Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Move or supplement inspection at a point with authorized decrypted visibility.

The current facts call for this action: move or supplement inspection at a point with authorized decrypted visibility.

Application-layer filtering is effective at the exposed web boundary. The scenario does not present the alternate condition: an application must block malicious HTTP parameters before requests reach its application tier. The proper immediate action is to move or supplement inspection at a point with authorized decrypted visibility.

The current facts call for this action: protect log transport with mutual authentication and encrypted channels.

Redundant transport should not inflate apparent threat volume. The scenario does not present the alternate condition: two collectors ingest each endpoint event and multiply incident counts. The proper immediate action is to protect log transport with mutual authentication and encrypted channels.

The reported condition calls for this action: Protect log transport with mutual authentication and encrypted channels.

Moving or supplement inspection at a point with authorized decrypted visibility would not meet the need for passive detection and an approved separate enforcement path.

Application-layer filtering is effective at the exposed web boundary. The scenario does not present the alternate condition: an application must block malicious HTTP parameters before requests reach its application tier. The proper immediate action is to use passive detection and an approved separate enforcement path.

Putting rate and abuse controls at an API gateway would not meet the need for passive detection and an approved separate enforcement path.

Using immutable separated recovery copies and independent credentials would not design and rehearse failover considering TTL and client behavior.

The current facts call for this action: design and rehearse failover considering TTL and client behavior.

Testing failover and automate only verified steps with rollback options would not design and rehearse failover considering TTL and client behavior.

The reported condition calls for this action: Preserve authenticated client attribution through trusted forwarding metadata.

The current facts call for this action: preserve authenticated client attribution through trusted forwarding metadata.

Scanning frequency and method must respect operational constraints. The scenario does not present the alternate condition: a security scanner saturates a low-bandwidth OT link every morning. The proper immediate action is to preserve authenticated client attribution through trusted forwarding metadata.

The current facts call for this action: version schema contracts and regression-test identity context.

Confidential channels alone do not enforce least privilege. The scenario does not present the alternate condition: a service mesh encrypts links but lacks visibility into who is allowed to call which service. The proper immediate action is to version schema contracts and regression-test identity context.

The reported condition calls for this action: Version schema contracts and regression-test identity context.

Correlating proxy metadata with app-side logs and endpoint activity would not address the need for deduplicate by source-event identity while preserving raw copies.

Evidence loses trust when it can be intercepted or altered. The scenario does not present the alternate condition: a collector forwards security events through one unencrypted shared-network hop. The proper immediate action is to deduplicate by source-event identity while preserving raw copies.

Placing additional east-west sensors on the relevant network paths would not address the need for deduplicate by source-event identity while preserving raw copies.

Choosing approved same-jurisdiction recovery sites with tested isolation would not revise the architecture or recovery objective based on measured activation time.

The current facts call for this action: revise the architecture or recovery objective based on measured activation time.

Diversify connectivity and critical name-service dependencies would not revise the architecture or recovery objective based on measured activation time.

The reported condition calls for this action: Apply monitored scale-down and capacity bounds without affecting service requirements.

The current facts call for this action: apply monitored scale-down and capacity bounds without affecting service requirements.

Vertical hardware limits require different scaling behavior. The scenario does not present the alternate condition: a read-heavy service scales vertically until its largest instance is still saturated. The proper immediate action is to apply monitored scale-down and capacity bounds without affecting service requirements.

The current facts call for this action: apply formal properties or model checking to essential invariants.

Human review quality depends on tested criteria. The scenario does not present the alternate condition: two code reviewers approve changes without verifying the required second-factor branch. The proper immediate action is to apply formal properties or model checking to essential invariants.

The reported condition calls for this action: Apply formal properties or model checking to essential invariants.

Using DAST in an authorized test environment with representative user flows would not add SAST to pull request checks and route findings to code owners.

Runtime context differs from offline static scanning. The scenario does not present the alternate condition: a production workload needs monitoring that can associate dangerous inputs with executing code paths. The proper immediate action is to add SAST to pull request checks and route findings to code owners.

Running software composition analysis and inspecting reachable use of the component would not add SAST to pull request checks and route findings to code owners.