CompTIA CAS-005 Practice Test 18

Question 170

A merge request changes access policy without updating integration tests. Which action is MOST defensible given these facts?

Use security-focused reviews with explicit authentication invariants.
Gate release on authorization tests reflecting the changed policy.
Record the concern with acceptance authority and a concrete remediation decision.
Apply formal properties or model checking to essential invariants.

Explanation

Correct Answer

Security requirements must remain executable through change. The controlling fact is: A merge request changes access policy without updating integration tests.

Incorrect Answers

Using security-focused reviews with explicit authentication invariants would not address the need for gate release on authorization tests reflecting the changed policy.

Design risk needs accountable disposition. The scenario does not present the alternate condition: a threat review finds a risky dependency but the code owner dismisses it as out of scope. The proper immediate action is to gate release on authorization tests reflecting the changed policy.

Applying formal properties or model checking to essential invariants would not address the need for gate release on authorization tests reflecting the changed policy.

Question 171

A rollback restores code but leaves an incompatible database migration behind. Which action is the BEST response to the security requirement?

Use canary rollout with health gates and automatic rollback.
Test representative integration and interoperability before promotion.
Design and test state-compatible rollback or forward recovery.
Run regression and integration tests across supported clients.

Explanation

Correct Answer

Safe release recovery includes data state, not only binaries. The controlling fact is: A rollback restores code but leaves an incompatible database migration behind.

Incorrect Answers

Using canary rollout with health gates and automatic rollback would not design and test state-compatible rollback or forward recovery.

The current facts call for this action: design and test state-compatible rollback or forward recovery.

Running regression and integration tests across supported clients would not design and test state-compatible rollback or forward recovery.

Question 172

A new supplier component arrives without disclosure of its own build dependencies. Which control or decision MOST directly resolves the stated gap?

Pin signed dependencies and enforce reviewed source provenance.
Verify build attestation and trusted pipeline identity beyond signature presence.
Generate and retain an accurate SBOM for each released artifact.
Require contractually useful provenance and dependency transparency.

Explanation

Correct Answer

Third-party risk extends below the direct supplier. The controlling fact is: A new supplier component arrives without disclosure of its own build dependencies.

Incorrect Answers

The reported condition calls for this action: Require contractually useful provenance and dependency transparency.

The current facts call for this action: require contractually useful provenance and dependency transparency.

Component visibility supports vulnerability response. The scenario does not present the alternate condition: a customer demands a machine-readable inventory of included software components. The proper immediate action is to require contractually useful provenance and dependency transparency.

Question 173

An emergency firmware update cannot be rolled back if it breaks booting. What is the appropriate security response for this scenario?

Require verified recovery image and safe maintenance strategy.
Plan a controlled upgrade or isolation with explicit risk acceptance.
Verify model, firmware and certification scope for the actual device.
Verify trusted manufacture and firmware integrity before installation.

Explanation

Correct Answer

Reliability and security both depend on recoverability. The controlling fact is: An emergency firmware update cannot be rolled back if it breaks booting.

Incorrect Answers

The current facts call for this action: require verified recovery image and safe maintenance strategy.

Assurance is version-specific. The scenario does not present the alternate condition: a product certification covers a hardware revision different from the delivered version. The proper immediate action is to require verified recovery image and safe maintenance strategy.

The reported condition calls for this action: Require verified recovery image and safe maintenance strategy.

Question 174

A developer proposes eliminating authorization checks to reduce interface complexity. What should the enterprise security architect or analyst do NEXT?

Design a controlled emergency workflow with audit and heightened review.
Evaluate usability improvements that preserve policy enforcement.
Add explicit tenant isolation and authorization acceptance criteria.
Define latency, uptime and recovery nonfunctional targets.

Explanation

Correct Answer

Security and usability trade-offs should not bypass mandatory controls. The controlling fact is: A developer proposes eliminating authorization checks to reduce interface complexity.

Incorrect Answers

Designing a controlled emergency workflow with audit and heightened review would not meet the need for usability improvements that preserve policy enforcement.

Security requirements must be testable before implementation. The scenario does not present the alternate condition: a new SaaS product defines access speed but no requirement for tenant isolation. The proper immediate action is to evaluate usability improvements that preserve policy enforcement.

Defining latency, uptime and recovery nonfunctional targets would not meet the need for usability improvements that preserve policy enforcement.

Question 175

A package contains a vulnerable transitive dependency absent from the source team's inventory. Which action is MOST defensible given these facts?

Add SAST to pull request checks and route findings to code owners.
Use DAST in an authorized test environment with representative user flows.
Run software composition analysis and inspect reachable use of the component.
Evaluate runtime protection with bounded policies and performance tests.

Explanation

Correct Answer

Transitive dependencies contribute to attack surface. The controlling fact is: A package contains a vulnerable transitive dependency absent from the source team's inventory.

Incorrect Answers

Adding SAST to pull request checks and routing findings to code owners would not run software composition analysis and inspect reachable use of the component.

The current facts call for this action: run software composition analysis and inspect reachable use of the component.

Evaluating runtime protection with bounded policies and performance tests would not run software composition analysis and inspect reachable use of the component.

Question 176

A pipeline can overwrite published artifacts under the same version without detection. Which action is the BEST response to the security requirement?

Use controlled emergency approval and preserve branch protections and logs.
Use isolated short-lived identities and secrets scoped to each pipeline stage.
Move essential security gates before release with controlled exceptions.
Use immutable signed artifacts and provenance attestations.

Explanation

Correct Answer

Release consumers need a stable, verifiable identity. The controlling fact is: A pipeline can overwrite published artifacts under the same version without detection.

Incorrect Answers

The reported condition calls for this action: Use immutable signed artifacts and provenance attestations.

The current facts call for this action: use immutable signed artifacts and provenance attestations.

Preventive checks should execute before exposure. The scenario does not present the alternate condition: a code scanning job runs after artifacts are publicly deployed. The proper immediate action is to use immutable signed artifacts and provenance attestations.

Question 177

Cloud workloads trust a flat VPN from the corporate data center to the entire virtual network. What is the appropriate security response for this scenario?

Segment routes and require workload-aware identity policies.
Grant narrow API scopes and independently log its service identity.
Design limited audited egress to trusted key service endpoints.
Establish canonical claims and enforce authorization locally.

Explanation

Correct Answer

VPN connectivity should not grant universal east-west access. The controlling fact is: Cloud workloads trust a flat VPN from the corporate data center to the entire virtual network.

Incorrect Answers

The current facts call for this action: segment routes and require workload-aware identity policies.

A control must allow the dependencies it is meant to protect. The scenario does not present the alternate condition: on-premises egress filtering blocks approved cloud key-retrieval endpoints. The proper immediate action is to segment routes and require workload-aware identity policies.

The reported condition calls for this action: Segment routes and require workload-aware identity policies.

Question 178

A nonpatchable imaging device requires an obsolete protocol to communicate with hospital systems. What should the enterprise security architect or analyst do NEXT?

Apply tested interim isolation and expedite replacement with owner signoff.
Place it in a restricted segment with mediated access and monitoring.
Use protected external database activity monitoring and network-level corroboration.
Remove the insecure bypass or enforce a controlled verified trust exception.

Explanation

Correct Answer

Risk can be reduced when direct remediation is unavailable. The controlling fact is: A nonpatchable imaging device requires an obsolete protocol to communicate with hospital systems.

Incorrect Answers

Applying tested interim isolation and expedite replacement with owner signoff would not place it in a restricted segment with mediated access and monitoring.

Compensating controls can supply missing native telemetry. The scenario does not present the alternate condition: a legacy database lacks native audit logs but the architecture needs tamper evidence. The proper immediate action is to place it in a restricted segment with mediated access and monitoring.

Removing the insecure bypass or enforce a controlled verified trust exception would not place it in a restricted segment with mediated access and monitoring.

Question 179

A customer database relies entirely on an externally facing firewall and has broad service permissions. Which action is MOST defensible given these facts?

Enforce object-level authorization in the application.
Update attack surface mapping and gate the management path.
Add independent database authorization and segmentation controls.
Disable unused components or isolate unavoidable legacy functionality.

Explanation

Correct Answer

A single perimeter cannot enforce every data-level trust boundary. The controlling fact is: A customer database relies entirely on an externally facing firewall and has broad service permissions.

Incorrect Answers

Enforcing object-level authorization in the application would not add independent database authorization and segmentation controls. A single perimeter cannot enforce every data-level trust boundary.

The current facts call for this action: add independent database authorization and segmentation controls.

Disable unused components or isolate unavoidable legacy functionality would not add independent database authorization and segmentation controls. A single perimeter cannot enforce every data-level trust boundary.

Question 180

A vendor manages network devices but sends remote maintenance commands outside the bastion. Which action is the BEST response to the security requirement?

Enforce contractual retention, encryption and secure deletion.
Require sender authentication and replay-resistant request integrity.
Isolate tenant credentials and use audience-restricted tokens.
Enforce contract-mapped time-limited access through monitored sessions.

Explanation

Correct Answer

Supplier control must be applied at the operational interface. The controlling fact is: A vendor manages network devices but sends remote maintenance commands outside the bastion.

Incorrect Answers

The reported condition calls for this action: Enforce contract-mapped time-limited access through monitored sessions.

The current facts call for this action: enforce contract-mapped time-limited access through monitored sessions.

Shared external integration secrets amplify compromise. The scenario does not present the alternate condition: an external payment connector shares tokens across customer tenants. The proper immediate action is to enforce contract-mapped time-limited access through monitored sessions.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 16 - 10 Questions (Last Reviewed 23-Oct-2026)
CompTIA CAS-005 Practice Test 17 - 10 Questions (Last Reviewed 22-Oct-2026)
CompTIA CAS-005 Practice Test 18 - 10 Questions (Last Reviewed 21-Oct-2026)
CompTIA CAS-005 Practice Test 19 - 10 Questions (Last Reviewed 20-Oct-2026)
CompTIA CAS-005 Practice Test 20 - 10 Questions (Last Reviewed 19-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 170

Explanation

Correct Answer

Incorrect Answers

Question 171

Explanation

Correct Answer

Incorrect Answers

Question 172

Explanation

Correct Answer

Incorrect Answers

Question 173

Explanation

Correct Answer

Incorrect Answers

Question 174

Explanation

Correct Answer

Incorrect Answers

Question 175

Explanation

Correct Answer

Incorrect Answers

Question 176

Explanation

Correct Answer

Incorrect Answers

Question 177

Explanation

Correct Answer

Incorrect Answers

Question 178

Explanation

Correct Answer

Incorrect Answers

Question 179

Explanation

Correct Answer

Incorrect Answers

Question 180

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests