Pass Your CompTIA CAS-005 Exam Easy!

Adding proofing and authoritative approval would not address the need for automate deprovisioning and verify target application account removal.

Reset routes are authentication control surfaces. The scenario does not present the alternate condition: a help-desk password reset bypasses prior identity proofing for executive accounts. The proper immediate action is to automate deprovisioning and verify target application account removal.

Recertify entitlements and remove obsolete privileges would not address the need for automate deprovisioning and verify target application account removal.

Requiring risk-based identity verification and auditing the reset would not add proofing and authoritative approval.

The current facts call for this action: add proofing and authoritative approval before issuing the role.

Recertify entitlements and remove obsolete privileges would not add proofing and authoritative approval.

The reported condition calls for this action: Bind issuer, audience and nonce to the intended client flow.

The current facts call for this action: bind issuer, audience and nonce to the intended client flow.

Successful sign-in should not imply privilege. The scenario does not present the alternate condition: an enterprise uses SSO but each application assigns administrator rights by default. The proper immediate action is to bind issuer, audience and nonce to the intended client flow.

The current facts call for this action: require RA validation and issuance audit trails.

Revocation availability affects authenticated session establishment. The scenario does not present the alternate condition: tLS handshakes stall because clients cannot query the revocation endpoint. The proper immediate action is to require RA validation and issuance audit trails.

The reported condition calls for this action: Require RA validation and issuance audit trails.

Replacing discretionary permissions with centrally governed data policies would not meet the need for attribute-based authorization with current contextual claims.

Discretionary sharing should not override mandatory restrictions. The scenario does not present the alternate condition: a government document must be read only by personnel with clearance and need-to-know. The proper immediate action is to use attribute-based authorization with current contextual claims.

Enforcing separation of duties through approved role rules would not meet the need for attribute-based authorization with current contextual claims.

Enforcing facility zone authorization rather than generic card validity would not address the need for credential management. Logical deprovisioning does not revoke shared secrets.

The current facts call for this action: rotate shared credentials and review emergency access ownership.

The reported condition calls for this action: Rotate shared credentials and review emergency access ownership.

The reported condition calls for this action: Apply resource-sensitive step-up policy and approval gates.

The current facts call for this action: apply resource-sensitive step-up policy and approval gates.

Security state can change after initial authentication. The scenario does not present the alternate condition: a trusted device becomes noncompliant mid-session but keeps privileged SaaS access. The proper immediate action is to apply resource-sensitive step-up policy and approval gates.

The current facts call for this action: replace shared codes with individual attributable credentials.

Logical deprovisioning does not revoke shared secrets. The scenario does not present the alternate condition: a user is removed from a privileged logical group but retains a shared break-glass password. The proper immediate action is to replace shared codes with individual attributable credentials.

The reported condition calls for this action: Replace shared codes with individual attributable credentials.

Validating issuer, signature, audience and replay constraints at the service provider would not separate authentication federation from application role authorization.

Tokens need context-specific verification. The scenario does not present the alternate condition: an OIDC app accepts ID tokens from a different client application. The proper immediate action is to separate authentication federation from application role authorization.

Repairing federated subject mapping and rejecting ambiguous principal identities would not separate authentication federation from application role authorization.

Adding proofing and authoritative approval would not require risk-based identity verification and audit the reset.

The current facts call for this action: require risk-based identity verification and audit the reset.

Recertify entitlements and remove obsolete privileges would not require risk-based identity verification and audit the reset.

The reported condition calls for this action: Evaluate approved OCSP stapling or reachable revocation infrastructure.

The current facts call for this action: evaluate approved OCSP stapling or reachable revocation infrastructure.

Chain validation depends on current issuing authorities. The scenario does not present the alternate condition: an internal web endpoint presents a certificate signed by a retired enterprise intermediate. The proper immediate action is to evaluate approved OCSP stapling or reachable revocation infrastructure.