Pass Your CompTIA CAS-005 Exam Easy!

Using recursion guards, idempotency and execution budgets would not scope its execution role to the one input/output resource set.

Serverless events need central retention for investigation. The scenario does not present the alternate condition: failed function executions disappear because no shared audit collector receives events. The proper immediate action is to scope its execution role to the one input/output resource set.

The reported condition calls for this action: Scope its execution role to the one input/output resource set.

Selecting compliant key and data locality settings together would not address the need for bind key permissions to tenant identity and encryption context.

The current facts call for this action: bind key permissions to tenant identity and encryption context.

Execute authorized lifecycle deletion and assess cryptographic erasure conditions would not address the need for bind key permissions to tenant identity and encryption context.

The reported condition calls for this action: Use CASB discovery and enforce approved destination policies.

The current facts call for this action: use CASB discovery and enforce approved destination policies.

Inline controls need attributable access context. The scenario does not present the alternate condition: a secure web gateway sees risky uploads but lacks identity mapping for unmanaged browsers. The proper immediate action is to use CASB discovery and enforce approved destination policies.

The current facts call for this action: add predeployment policy-as-code checks and fix the IaC source.

Infrastructure changes need traceable review and scope. The scenario does not present the alternate condition: a cloud environment applies broad policy changes from a developer branch without review. The proper immediate action is to add predeployment policy-as-code checks and fix the IaC source.

The reported condition calls for this action: Add predeployment policy-as-code checks and fix the IaC source.

Testing customer data restoration and defining recovery ownership explicitly would not correct customer-managed exposure and validate provider control boundaries.

Provider assurance cannot certify customer code. The scenario does not present the alternate condition: a provider's infrastructure SOC report excludes a customer's exposed API endpoint. The proper immediate action is to correct customer-managed exposure and validate provider control boundaries.

Requiring contract-aligned processing transparency and transferring review would not correct customer-managed exposure and validate provider control boundaries.

Rebuilding and testing on maintained base layers with dependency tracking would not address the need for immutable evidence retention.

The current facts call for this action: pin immutable digests and verify signed image provenance.

Enforcing admission rules that prohibit unnecessary host privileges would not address the need for immutable evidence retention.

The reported condition calls for this action: Select compliant key and data locality settings together.

The current facts call for this action: select compliant key and data locality settings together.

Key ownership changes operational control and responsibility. The scenario does not present the alternate condition: a service uses provider-managed keys despite contractually required customer revocation control. The proper immediate action is to select compliant key and data locality settings together.

The current facts call for this action: use protected credential injection and per-service identities.

Unreviewed drift can silently expand exposure. The scenario does not present the alternate condition: a drift scanner finds public ports opened by emergency console changes. The proper immediate action is to use protected credential injection and per-service identities.

The reported condition calls for this action: Use protected credential injection and per-service identities.

Using proxy-based session controls and trusted identity context where permitted would not meet the need for aPI-based CASB integration with provider-supported inspection.

Persistent exceptions can become new default exposures. The scenario does not present the alternate condition: a partner integration uses a CASB exception that never expires. The proper immediate action is to choose API-based CASB integration with provider-supported inspection.

Using CASB discovery and enforcing approved destination policies would not meet the need for aPI-based CASB integration with provider-supported inspection.

Validating nonce/timestamp and rejecting stale repeated operations would not meet the need for authenticated identity and trusted source controls for quotas.

The current facts call for this action: use authenticated identity and trusted source controls for quotas.

Enforcing object-level authorization at the API data access layer would not meet the need for authenticated identity and trusted source controls for quotas.

The reported condition calls for this action: Use recursion guards, idempotency and execution budgets.

The current facts call for this action: use recursion guards, idempotency and execution budgets.

Serverless events need central retention for investigation. The scenario does not present the alternate condition: failed function executions disappear because no shared audit collector receives events. The proper immediate action is to use recursion guards, idempotency and execution budgets.