CompTIA CAS-005 Practice Test 14

Question 130

The backup copies share the production administrator role and are deleted during ransomware. What should the enterprise security architect or analyst do NEXT?

Test failover and automate only verified steps with rollback options.
Use immutable separated recovery copies and independent credentials.
Design and rehearse failover considering TTL and client behavior.
Define an end-to-end health check tied to useful transaction outcomes.

Explanation

Correct Answer

Recoverability depends on isolation from the compromised control plane. The controlling fact is: The backup copies share the production administrator role and are deleted during ransomware.

Incorrect Answers

Testing failover and automate only verified steps with rollback options would not meet the need for immutable evidence retention. Recoverability depends on isolation from the compromised control plane.

External caches affect achieved recovery time. The scenario does not present the alternate condition: disaster recovery depends on DNS changes that clients cache for hours. The proper immediate action is to use immutable separated recovery copies and independent credentials.

Defining an end-to-end health check tied to useful transaction outcomes would not meet the need for immutable evidence retention. Recoverability depends on isolation from the compromised control plane.

Question 131

A campus switch accepts unmanaged devices on sensitive wired ports. Which action is MOST defensible given these facts?

Terminate VPN access through identity-aware policy with narrow resource routes.
Preserve authenticated client attribution through trusted forwarding metadata.
Integrate NAC with device identity and posture enforcement.
Schedule safe scoped scanning or passive assessment with OT approval.

Explanation

Correct Answer

Admission controls must operate before granting sensitive connectivity. The controlling fact is: A campus switch accepts unmanaged devices on sensitive wired ports.

Incorrect Answers

Terminate VPN access through identity-aware policy with narrow resource routes would not integrate NAC with device identity and posture enforcement.

The current facts call for this action: integrate NAC with device identity and posture enforcement.

Scheduling safe scoped scanning or passive assessment with OT approval would not integrate NAC with device identity and posture enforcement.

Question 132

Encrypted traffic is inspected at an approved termination point but the SOC lacks the terminating server's logs. Which action is the BEST response to the security requirement?

Place additional east-west sensors on the relevant network paths.
Protect log transport with mutual authentication and encrypted channels.
Deduplicate by source-event identity while preserving raw copies.
Correlate proxy metadata with app-side logs and endpoint activity.

Explanation

Correct Answer

Layered telemetry can explain encrypted sessions without unsafe interception. The controlling fact is: Encrypted traffic is inspected at an approved termination point but the SOC lacks the terminating server's logs.

Incorrect Answers

The reported condition calls for this action: Correlate proxy metadata with app-side logs and endpoint activity.

The current facts call for this action: correlate proxy metadata with app-side logs and endpoint activity.

Redundant transport should not inflate apparent threat volume. The scenario does not present the alternate condition: two collectors ingest each endpoint event and multiply incident counts. The proper immediate action is to correlate proxy metadata with app-side logs and endpoint activity.

Question 133

Both active sites rely on a single internet transit provider and the same DNS resolver. Which control or decision MOST directly resolves the stated gap?

Diversify connectivity and critical name-service dependencies.
Revise the architecture or recovery objective based on measured activation time.
Use region-aware caching or CDN placement while controlling sensitive content.
Choose approved same-jurisdiction recovery sites with tested isolation.

Explanation

Correct Answer

Geographic distribution can still share a common failure point. The controlling fact is: Both active sites rely on a single internet transit provider and the same DNS resolver.

Incorrect Answers

The current facts call for this action: diversify connectivity and critical name-service dependencies.

Content delivery can improve response time without copying secrets indiscriminately. The scenario does not present the alternate condition: a global user base experiences unacceptable latency despite a healthy origin application. The proper immediate action is to diversify connectivity and critical name-service dependencies.

The reported condition calls for this action: Diversify connectivity and critical name-service dependencies.

Question 134

An application must block malicious HTTP parameters before requests reach its application tier. What is the appropriate security response for this scenario?

Move or supplement inspection at a point with authorized decrypted visibility.
Deploy a WAF with tested route-specific rules in the reverse-proxy path.
Use passive detection and an approved separate enforcement path.
Put rate and abuse controls at an API gateway before costly backend execution.

Explanation

Correct Answer

Application-layer filtering is effective at the exposed web boundary. The controlling fact is: An application must block malicious HTTP parameters before requests reach its application tier.

Incorrect Answers

Moving or supplement inspection at a point with authorized decrypted visibility would not deploy a WAF with tested route-specific rules in the reverse-proxy path.

Safety and availability constraints can favor non-inline monitoring. The scenario does not present the alternate condition: a remote industrial site cannot tolerate inline filtering outages. The proper immediate action is to deploy a WAF with tested route-specific rules in the reverse-proxy path.

Putting rate and abuse controls at an API gateway would not deploy a WAF with tested route-specific rules in the reverse-proxy path.

Question 135

A security scanner saturates a low-bandwidth OT link every morning. Which control or decision MOST directly resolves the stated gap?

Terminate VPN access through identity-aware policy with narrow resource routes.
Preserve authenticated client attribution through trusted forwarding metadata.
Schedule safe scoped scanning or passive assessment with OT approval.
Integrate NAC with device identity and posture enforcement.

Explanation

Correct Answer

Scanning frequency and method must respect operational constraints. The controlling fact is: A security scanner saturates a low-bandwidth OT link every morning.

Incorrect Answers

Terminate VPN access through identity-aware policy with narrow resource routes would not schedule safe scoped scanning or passive assessment with OT approval.

The current facts call for this action: schedule safe scoped scanning or passive assessment with OT approval.

Integrating NAC with device identity and posture enforcement would not schedule safe scoped scanning or passive assessment with OT approval.

Question 136

A load balancer considers a service healthy because its TCP port is open while database operations fail. What is the appropriate security response for this scenario?

Test failover and automate only verified steps with rollback options.
Design and rehearse failover considering TTL and client behavior.
Use immutable separated recovery copies and independent credentials.
Define an end-to-end health check tied to useful transaction outcomes.

Explanation

Correct Answer

Transport reachability does not prove application readiness. The controlling fact is: A load balancer considers a service healthy because its TCP port is open while database operations fail.

Incorrect Answers

The reported condition calls for this action: Define an end-to-end health check tied to useful transaction outcomes.

The current facts call for this action: define an end-to-end health check tied to useful transaction outcomes.

Recoverability depends on isolation from the compromised control plane. The scenario does not present the alternate condition: the backup copies share the production administrator role and are deleted during ransomware. The proper immediate action is to define an end-to-end health check tied to useful transaction outcomes.

Question 137

An autoscaler increases instances but every node downloads the same large secret bundle. What should the enterprise security architect or analyst do NEXT?

Provision narrowly scoped secrets per workload through approved secret delivery.
Distribute work with horizontal capacity and measure bottlenecks.
Apply monitored scale-down and capacity bounds without affecting service requirements.
Externalize session state or design consistent safe session routing.

Explanation

Correct Answer

Scaling must not multiply privilege unnecessarily. The controlling fact is: An autoscaler increases instances but every node downloads the same large secret bundle.

Incorrect Answers

The current facts call for this action: provision narrowly scoped secrets per workload through approved secret delivery.

Elasticity needs both safe growth and removal. The scenario does not present the alternate condition: an autoscaler launches extra instances after demand subsides and costs climb. The proper immediate action is to provision narrowly scoped secrets per workload through approved secret delivery.

The reported condition calls for this action: Provision narrowly scoped secrets per workload through approved secret delivery.

Question 138

A global user base experiences unacceptable latency despite a healthy origin application. Which action is MOST defensible given these facts?

Choose approved same-jurisdiction recovery sites with tested isolation.
Use region-aware caching or CDN placement while controlling sensitive content.
Revise the architecture or recovery objective based on measured activation time.
Diversify connectivity and critical name-service dependencies.

Explanation

Correct Answer

Content delivery can improve response time without copying secrets indiscriminately. The controlling fact is: A global user base experiences unacceptable latency despite a healthy origin application.

Incorrect Answers

Choosing approved same-jurisdiction recovery sites with tested isolation would not meet the need for region-aware caching or CDN placement while controlling sensitive content.

Cold readiness cannot deliver an instantaneous failover guarantee. The scenario does not present the alternate condition: an enterprise expects a cold recovery region to meet a near-zero RTO. The proper immediate action is to use region-aware caching or CDN placement while controlling sensitive content.

Diversify connectivity and critical name-service dependencies would not meet the need for region-aware caching or CDN placement while controlling sensitive content.

Question 139

A service mesh encrypts links but lacks visibility into who is allowed to call which service. Which action is the BEST response to the security requirement?

Version schema contracts and regression-test identity context.
Test targeted exceptions against malicious samples and change-control approval.
Use authenticated service identities and authorization policies at the mesh.
Normalize canonical identity keys while retaining source provenance.

Explanation

Correct Answer

Confidential channels alone do not enforce least privilege. The controlling fact is: A service mesh encrypts links but lacks visibility into who is allowed to call which service.

Incorrect Answers

Schema-based testing would not meet the need for authenticated service identities and authorization policies at the mesh.

The current facts call for this action: use authenticated service identities and authorization policies at the mesh.

Normalizing canonical identity keys while retaining source provenance would not meet the need for authenticated service identities and authorization policies at the mesh.

Question 140

A sensor deployed behind a decrypting proxy sees only unrelated encrypted records. Which control or decision MOST directly resolves the stated gap?

Put rate and abuse controls at an API gateway before costly backend execution.
Use passive detection and an approved separate enforcement path.
Deploy a WAF with tested route-specific rules in the reverse-proxy path.
Move or supplement inspection at a point with authorized decrypted visibility.

Explanation

Correct Answer

Sensor placement must match the evidence needed to detect attacks. The controlling fact is: A sensor deployed behind a decrypting proxy sees only unrelated encrypted records.

Incorrect Answers

The reported condition calls for this action: Move or supplement inspection at a point with authorized decrypted visibility.

The current facts call for this action: move or supplement inspection at a point with authorized decrypted visibility.

Application-layer filtering is effective at the exposed web boundary. The scenario does not present the alternate condition: an application must block malicious HTTP parameters before requests reach its application tier. The proper immediate action is to move or supplement inspection at a point with authorized decrypted visibility.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 12 - 10 Questions (Last Reviewed 27-Oct-2026)
CompTIA CAS-005 Practice Test 13 - 10 Questions (Last Reviewed 26-Oct-2026)
CompTIA CAS-005 Practice Test 14 - 10 Questions (Last Reviewed 25-Oct-2026)
CompTIA CAS-005 Practice Test 15 - 10 Questions (Last Reviewed 24-Oct-2026)
CompTIA CAS-005 Practice Test 16 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 130

Explanation

Correct Answer

Incorrect Answers

Question 131

Explanation

Correct Answer

Incorrect Answers

Question 132

Explanation

Correct Answer

Incorrect Answers

Question 133

Explanation

Correct Answer

Incorrect Answers

Question 134

Explanation

Correct Answer

Incorrect Answers

Question 135

Explanation

Correct Answer

Incorrect Answers

Question 136

Explanation

Correct Answer

Incorrect Answers

Question 137

Explanation

Correct Answer

Incorrect Answers

Question 138

Explanation

Correct Answer

Incorrect Answers

Question 139

Explanation

Correct Answer

Incorrect Answers

Question 140

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests