CompTIA CAS-005 Practice Test 26

Question 250

A service uses provider-managed keys despite contractually required customer revocation control. Which action is MOST defensible given these facts?

Select compliant key and data locality settings together.
Choose a supported customer-managed key design and test revocation.
Bind key permissions to tenant identity and encryption context.
Execute authorized lifecycle deletion and assess cryptographic erasure conditions.

Explanation

Correct Answer

Key ownership changes operational control and responsibility. The controlling fact is: A service uses provider-managed keys despite contractually required customer revocation control.

Incorrect Answers

Selecting compliant key and data locality settings together would not meet the need for a supported customer-managed key design and test revocation.

Key use must be authorized per principal and purpose. The scenario does not present the alternate condition: a cloud service holds keys for one tenant but another tenant can invoke decrypt under a broad policy. The proper immediate action is to choose a supported customer-managed key design and test revocation.

Execute authorized lifecycle deletion and assess cryptographic erasure conditions would not meet the need for a supported customer-managed key design and test revocation.

Question 251

A partner integration uses a CASB exception that never expires. Which action is the BEST response to the security requirement?

Use CASB discovery and enforce approved destination policies.
Choose API-based CASB integration with provider-supported inspection.
Time-box exceptions with owner review and telemetry.
Use proxy-based session controls and trusted identity context where permitted.

Explanation

Correct Answer

Persistent exceptions can become new default exposures. The controlling fact is: A partner integration uses a CASB exception that never expires.

Incorrect Answers

Using CASB discovery and enforcing approved destination policies would not address the need for time-box exceptions with owner review and telemetry.

The current facts call for this action: time-box exceptions with owner review and telemetry.

Using proxy-based session controls and trusted identity context where permitted would not address the need for time-box exceptions with owner review and telemetry.

Question 252

A cloud environment applies broad policy changes from a developer branch without review. Which control or decision MOST directly resolves the stated gap?

Reconcile authorized state and enforce guardrailed drift remediation.
Add predeployment policy-as-code checks and fix the IaC source.
Use protected credential injection and per-service identities.
Require approved plan inspection and protected deployment identity.

Explanation

Correct Answer

Infrastructure changes need traceable review and scope. The controlling fact is: A cloud environment applies broad policy changes from a developer branch without review.

Incorrect Answers

The reported condition calls for this action: Require approved plan inspection and protected deployment identity.

The current facts call for this action: require approved plan inspection and protected deployment identity.

Automated deployment must respect secret-management boundaries. The scenario does not present the alternate condition: ansible deployment tasks use shared SSH secrets stored in the repository. The proper immediate action is to require approved plan inspection and protected deployment identity.

Question 253

A provider's infrastructure SOC report excludes a customer's exposed API endpoint. What is the appropriate security response for this scenario?

Assess the application's own access and data controls.
Correct customer-managed exposure and validate provider control boundaries.
Require contract-aligned processing transparency and transfer review.
Test customer data restoration and define recovery ownership explicitly.

Explanation

Correct Answer

Provider assurance cannot certify customer code. The controlling fact is: A provider's infrastructure SOC report excludes a customer's exposed API endpoint.

Incorrect Answers

The current facts call for this action: assess the application's own access and data controls.

Hosted software still entails supplier and jurisdiction risk. The scenario does not present the alternate condition: a SaaS vendor stores regulated records but refuses to supply its actual subprocessor list. The proper immediate action is to assess the application's own access and data controls.

The reported condition calls for this action: Assess the application's own access and data controls.

Question 254

Failed function executions disappear because no shared audit collector receives events. What should the enterprise security architect or analyst do NEXT?

Use recursion guards, idempotency and execution budgets.
Enable protected execution telemetry and control-plane logs.
Scope its execution role to the one input/output resource set.
Redact sensitive log fields and rotate exposed credentials.

Explanation

Correct Answer

Serverless events need central retention for investigation. The controlling fact is: Failed function executions disappear because no shared audit collector receives events.

Incorrect Answers

Using recursion guards, idempotency and execution budgets would not enable protected execution telemetry and control-plane logs.

Short-lived compute still needs least privilege. The scenario does not present the alternate condition: a function for invoice formatting has permissions to list every storage bucket in the account. The proper immediate action is to enable protected execution telemetry and control-plane logs.

The reported condition calls for this action: Enable protected execution telemetry and control-plane logs.

Question 255

A cloud API's error logs include full credentials from failed requests. Which action is MOST defensible given these facts?

Enforce object-level authorization at the API data access layer.
Use authenticated identity and trusted source controls for quotas.
Redact secrets at collection and rotate exposed tokens.
Validate nonce/timestamp and reject stale repeated operations.

Explanation

Correct Answer

Observability should not reveal authentication material. The controlling fact is: A cloud API's error logs include full credentials from failed requests.

Incorrect Answers

Enforcing object-level authorization at the API data access layer would not redact secrets at collection and rotate exposed tokens.

The current facts call for this action: redact secrets at collection and rotate exposed tokens.

Validating nonce/timestamp and rejecting stale repeated operations would not redact secrets at collection and rotate exposed tokens.

Question 256

A deployment uses a vulnerable base image not refreshed by source code updates. Which action is the BEST response to the security requirement?

Enforce admission rules that prohibit unnecessary host privileges.
Move secrets into ephemeral protected build-time mechanisms.
Pin immutable digests and verify signed image provenance.
Rebuild and test on maintained base layers with dependency tracking.

Explanation

Correct Answer

Inherited OS packages are part of runtime exposure. The controlling fact is: A deployment uses a vulnerable base image not refreshed by source code updates.

Incorrect Answers

The reported condition calls for this action: Rebuild and test on maintained base layers with dependency tracking.

The current facts call for this action: rebuild and test on maintained base layers with dependency tracking.

Unpinned tags can change deployment content silently. The scenario does not present the alternate condition: a container image uses the floating latest tag with unreviewed dependencies. The proper immediate action is to rebuild and test on maintained base layers with dependency tracking.

Question 257

An identity engine correctly denies a request but the API gateway ignores the decision. What is the appropriate security response for this scenario?

Fix enforcement integration and test explicit deny cases.
Include subject, object and environmental attributes in policy evaluation.
Use authenticated claims and protected policy communication.
Set bounded caching and invalidate decisions on entitlement updates.

Explanation

Correct Answer

Correct decisions have no effect if applications disregard them. The controlling fact is: An identity engine correctly denies a request but the API gateway ignores the decision.

Incorrect Answers

The current facts call for this action: fix enforcement integration and test explicit deny cases.

Decision inputs must resist caller tampering. The scenario does not present the alternate condition: an architecture sends API keys to the policy service in an unauthenticated header. The proper immediate action is to fix enforcement integration and test explicit deny cases.

The reported condition calls for this action: Fix enforcement integration and test explicit deny cases.

Question 258

One production namespace can reach unrelated internal payroll databases by default. What should the enterprise security architect or analyst do NEXT?

Create narrowly authorized probes and verify monitoring behavior.
Allow only verified service-to-service flows and deny other east-west traffic.
Use a dedicated identity-aware administrative zone with narrow privileges.
Enforce authenticated workload identities and peer authorization policies.

Explanation

Correct Answer

Application segmentation reduces lateral reach. The controlling fact is: One production namespace can reach unrelated internal payroll databases by default.

Incorrect Answers

Creating narrowly authorized probes and verifying monitoring behavior would not allow only verified service-to-service flows and deny other east-west traffic.

Administrative entry points need stricter boundaries. The scenario does not present the alternate condition: firewall rules permit management access from every laptop in the company. The proper immediate action is to allow only verified service-to-service flows and deny other east-west traffic.

Enforcing authenticated workload identities and peer authorization policies would not allow only verified service-to-service flows and deny other east-west traffic.

Question 259

A branch bypasses company web filtering by routing one SaaS app directly to the internet. Which action is MOST defensible given these facts?

Apply consistent device, identity and application policy regardless of location.
Authenticate peers and constrain accepted route prefixes.
Enforce the approved SASE path or narrowly reviewed exception.
Use identity-aware per-app access rather than broad network reach.

Explanation

Correct Answer

Deperimeterization still needs consistent policy enforcement. The controlling fact is: A branch bypasses company web filtering by routing one SaaS app directly to the internet.

Incorrect Answers

Applying consistent device, identity and application policy regardless of location would not enforce the approved SASE path or narrowly reviewed exception.

The current facts call for this action: enforce the approved SASE path or narrowly reviewed exception.

Using identity-aware per-app access rather than broad network reach would not enforce the approved SASE path or narrowly reviewed exception.

Question 260

Vendors connect to production using permanent desktop credentials and an unmanaged VPN. Which action is the BEST response to the security requirement?

Restore strict mutual identity verification and rotate the credential.
Restrict network reach to intended administrative assets with stronger segmentation.
Design protected, audited break-glass capability with periodic testing.
Use time-bound monitored access through a managed administrative broker.

Explanation

Correct Answer

Remote support should be attributable and limited. The controlling fact is: Vendors connect to production using permanent desktop credentials and an unmanaged VPN.

Incorrect Answers

The reported condition calls for this action: Use time-bound monitored access through a managed administrative broker.

The current facts call for this action: use time-bound monitored access through a managed administrative broker.

Emergency access must survive outages without becoming a standing backdoor. The scenario does not present the alternate condition: engineers require emergency access when the central identity service is offline. The proper immediate action is to use time-bound monitored access through a managed administrative broker.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 24 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CAS-005 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CAS-005 Practice Test 26 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CAS-005 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CAS-005 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 250

Explanation

Correct Answer

Incorrect Answers

Question 251

Explanation

Correct Answer

Incorrect Answers

Question 252

Explanation

Correct Answer

Incorrect Answers

Question 253

Explanation

Correct Answer

Incorrect Answers

Question 254

Explanation

Correct Answer

Incorrect Answers

Question 255

Explanation

Correct Answer

Incorrect Answers

Question 256

Explanation

Correct Answer

Incorrect Answers

Question 257

Explanation

Correct Answer

Incorrect Answers

Question 258

Explanation

Correct Answer

Incorrect Answers

Question 259

Explanation

Correct Answer

Incorrect Answers

Question 260

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests