Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Test controlled emergency sign-in and record independent monitoring.

The current facts call for this action: test controlled emergency sign-in and record independent monitoring.

Shared long-lived credentials magnify compromise impact. The scenario does not present the alternate condition: a service account uses the same password across a fleet and has no rotation ownership. The proper immediate action is to test controlled emergency sign-in and record independent monitoring.

The current facts call for this action: use accessible alternative factors with equivalent assurance and safeguards.

Link encryption alone does not establish device eligibility. The scenario does not present the alternate condition: a wireless network uses WPA3 but allows an unverified corporate device to join a privileged VLAN. The proper immediate action is to use accessible alternative factors with equivalent assurance and safeguards.

The reported condition calls for this action: Use accessible alternative factors with equivalent assurance and safeguards.

Preserving method claims and policy evaluation evidence for review would not meet the need for trusted identity provider and network signals in conditions. Authorization cannot rely on unauthenticated request metadata.

Authentication risk must be reflected in active access. The scenario does not present the alternate condition: an identity risk engine marks an account compromised but legacy app sessions persist. The proper immediate action is to use trusted identity provider and network signals in conditions.

Checking policy conditions and enforcing resource-specific authentication strength would not meet the need for trusted identity provider and network signals in conditions.

Validating issuer, token audience, signature and scoping would not address the need for treat the app as a public client and use a suitable PKCE-based flow.

The current facts call for this action: treat the app as a public client and use a suitable PKCE-based flow.

Revoking tokens and enforcing sign-in state in the relying service would not address the need for treat the app as a public client and use a suitable PKCE-based flow.

The reported condition calls for this action: Invalidate cached entitlements and verify effective access revocation.

The current facts call for this action: invalidate cached entitlements and verify effective access revocation.

Emergency readiness requires verified access under outage conditions. The scenario does not present the alternate condition: a privileged break-glass account has never been used in a tested recovery exercise. The proper immediate action is to invalidate cached entitlements and verify effective access revocation.

The current facts call for this action: investigate the requesting host, ticket types and approved service behavior.

Kerberos tickets depend on reasonably synchronized clocks. The scenario does not present the alternate condition: kerberos authentication fails after a server clock drifts beyond tolerance. The proper immediate action is to investigate the requesting host, ticket types and approved service behavior.

The reported condition calls for this action: Investigate the requesting host, ticket types and approved service behavior.

Rejecting the response and repairing nonce binding in the client flow would not fix unique subject mapping and validate identity association.

A valid signature does not make a token valid for another audience. The scenario does not present the alternate condition: sAML assertions are validly signed but rejected because an app expects a different audience URI. The proper immediate action is to fix unique subject mapping and validate identity association.

Updating trusted signing certificates through approved metadata rollover would not fix unique subject mapping and validate identity association.

Preserving off-host events and investigating policy change attribution would not review parent process, arguments, task creation and remote links.

The current facts call for this action: review parent process, arguments, task creation and remote links.

Correlating behavior and process lineage rather than filenames alone would not review parent process, arguments, task creation and remote links.

The reported condition calls for this action: Correlate agent health, management changes and network reachability.

The current facts call for this action: correlate agent health, management changes and network reachability.

Containment must be measured at the protected boundary. The scenario does not present the alternate condition: a quarantined endpoint continues sending malicious traffic from a second network interface. The proper immediate action is to correlate agent health, management changes and network reachability.

The current facts call for this action: constrain execution by publisher, path integrity and approved plugin identity.

Detection alerts are not proof of successful launch. The scenario does not present the alternate condition: malware is blocked by antivirus but endpoint logs cannot show whether any child process started. The proper immediate action is to constrain execution by publisher, path integrity and approved plugin identity.

The reported condition calls for this action: Constrain execution by publisher, path integrity and approved plugin identity.

Applying managed application data boundaries and DLP policies would not meet the need for browser isolation or controlled content detonation for untrusted sites.

Shared endpoints require deliberate session lifecycle controls. The scenario does not present the alternate condition: a kiosk browser automatically preserves credentials between anonymous visitors. The proper immediate action is to use browser isolation or controlled content detonation for untrusted sites.

Restoring enrollment and enforcing a minimum supported OS posture would not meet the need for browser isolation or controlled content detonation for untrusted sites.