Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Compare PCR measurements to trusted baselines and investigate.

The current facts call for this action: compare PCR measurements to trusted baselines and investigate.

Virtual hardware roots of trust must remain isolated. The scenario does not present the alternate condition: virtual desktops clone a virtual TPM identity between tenants. The proper immediate action is to compare PCR measurements to trusted baselines and investigate.

The current facts call for this action: apply attestation policy against known-good measurements.

Self-healing should not destroy essential incident artifacts. The scenario does not present the alternate condition: a detected firmware alteration triggers an automatic reinstall that erases forensic evidence. The proper immediate action is to apply attestation policy against known-good measurements.

The reported condition calls for this action: Apply attestation policy against known-good measurements.

Using evaluated tamper-resistant modules and documented incident replacement would not meet the need for physical access control.

Environment constraints affect hardware reliability and integrity. The scenario does not present the alternate condition: a secure device must operate near severe electromagnetic interference. The proper immediate action is to use port restrictions, device control and physical access safeguards.

Connecting sensors to monitored response with access logs would not meet the need for physical access control.

Testing quorum-held recovery procedures and protected backup material would not separate duties and require quorum or controlled authorization.

The current facts call for this action: separate duties and require quorum or controlled authorization.

Using approved hardware scaling or acceleration without exporting keys would not separate duties and require quorum or controlled authorization.

The reported condition calls for this action: Use approved hardware acceleration while retaining authenticated encryption.

The current facts call for this action: use approved hardware acceleration while retaining authenticated encryption.

Hardware security boundaries are subject to implementation flaws. The scenario does not present the alternate condition: a device relies on an outdated CPU security extension vulnerable to known side channels. The proper immediate action is to use approved hardware acceleration while retaining authenticated encryption.

The current facts call for this action: use approved hardware scaling or acceleration without exporting keys.

Root signing keys need isolation from application compromise. The scenario does not present the alternate condition: an online signing service stores its root CA key in the same general-purpose app server. The proper immediate action is to use approved hardware scaling or acceleration without exporting keys.

The reported condition calls for this action: Use approved hardware scaling or acceleration without exporting keys.

Comparing PCR measurements to trusted baselines and investigating would not provision unique vTPM state and segregate tenant ownership.

Trusted hardware protection requires controlled recovery paths. The scenario does not present the alternate condition: laptop disks are encrypted but recovery keys are exported from unmanaged endpoints. The proper immediate action is to provision unique vTPM state and segregate tenant ownership.

Investigating attestation and key export policy violations would not provision unique vTPM state and segregate tenant ownership.

Applying attestation policy against known-good measurements would not verify vendor signature and trusted update channel.

The current facts call for this action: verify vendor signature and trusted update channel before deployment.

Preserving necessary evidence would not verify vendor signature and trusted update channel.

The reported condition calls for this action: Use appropriate shielding and verified equipment ratings.

The current facts call for this action: use appropriate shielding and verified equipment ratings.

Physical interfaces can bypass normal remote access policy. The scenario does not present the alternate condition: an attacker could connect a rogue USB device to an unattended industrial console. The proper immediate action is to use appropriate shielding and verified equipment ratings.

The current facts call for this action: require remote attestation before releasing confidential inputs.

Hardware security boundaries are subject to implementation flaws. The scenario does not present the alternate condition: a device relies on an outdated CPU security extension vulnerable to known side channels. The proper immediate action is to require remote attestation before releasing confidential inputs.

The reported condition calls for this action: Require remote attestation before releasing confidential inputs.

Requiring remote attestation would not apply mitigations and reassess whether isolation remains sufficient.

Trusted execution can reduce host exposure but not eliminate all risks. The scenario does not present the alternate condition: a confidential analytics service wants to protect selected computations from the host OS. The proper immediate action is to apply mitigations and reassess whether isolation remains sufficient.

Using approved hardware acceleration while retaining authenticated encryption would not apply mitigations and reassess whether isolation remains sufficient.