CompTIA CAS-005 Practice Test 32

Question 310

Users access unknown file-sharing sites from devices with unrestricted browser downloads. Which action is the BEST response to the security requirement?

Apply managed application data boundaries and DLP policies.
Use browser isolation or controlled content detonation for untrusted sites.
Disable persistent sessions and clear identity state between users.
Restore enrollment and enforce a minimum supported OS posture.

Explanation

Correct Answer

Web threats can be contained away from the local endpoint. The controlling fact is: Users access unknown file-sharing sites from devices with unrestricted browser downloads.

Incorrect Answers

Applying managed application data boundaries and DLP policies would not meet the need for browser isolation or controlled content detonation for untrusted sites.

Shared endpoints require deliberate session lifecycle controls. The scenario does not present the alternate condition: a kiosk browser automatically preserves credentials between anonymous visitors. The proper immediate action is to use browser isolation or controlled content detonation for untrusted sites.

Restoring enrollment and enforcing a minimum supported OS posture would not meet the need for browser isolation or controlled content detonation for untrusted sites.

Question 311

A support engineer requests permanent local administrator privileges to install approved tools weekly. Which control or decision MOST directly resolves the stated gap?

Validate the vendor behavior and define a narrow monitored exclusion.
Correlate configuration drift with privileged execution evidence.
Use delegated controlled elevation for documented tasks.
Investigate credential attribution and eliminate shared elevated identities.

Explanation

Correct Answer

Least privilege can support operations without standing admin access. The controlling fact is: A support engineer requests permanent local administrator privileges to install approved tools weekly.

Incorrect Answers

Validating the vendor behavior and defining a narrow monitored exclusion would not meet the need for delegated controlled elevation for documented tasks.

The current facts call for this action: use delegated controlled elevation for documented tasks.

Investigating credential attribution and eliminate shared elevated identities would not meet the need for delegated controlled elevation for documented tasks.

Question 312

An SELinux policy blocks a legitimate daemon after a filesystem relabeling. What is the appropriate security response for this scenario?

Restrict host inbound SSH to authorized management networks.
Remove unsafe write permissions and verify execution integrity.
Create a narrowly scoped policy fix and restore enforcing mode.
Inspect AVC denials and correct the approved file context.

Explanation

Correct Answer

SELinux should be repaired at the labeling or policy boundary. The controlling fact is: An SELinux policy blocks a legitimate daemon after a filesystem relabeling.

Incorrect Answers

The reported condition calls for this action: Inspect AVC denials and correct the approved file context.

The current facts call for this action: inspect AVC denials and correct the approved file context.

Global permissive mode weakens host protection unnecessarily. The scenario does not present the alternate condition: administrators set SELinux to permissive to fix one service immediately. The proper immediate action is to inspect AVC denials and correct the approved file context.

Question 313

Administrators set SELinux to permissive to fix one service immediately. Which control or decision MOST directly resolves the stated gap?

Create a narrowly scoped policy fix and restore enforcing mode.
Remove unsafe write permissions and verify execution integrity.
Inspect AVC denials and correct the approved file context.
Restrict host inbound SSH to authorized management networks.

Explanation

Correct Answer

Global permissive mode weakens host protection unnecessarily. The controlling fact is: Administrators set SELinux to permissive to fix one service immediately.

Incorrect Answers

The current facts call for this action: create a narrowly scoped policy fix and restore enforcing mode.

SELinux should be repaired at the labeling or policy boundary. The scenario does not present the alternate condition: an SELinux policy blocks a legitimate daemon after a filesystem relabeling. The proper immediate action is to create a narrowly scoped policy fix and restore enforcing mode.

The reported condition calls for this action: Create a narrowly scoped policy fix and restore enforcing mode.

Question 314

A quarantined endpoint continues sending malicious traffic from a second network interface. What is the appropriate security response for this scenario?

Preserve source timestamps and prevent ingestion-time distortion.
Verify isolation controls across all interfaces and paths.
Correlate agent health, management changes and network reachability.
Enable appropriate EDR telemetry and retention for process relationships.

Explanation

Correct Answer

Containment must be measured at the protected boundary. The controlling fact is: A quarantined endpoint continues sending malicious traffic from a second network interface.

Incorrect Answers

Preserving source timestamps and prevent ingestion-time distortion would not verify isolation controls across all interfaces and paths.

Central misconfiguration can mimic adversary tampering. The scenario does not present the alternate condition: many endpoints lose EDR heartbeat immediately after an administrator pushes a new policy. The proper immediate action is to verify isolation controls across all interfaces and paths.

Enabling appropriate EDR telemetry and retention for process relationships would not verify isolation controls across all interfaces and paths.

Question 315

A new prevention rule blocks production backup agents because they inject signed DLLs. What should the enterprise security architect or analyst do NEXT?

Use delegated controlled elevation for documented tasks.
Investigate credential attribution and eliminate shared elevated identities.
Validate the vendor behavior and define a narrow monitored exclusion.
Correlate configuration drift with privileged execution evidence.

Explanation

Correct Answer

Prevention tuning should address demonstrated false positives. The controlling fact is: A new prevention rule blocks production backup agents because they inject signed DLLs.

Incorrect Answers

Using delegated controlled elevation for documented tasks would not validate the vendor behavior and define a narrow monitored exclusion.

The current facts call for this action: validate the vendor behavior and define a narrow monitored exclusion.

Correlating configuration drift with privileged execution evidence would not validate the vendor behavior and define a narrow monitored exclusion.

Question 316

A fleet of corporate tablets stops receiving security updates because MDM enrollment expired. Which action is MOST defensible given these facts?

Apply managed application data boundaries and DLP policies.
Disable persistent sessions and clear identity state between users.
Use browser isolation or controlled content detonation for untrusted sites.
Restore enrollment and enforce a minimum supported OS posture.

Explanation

Correct Answer

Management state is a prerequisite for device patch assurances. The controlling fact is: A fleet of corporate tablets stops receiving security updates because MDM enrollment expired.

Incorrect Answers

The reported condition calls for this action: Restore enrollment and enforce a minimum supported OS posture.

The current facts call for this action: restore enrollment and enforce a minimum supported OS posture.

Web threats can be contained away from the local endpoint. The scenario does not present the alternate condition: users access unknown file-sharing sites from devices with unrestricted browser downloads. The proper immediate action is to restore enrollment and enforce a minimum supported OS posture.

Question 317

Hosts across different subnets begin creating the same new service remotely. Which action is the BEST response to the security requirement?

Correlate service-control and authentication events with source hosts.
Preserve off-host events and investigate policy change attribution.
Correlate behavior and process lineage rather than filenames alone.
Review parent process, arguments, task creation and remote links.

Explanation

Correct Answer

Synchronized remote creation can indicate lateral execution. The controlling fact is: Hosts across different subnets begin creating the same new service remotely.

Incorrect Answers

The current facts call for this action: correlate service-control and authentication events with source hosts.

Behavioral detections resist trivial file renaming. The scenario does not present the alternate condition: a security rule only detects exact script filenames, missing renamed suspicious executables. The proper immediate action is to correlate service-control and authentication events with source hosts.

The reported condition calls for this action: Correlate service-control and authentication events with source hosts.

Question 318

Malware is blocked by antivirus but endpoint logs cannot show whether any child process started. Which control or decision MOST directly resolves the stated gap?

Constrain script execution and monitor interpreters and descendants.
Correlate EDR process trees and prevention outcomes before declaring execution.
Constrain execution by publisher, path integrity and approved plugin identity.
Compare process parameters and approved task records before containment.

Explanation

Correct Answer

Detection alerts are not proof of successful launch. The controlling fact is: Malware is blocked by antivirus but endpoint logs cannot show whether any child process started.

Incorrect Answers

Constrain script execution and monitor interpreters and descendants would not correlate EDR process trees and prevention outcomes.

Signing of one executable does not trust every loaded module. The scenario does not present the alternate condition: a signed application is approved but a newly added plugin executes from user-writable storage. The proper immediate action is to correlate EDR process trees and prevention outcomes before declaring execution.

Comparing process parameters and approved task records would not correlate EDR process trees and prevention outcomes.

Question 319

An authorized administrator runs a dual-use utility in a maintenance window. Which action is the BEST response to the security requirement?

Constrain execution by publisher, path integrity and approved plugin identity.
Correlate EDR process trees and prevention outcomes before declaring execution.
Compare process parameters and approved task records before containment.
Constrain script execution and monitor interpreters and descendants.

Explanation

Correct Answer

Application allowlisting should preserve verified legitimate operations. The controlling fact is: An authorized administrator runs a dual-use utility in a maintenance window.

Incorrect Answers

Constrain execution by publisher, path integrity and approved plugin identity would not meet the need for process parameters and approved task records.

The current facts call for this action: compare process parameters and approved task records before containment.

Constrain script execution and monitor interpreters and descendants would not meet the need for process parameters and approved task records.

Question 320

A workstation disables local auditing after receiving an unknown script. Which control or decision MOST directly resolves the stated gap?

Correlate service-control and authentication events with source hosts.
Correlate behavior and process lineage rather than filenames alone.
Review parent process, arguments, task creation and remote links.
Preserve off-host events and investigate policy change attribution.

Explanation

Correct Answer

Tampering with logs can conceal later compromise. The controlling fact is: A workstation disables local auditing after receiving an unknown script.

Incorrect Answers

The reported condition calls for this action: Preserve off-host events and investigate policy change attribution.

The current facts call for this action: preserve off-host events and investigate policy change attribution.

Trusted binaries can be used for persistence. The scenario does not present the alternate condition: a signed operating system tool installs a hidden scheduled task after a document is opened. The proper immediate action is to preserve off-host events and investigate policy change attribution.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 30 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CAS-005 Practice Test 31 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CAS-005 Practice Test 32 - 10 Questions (Last Reviewed 07-Oct-2026)
CompTIA CAS-005 Practice Test 33 - 10 Questions (Last Reviewed 06-Oct-2026)
CompTIA CAS-005 Practice Test 34 - 10 Questions (Last Reviewed 05-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 310

Explanation

Correct Answer

Incorrect Answers

Question 311

Explanation

Correct Answer

Incorrect Answers

Question 312

Explanation

Correct Answer

Incorrect Answers

Question 313

Explanation

Correct Answer

Incorrect Answers

Question 314

Explanation

Correct Answer

Incorrect Answers

Question 315

Explanation

Correct Answer

Incorrect Answers

Question 316

Explanation

Correct Answer

Incorrect Answers

Question 317

Explanation

Correct Answer

Incorrect Answers

Question 318

Explanation

Correct Answer

Incorrect Answers

Question 319

Explanation

Correct Answer

Incorrect Answers

Question 320

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests