Pass Your CompTIA CAS-005 Exam Easy!

Establishing canonical claims and enforcing authorization locally would not grant narrow API scopes and independently log its service identity.

A control must allow the dependencies it is meant to protect. The scenario does not present the alternate condition: on-premises egress filtering blocks approved cloud key-retrieval endpoints. The proper immediate action is to grant narrow API scopes and independently log its service identity.

Segment routes and require workload-aware identity policies would not grant narrow API scopes and independently log its service identity.

Defining a usable classification model tied to handling requirements would not extend coverage to the remaining authorized egress channels.

The current facts call for this action: extend coverage to the remaining authorized egress channels.

Detecting content sensitivity and relabel the artifact would not extend coverage to the remaining authorized egress channels.

The reported condition calls for this action: Enforce contractual retention, encryption and secure deletion.

The current facts call for this action: enforce contractual retention, encryption and secure deletion.

A trusted partner label does not authenticate each request. The scenario does not present the alternate condition: a partner API ignores signature verification for incoming callbacks. The proper immediate action is to enforce contractual retention, encryption and secure deletion.

The current facts call for this action: tune using data classification and valid business destinations.

Raw block volume is a poor effectiveness metric. The scenario does not present the alternate condition: a WAF reports a million blocked requests but has no evidence that business attacks were prevented. The proper immediate action is to tune using data classification and valid business destinations.

The reported condition calls for this action: Tune using data classification and valid business destinations.

Applying tested interim isolation and expedite replacement with owner signoff would not meet the need for protected external database activity monitoring and network-level corroboration.

Risk can be reduced when direct remediation is unavailable. The scenario does not present the alternate condition: a nonpatchable imaging device requires an obsolete protocol to communicate with hospital systems. The proper immediate action is to use protected external database activity monitoring and network-level corroboration.

Removing the insecure bypass or enforce a controlled verified trust exception would not meet the need for protected external database activity monitoring and network-level corroboration.

Adding independent database authorization and segmentation controls would not update attack surface mapping and gate the management path.

The current facts call for this action: update attack surface mapping and gate the management path.

Disable unused components or isolate unavoidable legacy functionality would not update attack surface mapping and gate the management path.

The reported condition calls for this action: Establish canonical claims and enforce authorization locally.

The current facts call for this action: establish canonical claims and enforce authorization locally.

Integration convenience is not sufficient for tenant-wide access. The scenario does not present the alternate condition: a SaaS reporting connector requests full administrative privileges to read one dataset. The proper immediate action is to establish canonical claims and enforce authorization locally.

The current facts call for this action: alert on heartbeat and ingestion-health failures.

Effective detection needs attributable service events. The scenario does not present the alternate condition: a new sensitive microservice generates only error summaries without request identity or correlation IDs. The proper immediate action is to alert on heartbeat and ingestion-health failures.

The reported condition calls for this action: Alert on heartbeat and ingestion-health failures.

Disable unused components or isolate unavoidable legacy functionality would not enforce object-level authorization in the application. Perimeter filtering cannot repair broken business authorization.

Unmodeled interfaces weaken exposure assessments. The scenario does not present the alternate condition: a vulnerability scan reports a service with hidden management routes not accounted for in the design. The proper immediate action is to enforce object-level authorization in the application.

Adding independent database authorization and segmentation controls would not enforce object-level authorization in the application. Perimeter filtering cannot repair broken business authorization.

Establishing canonical claims and enforcing authorization locally would not design limited audited egress to trusted key service endpoints.

The current facts call for this action: design limited audited egress to trusted key service endpoints.

Granting narrow API scopes and independently log its service identity would not design limited audited egress to trusted key service endpoints.

The reported condition calls for this action: Constrain snapshot retention and secret remediation using data discovery.

The current facts call for this action: constrain snapshot retention and secret remediation using data discovery.

Partial channels create unobserved exfiltration paths. The scenario does not present the alternate condition: a DLP control monitors web uploads but not file copies to local removable drives. The proper immediate action is to constrain snapshot retention and secret remediation using data discovery.