CompTIA CAS-005 Practice Test 28

Question 270

A new machine client is provisioned by copying another application's OAuth credentials. What should the enterprise security architect or analyst do NEXT?

Recheck authorization at each changed resource boundary.
Issue audience-scoped service credentials for each distinct subject.
Use a dedicated managed workload identity with bounded permissions.
Check subject-object authorization on every request.

Explanation

Correct Answer

Shared client secrets erase meaningful identity boundaries. The controlling fact is: A new machine client is provisioned by copying another application's OAuth credentials.

Incorrect Answers

The reported condition calls for this action: Issue audience-scoped service credentials for each distinct subject.

Automation should not inherit an employee's broad grants. Shared client secrets erase meaningful identity boundaries.

An authenticated caller may still lack object permission. Shared client secrets erase meaningful identity boundaries.

Question 271

A traveler changes networks but stays authenticated for highly sensitive operations. What is the appropriate security response for this scenario?

Invalidate outdated grants and enforce up-to-date policy decisions.
Revoke the session and recheck identity and device trust.
Use context-driven step-up before the sensitive action.
Continuously evaluate device and session signals for risky changes.

Explanation

Correct Answer

Network and transaction context can change authentication assurance. The controlling fact is: A traveler changes networks but stays authenticated for highly sensitive operations.

Incorrect Answers

Invalidate outdated grants and enforce up-to-date policy decisions would not meet the need for context-driven step-up.

The current facts call for this action: use context-driven step-up before the sensitive action.

Continuously evaluate device and session signals for risky changes would not meet the need for context-driven step-up.

Question 272

A broker caches decisions without expiration after high-risk role changes. What should the enterprise security architect or analyst do NEXT?

Fix enforcement integration and test explicit deny cases.
Use authenticated claims and protected policy communication.
Include subject, object and environmental attributes in policy evaluation.
Set bounded caching and invalidate decisions on entitlement updates.

Explanation

Correct Answer

Policy freshness matters during privilege revocation. The controlling fact is: A broker caches decisions without expiration after high-risk role changes.

Incorrect Answers

The reported condition calls for this action: Set bounded caching and invalidate decisions on entitlement updates.

The current facts call for this action: set bounded caching and invalidate decisions on entitlement updates.

Authorization must consider the target resource. The scenario does not present the alternate condition: a policy engine makes a grant based on identity but ignores resource labels. The proper immediate action is to set bounded caching and invalidate decisions on entitlement updates.

Question 273

An unmanaged contractor device needs access to a low-sensitivity public project portal. Which action is MOST defensible given these facts?

Apply a policy matching object sensitivity and limited device confidence.
Rebind inventory and authorization to the new accountable owner.
Reissue unique workload identity bound to the new instance.
Check trusted hardware attestation before accepting the posture claim.

Explanation

Correct Answer

Zero Trust can grant proportional access rather than blanket trust. The controlling fact is: An unmanaged contractor device needs access to a low-sensitivity public project portal.

Incorrect Answers

The current facts call for this action: apply a policy matching object sensitivity and limited device confidence.

Cloned credentials defeat service identity assurance. The scenario does not present the alternate condition: a new server instance inherits an identity from a retired clone. The proper immediate action is to apply a policy matching object sensitivity and limited device confidence.

The reported condition calls for this action: Apply a policy matching object sensitivity and limited device confidence.

Question 274

A critical SD-WAN policy accepts routes learned from untrusted peers without validation. Which action is the BEST response to the security requirement?

Apply consistent device, identity and application policy regardless of location.
Authenticate peers and constrain accepted route prefixes.
Enforce the approved SASE path or narrowly reviewed exception.
Use identity-aware per-app access rather than broad network reach.

Explanation

Correct Answer

Dynamic paths need trusted control-plane decisions. The controlling fact is: A critical SD-WAN policy accepts routes learned from untrusted peers without validation.

Incorrect Answers

Applying consistent device, identity and application policy regardless of location would not authenticate peers and constrain accepted route prefixes.

Deperimeterization still needs consistent policy enforcement. The scenario does not present the alternate condition: a branch bypasses company web filtering by routing one SaaS app directly to the internet. The proper immediate action is to authenticate peers and constrain accepted route prefixes.

Using identity-aware per-app access rather than broad network reach would not authenticate peers and constrain accepted route prefixes.

Question 275

An always-on VPN can reach an entire manufacturing network from a single approved laptop. Which control or decision MOST directly resolves the stated gap?

Design protected, audited break-glass capability with periodic testing.
Use time-bound monitored access through a managed administrative broker.
Restrict network reach to intended administrative assets with stronger segmentation.
Restore strict mutual identity verification and rotate the credential.

Explanation

Correct Answer

Trusted device posture does not justify unrestricted east-west access. The controlling fact is: An always-on VPN can reach an entire manufacturing network from a single approved laptop.

Incorrect Answers

Designing protected, audited break-glass capability with periodic testing would not restrict network reach to intended administrative assets with stronger segmentation.

The current facts call for this action: restrict network reach to intended administrative assets with stronger segmentation.

Restoring strict mutual identity verification and rotate the credential would not restrict network reach to intended administrative assets with stronger segmentation.

Question 276

A service uses a human employee's token to run unattended nightly work. What is the appropriate security response for this scenario?

Issue audience-scoped service credentials for each distinct subject.
Recheck authorization at each changed resource boundary.
Check subject-object authorization on every request.
Use a dedicated managed workload identity with bounded permissions.

Explanation

Correct Answer

Automation should not inherit an employee's broad grants. The controlling fact is: A service uses a human employee's token to run unattended nightly work.

Incorrect Answers

The reported condition calls for this action: Use a dedicated managed workload identity with bounded permissions.

The current facts call for this action: use a dedicated managed workload identity with bounded permissions.

An authenticated caller may still lack object permission. The scenario does not present the alternate condition: a partner API grants every customer the right to fetch an unrelated account record. The proper immediate action is to use a dedicated managed workload identity with bounded permissions.

Question 277

A service mesh verifies TLS transport but does not check service identity authorization. What should the enterprise security architect or analyst do NEXT?

Enforce authenticated workload identities and peer authorization policies.
Use a dedicated identity-aware administrative zone with narrow privileges.
Allow only verified service-to-service flows and deny other east-west traffic.
Create narrowly authorized probes and verify monitoring behavior.

Explanation

Correct Answer

Encrypted traffic can still be unauthorized. The controlling fact is: A service mesh verifies TLS transport but does not check service identity authorization.

Incorrect Answers

The current facts call for this action: enforce authenticated workload identities and peer authorization policies.

Application segmentation reduces lateral reach. The scenario does not present the alternate condition: one production namespace can reach unrelated internal payroll databases by default. The proper immediate action is to enforce authenticated workload identities and peer authorization policies.

The reported condition calls for this action: Enforce authenticated workload identities and peer authorization policies.

Question 278

Network segmentation blocks legitimate health checks and causes false failover. What is the appropriate security response for this scenario?

Allow only verified service-to-service flows and deny other east-west traffic.
Create narrowly authorized probes and verify monitoring behavior.
Enforce authenticated workload identities and peer authorization policies.
Use a dedicated identity-aware administrative zone with narrow privileges.

Explanation

Correct Answer

Isolation policies must include essential operational dependencies. The controlling fact is: Network segmentation blocks legitimate health checks and causes false failover.

Incorrect Answers

Allowing only verified service-to-service flows and deny other east-west traffic would not create narrowly authorized probes and verify monitoring behavior.

Encrypted traffic can still be unauthorized. The scenario does not present the alternate condition: a service mesh verifies TLS transport but does not check service identity authorization. The proper immediate action is to create narrowly authorized probes and verify monitoring behavior.

Using a dedicated identity-aware administrative zone with narrow privileges would not create narrowly authorized probes and verify monitoring behavior.

Question 279

An architecture sends API keys to the policy service in an unauthenticated header. What should the enterprise security architect or analyst do NEXT?

Fix enforcement integration and test explicit deny cases.
Include subject, object and environmental attributes in policy evaluation.
Use authenticated claims and protected policy communication.
Set bounded caching and invalidate decisions on entitlement updates.

Explanation

Correct Answer

Decision inputs must resist caller tampering. The controlling fact is: An architecture sends API keys to the policy service in an unauthenticated header.

Incorrect Answers

Fixing enforcement integration and testing explicit deny cases would not meet the need for authenticated claims and protected policy communication.

The current facts call for this action: use authenticated claims and protected policy communication.

Setting bounded caching and invalidate decisions on entitlement updates would not meet the need for authenticated claims and protected policy communication.

Question 280

A trusted device certificate remains valid after ownership transfers to another department. Which action is MOST defensible given these facts?

Apply a policy matching object sensitivity and limited device confidence.
Reissue unique workload identity bound to the new instance.
Check trusted hardware attestation before accepting the posture claim.
Rebind inventory and authorization to the new accountable owner.

Explanation

Correct Answer

Attestation and authorization must reflect current ownership. The controlling fact is: A trusted device certificate remains valid after ownership transfers to another department.

Incorrect Answers

The reported condition calls for this action: Rebind inventory and authorization to the new accountable owner.

The current facts call for this action: rebind inventory and authorization to the new accountable owner.

Reported compliance and measured integrity are different evidence. The scenario does not present the alternate condition: a laptop's posture report says compliant but measured boot reports unexpected firmware state. The proper immediate action is to rebind inventory and authorization to the new accountable owner.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 26 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CAS-005 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CAS-005 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CAS-005 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CAS-005 Practice Test 30 - 10 Questions (Last Reviewed 09-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 270

Explanation

Correct Answer

Incorrect Answers

Question 271

Explanation

Correct Answer

Incorrect Answers

Question 272

Explanation

Correct Answer

Incorrect Answers

Question 273

Explanation

Correct Answer

Incorrect Answers

Question 274

Explanation

Correct Answer

Incorrect Answers

Question 275

Explanation

Correct Answer

Incorrect Answers

Question 276

Explanation

Correct Answer

Incorrect Answers

Question 277

Explanation

Correct Answer

Incorrect Answers

Question 278

Explanation

Correct Answer

Incorrect Answers

Question 279

Explanation

Correct Answer

Incorrect Answers

Question 280

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests