CompTIA CAS-005 Practice Test 3

Question 20

Staff report attacks late because they fear punishment for mistaken clicks. Which action is MOST defensible given these facts?

Use role-appropriate exercises and measure behavioral improvement.
Tailor operational security training to OT safety and access workflows.
Minimize training data and avoid unnecessary sensitive collection.
Publish a clear nonpunitive reporting route and rehearse prompt reporting.

Explanation

Correct Answer

A trusted reporting culture reduces dwell time. The controlling fact is: Staff report attacks late because they fear punishment for mistaken clicks.

Incorrect Answers

The reported condition calls for this action: Publish a clear nonpunitive reporting route and rehearse prompt reporting.

The current facts call for this action: publish a clear nonpunitive reporting route and rehearse prompt reporting.

Security awareness must not create a new privacy exposure. The scenario does not present the alternate condition: a privacy training campaign collects learners' full medical details to personalize scenarios. The proper immediate action is to publish a clear nonpunitive reporting route and rehearse prompt reporting.

Question 21

A new outsourced security function has operational tasks but no approved escalation boundary. Which action is the BEST response to the security requirement?

Document decision rights, service obligations and escalation ownership.
Assign risk acceptance to the authorized accountable business owner.
Resolve to one accountable role and identify consulted responders.
Record decisions, owners and follow-up dates in committee governance records.

Explanation

Correct Answer

Governance requires clear accountability at supplier interfaces. The controlling fact is: A new outsourced security function has operational tasks but no approved escalation boundary.

Incorrect Answers

The current facts call for this action: document decision rights, service obligations and escalation ownership.

Unambiguous accountability prevents contradictory approvals. The scenario does not present the alternate condition: the RACI matrix names two accountable owners for the same incident escalation decision. The proper immediate action is to document decision rights, service obligations and escalation ownership.

The reported condition calls for this action: Document decision rights, service obligations and escalation ownership.

Question 22

An engineer changes firewall configuration directly and skips documented approval. Which control or decision MOST directly resolves the stated gap?

Reconcile CMDB records with authoritative discovery and disposal evidence.
Require authorized change recording and reconcile the deployed baseline.
Define configuration item relationships and accountable owners for components.
Enroll the asset through approval, classification and baseline tracking.

Explanation

Correct Answer

A traceable change record links risk review to actual configuration. The controlling fact is: An engineer changes firewall configuration directly and skips documented approval.

Incorrect Answers

Reconciling CMDB records with authoritative discovery and disposal evidence would not require authorized change recording and reconcile the deployed baseline.

Dependencies make ownership actionable during outages and remediation. The scenario does not present the alternate condition: a business critical application has a service owner but no infrastructure owner. The proper immediate action is to require authorized change recording and reconcile the deployed baseline.

Enroll the asset through approval, classification and baseline tracking would not require authorized change recording and reconcile the deployed baseline.

Question 23

A CI test uploads its artifact containing personal details to a public build log. What is the appropriate security response for this scenario?

Supply representative tokenized test fixtures rather than live card data.
Apply a defined retention and secure-disposal lifecycle to snapshots.
Sanitize test outputs and secure the artifact repository.
Use masked or synthetic data and restrict nonproduction access.

Explanation

Correct Answer

Temporary pipeline outputs are data-governance assets. The controlling fact is: A CI test uploads its artifact containing personal details to a public build log.

Incorrect Answers

Supplying representative tokenized test fixtures rather than live card data would not address the need for sanitize test outputs and secure the artifact repository.

The current facts call for this action: sanitize test outputs and secure the artifact repository.

Using masked or synthetic data and restricting nonproduction access would not address the need for sanitize test outputs and secure the artifact repository.

Question 24

A regional law changes how customer records must be handled and a policy owner is absent. What should the enterprise security architect or analyst do NEXT?

Separate optional guidance from binding policies and standards before approval.
Issue a measurable enterprise encryption standard with scoped exceptions.
Publish an approved procedure detailing accountable steps and evidence.
Assign policy ownership and execute the documented change and approval cycle.

Explanation

Correct Answer

Governed revision keeps policy aligned to binding requirements. The controlling fact is: A regional law changes how customer records must be handled and a policy owner is absent.

Incorrect Answers

The reported condition calls for this action: Assign policy ownership and execute the documented change and approval cycle.

The current facts call for this action: assign policy ownership and execute the documented change and approval cycle.

A policy states intent; a procedure defines repeatable execution. The scenario does not present the alternate condition: an insurer's security policy names a required outcome but teams need a precise password rotation procedure. The proper immediate action is to assign policy ownership and execute the documented change and approval cycle.

Question 25

Biometric templates are retained beyond the stated service purpose. Which action is the BEST response to the security requirement?

Evaluate necessity, retention and lawful disposal of biometrics.
Assess sovereignty, legal transfer basis and storage location constraints.
Reconcile the request with valid retention and hold obligations.
Start incident assessment, preserve evidence and notify legal/privacy owners.

Explanation

Correct Answer

Irreplaceable identifiers require strict minimization. The controlling fact is: Biometric templates are retained beyond the stated service purpose.

Incorrect Answers

The current facts call for this action: evaluate necessity, retention and lawful disposal of biometrics.

Rights handling requires an exception decision based on legal duty. The scenario does not present the alternate condition: a customer invokes erasure while a legal hold covers relevant records. The proper immediate action is to evaluate necessity, retention and lawful disposal of biometrics.

The reported condition calls for this action: Evaluate necessity, retention and lawful disposal of biometrics.

Question 26

Three critical applications rely on one subcontractor's identity service. Which control or decision MOST directly resolves the stated gap?

Trigger contractual notification and privacy transfer risk assessment.
Assess fourth-party concentration and contractual outage dependencies.
Request scope-relevant evidence and bridge the coverage gap.
Define recovery tests, measurable objectives and audit rights.

Explanation

Correct Answer

Shared dependencies can defeat apparent supplier diversity. The controlling fact is: Three critical applications rely on one subcontractor's identity service.

Incorrect Answers

Trigger contractual notification and privacy transfer risk assessment would not assess fourth-party concentration and contractual outage dependencies.

An attestation outside the delivered service scope does not prove the control. The scenario does not present the alternate condition: a vendor submits a SOC 2 report that excludes the exact hosting service purchased. The proper immediate action is to assess fourth-party concentration and contractual outage dependencies.

Defining recovery tests, measurable objectives and auditing rights would not assess fourth-party concentration and contractual outage dependencies.

Question 27

A nonessential legacy portal is exposed and cannot be patched. What is the appropriate security response for this scenario?

Perform postchange validation and investigate the unpatched exceptions.
Implement and test a scoped mitigating control with expiry and owner.
Retire the function or remove the unnecessary exposure.
Keep minimum controls and recognize insurance transfers only financial portions.

Explanation

Correct Answer

Avoidance may be safer than maintaining unsupported risk. The controlling fact is: A nonessential legacy portal is exposed and cannot be patched.

Incorrect Answers

Performing postchange validation and investigating the unpatched exceptions would not retire the function or remove the unnecessary exposure.

The current facts call for this action: retire the function or remove the unnecessary exposure.

Keeping minimum controls and recognize insurance transfers only financial portions would not retire the function or remove the unnecessary exposure.

Question 28

A payment platform is targeted for a 10-minute RTO but shared authentication requires 45 minutes to restore. What should the enterprise security architect or analyst do NEXT?

Size backup and replication cadence to accepted data-loss tolerance.
Evaluate common-mode failure and independent recovery access.
Validate an end-to-end business service acceptance test.
Reconcile dependency recovery times and design a feasible recovery chain.

Explanation

Correct Answer

RTOs must reflect end-to-end service dependencies. The controlling fact is: A payment platform is targeted for a 10-minute RTO but shared authentication requires 45 minutes to restore.

Incorrect Answers

The reported condition calls for this action: Reconcile dependency recovery times and design a feasible recovery chain.

The current facts call for this action: reconcile dependency recovery times and design a feasible recovery chain.

Technical startup alone does not demonstrate business recovery. The scenario does not present the alternate condition: a recovery exercise restores infrastructure but cannot process a real sample transaction. The proper immediate action is to reconcile dependency recovery times and design a feasible recovery chain.

Question 29

Backups remain connected with the same administrator credentials used in production. Which action is MOST defensible given these facts?

Add immutable or segregated recovery copies and test restore access.
Bind signed records to preserved hashes and trusted timestamps.
Test logical restore consistency and business transactions.
Enable append-only or remotely protected journals with integrity checks.

Explanation

Correct Answer

Connected copies can be destroyed during compromise. The controlling fact is: Backups remain connected with the same administrator credentials used in production.

Incorrect Answers

The current facts call for this action: add immutable or segregated recovery copies and test restore access.

Bit-level integrity is not the same as usable recovered state. The scenario does not present the alternate condition: recovery media pass a checksum test but contain corrupted application relationships. The proper immediate action is to add immutable or segregated recovery copies and test restore access.

The reported condition calls for this action: Add immutable or segregated recovery copies and test restore access.

Question 30

A system owner accepts a risk whose loss estimate exceeds the board's documented tolerance. Which action is the BEST response to the security requirement?

Reassess residual risk after validating the control outcome.
Escalate for authorized risk treatment or explicit governance-approved exception.
Document exposure, alternatives and accountable risk-owner approval.
Compare likelihood, impact and business scenarios before ranking.

Explanation

Correct Answer

An owner cannot override enterprise tolerance by informal acceptance. The controlling fact is: A system owner accepts a risk whose loss estimate exceeds the board's documented tolerance.

Incorrect Answers

Reassess residual risk after validating the control outcome would not address the need for escalate for authorized risk treatment or explicit governance-approved exception.

Delivery convenience alone is not a risk acceptance authority. The scenario does not present the alternate condition: a vendor proposes accepting a new risk because the patch window is inconvenient. The proper immediate action is to escalate for authorized risk treatment or explicit governance-approved exception.

Comparing likelihood, impact and business scenarios would not address the need for escalate for authorized risk treatment or explicit governance-approved exception.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 1 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA CAS-005 Practice Test 2 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA CAS-005 Practice Test 3 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA CAS-005 Practice Test 4 - 10 Questions (Last Reviewed 04-Nov-2026)
CompTIA CAS-005 Practice Test 5 - 10 Questions (Last Reviewed 03-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 20

Explanation

Correct Answer

Incorrect Answers

Question 21

Explanation

Correct Answer

Incorrect Answers

Question 22

Explanation

Correct Answer

Incorrect Answers

Question 23

Explanation

Correct Answer

Incorrect Answers

Question 24

Explanation

Correct Answer

Incorrect Answers

Question 25

Explanation

Correct Answer

Incorrect Answers

Question 26

Explanation

Correct Answer

Incorrect Answers

Question 27

Explanation

Correct Answer

Incorrect Answers

Question 28

Explanation

Correct Answer

Incorrect Answers

Question 29

Explanation

Correct Answer

Incorrect Answers

Question 30

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests