CompTIA CAS-005 Practice Test 39

Question 380

A train signaling network shares a management password with ordinary station Wi-Fi equipment. What should the enterprise security architect or analyst do NEXT?

Broker constrained protocols through a protected interface with auditing.
Buffer signed events locally for protected delayed transfer.
Document interim safeguards and plan validated migration with clinical owners.
Separate credentials and control networks by safety function.

Explanation

Correct Answer

Transport safety domains require stronger separation. The controlling fact is: A train signaling network shares a management password with ordinary station Wi-Fi equipment.

Incorrect Answers

The reported condition calls for this action: Separate credentials and control networks by safety function.

The current facts call for this action: separate credentials and control networks by safety function.

Change approval and patient safety constrain remediation sequencing. The scenario does not present the alternate condition: a medical infusion controller is end-of-life but replacement needs regulatory acceptance testing. The proper immediate action is to separate credentials and control networks by safety function.

Question 381

A battery-limited sensor cannot use a heavyweight continuously connected VPN. Which action is MOST defensible given these facts?

Select efficient authenticated transport and bounded key lifecycle.
Correlate physical interference with signed sensor and gateway telemetry.
Authenticate commands and segment radio gateways from control logic.
Require protected provisioning and suppress unnecessary RF disclosure.

Explanation

Correct Answer

Constrained hardware needs proportionate strong security. The controlling fact is: A battery-limited sensor cannot use a heavyweight continuously connected VPN.

Incorrect Answers

The current facts call for this action: select efficient authenticated transport and bounded key lifecycle.

Proximity does not establish device authority. The scenario does not present the alternate condition: a factory wireless sensor accepts unsigned commands sent from nearby radios. The proper immediate action is to select efficient authenticated transport and bounded key lifecycle.

The reported condition calls for this action: Select efficient authenticated transport and bounded key lifecycle.

Question 382

Engineers route enterprise Wi-Fi directly into a SCADA control VLAN for convenience. Which action is the BEST response to the security requirement?

Apply compensating gateway controls and strict physical/network access.
Enforce industrial segmentation with monitored jump access.
Use safety-approved containment procedures and human authorization.
Move to passive visibility and schedule any necessary active test with plant safety owners.

Explanation

Correct Answer

Unmanaged IT paths increase critical control exposure. The controlling fact is: Engineers route enterprise Wi-Fi directly into a SCADA control VLAN for convenience.

Incorrect Answers

Applying compensating gateway controls and strict physical/network access would not enforce industrial segmentation with monitored jump access.

Aggressive endpoint actions can create physical harm. The scenario does not present the alternate condition: incident responders plan to automatically power off a safety-critical controller on every malware alert. The proper immediate action is to enforce industrial segmentation with monitored jump access.

Moving to passive visibility and scheduling any necessary active test with plant safety owners would not enforce industrial segmentation with monitored jump access.

Question 383

Remote sensors receive firmware over an unsecured channel without signature checks. Which control or decision MOST directly resolves the stated gap?

Minimize data collection and apply strict privacy retention.
Enforce unique credentials and inventory-backed provisioning.
Require signed updates and verified boot or firmware acceptance.
Segregate untrusted devices and reconcile their state before service access.

Explanation

Correct Answer

Embedded devices need a trustworthy update chain. The controlling fact is: Remote sensors receive firmware over an unsecured channel without signature checks.

Incorrect Answers

Minimize data collection and apply strict privacy retention would not require signed updates and verified boot or firmware acceptance.

The current facts call for this action: require signed updates and verified boot or firmware acceptance.

Segregate untrusted devices and reconcile their state would not require signed updates and verified boot or firmware acceptance.

Question 384

Historian logs are overwritten every day although incident analysis needs a month of trends. What is the appropriate security response for this scenario?

Preserve signed or verified logic versions and audit changes.
Use time-limited supervised sessions with logged approvals.
Isolate the gateway and maintain a funded replacement plan.
Use buffered protected collection with an approved retention period.

Explanation

Correct Answer

OT logs must survive device and network constraints. The controlling fact is: Historian logs are overwritten every day although incident analysis needs a month of trends.

Incorrect Answers

The reported condition calls for this action: Use buffered protected collection with an approved retention period.

The current facts call for this action: use buffered protected collection with an approved retention period.

Permanent exception without replacement leaves persistent risk. The scenario does not present the alternate condition: a manufacturing gateway only runs obsolete software and no vendor patches are available. The proper immediate action is to use buffered protected collection with an approved retention period.

Question 385

A plant controller cannot support modern authentication but must remain in use for one year. Which control or decision MOST directly resolves the stated gap?

Apply compensating gateway controls and strict physical/network access.
Enforce industrial segmentation with monitored jump access.
Use safety-approved containment procedures and human authorization.
Move to passive visibility and schedule any necessary active test with plant safety owners.

Explanation

Correct Answer

Unsupported identity controls need external mitigation. The controlling fact is: A plant controller cannot support modern authentication but must remain in use for one year.

Incorrect Answers

The current facts call for this action: apply compensating gateway controls and strict physical/network access.

Aggressive endpoint actions can create physical harm. The scenario does not present the alternate condition: incident responders plan to automatically power off a safety-critical controller on every malware alert. The proper immediate action is to apply compensating gateway controls and strict physical/network access.

The reported condition calls for this action: Apply compensating gateway controls and strict physical/network access.

Question 386

Emergency vehicle telemetry intermittently fails in tunnels and loses evidence of safety events. What is the appropriate security response for this scenario?

Document interim safeguards and plan validated migration with clinical owners.
Buffer signed events locally for protected delayed transfer.
Broker constrained protocols through a protected interface with auditing.
Separate credentials and control networks by safety function.

Explanation

Correct Answer

Intermittent links must not erase integrity and chronology. The controlling fact is: Emergency vehicle telemetry intermittently fails in tunnels and loses evidence of safety events.

Incorrect Answers

Documenting interim safeguards and planning validated migration with clinical owners would not address the need for buffer signed events locally for protected delayed transfer.

Clinical continuity requires mediated compatibility. The scenario does not present the alternate condition: a hospital imaging system cannot be reconfigured but exchanges data with a modern records platform. The proper immediate action is to buffer signed events locally for protected delayed transfer.

The reported condition calls for this action: Buffer signed events locally for protected delayed transfer.

Question 387

Field operators change PLC logic but the approved program baseline is not recorded. What should the enterprise security architect or analyst do NEXT?

Use time-limited supervised sessions with logged approvals.
Isolate the gateway and maintain a funded replacement plan.
Preserve signed or verified logic versions and audit changes.
Use buffered protected collection with an approved retention period.

Explanation

Correct Answer

Control logic integrity supports safe operation. The controlling fact is: Field operators change PLC logic but the approved program baseline is not recorded.

Incorrect Answers

Using time-limited supervised sessions with logged approvals would not preserve signed or verified logic versions and audit changes.

The current facts call for this action: preserve signed or verified logic versions and audit changes.

Using buffered protected collection with an approved retention period would not preserve signed or verified logic versions and audit changes.

Question 388

A field device reports impossible measurements after nearby RF interference. Which action is MOST defensible given these facts?

Select efficient authenticated transport and bounded key lifecycle.
Authenticate commands and segment radio gateways from control logic.
Require protected provisioning and suppress unnecessary RF disclosure.
Correlate physical interference with signed sensor and gateway telemetry.

Explanation

Correct Answer

Environmental effects must be distinguished from adversary tampering. The controlling fact is: A field device reports impossible measurements after nearby RF interference.

Incorrect Answers

The reported condition calls for this action: Correlate physical interference with signed sensor and gateway telemetry.

The current facts call for this action: correlate physical interference with signed sensor and gateway telemetry.

Sensitive maintenance data should not be sent openly. The scenario does not present the alternate condition: a remote utility gateway broadcasts maintenance configuration without encryption. The proper immediate action is to correlate physical interference with signed sensor and gateway telemetry.

Question 389

A wearable sends precise location telemetry even when only step count is required. Which action is the BEST response to the security requirement?

Minimize data collection and apply strict privacy retention.
Segregate untrusted devices and reconcile their state before service access.
Enforce unique credentials and inventory-backed provisioning.
Require signed updates and verified boot or firmware acceptance.

Explanation

Correct Answer

Constrained devices still create personal data risks. The controlling fact is: A wearable sends precise location telemetry even when only step count is required.

Incorrect Answers

The current facts call for this action: minimize data collection and apply strict privacy retention.

Shared default secrets allow fleet-wide access. The scenario does not present the alternate condition: thousands of network cameras ship with one vendor default administrator password. The proper immediate action is to minimize data collection and apply strict privacy retention.

The reported condition calls for this action: Minimize data collection and apply strict privacy retention.

Question 390

A fleet contains devices that cannot be patched and periodically reconnect after long outages. Which action is MOST defensible given these facts?

Require signed updates and verified boot or firmware acceptance.
Segregate untrusted devices and reconcile their state before service access.
Enforce unique credentials and inventory-backed provisioning.
Minimize data collection and apply strict privacy retention.

Explanation

Correct Answer

Offline duration can invalidate earlier trust. The controlling fact is: A fleet contains devices that cannot be patched and periodically reconnect after long outages.

Incorrect Answers

Requiring signed updates and verified boot or firmware acceptance would not address the need for segregate untrusted devices and reconcile their state.

Shared default secrets allow fleet-wide access. The scenario does not present the alternate condition: thousands of network cameras ship with one vendor default administrator password. The proper immediate action is to segregate untrusted devices and reconcile their state before service access.

Minimize data collection and apply strict privacy retention would not address the need for segregate untrusted devices and reconcile their state.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
CompTIA CAS-005 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
CompTIA CAS-005 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA CAS-005 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA CAS-005 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 380

Explanation

Correct Answer

Incorrect Answers

Question 381

Explanation

Correct Answer

Incorrect Answers

Question 382

Explanation

Correct Answer

Incorrect Answers

Question 383

Explanation

Correct Answer

Incorrect Answers

Question 384

Explanation

Correct Answer

Incorrect Answers

Question 385

Explanation

Correct Answer

Incorrect Answers

Question 386

Explanation

Correct Answer

Incorrect Answers

Question 387

Explanation

Correct Answer

Incorrect Answers

Question 388

Explanation

Correct Answer

Incorrect Answers

Question 389

Explanation

Correct Answer

Incorrect Answers

Question 390

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests