Pass Your CompTIA CAS-005 Exam Easy!

Reassess residual risk after validating the control outcome would not address the need for escalate for authorized risk treatment or explicit governance-approved exception.

Delivery convenience alone is not a risk acceptance authority. The scenario does not present the alternate condition: a vendor proposes accepting a new risk because the patch window is inconvenient. The proper immediate action is to escalate for authorized risk treatment or explicit governance-approved exception.

Comparing likelihood, impact and business scenarios would not address the need for escalate for authorized risk treatment or explicit governance-approved exception.

Including correlated service dependencies in extreme-but-plausible scenarios would not estimate annualized loss exposure with calibrated assumptions and ranges.

The current facts call for this action: estimate annualized loss exposure with calibrated assumptions and ranges.

Validating the shared-responsibility and recovery assumptions would not estimate annualized loss exposure with calibrated assumptions and ranges.

The reported condition calls for this action: Assess sovereignty, legal transfer basis and storage location constraints.

The current facts call for this action: assess sovereignty, legal transfer basis and storage location constraints.

Rights handling requires an exception decision based on legal duty. The scenario does not present the alternate condition: a customer invokes erasure while a legal hold covers relevant records. The proper immediate action is to assess sovereignty, legal transfer basis and storage location constraints.

The current facts call for this action: compare likelihood, impact and business scenarios before ranking.

An owner cannot override enterprise tolerance by informal acceptance. The scenario does not present the alternate condition: a system owner accepts a risk whose loss estimate exceeds the board's documented tolerance. The proper immediate action is to compare likelihood, impact and business scenarios before ranking.

The reported condition calls for this action: Compare likelihood, impact and business scenarios before ranking.

Validating an end-to-end business service acceptance test would not address the need for size backup and replication cadence to accepted data-loss tolerance.

RTOs must reflect end-to-end service dependencies. The scenario does not present the alternate condition: a payment platform is targeted for a 10-minute RTO but shared authentication requires 45 minutes to restore. The proper immediate action is to size backup and replication cadence to accepted data-loss tolerance.

Evaluating common-mode failure and independent recovery access would not address the need for size backup and replication cadence to accepted data-loss tolerance.

Testing logical restore consistency and business transactions would not enable append-only or remotely protected journals with integrity checks.

The current facts call for this action: enable append-only or remotely protected journals with integrity checks.

Adding immutable or segregated recovery copies and testing restore access would not enable append-only or remotely protected journals with integrity checks.

The reported condition calls for this action: Use clearly defined qualitative scenarios and uncertainty ratings.

The current facts call for this action: use clearly defined qualitative scenarios and uncertainty ratings.

Independent scores can underestimate concentrated systemic risk. The scenario does not present the alternate condition: a regional office scores risk without considering shared cloud dependency failures. The proper immediate action is to use clearly defined qualitative scenarios and uncertainty ratings.

The current facts call for this action: request scope-relevant evidence and bridge the coverage gap.

Subprocessor changes can alter regulatory and operational exposure. The scenario does not present the alternate condition: a supplier changes its subprocessor to another jurisdiction without review. The proper immediate action is to request scope-relevant evidence and bridge the coverage gap.

The reported condition calls for this action: Request scope-relevant evidence and bridge the coverage gap.

Retiring the function or remove the unnecessary exposure would not implement and test a scoped mitigating control with expiry and owner.

Risk treatment is not complete without proof. The scenario does not present the alternate condition: a critical asset remains vulnerable after a patch rollout reports success. The proper immediate action is to implement and test a scoped mitigating control with expiry and owner.

Keeping minimum controls and recognize insurance transfers only financial portions would not implement and test a scoped mitigating control with expiry and owner.

Estimating annualized loss exposure with calibrated assumptions and ranges would not include correlated service dependencies in extreme-but-plausible scenarios.

The current facts call for this action: include correlated service dependencies in extreme-but-plausible scenarios.

Validating the shared-responsibility and recovery assumptions would not include correlated service dependencies in extreme-but-plausible scenarios.

The reported condition calls for this action: Test logical restore consistency and business transactions.

The current facts call for this action: test logical restore consistency and business transactions.

Independent records improve postincident reconstruction. The scenario does not present the alternate condition: transaction records are changed without any independent tamper evidence. The proper immediate action is to test logical restore consistency and business transactions.