Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Generate and retain an accurate SBOM for each released artifact.

The current facts call for this action: generate and retain an accurate SBOM for each released artifact.

Reproducible inputs reduce supply-chain substitution risk. The scenario does not present the alternate condition: a software release is built from unpinned external packages that can change without review. The proper immediate action is to generate and retain an accurate SBOM for each released artifact.

The current facts call for this action: design a controlled emergency workflow with audit and heightened review.

Unmeasurable security objectives cannot be validated. The scenario does not present the alternate condition: a product says it must be secure but gives no measurable availability goal. The proper immediate action is to design a controlled emergency workflow with audit and heightened review.

The reported condition calls for this action: Design a controlled emergency workflow with audit and heightened review.

Adding SAST to pull request checks and routing findings to code owners would not meet the need for dAST in an authorized test environment with representative user flows.

Transitive dependencies contribute to attack surface. The scenario does not present the alternate condition: a package contains a vulnerable transitive dependency absent from the source team's inventory. The proper immediate action is to use DAST in an authorized test environment with representative user flows.

Evaluating runtime protection with bounded policies and performance tests would not meet the need for dAST in an authorized test environment with representative user flows.

Recording the concern with acceptance authority and a concrete remediation decision would not meet the need for security-focused reviews with explicit authentication invariants.

The current facts call for this action: use security-focused reviews with explicit authentication invariants.

Applying formal properties or model checking to essential invariants would not meet the need for security-focused reviews with explicit authentication invariants. Human review quality depends on tested criteria.

The reported condition calls for this action: Verify model, firmware and certification scope for the actual device.

The current facts call for this action: verify model, firmware and certification scope for the actual device.

Hardware supply chain is part of the trusted computing base. The scenario does not present the alternate condition: replacement network cards arrive without firmware signatures or authentic provenance evidence. The proper immediate action is to verify model, firmware and certification scope for the actual device.

The current facts call for this action: test representative integration and interoperability before promotion.

Safe release recovery includes data state, not only binaries. The scenario does not present the alternate condition: a rollback restores code but leaves an incompatible database migration behind. The proper immediate action is to test representative integration and interoperability before promotion.

The reported condition calls for this action: Test representative integration and interoperability before promotion.

Generating and retaining an accurate SBOM for each released artifact would not verify build attestation and trusted pipeline identity beyond signature presence.

Third-party risk extends below the direct supplier. The scenario does not present the alternate condition: a new supplier component arrives without disclosure of its own build dependencies. The proper immediate action is to verify build attestation and trusted pipeline identity beyond signature presence.

Pin signed dependencies and enforce reviewed source provenance would not verify build attestation and trusted pipeline identity beyond signature presence. A signature alone cannot explain which workflow produced code.

Designing a controlled emergency workflow with audit and heightened review would not define latency, uptime and recovery nonfunctional targets.

The current facts call for this action: define latency, uptime and recovery nonfunctional targets.

Evaluating usability improvements that preserve policy enforcement would not define latency, uptime and recovery nonfunctional targets.

The reported condition calls for this action: Move essential security gates before release with controlled exceptions.

The current facts call for this action: move essential security gates before release with controlled exceptions.

Build environments must not inherit deployment powers. The scenario does not present the alternate condition: a compromised build runner can read production credentials despite only running tests. The proper immediate action is to move essential security gates before release with controlled exceptions.

The current facts call for this action: evaluate runtime protection with bounded policies and performance tests.

Transitive dependencies contribute to attack surface. The scenario does not present the alternate condition: a package contains a vulnerable transitive dependency absent from the source team's inventory. The proper immediate action is to evaluate runtime protection with bounded policies and performance tests.

The reported condition calls for this action: Evaluate runtime protection with bounded policies and performance tests.

Using security-focused reviews with explicit authentication invariants would not address the need for gate release on authorization tests reflecting the changed policy.

Design risk needs accountable disposition. The scenario does not present the alternate condition: a threat review finds a risky dependency but the code owner dismisses it as out of scope. The proper immediate action is to gate release on authorization tests reflecting the changed policy.

Applying formal properties or model checking to essential invariants would not address the need for gate release on authorization tests reflecting the changed policy.