CompTIA CAS-005 Practice Test 36

Question 350

A newly deployed detection rule raises no alerts because ingestion fields are renamed. Which action is MOST defensible given these facts?

Reproduce the match and refine a scoped policy with malicious regression tests.
Validate input parsing and rule dependencies against real events.
Correlate NAT mappings or change placement to recover attribution.
Use a network sensor for the appropriate mirrored traffic.

Explanation

Correct Answer

Detection correctness requires reliable normalization. The controlling fact is: A newly deployed detection rule raises no alerts because ingestion fields are renamed.

Incorrect Answers

Reproduce the match and refine a scoped policy with malicious regression tests would not validate input parsing and rule dependencies against real events.

Observation location changes what addresses mean. The scenario does not present the alternate condition: an IDS sensor is mounted after NAT but analysts expect pre-NAT source identities. The proper immediate action is to validate input parsing and rule dependencies against real events.

Using a network sensor for the appropriate mirrored traffic would not validate input parsing and rule dependencies against real events.

Question 351

A local resolver cache returns poisoned records for one banking hostname. Which action is the BEST response to the security requirement?

Update the trusted DNSSEC key chain and validate signed responses.
Restrict AXFR to approved secondaries using authenticated transfers.
Purge untrusted cache entries and validate upstream provenance.
Configure the sinkhole with monitoring and case correlation.

Explanation

Correct Answer

Bad name resolution can redirect authenticated workflows. The controlling fact is: A local resolver cache returns poisoned records for one banking hostname.

Incorrect Answers

Updating the trusted DNSSEC key chain and validating signed responses would not address the need for purge untrusted cache entries and validate upstream provenance.

The current facts call for this action: purge untrusted cache entries and validate upstream provenance.

Configuring the sinkhole with monitoring and case correlation would not address the need for purge untrusted cache entries and validate upstream provenance.

Question 352

Revocation checks fail because the OCSP responder is unreachable from segmented clients. Which control or decision MOST directly resolves the stated gap?

Install the complete appropriate chain and test diverse clients.
Replace the binding with a certificate for the intended identity.
Negotiate a mutually supported modern TLS configuration without re-enabling obsolete ciphers.
Provide approved reachable revocation service or stapled status.

Explanation

Correct Answer

Revocation design has an availability dependency. The controlling fact is: Revocation checks fail because the OCSP responder is unreachable from segmented clients.

Incorrect Answers

The reported condition calls for this action: Provide approved reachable revocation service or stapled status.

The current facts call for this action: provide approved reachable revocation service or stapled status.

Compatibility should not force insecure algorithms. The scenario does not present the alternate condition: a client fails TLS because its only cipher suites are disabled on the server. The proper immediate action is to provide approved reachable revocation service or stapled status.

Question 353

One firewall zone allows return traffic but blocks the initial authorized connection. What is the appropriate security response for this scenario?

Review stateful policy direction and permitted service ports.
Compare selectors, routes and access-control lists on both peers.
Correct route policy and verify the intended trusted egress path.
Isolate the loop and validate spanning-tree convergence and trunk settings.

Explanation

Correct Answer

Asymmetric ACL assumptions can prevent legitimate sessions. The controlling fact is: One firewall zone allows return traffic but blocks the initial authorized connection.

Incorrect Answers

The current facts call for this action: review stateful policy direction and permitted service ports.

Routing errors can bypass segmentation. The scenario does not present the alternate condition: a new static route sends management traffic through an untrusted partner network. The proper immediate action is to review stateful policy direction and permitted service ports.

The reported condition calls for this action: Review stateful policy direction and permitted service ports.

Question 354

A failover system repeatedly promotes unhealthy nodes during traffic spikes. What should the enterprise security architect or analyst do NEXT?

Engage upstream DDoS mitigation or traffic scrubbing.
Align health thresholds with stable service and rate-limit transitions.
Apply connection-state and SYN flood protection.
Apply per-identity resource quotas and request-cost controls.

Explanation

Correct Answer

Oscillating failover can worsen availability loss. The controlling fact is: A failover system repeatedly promotes unhealthy nodes during traffic spikes.

Incorrect Answers

Engage upstream DDoS mitigation or traffic scrubbing would not align health thresholds with stable service and rate-limit transitions.

Transport exhaustion requires network-layer controls. The scenario does not present the alternate condition: sYN backlog exhaustion occurs even though application worker utilization stays low. The proper immediate action is to align health thresholds with stable service and rate-limit transitions.

Applying per-identity resource quotas and requesting-cost controls would not align health thresholds with stable service and rate-limit transitions.

Question 355

Laptop disks are encrypted but recovery keys are exported from unmanaged endpoints. Which action is the BEST response to the security requirement?

Compare PCR measurements to trusted baselines and investigate.
Investigate attestation and key export policy violations.
Bind key handling to TPM and enterprise escrow policies.
Provision unique vTPM state and segregate tenant ownership.

Explanation

Correct Answer

Trusted hardware protection requires controlled recovery paths. The controlling fact is: Laptop disks are encrypted but recovery keys are exported from unmanaged endpoints.

Incorrect Answers

Comparing PCR measurements to trusted baselines and investigating would not address the need for bind key handling to TPM and enterprise escrow policies. Trusted hardware protection requires controlled recovery paths.

The current facts call for this action: bind key handling to TPM and enterprise escrow policies.

Provisioning unique vTPM state and segregate tenant ownership would not address the need for bind key handling to TPM and enterprise escrow policies. Trusted hardware protection requires controlled recovery paths.

Question 356

A confidential analytics service wants to protect selected computations from the host OS. Which control or decision MOST directly resolves the stated gap?

Require remote attestation before releasing confidential inputs.
Apply mitigations and reassess whether isolation remains sufficient.
Use approved hardware acceleration while retaining authenticated encryption.
Use an appropriately attested enclave with narrowly scoped secrets.

Explanation

Correct Answer

Trusted execution can reduce host exposure but not eliminate all risks. The controlling fact is: A confidential analytics service wants to protect selected computations from the host OS.

Incorrect Answers

The reported condition calls for this action: Use an appropriately attested enclave with narrowly scoped secrets.

The current facts call for this action: use an appropriately attested enclave with narrowly scoped secrets.

Performance must not eliminate integrity verification. The scenario does not present the alternate condition: a cryptographic operation slows down processing and engineers propose disabling authentication tags. The proper immediate action is to use an appropriately attested enclave with narrowly scoped secrets.

Question 357

An online signing service stores its root CA key in the same general-purpose app server. What is the appropriate security response for this scenario?

Move high-value key operations to controlled HSM-backed custody.
Use approved hardware scaling or acceleration without exporting keys.
Separate duties and require quorum or controlled authorization.
Test quorum-held recovery procedures and protected backup material.

Explanation

Correct Answer

Root signing keys need isolation from application compromise. The controlling fact is: An online signing service stores its root CA key in the same general-purpose app server.

Incorrect Answers

The current facts call for this action: move high-value key operations to controlled HSM-backed custody.

Key-management governance should prevent unilateral destruction. The scenario does not present the alternate condition: one cloud operator can both issue and approve key deletion. The proper immediate action is to move high-value key operations to controlled HSM-backed custody.

The reported condition calls for this action: Move high-value key operations to controlled HSM-backed custody.

Question 358

A workstation loads an unapproved bootloader even though the disk encryption check passed. What should the enterprise security architect or analyst do NEXT?

Apply attestation policy against known-good measurements.
Enforce Secure Boot trust and investigate firmware startup chain.
Preserve necessary evidence before approved trusted firmware recovery.
Verify vendor signature and trusted update channel before deployment.

Explanation

Correct Answer

Encryption does not validate executable boot integrity. The controlling fact is: A workstation loads an unapproved bootloader even though the disk encryption check passed.

Incorrect Answers

Applying attestation policy against known-good measurements would not enforce Secure Boot trust and investigate firmware startup chain. Encryption does not validate executable boot integrity.

Self-healing should not destroy essential incident artifacts. The scenario does not present the alternate condition: a detected firmware alteration triggers an automatic reinstall that erases forensic evidence. The proper immediate action is to enforce Secure Boot trust and investigate firmware startup chain.

Verifying vendor signature and trusted update channel would not enforce Secure Boot trust and investigate firmware startup chain. Encryption does not validate executable boot integrity.

Question 359

A datacenter cabinet has tamper sensors but no alert route when opened. Which action is MOST defensible given these facts?

Use evaluated tamper-resistant modules and documented incident replacement.
Use appropriate shielding and verified equipment ratings.
Connect sensors to monitored response with access logs.
Use port restrictions, device control and physical access safeguards.

Explanation

Correct Answer

Detection without actionable monitoring adds little assurance. The controlling fact is: A datacenter cabinet has tamper sensors but no alert route when opened.

Incorrect Answers

Using evaluated tamper-resistant modules and documented incident replacement would not connect sensors to monitored response with access logs.

The current facts call for this action: connect sensors to monitored response with access logs.

Using port restrictions, device control and physical access safeguards would not connect sensors to monitored response with access logs.

Question 360

A device's measured boot digest changes after an unapproved firmware update. What should the enterprise security architect or analyst do NEXT?

Bind key handling to TPM and enterprise escrow policies.
Investigate attestation and key export policy violations.
Provision unique vTPM state and segregate tenant ownership.
Compare PCR measurements to trusted baselines and investigate.

Explanation

Correct Answer

Measured boot provides evidence, not automatic acceptance. The controlling fact is: A device's measured boot digest changes after an unapproved firmware update.

Incorrect Answers

The reported condition calls for this action: Compare PCR measurements to trusted baselines and investigate.

The current facts call for this action: compare PCR measurements to trusted baselines and investigate.

Virtual hardware roots of trust must remain isolated. The scenario does not present the alternate condition: virtual desktops clone a virtual TPM identity between tenants. The proper immediate action is to compare PCR measurements to trusted baselines and investigate.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 34 - 10 Questions (Last Reviewed 05-Oct-2026)
CompTIA CAS-005 Practice Test 35 - 10 Questions (Last Reviewed 04-Oct-2026)
CompTIA CAS-005 Practice Test 36 - 10 Questions (Last Reviewed 03-Oct-2026)
CompTIA CAS-005 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
CompTIA CAS-005 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 350

Explanation

Correct Answer

Incorrect Answers

Question 351

Explanation

Correct Answer

Incorrect Answers

Question 352

Explanation

Correct Answer

Incorrect Answers

Question 353

Explanation

Correct Answer

Incorrect Answers

Question 354

Explanation

Correct Answer

Incorrect Answers

Question 355

Explanation

Correct Answer

Incorrect Answers

Question 356

Explanation

Correct Answer

Incorrect Answers

Question 357

Explanation

Correct Answer

Incorrect Answers

Question 358

Explanation

Correct Answer

Incorrect Answers

Question 359

Explanation

Correct Answer

Incorrect Answers

Question 360

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests