CompTIA CAS-005 Practice Test 38

Question 370

A device relies on an outdated CPU security extension vulnerable to known side channels. Which action is MOST defensible given these facts?

Require remote attestation before releasing confidential inputs.
Apply mitigations and reassess whether isolation remains sufficient.
Use an appropriately attested enclave with narrowly scoped secrets.
Use approved hardware acceleration while retaining authenticated encryption.

Explanation

Correct Answer

Hardware security boundaries are subject to implementation flaws. The controlling fact is: A device relies on an outdated CPU security extension vulnerable to known side channels.

Incorrect Answers

Requiring remote attestation would not apply mitigations and reassess whether isolation remains sufficient.

Trusted execution can reduce host exposure but not eliminate all risks. The scenario does not present the alternate condition: a confidential analytics service wants to protect selected computations from the host OS. The proper immediate action is to apply mitigations and reassess whether isolation remains sufficient.

Using approved hardware acceleration while retaining authenticated encryption would not apply mitigations and reassess whether isolation remains sufficient.

Question 371

A detected firmware alteration triggers an automatic reinstall that erases forensic evidence. Which action is the BEST response to the security requirement?

Enforce Secure Boot trust and investigate firmware startup chain.
Verify vendor signature and trusted update channel before deployment.
Preserve necessary evidence before approved trusted firmware recovery.
Apply attestation policy against known-good measurements.

Explanation

Correct Answer

Self-healing should not destroy essential incident artifacts. The controlling fact is: A detected firmware alteration triggers an automatic reinstall that erases forensic evidence.

Incorrect Answers

Enforcing Secure Boot trust and investigating firmware startup chain would not preserve necessary evidence.

The current facts call for this action: preserve necessary evidence before approved trusted firmware recovery.

Applying attestation policy against known-good measurements would not preserve necessary evidence.

Question 372

A disaster recovery drill cannot access HSM backups because no independent custodian is available. Which control or decision MOST directly resolves the stated gap?

Move high-value key operations to controlled HSM-backed custody.
Separate duties and require quorum or controlled authorization.
Use approved hardware scaling or acceleration without exporting keys.
Test quorum-held recovery procedures and protected backup material.

Explanation

Correct Answer

Recovery of trust anchors requires operational readiness. The controlling fact is: A disaster recovery drill cannot access HSM backups because no independent custodian is available.

Incorrect Answers

The reported condition calls for this action: Test quorum-held recovery procedures and protected backup material.

The current facts call for this action: test quorum-held recovery procedures and protected backup material.

Performance fixes cannot discard private-key protection. The scenario does not present the alternate condition: a signing service performance bottleneck leads engineers to export private keys into software. The proper immediate action is to test quorum-held recovery procedures and protected backup material.

Question 373

A hardware-bound private key appears usable from a different machine image. What is the appropriate security response for this scenario?

Investigate attestation and key export policy violations.
Compare PCR measurements to trusted baselines and investigate.
Provision unique vTPM state and segregate tenant ownership.
Bind key handling to TPM and enterprise escrow policies.

Explanation

Correct Answer

Hardware binding should resist arbitrary cloning. The controlling fact is: A hardware-bound private key appears usable from a different machine image.

Incorrect Answers

The current facts call for this action: investigate attestation and key export policy violations.

Virtual hardware roots of trust must remain isolated. The scenario does not present the alternate condition: virtual desktops clone a virtual TPM identity between tenants. The proper immediate action is to investigate attestation and key export policy violations.

The reported condition calls for this action: Investigate attestation and key export policy violations.

Question 374

A hardware security module exposes keys if its tamper enclosure is defeated. What should the enterprise security architect or analyst do NEXT?

Use port restrictions, device control and physical access safeguards.
Use evaluated tamper-resistant modules and documented incident replacement.
Connect sensors to monitored response with access logs.
Use appropriate shielding and verified equipment ratings.

Explanation

Correct Answer

Physical countermeasures protect sensitive internal materials. The controlling fact is: A hardware security module exposes keys if its tamper enclosure is defeated.

Incorrect Answers

Using port restrictions, device control and physical access safeguards would not meet the need for evaluated tamper-resistant modules and documented incident replacement.

Detection without actionable monitoring adds little assurance. The scenario does not present the alternate condition: a datacenter cabinet has tamper sensors but no alert route when opened. The proper immediate action is to use evaluated tamper-resistant modules and documented incident replacement.

Using appropriate shielding and verified equipment ratings would not meet the need for evaluated tamper-resistant modules and documented incident replacement.

Question 375

A factory wireless sensor accepts unsigned commands sent from nearby radios. Which action is the BEST response to the security requirement?

Require protected provisioning and suppress unnecessary RF disclosure.
Select efficient authenticated transport and bounded key lifecycle.
Authenticate commands and segment radio gateways from control logic.
Correlate physical interference with signed sensor and gateway telemetry.

Explanation

Correct Answer

Proximity does not establish device authority. The controlling fact is: A factory wireless sensor accepts unsigned commands sent from nearby radios.

Incorrect Answers

Requiring protected provisioning and suppress unnecessary RF disclosure would not authenticate commands and segment radio gateways from control logic.

The current facts call for this action: authenticate commands and segment radio gateways from control logic.

Correlating physical interference with signed sensor and gateway telemetry would not authenticate commands and segment radio gateways from control logic.

Question 376

A hospital imaging system cannot be reconfigured but exchanges data with a modern records platform. Which control or decision MOST directly resolves the stated gap?

Buffer signed events locally for protected delayed transfer.
Document interim safeguards and plan validated migration with clinical owners.
Separate credentials and control networks by safety function.
Broker constrained protocols through a protected interface with auditing.

Explanation

Correct Answer

Clinical continuity requires mediated compatibility. The controlling fact is: A hospital imaging system cannot be reconfigured but exchanges data with a modern records platform.

Incorrect Answers

The reported condition calls for this action: Broker constrained protocols through a protected interface with auditing.

The current facts call for this action: broker constrained protocols through a protected interface with auditing.

Transport safety domains require stronger separation. The scenario does not present the alternate condition: a train signaling network shares a management password with ordinary station Wi-Fi equipment. The proper immediate action is to broker constrained protocols through a protected interface with auditing.

Question 377

A manufacturing gateway only runs obsolete software and no vendor patches are available. What is the appropriate security response for this scenario?

Isolate the gateway and maintain a funded replacement plan.
Use buffered protected collection with an approved retention period.
Preserve signed or verified logic versions and audit changes.
Use time-limited supervised sessions with logged approvals.

Explanation

Correct Answer

Permanent exception without replacement leaves persistent risk. The controlling fact is: A manufacturing gateway only runs obsolete software and no vendor patches are available.

Incorrect Answers

The current facts call for this action: isolate the gateway and maintain a funded replacement plan.

Control logic integrity supports safe operation. The scenario does not present the alternate condition: field operators change PLC logic but the approved program baseline is not recorded. The proper immediate action is to isolate the gateway and maintain a funded replacement plan.

The reported condition calls for this action: Isolate the gateway and maintain a funded replacement plan.

Question 378

Thousands of network cameras ship with one vendor default administrator password. What should the enterprise security architect or analyst do NEXT?

Segregate untrusted devices and reconcile their state before service access.
Enforce unique credentials and inventory-backed provisioning.
Minimize data collection and apply strict privacy retention.
Require signed updates and verified boot or firmware acceptance.

Explanation

Correct Answer

Shared default secrets allow fleet-wide access. The controlling fact is: Thousands of network cameras ship with one vendor default administrator password.

Incorrect Answers

Offline duration can invalidate earlier trust. Shared default secrets allow fleet-wide access.

Constrained devices still create personal data risks. Shared default secrets allow fleet-wide access.

Embedded devices need a trustworthy update chain. Shared default secrets allow fleet-wide access.

Question 379

An active scan causes a legacy process controller to reset during production. Which action is MOST defensible given these facts?

Apply compensating gateway controls and strict physical/network access.
Enforce industrial segmentation with monitored jump access.
Move to passive visibility and schedule any necessary active test with plant safety owners.
Use safety-approved containment procedures and human authorization.

Explanation

Correct Answer

Availability and safety govern OT assessment methods. The controlling fact is: An active scan causes a legacy process controller to reset during production.

Incorrect Answers

Applying compensating gateway controls and strict physical/network access would not move to passive visibility and schedule any necessary active test with plant safety owners.

The current facts call for this action: move to passive visibility and schedule any necessary active test with plant safety owners.

Using safety-approved containment procedures and human authorization would not move to passive visibility and schedule any necessary active test with plant safety owners.

Question 380

A train signaling network shares a management password with ordinary station Wi-Fi equipment. What should the enterprise security architect or analyst do NEXT?

Broker constrained protocols through a protected interface with auditing.
Buffer signed events locally for protected delayed transfer.
Document interim safeguards and plan validated migration with clinical owners.
Separate credentials and control networks by safety function.

Explanation

Correct Answer

Transport safety domains require stronger separation. The controlling fact is: A train signaling network shares a management password with ordinary station Wi-Fi equipment.

Incorrect Answers

The reported condition calls for this action: Separate credentials and control networks by safety function.

The current facts call for this action: separate credentials and control networks by safety function.

Change approval and patient safety constrain remediation sequencing. The scenario does not present the alternate condition: a medical infusion controller is end-of-life but replacement needs regulatory acceptance testing. The proper immediate action is to separate credentials and control networks by safety function.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 36 - 10 Questions (Last Reviewed 03-Oct-2026)
CompTIA CAS-005 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
CompTIA CAS-005 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
CompTIA CAS-005 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA CAS-005 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 370

Explanation

Correct Answer

Incorrect Answers

Question 371

Explanation

Correct Answer

Incorrect Answers

Question 372

Explanation

Correct Answer

Incorrect Answers

Question 373

Explanation

Correct Answer

Incorrect Answers

Question 374

Explanation

Correct Answer

Incorrect Answers

Question 375

Explanation

Correct Answer

Incorrect Answers

Question 376

Explanation

Correct Answer

Incorrect Answers

Question 377

Explanation

Correct Answer

Incorrect Answers

Question 378

Explanation

Correct Answer

Incorrect Answers

Question 379

Explanation

Correct Answer

Incorrect Answers

Question 380

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests