Pass Your CompTIA CAS-005 Exam Easy!

Validating generated tool arguments against policy would not address the need for constrain tool permissions and require approval for sensitive actions.

Document content must not gain control authority. The scenario does not present the alternate condition: a retrieval assistant treats a sentence in an external document as an administrator command. The proper immediate action is to constrain tool permissions and require approval for sensitive actions.

Reduce secret-bearing prompts and test output disclosure controls would not address the need for constrain tool permissions and require approval for sensitive actions.

Testing fairness and error rates across languages would not meet the need for strong out-of-band identity proofing rather than voice familiarity.

The current facts call for this action: use strong out-of-band identity proofing rather than voice familiarity.

Using protected transaction verification and behavioral reporting drills would not meet the need for strong out-of-band identity proofing rather than voice familiarity.

The reported condition calls for this action: Require tested controls, documented datasets and measurable governance evidence.

The current facts call for this action: require tested controls, documented datasets and measurable governance evidence.

Automation does not establish factual reliability. The scenario does not present the alternate condition: a report includes AI-generated citations that no reviewer has checked. The proper immediate action is to require tested controls, documented datasets and measurable governance evidence.

The current facts call for this action: reduce secret-bearing prompts and test output disclosure controls.

Data-sourced instructions should not trigger exfiltration. The scenario does not present the alternate condition: an assistant summarizes vendor notes that contain an instruction to email secret keys. The proper immediate action is to reduce secret-bearing prompts and test output disclosure controls.

The reported condition calls for this action: Reduce secret-bearing prompts and test output disclosure controls.

Requiring signed provenance and dependency review would not address the need for rate-limit and test for data reconstruction or inversion behavior.

Poisoned examples can change model behavior after training. The scenario does not present the alternate condition: a threat actor gains permission to modify a training data bucket. The proper immediate action is to rate-limit and test for data reconstruction or inversion behavior.

Removing unauthorized model export and enforcing artifact access controls would not address the need for rate-limit and test for data reconstruction or inversion behavior.

Preserving DLP and exception governance independently of agent requests would not apply bounded tool budgets and cancellation thresholds.

The current facts call for this action: apply bounded tool budgets and cancellation thresholds.

Requiring policy-constrained approvals for high-impact changes would not apply bounded tool budgets and cancellation thresholds.

The reported condition calls for this action: Verify underlying sources before using generated claims as evidence.

The current facts call for this action: verify underlying sources before using generated claims as evidence.

Opaque automated outcomes can create fairness and regulatory risks. The scenario does not present the alternate condition: a high-impact model denies applicants without any meaningful explanation or appeal route. The proper immediate action is to verify underlying sources before using generated claims as evidence.

The current facts call for this action: remove unauthorized model export and enforce artifact access controls.

Model pipelines have software supply-chain risks. The scenario does not present the alternate condition: a model provider distributes a new binary artifact with no signature or origin evidence. The proper immediate action is to remove unauthorized model export and enforce artifact access controls.

The reported condition calls for this action: Remove unauthorized model export and enforce artifact access controls.

Enforcing separation of untrusted retrieval text from privileged instructions would not validate generated tool arguments against policy.

Data-sourced instructions should not trigger exfiltration. The scenario does not present the alternate condition: an assistant summarizes vendor notes that contain an instruction to email secret keys. The proper immediate action is to validate generated tool arguments against policy before execution.

Reduce secret-bearing prompts and test output disclosure controls would not validate generated tool arguments against policy.

Requiring policy-constrained approvals for high-impact changes would not preserve DLP and exception governance independently of agent requests. Business convenience cannot override mandatory data controls.

The current facts call for this action: preserve DLP and exception governance independently of agent requests.

Applying bounded tool budgets and cancellation thresholds would not preserve DLP and exception governance independently of agent requests. Business convenience cannot override mandatory data controls.

The reported condition calls for this action: Test fairness and error rates across languages before deployment.

The current facts call for this action: test fairness and error rates across languages before deployment.

Convincing synthetic media does not replace payment controls. The scenario does not present the alternate condition: a finance executive appears in a video call requesting a new urgent wire transfer. The proper immediate action is to test fairness and error rates across languages before deployment.