CompTIA CAS-005 Practice Test 27

Question 260

Vendors connect to production using permanent desktop credentials and an unmanaged VPN. Which action is the BEST response to the security requirement?

Restore strict mutual identity verification and rotate the credential.
Restrict network reach to intended administrative assets with stronger segmentation.
Design protected, audited break-glass capability with periodic testing.
Use time-bound monitored access through a managed administrative broker.

Explanation

Correct Answer

Remote support should be attributable and limited. The controlling fact is: Vendors connect to production using permanent desktop credentials and an unmanaged VPN.

Incorrect Answers

The reported condition calls for this action: Use time-bound monitored access through a managed administrative broker.

The current facts call for this action: use time-bound monitored access through a managed administrative broker.

Emergency access must survive outages without becoming a standing backdoor. The scenario does not present the alternate condition: engineers require emergency access when the central identity service is offline. The proper immediate action is to use time-bound monitored access through a managed administrative broker.

Question 261

A laptop's posture report says compliant but measured boot reports unexpected firmware state. Which control or decision MOST directly resolves the stated gap?

Check trusted hardware attestation before accepting the posture claim.
Apply a policy matching object sensitivity and limited device confidence.
Rebind inventory and authorization to the new accountable owner.
Reissue unique workload identity bound to the new instance.

Explanation

Correct Answer

Reported compliance and measured integrity are different evidence. The controlling fact is: A laptop's posture report says compliant but measured boot reports unexpected firmware state.

Incorrect Answers

The current facts call for this action: check trusted hardware attestation before accepting the posture claim.

Attestation and authorization must reflect current ownership. The scenario does not present the alternate condition: a trusted device certificate remains valid after ownership transfers to another department. The proper immediate action is to check trusted hardware attestation before accepting the posture claim.

The reported condition calls for this action: Check trusted hardware attestation before accepting the posture claim.

Question 262

A zero-trust gateway grants a month-long session based on posture measured only on login. What is the appropriate security response for this scenario?

Use context-driven step-up before the sensitive action.
Continuously evaluate device and session signals for risky changes.
Invalidate outdated grants and enforce up-to-date policy decisions.
Revoke the session and recheck identity and device trust.

Explanation

Correct Answer

Trust is conditional and time-varying. The controlling fact is: A zero-trust gateway grants a month-long session based on posture measured only on login.

Incorrect Answers

Using context-driven step-up would not address the need for continuously evaluate device and session signals for risky changes.

Stale authorization is not continuous authorization. The scenario does not present the alternate condition: a gateway caches an allow policy even after an employee changes roles. The proper immediate action is to continuously evaluate device and session signals for risky changes.

Revoking the session and recheck identity and device trust would not address the need for continuously evaluate device and session signals for risky changes.

Question 263

A partner API grants every customer the right to fetch an unrelated account record. What should the enterprise security architect or analyst do NEXT?

Use a dedicated managed workload identity with bounded permissions.
Recheck authorization at each changed resource boundary.
Check subject-object authorization on every request.
Issue audience-scoped service credentials for each distinct subject.

Explanation

Correct Answer

An authenticated caller may still lack object permission. The controlling fact is: A partner API grants every customer the right to fetch an unrelated account record.

Incorrect Answers

Using a dedicated managed workload identity with bounded permissions would not check subject-object authorization on every request.

The current facts call for this action: check subject-object authorization on every request.

The reported condition calls for this action: Check subject-object authorization on every request.

Question 264

A privileged application receives a valid cookie from a device recently marked lost. What is the appropriate security response for this scenario?

Continuously evaluate device and session signals for risky changes.
Use context-driven step-up before the sensitive action.
Invalidate outdated grants and enforce up-to-date policy decisions.
Revoke the session and recheck identity and device trust.

Explanation

Correct Answer

Existing sessions must respond to current high-risk conditions. The controlling fact is: A privileged application receives a valid cookie from a device recently marked lost.

Incorrect Answers

The reported condition calls for this action: Revoke the session and recheck identity and device trust.

The current facts call for this action: revoke the session and recheck identity and device trust.

Stale authorization is not continuous authorization. The scenario does not present the alternate condition: a gateway caches an allow policy even after an employee changes roles. The proper immediate action is to revoke the session and recheck identity and device trust.

Question 265

A policy engine makes a grant based on identity but ignores resource labels. What should the enterprise security architect or analyst do NEXT?

Include subject, object and environmental attributes in policy evaluation.
Fix enforcement integration and test explicit deny cases.
Set bounded caching and invalidate decisions on entitlement updates.
Use authenticated claims and protected policy communication.

Explanation

Correct Answer

Authorization must consider the target resource. The controlling fact is: A policy engine makes a grant based on identity but ignores resource labels.

Incorrect Answers

The current facts call for this action: include subject, object and environmental attributes in policy evaluation.

Policy freshness matters during privilege revocation. The scenario does not present the alternate condition: a broker caches decisions without expiration after high-risk role changes. The proper immediate action is to include subject, object and environmental attributes in policy evaluation.

The reported condition calls for this action: Include subject, object and environmental attributes in policy evaluation.

Question 266

Firewall rules permit management access from every laptop in the company. Which action is MOST defensible given these facts?

Allow only verified service-to-service flows and deny other east-west traffic.
Use a dedicated identity-aware administrative zone with narrow privileges.
Create narrowly authorized probes and verify monitoring behavior.
Enforce authenticated workload identities and peer authorization policies.

Explanation

Correct Answer

Administrative entry points need stricter boundaries. The controlling fact is: Firewall rules permit management access from every laptop in the company.

Incorrect Answers

Allowing only verified service-to-service flows and deny other east-west traffic would not meet the need for a dedicated identity-aware administrative zone with narrow privileges.

Isolation policies must include essential operational dependencies. The scenario does not present the alternate condition: network segmentation blocks legitimate health checks and causes false failover. The proper immediate action is to use a dedicated identity-aware administrative zone with narrow privileges.

Enforcing authenticated workload identities and peer authorization policies would not meet the need for a dedicated identity-aware administrative zone with narrow privileges.

Question 267

A new server instance inherits an identity from a retired clone. Which action is the BEST response to the security requirement?

Apply a policy matching object sensitivity and limited device confidence.
Rebind inventory and authorization to the new accountable owner.
Reissue unique workload identity bound to the new instance.
Check trusted hardware attestation before accepting the posture claim.

Explanation

Correct Answer

Cloned credentials defeat service identity assurance. The controlling fact is: A new server instance inherits an identity from a retired clone.

Incorrect Answers

Applying a policy matching object sensitivity and limited device confidence would not address the need for reissue unique workload identity bound to the new instance.

The current facts call for this action: reissue unique workload identity bound to the new instance.

Checking trusted hardware attestation would not address the need for reissue unique workload identity bound to the new instance.

Question 268

A remote worker has full network VPN access although only two cloud applications are required. Which control or decision MOST directly resolves the stated gap?

Apply consistent device, identity and application policy regardless of location.
Enforce the approved SASE path or narrowly reviewed exception.
Authenticate peers and constrain accepted route prefixes.
Use identity-aware per-app access rather than broad network reach.

Explanation

Correct Answer

The protected object should determine grant scope. The controlling fact is: A remote worker has full network VPN access although only two cloud applications are required.

Incorrect Answers

The reported condition calls for this action: Use identity-aware per-app access rather than broad network reach.

The current facts call for this action: use identity-aware per-app access rather than broad network reach.

Dynamic paths need trusted control-plane decisions. The scenario does not present the alternate condition: a critical SD-WAN policy accepts routes learned from untrusted peers without validation. The proper immediate action is to use identity-aware per-app access rather than broad network reach.

Question 269

Engineers require emergency access when the central identity service is offline. What is the appropriate security response for this scenario?

Design protected, audited break-glass capability with periodic testing.
Restore strict mutual identity verification and rotate the credential.
Restrict network reach to intended administrative assets with stronger segmentation.
Use time-bound monitored access through a managed administrative broker.

Explanation

Correct Answer

Emergency access must survive outages without becoming a standing backdoor. The controlling fact is: Engineers require emergency access when the central identity service is offline.

Incorrect Answers

The current facts call for this action: design protected, audited break-glass capability with periodic testing.

Trusted device posture does not justify unrestricted east-west access. The scenario does not present the alternate condition: an always-on VPN can reach an entire manufacturing network from a single approved laptop. The proper immediate action is to design protected, audited break-glass capability with periodic testing.

The reported condition calls for this action: Design protected, audited break-glass capability with periodic testing.

Question 270

A new machine client is provisioned by copying another application's OAuth credentials. What should the enterprise security architect or analyst do NEXT?

Recheck authorization at each changed resource boundary.
Issue audience-scoped service credentials for each distinct subject.
Use a dedicated managed workload identity with bounded permissions.
Check subject-object authorization on every request.

Explanation

Correct Answer

Shared client secrets erase meaningful identity boundaries. The controlling fact is: A new machine client is provisioned by copying another application's OAuth credentials.

Incorrect Answers

The reported condition calls for this action: Issue audience-scoped service credentials for each distinct subject.

Automation should not inherit an employee's broad grants. Shared client secrets erase meaningful identity boundaries.

An authenticated caller may still lack object permission. Shared client secrets erase meaningful identity boundaries.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CAS-005 Practice Test 26 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CAS-005 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CAS-005 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CAS-005 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 260

Explanation

Correct Answer

Incorrect Answers

Question 261

Explanation

Correct Answer

Incorrect Answers

Question 262

Explanation

Correct Answer

Incorrect Answers

Question 263

Explanation

Correct Answer

Incorrect Answers

Question 264

Explanation

Correct Answer

Incorrect Answers

Question 265

Explanation

Correct Answer

Incorrect Answers

Question 266

Explanation

Correct Answer

Incorrect Answers

Question 267

Explanation

Correct Answer

Incorrect Answers

Question 268

Explanation

Correct Answer

Incorrect Answers

Question 269

Explanation

Correct Answer

Incorrect Answers

Question 270

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests