Pass Your CompTIA CAS-005 Exam Easy!

Using browser isolation or controlled content detonation for untrusted sites would not address the need for disable persistent sessions and clear identity state between users.

Containerization and app policy reduce unmanaged data flow. The scenario does not present the alternate condition: mobile employees can copy regulated documents into unapproved personal apps. The proper immediate action is to disable persistent sessions and clear identity state between users.

Restoring enrollment and enforcing a minimum supported OS posture would not address the need for disable persistent sessions and clear identity state between users.

Engage upstream DDoS mitigation or traffic scrubbing would not apply per-identity resource quotas and request-cost controls.

The current facts call for this action: apply per-identity resource quotas and request-cost controls.

Aligning health thresholds with stable service and rate-limit transitions would not apply per-identity resource quotas and request-cost controls.

The reported condition calls for this action: Update the trusted DNSSEC key chain and validate signed responses.

The current facts call for this action: update the trusted DNSSEC key chain and validate signed responses.

Defensive redirection should preserve investigation visibility. The scenario does not present the alternate condition: a response team blocks a malicious domain but a security sinkhole returns an unlogged destination. The proper immediate action is to update the trusted DNSSEC key chain and validate signed responses.

The current facts call for this action: correct route policy and verify the intended trusted egress path.

Asymmetric ACL assumptions can prevent legitimate sessions. The scenario does not present the alternate condition: one firewall zone allows return traffic but blocks the initial authorized connection. The proper immediate action is to correct route policy and verify the intended trusted egress path.

The reported condition calls for this action: Correct route policy and verify the intended trusted egress path.

Correcting DNS authentication records and testing legitimate mail flows would not inspect the aligned domain identities and fix sender configuration. SPF alone does not establish DMARC alignment.

A valid signature may authenticate the wrong domain. The scenario does not present the alternate condition: a malicious sender signs a message with DKIM for a different unrelated domain. The proper immediate action is to inspect the aligned domain identities and fix sender configuration.

Credential management would not inspect the aligned domain identities and fix sender configuration. SPF alone does not establish DMARC alignment.

Validating input parsing and rule dependencies against real events would not address the need for reproduce the match and refine a scoped policy with malicious regression tests.

The current facts call for this action: reproduce the match and refine a scoped policy with malicious regression tests.

Using a network sensor for the appropriate mirrored traffic would not address the need for reproduce the match and refine a scoped policy with malicious regression tests.

The reported condition calls for this action: Negotiate a mutually supported modern TLS configuration without re-enabling obsolete ciphers.

The current facts call for this action: negotiate a mutually supported modern TLS configuration without re-enabling obsolete ciphers.

Revocation design has an availability dependency. The scenario does not present the alternate condition: revocation checks fail because the OCSP responder is unreachable from segmented clients. The proper immediate action is to negotiate a mutually supported modern TLS configuration without re-enabling obsolete ciphers.

The current facts call for this action: replace the binding with a certificate for the intended identity.

Missing intermediates can break otherwise valid validation. The scenario does not present the alternate condition: a TLS endpoint serves an incomplete intermediate chain to external clients. The proper immediate action is to replace the binding with a certificate for the intended identity.

The reported condition calls for this action: Replace the binding with a certificate for the intended identity.

Applying per-identity resource quotas and requesting-cost controls would not address the need for engage upstream DDoS mitigation or traffic scrubbing. On-prem filtering cannot restore an already saturated link.

Oscillating failover can worsen availability loss. The scenario does not present the alternate condition: a failover system repeatedly promotes unhealthy nodes during traffic spikes. The proper immediate action is to engage upstream DDoS mitigation or traffic scrubbing.

Applying connection-state and SYN flood protection would not address the need for engage upstream DDoS mitigation or traffic scrubbing. On-prem filtering cannot restore an already saturated link.

Configuring the sinkhole with monitoring and case correlation would not restrict AXFR to approved secondaries using authenticated transfers.

The current facts call for this action: restrict AXFR to approved secondaries using authenticated transfers.

Updating the trusted DNSSEC key chain and validating signed responses would not restrict AXFR to approved secondaries using authenticated transfers.

The reported condition calls for this action: Treat the DKIM result as insufficient for displayed sender trust.

The current facts call for this action: treat the DKIM result as insufficient for displayed sender trust.

Message signatures rely on valid certificate identity and dates. The scenario does not present the alternate condition: a partner uses S/MIME signatures that recipients cannot validate after certificate expiry. The proper immediate action is to treat the DKIM result as insufficient for displayed sender trust.