recommend but cannot accept risk.

Incorrect Answers

Recording decisions, owners and follow-up dates in committee governance records would not assign risk acceptance to the authorized accountable business owner.

The current facts call for this action: assign risk acceptance to the authorized accountable business owner.

Documenting decision rights, service obligations and escalation ownership would not assign risk acceptance to the authorized accountable business owner.

Question 4

Five regulations map to overlapping access-control requirements, creating duplicated attestations. Which action is MOST defensible given these facts?

Preserve immutable evidence snapshots and review timestamps.
Integrate continuous test results and monitor missing evidence as a gap.
Record scope, exceptions and residual exposure explicitly.
Build a unified control mapping with requirement-specific evidence links.

Explanation

Correct Answer

One effective control can support several obligations without losing traceability. The controlling fact is: Five regulations map to overlapping access-control requirements, creating duplicated attestations.

Incorrect Answers

The reported condition calls for this action: Build a unified control mapping with requirement-specific evidence links.

The current facts call for this action: build a unified control mapping with requirement-specific evidence links.

Compliance reporting must reflect the assets actually covered. The scenario does not present the alternate condition: a control owner marks encryption compliant although one environment is excluded. The proper immediate action is to build a unified control mapping with requirement-specific evidence links.

Question 5

Employees finish annual training yet continue entering credentials in simulated phishing pages. Which action is the BEST response to the security requirement?

Use role-appropriate exercises and measure behavioral improvement.
Tailor operational security training to OT safety and access workflows.
Minimize training data and avoid unnecessary sensitive collection.
Publish a clear nonpunitive reporting route and rehearse prompt reporting.

Explanation

Correct Answer

Completion rates do not establish effective awareness. The controlling fact is: Employees finish annual training yet continue entering credentials in simulated phishing pages.

Incorrect Answers

The current facts call for this action: use role-appropriate exercises and measure behavioral improvement.

Security awareness must not create a new privacy exposure. The scenario does not present the alternate condition: a privacy training campaign collects learners' full medical details to personalize scenarios. The proper immediate action is to use role-appropriate exercises and measure behavioral improvement.

The reported condition calls for this action: Use role-appropriate exercises and measure behavioral improvement.

Question 6

A CMDB shows a decommissioned server as active after it was removed from the network. Which control or decision MOST directly resolves the stated gap?

Require authorized change recording and reconcile the deployed baseline.
Reconcile CMDB records with authoritative discovery and disposal evidence.
Define configuration item relationships and accountable owners for components.
Enroll the asset through approval, classification and baseline tracking.

Explanation

Correct Answer

Asset lifecycle accuracy is necessary for defensible monitoring and risk ownership. The controlling fact is: A CMDB shows a decommissioned server as active after it was removed from the network.

Incorrect Answers

Requiring authorized change recording and reconciling the deployed baseline would not reconcile CMDB records with authoritative discovery and disposal evidence.

Dependencies make ownership actionable during outages and remediation. The scenario does not present the alternate condition: a business critical application has a service owner but no infrastructure owner. The proper immediate action is to reconcile CMDB records with authoritative discovery and disposal evidence.

Enroll the asset through approval, classification and baseline tracking would not reconcile CMDB records with authoritative discovery and disposal evidence.

Question 7

Two subsidiaries follow incompatible encryption settings although corporate security intent is identical. Which action is the BEST response to the security requirement?

Separate optional guidance from binding policies and standards before approval.
Assign policy ownership and execute the documented change and approval cycle.
Issue a measurable enterprise encryption standard with scoped exceptions.
Publish an approved procedure detailing accountable steps and evidence.

Explanation

Correct Answer

A standard establishes the same enforceable baseline across business units. The controlling fact is: Two subsidiaries follow incompatible encryption settings although corporate security intent is identical.

Incorrect Answers

Guidelines provide advice but should not silently become mandatory controls. A standard establishes the same enforceable baseline across business units.

Governed revision keeps policy aligned to binding requirements. A standard establishes the same enforceable baseline across business units.

A policy states intent; a procedure defines repeatable execution. A standard establishes the same enforceable baseline across business units.

Question 8

A staging database is retired but its snapshots remain indefinitely accessible. Which control or decision MOST directly resolves the stated gap?

Use masked or synthetic data and restrict nonproduction access.
Sanitize test outputs and secure the artifact repository.
Supply representative tokenized test fixtures rather than live card data.
Apply a defined retention and secure-disposal lifecycle to snapshots.

Explanation

Correct Answer

Copies remain regulated data throughout their life. The controlling fact is: A staging database is retired but its snapshots remain indefinitely accessible.

Incorrect Answers

The reported condition calls for this action: Apply a defined retention and secure-disposal lifecycle to snapshots.

The current facts call for this action: apply a defined retention and secure-disposal lifecycle to snapshots.

Functional realism does not require real payment identifiers. The scenario does not present the alternate condition: a test engineer needs realistic payment behavior and requests complete primary account numbers. The proper immediate action is to apply a defined retention and secure-disposal lifecycle to snapshots.

Question 9

Contractors operate industrial equipment but the training only covers office phishing. What is the appropriate security response for this scenario?

Tailor operational security training to OT safety and access workflows.
Use role-appropriate exercises and measure behavioral improvement.
Publish a clear nonpunitive reporting route and rehearse prompt reporting.
Minimize training data and avoid unnecessary sensitive collection.

Explanation

Correct Answer

Training should match actual tasks and consequence. The controlling fact is: Contractors operate industrial equipment but the training only covers office phishing.

Incorrect Answers

The current facts call for this action: tailor operational security training to OT safety and access workflows.

A trusted reporting culture reduces dwell time. The scenario does not present the alternate condition: staff report attacks late because they fear punishment for mistaken clicks. The proper immediate action is to tailor operational security training to OT safety and access workflows.

The reported condition calls for this action: Tailor operational security training to OT safety and access workflows.

Question 10

A business critical application has a service owner but no infrastructure owner. What should the enterprise security architect or analyst do NEXT?

Require authorized change recording and reconcile the deployed baseline.
Define configuration item relationships and accountable owners for components.
Reconcile CMDB records with authoritative discovery and disposal evidence.
Enroll the asset through approval, classification and baseline tracking.

Explanation

Correct Answer

Dependencies make ownership actionable during outages and remediation. The controlling fact is: A business critical application has a service owner but no infrastructure owner.

Incorrect Answers

Requiring authorized change recording and reconciling the deployed baseline would not define configuration item relationships and accountable owners for components.

Asset lifecycle accuracy is necessary for defensible monitoring and risk ownership. The scenario does not present the alternate condition: a CMDB shows a decommissioned server as active after it was removed from the network. The proper immediate action is to define configuration item relationships and accountable owners for components.

Enroll the asset through approval, classification and baseline tracking would not define configuration item relationships and accountable owners for components.