CompTIA CAS-005 Practice Test 23

Question 220

TLS handshakes stall because clients cannot query the revocation endpoint. Which control or decision MOST directly resolves the stated gap?

Require RA validation and issuance audit trails.
Use the appropriate certificate profile and key usage for client identity.
Update the certificate chain and trust anchors using approved CA rollover.
Evaluate approved OCSP stapling or reachable revocation infrastructure.

Explanation

Correct Answer

Revocation availability affects authenticated session establishment. The controlling fact is: TLS handshakes stall because clients cannot query the revocation endpoint.

Incorrect Answers

The reported condition calls for this action: Evaluate approved OCSP stapling or reachable revocation infrastructure.

The current facts call for this action: evaluate approved OCSP stapling or reachable revocation infrastructure.

Chain validation depends on current issuing authorities. The scenario does not present the alternate condition: an internal web endpoint presents a certificate signed by a retired enterprise intermediate. The proper immediate action is to evaluate approved OCSP stapling or reachable revocation infrastructure.

Question 221

A government document must be read only by personnel with clearance and need-to-know. What is the appropriate security response for this scenario?

Apply mandatory classification and clearance control labels.
Enforce separation of duties through approved role rules.
Use attribute-based authorization with current contextual claims.
Replace discretionary permissions with centrally governed data policies.

Explanation

Correct Answer

Discretionary sharing should not override mandatory restrictions. The controlling fact is: A government document must be read only by personnel with clearance and need-to-know.

Incorrect Answers

The current facts call for this action: apply mandatory classification and clearance control labels.

RBAC alone may not express dynamic conditions. The scenario does not present the alternate condition: a medical device requires access based on clinician role, shift and ward assignment. The proper immediate action is to apply mandatory classification and clearance control labels.

The reported condition calls for this action: Apply mandatory classification and clearance control labels.

Question 222

An authorization engine sends allow decisions but the downstream proxy ignores denials. What should the enterprise security architect or analyst do NEXT?

Reevaluate session authorization based on current device posture.
Verify policy enforcement point behavior with explicit deny tests.
Apply resource-sensitive step-up policy and approval gates.
Use trusted network metadata and authenticated device signals.

Explanation

Correct Answer

A policy decision is ineffective without enforcement. The controlling fact is: An authorization engine sends allow decisions but the downstream proxy ignores denials.

Incorrect Answers

Reevaluate session authorization based on current device posture would not verify policy enforcement point behavior with explicit deny tests.

Context must reflect data consequence as well as user identity. The scenario does not present the alternate condition: a user logs in from a managed laptop but requests a data export classified highly restricted. The proper immediate action is to verify policy enforcement point behavior with explicit deny tests.

Using trusted network metadata and authenticated device signals would not verify policy enforcement point behavior with explicit deny tests.

Question 223

A shared folder owner can unilaterally grant any employee access to regulated records. What is the appropriate security response for this scenario?

Use attribute-based authorization with current contextual claims.
Apply mandatory classification and clearance control labels.
Replace discretionary permissions with centrally governed data policies.
Enforce separation of duties through approved role rules.

Explanation

Correct Answer

Sensitive classification can require stricter control than owner preference. The controlling fact is: A shared folder owner can unilaterally grant any employee access to regulated records.

Incorrect Answers

Using attribute-based authorization with current contextual claims would not replace discretionary permissions with centrally governed data policies.

The current facts call for this action: replace discretionary permissions with centrally governed data policies.

Enforcing separation of duties through approved role rules would not replace discretionary permissions with centrally governed data policies.

Question 224

A service provider cannot distinguish two contractor identities due to a shared immutable subject value. What should the enterprise security architect or analyst do NEXT?

Bind issuer, audience and nonce to the intended client flow.
Separate authentication federation from application role authorization.
Validate issuer, signature, audience and replay constraints at the service provider.
Repair federated subject mapping and reject ambiguous principal identities.

Explanation

Correct Answer

Stable unique subjects are required for accountability. The controlling fact is: A service provider cannot distinguish two contractor identities due to a shared immutable subject value.

Incorrect Answers

The reported condition calls for this action: Repair federated subject mapping and reject ambiguous principal identities.

The current facts call for this action: repair federated subject mapping and reject ambiguous principal identities.

A signed assertion is not universally valid for every application. The scenario does not present the alternate condition: a SAML relying party trusts any assertion from a partner without validating the audience. The proper immediate action is to repair federated subject mapping and reject ambiguous principal identities.

Question 225

Policy rules trust an unvalidated IP header supplied by the requester. Which action is MOST defensible given these facts?

Use trusted network metadata and authenticated device signals.
Verify policy enforcement point behavior with explicit deny tests.
Apply resource-sensitive step-up policy and approval gates.
Reevaluate session authorization based on current device posture.

Explanation

Correct Answer

Requester-controlled claims are not reliable authorization attributes. The controlling fact is: Policy rules trust an unvalidated IP header supplied by the requester.

Incorrect Answers

The current facts call for this action: use trusted network metadata and authenticated device signals.

Context must reflect data consequence as well as user identity. The scenario does not present the alternate condition: a user logs in from a managed laptop but requests a data export classified highly restricted. The proper immediate action is to use trusted network metadata and authenticated device signals.

The reported condition calls for this action: Use trusted network metadata and authenticated device signals.

Question 226

Client TLS certificates are created with server authentication EKU only. Which action is the BEST response to the security requirement?

Require RA validation and issuance audit trails.
Use the appropriate certificate profile and key usage for client identity.
Update the certificate chain and trust anchors using approved CA rollover.
Evaluate approved OCSP stapling or reachable revocation infrastructure.

Explanation

Correct Answer

Certificate capabilities must match their intended role. The controlling fact is: Client TLS certificates are created with server authentication EKU only.

Incorrect Answers

Requiring RA validation and issuance audit trails would not meet the need for the appropriate certificate profile and key usage for client identity.

Chain validation depends on current issuing authorities. The scenario does not present the alternate condition: an internal web endpoint presents a certificate signed by a retired enterprise intermediate. The proper immediate action is to use the appropriate certificate profile and key usage for client identity.

Evaluating approved OCSP stapling or reachable revocation infrastructure would not meet the need for the appropriate certificate profile and key usage for client identity.

Question 227

A service account retains permanent administrator rights after its batch process is redesigned. Which control or decision MOST directly resolves the stated gap?

Require risk-based identity verification and audit the reset.
Automate deprovisioning and verify target application account removal.
Recertify entitlements and remove obsolete privileges.
Add proofing and authoritative approval before issuing the role.

Explanation

Correct Answer

Provisioning lifecycles include ongoing minimization. The controlling fact is: A service account retains permanent administrator rights after its batch process is redesigned.

Incorrect Answers

Requiring risk-based identity verification and auditing the reset would not address the need for recertify entitlements and remove obsolete privileges.

The current facts call for this action: recertify entitlements and remove obsolete privileges.

Adding proofing and authoritative approval would not address the need for recertify entitlements and remove obsolete privileges.

Question 228

An elevated cloud access request uses an unverified hardware key enrollment. What is the appropriate security response for this scenario?

Rotate shared credentials and review emergency access ownership.
Enforce facility zone authorization rather than generic card validity.
Replace shared codes with individual attributable credentials.
Attest the authenticator binding before granting privilege.

Explanation

Correct Answer

Strong authentication relies on trustworthy credential enrollment. The controlling fact is: An elevated cloud access request uses an unverified hardware key enrollment.

Incorrect Answers

The reported condition calls for this action: Attest the authenticator binding before granting privilege.

The current facts call for this action: attest the authenticator binding before granting privilege.

Identity accountability matters in physical access systems. The scenario does not present the alternate condition: a door system logs staff entries using only a communal access code. The proper immediate action is to attest the authenticator binding before granting privilege.

Question 229

A customer API grants access when callers supply another tenant's object number. Which action is MOST defensible given these facts?

Enforce object-level authorization at the API data access layer.
Use authenticated identity and trusted source controls for quotas.
Validate nonce/timestamp and reject stale repeated operations.
Redact secrets at collection and rotate exposed tokens.

Explanation

Correct Answer

Authentication is not proof of ownership of each object. The controlling fact is: A customer API grants access when callers supply another tenant's object number.

Incorrect Answers

The current facts call for this action: enforce object-level authorization at the API data access layer.

Message signatures alone do not prevent replay. The scenario does not present the alternate condition: an API accepts replayed signed requests without verifying request age. The proper immediate action is to enforce object-level authorization at the API data access layer.

The reported condition calls for this action: Enforce object-level authorization at the API data access layer.

Question 230

A function for invoice formatting has permissions to list every storage bucket in the account. Which action is the BEST response to the security requirement?

Use recursion guards, idempotency and execution budgets.
Scope its execution role to the one input/output resource set.
Enable protected execution telemetry and control-plane logs.
Redact sensitive log fields and rotate exposed credentials.

Explanation

Correct Answer

Short-lived compute still needs least privilege. The controlling fact is: A function for invoice formatting has permissions to list every storage bucket in the account.

Incorrect Answers

Using recursion guards, idempotency and execution budgets would not scope its execution role to the one input/output resource set.

Serverless events need central retention for investigation. The scenario does not present the alternate condition: failed function executions disappear because no shared audit collector receives events. The proper immediate action is to scope its execution role to the one input/output resource set.

The reported condition calls for this action: Scope its execution role to the one input/output resource set.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 21 - 10 Questions (Last Reviewed 18-Oct-2026)
CompTIA CAS-005 Practice Test 22 - 10 Questions (Last Reviewed 17-Oct-2026)
CompTIA CAS-005 Practice Test 23 - 10 Questions (Last Reviewed 16-Oct-2026)
CompTIA CAS-005 Practice Test 24 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CAS-005 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 220

Explanation

Correct Answer

Incorrect Answers

Question 221

Explanation

Correct Answer

Incorrect Answers

Question 222

Explanation

Correct Answer

Incorrect Answers

Question 223

Explanation

Correct Answer

Incorrect Answers

Question 224

Explanation

Correct Answer

Incorrect Answers

Question 225

Explanation

Correct Answer

Incorrect Answers

Question 226

Explanation

Correct Answer

Incorrect Answers

Question 227

Explanation

Correct Answer

Incorrect Answers

Question 228

Explanation

Correct Answer

Incorrect Answers

Question 229

Explanation

Correct Answer

Incorrect Answers

Question 230

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests