CompTIA CAS-005 Practice Test 33

Question 320

A workstation disables local auditing after receiving an unknown script. Which control or decision MOST directly resolves the stated gap?

Correlate service-control and authentication events with source hosts.
Correlate behavior and process lineage rather than filenames alone.
Review parent process, arguments, task creation and remote links.
Preserve off-host events and investigate policy change attribution.

Explanation

Correct Answer

Tampering with logs can conceal later compromise. The controlling fact is: A workstation disables local auditing after receiving an unknown script.

Incorrect Answers

The reported condition calls for this action: Preserve off-host events and investigate policy change attribution.

The current facts call for this action: preserve off-host events and investigate policy change attribution.

Trusted binaries can be used for persistence. The scenario does not present the alternate condition: a signed operating system tool installs a hidden scheduled task after a document is opened. The proper immediate action is to preserve off-host events and investigate policy change attribution.

Question 321

A host audit reports security service configuration changed without any authorized ticket. What is the appropriate security response for this scenario?

Correlate configuration drift with privileged execution evidence.
Investigate credential attribution and eliminate shared elevated identities.
Validate the vendor behavior and define a narrow monitored exclusion.
Use delegated controlled elevation for documented tasks.

Explanation

Correct Answer

Baseline deviations require accountable investigation. The controlling fact is: A host audit reports security service configuration changed without any authorized ticket.

Incorrect Answers

The current facts call for this action: correlate configuration drift with privileged execution evidence.

Prevention tuning should address demonstrated false positives. The scenario does not present the alternate condition: a new prevention rule blocks production backup agents because they inject signed DLLs. The proper immediate action is to correlate configuration drift with privileged execution evidence.

The reported condition calls for this action: Correlate configuration drift with privileged execution evidence.

Question 322

A root-owned startup script is writable by ordinary application users. What should the enterprise security architect or analyst do NEXT?

Inspect AVC denials and correct the approved file context.
Remove unsafe write permissions and verify execution integrity.
Restrict host inbound SSH to authorized management networks.
Create a narrowly scoped policy fix and restore enforcing mode.

Explanation

Correct Answer

Writable privileged startup paths enable escalation. The controlling fact is: A root-owned startup script is writable by ordinary application users.

Incorrect Answers

Inspecting AVC denials and correcting the approved file context would not remove unsafe write permissions and verify execution integrity.

Segmentation should be reinforced by host policy. The scenario does not present the alternate condition: a host firewall allows SSH from every source while the management VLAN is isolated. The proper immediate action is to remove unsafe write permissions and verify execution integrity.

Creating a narrowly scoped policy fix and restoring enforcing mode would not remove unsafe write permissions and verify execution integrity.

Question 323

Threat hunters need process ancestry but only file detection summaries are retained. Which action is MOST defensible given these facts?

Preserve source timestamps and prevent ingestion-time distortion.
Verify isolation controls across all interfaces and paths.
Enable appropriate EDR telemetry and retention for process relationships.
Correlate agent health, management changes and network reachability.

Explanation

Correct Answer

Summary alerts cannot reconstruct full execution chains. The controlling fact is: Threat hunters need process ancestry but only file detection summaries are retained.

Incorrect Answers

Preserving source timestamps and prevent ingestion-time distortion would not enable appropriate EDR telemetry and retention for process relationships. Summary alerts cannot reconstruct full execution chains.

The current facts call for this action: enable appropriate EDR telemetry and retention for process relationships.

Correlating agent health, management changes and network reachability would not enable appropriate EDR telemetry and retention for process relationships. Summary alerts cannot reconstruct full execution chains.

Question 324

Mobile employees can copy regulated documents into unapproved personal apps. Which action is the BEST response to the security requirement?

Restore enrollment and enforce a minimum supported OS posture.
Use browser isolation or controlled content detonation for untrusted sites.
Disable persistent sessions and clear identity state between users.
Apply managed application data boundaries and DLP policies.

Explanation

Correct Answer

Containerization and app policy reduce unmanaged data flow. The controlling fact is: Mobile employees can copy regulated documents into unapproved personal apps.

Incorrect Answers

The reported condition calls for this action: Apply managed application data boundaries and DLP policies.

The current facts call for this action: apply managed application data boundaries and DLP policies.

Shared endpoints require deliberate session lifecycle controls. The scenario does not present the alternate condition: a kiosk browser automatically preserves credentials between anonymous visitors. The proper immediate action is to apply managed application data boundaries and DLP policies.

Question 325

A malicious script launches through an allowed interpreter with an unrestricted child-process policy. Which action is MOST defensible given these facts?

Constrain script execution and monitor interpreters and descendants.
Compare process parameters and approved task records before containment.
Constrain execution by publisher, path integrity and approved plugin identity.
Correlate EDR process trees and prevention outcomes before declaring execution.

Explanation

Correct Answer

Allowing an interpreter can bypass naive binary allowlisting. The controlling fact is: A malicious script launches through an allowed interpreter with an unrestricted child-process policy.

Incorrect Answers

The current facts call for this action: constrain script execution and monitor interpreters and descendants.

Signing of one executable does not trust every loaded module. The scenario does not present the alternate condition: a signed application is approved but a newly added plugin executes from user-writable storage. The proper immediate action is to constrain script execution and monitor interpreters and descendants.

The reported condition calls for this action: Constrain script execution and monitor interpreters and descendants.

Question 326

A security rule only detects exact script filenames, missing renamed suspicious executables. Which action is the BEST response to the security requirement?

Correlate service-control and authentication events with source hosts.
Correlate behavior and process lineage rather than filenames alone.
Preserve off-host events and investigate policy change attribution.
Review parent process, arguments, task creation and remote links.

Explanation

Correct Answer

Behavioral detections resist trivial file renaming. The controlling fact is: A security rule only detects exact script filenames, missing renamed suspicious executables.

Incorrect Answers

Correlating service-control and authentication events with source hosts would not correlate behavior and process lineage rather than filenames alone.

Tampering with logs can conceal later compromise. The scenario does not present the alternate condition: a workstation disables local auditing after receiving an unknown script. The proper immediate action is to correlate behavior and process lineage rather than filenames alone.

Reviewing parent process, arguments, task creation and remote links would not correlate behavior and process lineage rather than filenames alone.

Question 327

A host firewall allows SSH from every source while the management VLAN is isolated. Which control or decision MOST directly resolves the stated gap?

Inspect AVC denials and correct the approved file context.
Remove unsafe write permissions and verify execution integrity.
Restrict host inbound SSH to authorized management networks.
Create a narrowly scoped policy fix and restore enforcing mode.

Explanation

Correct Answer

Segmentation should be reinforced by host policy. The controlling fact is: A host firewall allows SSH from every source while the management VLAN is isolated.

Incorrect Answers

Inspecting AVC denials and correcting the approved file context would not restrict host inbound SSH to authorized management networks.

The current facts call for this action: restrict host inbound SSH to authorized management networks.

Creating a narrowly scoped policy fix and restoring enforcing mode would not restrict host inbound SSH to authorized management networks.

Question 328

An endpoint launches a suspicious service using a shared administrator account from a different department. What is the appropriate security response for this scenario?

Validate the vendor behavior and define a narrow monitored exclusion.
Correlate configuration drift with privileged execution evidence.
Use delegated controlled elevation for documented tasks.
Investigate credential attribution and eliminate shared elevated identities.

Explanation

Correct Answer

Shared admin credentials undermine forensic accountability. The controlling fact is: An endpoint launches a suspicious service using a shared administrator account from a different department.

Incorrect Answers

The reported condition calls for this action: Investigate credential attribution and eliminate shared elevated identities.

The current facts call for this action: investigate credential attribution and eliminate shared elevated identities.

Least privilege can support operations without standing admin access. The scenario does not present the alternate condition: a support engineer requests permanent local administrator privileges to install approved tools weekly. The proper immediate action is to investigate credential attribution and eliminate shared elevated identities.

Question 329

A workstation returns from offline travel with weeks of delayed events. What should the enterprise security architect or analyst do NEXT?

Preserve source timestamps and prevent ingestion-time distortion.
Verify isolation controls across all interfaces and paths.
Correlate agent health, management changes and network reachability.
Enable appropriate EDR telemetry and retention for process relationships.

Explanation

Correct Answer

Delayed telemetry should not invent a new attack timeline. The controlling fact is: A workstation returns from offline travel with weeks of delayed events.

Incorrect Answers

The current facts call for this action: preserve source timestamps and prevent ingestion-time distortion.

Central misconfiguration can mimic adversary tampering. The scenario does not present the alternate condition: many endpoints lose EDR heartbeat immediately after an administrator pushes a new policy. The proper immediate action is to preserve source timestamps and prevent ingestion-time distortion.

The reported condition calls for this action: Preserve source timestamps and prevent ingestion-time distortion.

Question 330

A kiosk browser automatically preserves credentials between anonymous visitors. Which action is MOST defensible given these facts?

Use browser isolation or controlled content detonation for untrusted sites.
Disable persistent sessions and clear identity state between users.
Apply managed application data boundaries and DLP policies.
Restore enrollment and enforce a minimum supported OS posture.

Explanation

Correct Answer

Shared endpoints require deliberate session lifecycle controls. The controlling fact is: A kiosk browser automatically preserves credentials between anonymous visitors.

Incorrect Answers

Using browser isolation or controlled content detonation for untrusted sites would not address the need for disable persistent sessions and clear identity state between users.

Containerization and app policy reduce unmanaged data flow. The scenario does not present the alternate condition: mobile employees can copy regulated documents into unapproved personal apps. The proper immediate action is to disable persistent sessions and clear identity state between users.

Restoring enrollment and enforcing a minimum supported OS posture would not address the need for disable persistent sessions and clear identity state between users.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 31 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CAS-005 Practice Test 32 - 10 Questions (Last Reviewed 07-Oct-2026)
CompTIA CAS-005 Practice Test 33 - 10 Questions (Last Reviewed 06-Oct-2026)
CompTIA CAS-005 Practice Test 34 - 10 Questions (Last Reviewed 05-Oct-2026)
CompTIA CAS-005 Practice Test 35 - 10 Questions (Last Reviewed 04-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 320

Explanation

Correct Answer

Incorrect Answers

Question 321

Explanation

Correct Answer

Incorrect Answers

Question 322

Explanation

Correct Answer

Incorrect Answers

Question 323

Explanation

Correct Answer

Incorrect Answers

Question 324

Explanation

Correct Answer

Incorrect Answers

Question 325

Explanation

Correct Answer

Incorrect Answers

Question 326

Explanation

Correct Answer

Incorrect Answers

Question 327

Explanation

Correct Answer

Incorrect Answers

Question 328

Explanation

Correct Answer

Incorrect Answers

Question 329

Explanation

Correct Answer

Incorrect Answers

Question 330

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests