Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Treat the DKIM result as insufficient for displayed sender trust.

The current facts call for this action: treat the DKIM result as insufficient for displayed sender trust.

Message signatures rely on valid certificate identity and dates. The scenario does not present the alternate condition: a partner uses S/MIME signatures that recipients cannot validate after certificate expiry. The proper immediate action is to treat the DKIM result as insufficient for displayed sender trust.

The current facts call for this action: isolate the loop and validate spanning-tree convergence and trunk settings.

Tunnel up status does not prove forwarding authorization. The scenario does not present the alternate condition: a VPN tunnel is established but restricted subnets cannot exchange traffic. The proper immediate action is to isolate the loop and validate spanning-tree convergence and trunk settings.

The reported condition calls for this action: Isolate the loop and validate spanning-tree convergence and trunk settings.

Validating input parsing and rule dependencies against real events would not correlate NAT mappings or change placement to recover attribution.

Blind global disabling loses useful intrusion prevention. The scenario does not present the alternate condition: an IPS inline deployment blocks benign database replication after a broad signature update. The proper immediate action is to correlate NAT mappings or change placement to recover attribution.

Using a network sensor for the appropriate mirrored traffic would not correlate NAT mappings or change placement to recover attribution.

Treat the DKIM result as insufficient for displayed sender trust would not address the need for credential management.

The current facts call for this action: renew signing credentials and provide a verifiable trust chain.

Correcting DNS authentication records and testing legitimate mail flows would not address the need for credential management.

The reported condition calls for this action: Apply connection-state and SYN flood protection.

The current facts call for this action: apply connection-state and SYN flood protection.

Authenticated demand can still exhaust shared resources. The scenario does not present the alternate condition: a payment API is overwhelmed by expensive query requests from authenticated clients. The proper immediate action is to apply connection-state and SYN flood protection.

The current facts call for this action: use a network sensor for the appropriate mirrored traffic.

Detection correctness requires reliable normalization. The scenario does not present the alternate condition: a newly deployed detection rule raises no alerts because ingestion fields are renamed. The proper immediate action is to use a network sensor for the appropriate mirrored traffic.

The reported condition calls for this action: Use a network sensor for the appropriate mirrored traffic.

Isolate the loop and validate spanning-tree convergence and trunk settings would not meet the need for selectors, routes and access-control lists on both peers. Tunnel up status does not prove forwarding authorization.

Asymmetric ACL assumptions can prevent legitimate sessions. The scenario does not present the alternate condition: one firewall zone allows return traffic but blocks the initial authorized connection. The proper immediate action is to compare selectors, routes and access-control lists on both peers.

Correcting route policy and verifying the intended trusted egress path would not meet the need for selectors, routes and access-control lists on both peers. Tunnel up status does not prove forwarding authorization.

Updating the trusted DNSSEC key chain and validating signed responses would not configure the sinkhole with monitoring and case correlation.

The current facts call for this action: configure the sinkhole with monitoring and case correlation.

Purge untrusted cache entries and validate upstream provenance would not configure the sinkhole with monitoring and case correlation.

The reported condition calls for this action: Install the complete appropriate chain and test diverse clients.

The current facts call for this action: install the complete appropriate chain and test diverse clients.

CA trust does not override endpoint name validation. The scenario does not present the alternate condition: a certificate is trusted by its CA but lists a different hostname. The proper immediate action is to install the complete appropriate chain and test diverse clients.

The current facts call for this action: correct DNS authentication records and test legitimate mail flows.

A valid signature may authenticate the wrong domain. The scenario does not present the alternate condition: a malicious sender signs a message with DKIM for a different unrelated domain. The proper immediate action is to correct DNS authentication records and test legitimate mail flows.

The reported condition calls for this action: Correct DNS authentication records and test legitimate mail flows.

Reproduce the match and refine a scoped policy with malicious regression tests would not validate input parsing and rule dependencies against real events.

Observation location changes what addresses mean. The scenario does not present the alternate condition: an IDS sensor is mounted after NAT but analysts expect pre-NAT source identities. The proper immediate action is to validate input parsing and rule dependencies against real events.

Using a network sensor for the appropriate mirrored traffic would not validate input parsing and rule dependencies against real events.