Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Use recursion guards, idempotency and execution budgets.

The current facts call for this action: use recursion guards, idempotency and execution budgets.

Serverless events need central retention for investigation. The scenario does not present the alternate condition: failed function executions disappear because no shared audit collector receives events. The proper immediate action is to use recursion guards, idempotency and execution budgets.

The current facts call for this action: require contract-aligned processing transparency and transfer review.

Provider assurance cannot certify customer code. The scenario does not present the alternate condition: a provider's infrastructure SOC report excludes a customer's exposed API endpoint. The proper immediate action is to require contract-aligned processing transparency and transfer review.

The reported condition calls for this action: Require contract-aligned processing transparency and transfer review.

Immutable evidence retention would not enforce admission rules that prohibit unnecessary host privileges.

Inherited OS packages are part of runtime exposure. The scenario does not present the alternate condition: a deployment uses a vulnerable base image not refreshed by source code updates. The proper immediate action is to enforce admission rules that prohibit unnecessary host privileges.

Moving secrets into ephemeral protected build-time mechanisms would not enforce admission rules that prohibit unnecessary host privileges.

Bind key permissions to tenant identity and encryption context would not address the need for execute authorized lifecycle deletion and assess cryptographic erasure conditions.

The current facts call for this action: execute authorized lifecycle deletion and assess cryptographic erasure conditions.

Selecting compliant key and data locality settings together would not address the need for execute authorized lifecycle deletion and assess cryptographic erasure conditions.

The reported condition calls for this action: Test customer data restoration and define recovery ownership explicitly.

The current facts call for this action: test customer data restoration and define recovery ownership explicitly.

Managed service does not transfer all customer configuration risk. The scenario does not present the alternate condition: a managed database provider patches its infrastructure but customer-defined public network ACLs remain wide open. The proper immediate action is to test customer data restoration and define recovery ownership explicitly.

The current facts call for this action: reconcile authorized state and enforce guardrailed drift remediation.

Automated deployment must respect secret-management boundaries. The scenario does not present the alternate condition: ansible deployment tasks use shared SSH secrets stored in the repository. The proper immediate action is to reconcile authorized state and enforce guardrailed drift remediation.

The reported condition calls for this action: Reconcile authorized state and enforce guardrailed drift remediation.

Time-box exceptions with owner review and telemetry would not meet the need for proxy-based session controls and trusted identity context where permitted.

Out-of-band APIs can inspect at-rest SaaS content. The scenario does not present the alternate condition: a company needs to review SaaS files stored by remote users without inline web interception. The proper immediate action is to use proxy-based session controls and trusted identity context where permitted.

Using CASB discovery and enforcing approved destination policies would not meet the need for proxy-based session controls and trusted identity context where permitted.

Scoping the execution role limits resource access, but it does not remove bearer tokens already recorded in debug logs.

Protected telemetry could preserve more records, but the immediate problem is that the existing logs expose bearer tokens.

Recursion guards and execution budgets control function behavior; they do not redact exposed credentials or rotate affected tokens.

The reported condition calls for this action: Validate nonce/timestamp and reject stale repeated operations.

The current facts call for this action: validate nonce/timestamp and reject stale repeated operations.

Observability should not reveal authentication material. The scenario does not present the alternate condition: a cloud API's error logs include full credentials from failed requests. The proper immediate action is to validate nonce/timestamp and reject stale repeated operations.

The current facts call for this action: move secrets into ephemeral protected build-time mechanisms.

Container isolation depends on runtime policy. The scenario does not present the alternate condition: an orchestration workload requests privilege escalation and host networking without an operational need. The proper immediate action is to move secrets into ephemeral protected build-time mechanisms.

The reported condition calls for this action: Move secrets into ephemeral protected build-time mechanisms.

Selecting compliant key and data locality settings together would not meet the need for a supported customer-managed key design and test revocation.

Key use must be authorized per principal and purpose. The scenario does not present the alternate condition: a cloud service holds keys for one tenant but another tenant can invoke decrypt under a broad policy. The proper immediate action is to choose a supported customer-managed key design and test revocation.

Execute authorized lifecycle deletion and assess cryptographic erasure conditions would not meet the need for a supported customer-managed key design and test revocation.