CompTIA CAS-005 Practice Test 29

Question 280

A trusted device certificate remains valid after ownership transfers to another department. Which action is MOST defensible given these facts?

Apply a policy matching object sensitivity and limited device confidence.
Reissue unique workload identity bound to the new instance.
Check trusted hardware attestation before accepting the posture claim.
Rebind inventory and authorization to the new accountable owner.

Explanation

Correct Answer

Attestation and authorization must reflect current ownership. The controlling fact is: A trusted device certificate remains valid after ownership transfers to another department.

Incorrect Answers

The reported condition calls for this action: Rebind inventory and authorization to the new accountable owner.

The current facts call for this action: rebind inventory and authorization to the new accountable owner.

Reported compliance and measured integrity are different evidence. The scenario does not present the alternate condition: a laptop's posture report says compliant but measured boot reports unexpected firmware state. The proper immediate action is to rebind inventory and authorization to the new accountable owner.

Question 281

A remote monitoring agent keeps using an expired service credential because certificate validation was disabled. Which action is the BEST response to the security requirement?

Restore strict mutual identity verification and rotate the credential.
Use time-bound monitored access through a managed administrative broker.
Design protected, audited break-glass capability with periodic testing.
Restrict network reach to intended administrative assets with stronger segmentation.

Explanation

Correct Answer

Availability workarounds must not remove peer authentication. The controlling fact is: A remote monitoring agent keeps using an expired service credential because certificate validation was disabled.

Incorrect Answers

The current facts call for this action: restore strict mutual identity verification and rotate the credential.

Emergency access must survive outages without becoming a standing backdoor. The scenario does not present the alternate condition: engineers require emergency access when the central identity service is offline. The proper immediate action is to restore strict mutual identity verification and rotate the credential.

The reported condition calls for this action: Restore strict mutual identity verification and rotate the credential.

Question 282

A mobile workforce has inconsistent controls when switching between office and cellular networks. Which control or decision MOST directly resolves the stated gap?

Enforce the approved SASE path or narrowly reviewed exception.
Apply consistent device, identity and application policy regardless of location.
Use identity-aware per-app access rather than broad network reach.
Authenticate peers and constrain accepted route prefixes.

Explanation

Correct Answer

Zero Trust should not rely solely on campus address. The controlling fact is: A mobile workforce has inconsistent controls when switching between office and cellular networks.

Incorrect Answers

Enforcing the approved SASE path or narrowly reviewed exception would not apply consistent device, identity and application policy regardless of location.

The protected object should determine grant scope. The scenario does not present the alternate condition: a remote worker has full network VPN access although only two cloud applications are required. The proper immediate action is to apply consistent device, identity and application policy regardless of location.

Authenticating peers and constrain accepted route prefixes would not apply consistent device, identity and application policy regardless of location.

Question 283

A system administrator has global standing access for an infrequent quarterly task. What should the enterprise security architect or analyst do NEXT?

Assign scoped identities and rotate secrets from a managed vault.
Invalidate cached entitlements and verify effective access revocation.
Use just-in-time elevation with approval, expiry and audit.
Test controlled emergency sign-in and record independent monitoring.

Explanation

Correct Answer

Temporary access lowers persistent privilege. The controlling fact is: A system administrator has global standing access for an infrequent quarterly task.

Incorrect Answers

Assigning scoped identities and rotate secrets from a managed vault would not meet the need for just-in-time elevation with approval, expiry and audit.

The current facts call for this action: use just-in-time elevation with approval, expiry and audit.

Testing controlled emergency sign-in and recording independent monitoring would not meet the need for just-in-time elevation with approval, expiry and audit.

Question 284

A privileged account signs in from a managed device but a sensitive action lacks required step-up. Which action is MOST defensible given these facts?

Use trusted identity provider and network signals in conditions.
Apply continuous access evaluation or revoke relevant sessions and tokens.
Preserve method claims and policy evaluation evidence for review.
Check policy conditions and enforce resource-specific authentication strength.

Explanation

Correct Answer

Successful initial sign-in does not satisfy every action's assurance need. The controlling fact is: A privileged account signs in from a managed device but a sensitive action lacks required step-up.

Incorrect Answers

The reported condition calls for this action: Check policy conditions and enforce resource-specific authentication strength.

The current facts call for this action: check policy conditions and enforce resource-specific authentication strength.

A generic MFA flag can hide weaker methods. The scenario does not present the alternate condition: sign-in logs show MFA passed but no details about the actual authentication method. The proper immediate action is to check policy conditions and enforce resource-specific authentication strength.

Question 285

SAML assertions are validly signed but rejected because an app expects a different audience URI. Which action is the BEST response to the security requirement?

Correct the relying-party audience configuration and verify intended recipient.
Reject the response and repair nonce binding in the client flow.
Fix unique subject mapping and validate identity association.
Update trusted signing certificates through approved metadata rollover.

Explanation

Correct Answer

A valid signature does not make a token valid for another audience. The controlling fact is: SAML assertions are validly signed but rejected because an app expects a different audience URI.

Incorrect Answers

The current facts call for this action: correct the relying-party audience configuration and verify intended recipient.

Incorrect subject mapping can merge users and entitlements. The scenario does not present the alternate condition: several partner identities appear as one application user because subject claims are reused. The proper immediate action is to correct the relying-party audience configuration and verify intended recipient.

The reported condition calls for this action: Correct the relying-party audience configuration and verify intended recipient.

Question 286

An OAuth app requests file-write scope when it only displays a calendar. Which control or decision MOST directly resolves the stated gap?

Treat the app as a public client and use a suitable PKCE-based flow.
Reduce delegated permissions and review consent authorization.
Revoke tokens and enforce sign-in state in the relying service.
Validate issuer, token audience, signature and scope before authorization.

Explanation

Correct Answer

OAuth consent must be limited to required actions. The controlling fact is: An OAuth app requests file-write scope when it only displays a calendar.

Incorrect Answers

Treat the app as a public client and use a suitable PKCE-based flow would not address the need for reduce delegated permissions and review consent authorization.

Account state changes do not automatically invalidate every token. The scenario does not present the alternate condition: an administrator disables an account but its refresh tokens remain accepted by the SaaS service. The proper immediate action is to reduce delegated permissions and review consent authorization.

Validating issuer, token audience, signature and scoping would not address the need for reduce delegated permissions and review consent authorization.

Question 287

Kerberos authentication fails after a server clock drifts beyond tolerance. What is the appropriate security response for this scenario?

Protect ticket caches and constrain service account access.
Resolve the duplicate SPN and validate the intended service binding.
Restore time synchronization before resetting valid account passwords.
Investigate the requesting host, ticket types and approved service behavior.

Explanation

Correct Answer

Kerberos tickets depend on reasonably synchronized clocks. The controlling fact is: Kerberos authentication fails after a server clock drifts beyond tolerance.

Incorrect Answers

Protecting ticket caches and constrain service account access would not restore time synchronization.

The current facts call for this action: restore time synchronization before resetting valid account passwords.

Investigating the requesting host, ticket types and approved service behavior would not restore time synchronization.

Question 288

A wireless network uses WPA3 but allows an unverified corporate device to join a privileged VLAN. What should the enterprise security architect or analyst do NEXT?

Correct certificate trust and EAP server/client identity validation.
Revalidate identity proofing and audit the authenticator enrollment.
Use accessible alternative factors with equivalent assurance and safeguards.
Bind 802.1X/EAP authorization to managed device identity and access policy.

Explanation

Correct Answer

Link encryption alone does not establish device eligibility. The controlling fact is: A wireless network uses WPA3 but allows an unverified corporate device to join a privileged VLAN.

Incorrect Answers

The reported condition calls for this action: Bind 802.1X/EAP authorization to managed device identity and access policy.

The current facts call for this action: bind 802.1X/EAP authorization to managed device identity and access policy.

Biometrics are not infallible or universally usable. The scenario does not present the alternate condition: an enterprise deploys facial biometrics without a fallback for users whose characteristics are unreadable. The proper immediate action is to bind 802.1X/EAP authorization to managed device identity and access policy.

Question 289

An administrator disables an account but its refresh tokens remain accepted by the SaaS service. What is the appropriate security response for this scenario?

Revoke tokens and enforce sign-in state in the relying service.
Reduce delegated permissions and review consent authorization.
Treat the app as a public client and use a suitable PKCE-based flow.
Validate issuer, token audience, signature and scope before authorization.

Explanation

Correct Answer

Account state changes do not automatically invalidate every token. The controlling fact is: An administrator disables an account but its refresh tokens remain accepted by the SaaS service.

Incorrect Answers

The current facts call for this action: revoke tokens and enforce sign-in state in the relying service.

Secrets embedded in distributed clients cannot remain confidential. The scenario does not present the alternate condition: a mobile app exposes its long-lived client secret in publicly distributed code. The proper immediate action is to revoke tokens and enforce sign-in state in the relying service.

The reported condition calls for this action: Revoke tokens and enforce sign-in state in the relying service.

Question 290

An employee enrolls a new authenticator after a suspicious help-desk reset. What should the enterprise security architect or analyst do NEXT?

Correct certificate trust and EAP server/client identity validation.
Revalidate identity proofing and audit the authenticator enrollment.
Use accessible alternative factors with equivalent assurance and safeguards.
Bind 802.1X/EAP authorization to managed device identity and access policy.

Explanation

Correct Answer

MFA security depends on secure registration and recovery. The controlling fact is: An employee enrolls a new authenticator after a suspicious help-desk reset.

Incorrect Answers

Correcting certificate trust and EAP server/client identity validation would not revalidate identity proofing and audit the authenticator enrollment. MFA security depends on secure registration and recovery.

Biometrics are not infallible or universally usable. The scenario does not present the alternate condition: an enterprise deploys facial biometrics without a fallback for users whose characteristics are unreadable. The proper immediate action is to revalidate identity proofing and audit the authenticator enrollment.

Identity and access control would not revalidate identity proofing and audit the authenticator enrollment. MFA security depends on secure registration and recovery.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CAS-005 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CAS-005 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CAS-005 Practice Test 30 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CAS-005 Practice Test 31 - 10 Questions (Last Reviewed 08-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 280

Explanation

Correct Answer

Incorrect Answers

Question 281

Explanation

Correct Answer

Incorrect Answers

Question 282

Explanation

Correct Answer

Incorrect Answers

Question 283

Explanation

Correct Answer

Incorrect Answers

Question 284

Explanation

Correct Answer

Incorrect Answers

Question 285

Explanation

Correct Answer

Incorrect Answers

Question 286

Explanation

Correct Answer

Incorrect Answers

Question 287

Explanation

Correct Answer

Incorrect Answers

Question 288

Explanation

Correct Answer

Incorrect Answers

Question 289

Explanation

Correct Answer

Incorrect Answers

Question 290

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests