CompTIA CAS-005 Practice Test 40

Question 390

A fleet contains devices that cannot be patched and periodically reconnect after long outages. Which action is MOST defensible given these facts?

Require signed updates and verified boot or firmware acceptance.
Segregate untrusted devices and reconcile their state before service access.
Enforce unique credentials and inventory-backed provisioning.
Minimize data collection and apply strict privacy retention.

Explanation

Correct Answer

Offline duration can invalidate earlier trust. The controlling fact is: A fleet contains devices that cannot be patched and periodically reconnect after long outages.

Incorrect Answers

Requiring signed updates and verified boot or firmware acceptance would not address the need for segregate untrusted devices and reconcile their state.

Shared default secrets allow fleet-wide access. The scenario does not present the alternate condition: thousands of network cameras ship with one vendor default administrator password. The proper immediate action is to segregate untrusted devices and reconcile their state before service access.

Minimize data collection and apply strict privacy retention would not address the need for segregate untrusted devices and reconcile their state.

Question 391

Incident responders plan to automatically power off a safety-critical controller on every malware alert. Which action is the BEST response to the security requirement?

Apply compensating gateway controls and strict physical/network access.
Move to passive visibility and schedule any necessary active test with plant safety owners.
Use safety-approved containment procedures and human authorization.
Enforce industrial segmentation with monitored jump access.

Explanation

Correct Answer

Aggressive endpoint actions can create physical harm. The controlling fact is: Incident responders plan to automatically power off a safety-critical controller on every malware alert.

Incorrect Answers

Applying compensating gateway controls and strict physical/network access would not meet the need for safety-approved containment procedures and human authorization.

The current facts call for this action: use safety-approved containment procedures and human authorization.

Enforcing industrial segmentation with monitored jump access would not meet the need for safety-approved containment procedures and human authorization.

Question 392

A remote utility gateway broadcasts maintenance configuration without encryption. Which control or decision MOST directly resolves the stated gap?

Correlate physical interference with signed sensor and gateway telemetry.
Authenticate commands and segment radio gateways from control logic.
Select efficient authenticated transport and bounded key lifecycle.
Require protected provisioning and suppress unnecessary RF disclosure.

Explanation

Correct Answer

Sensitive maintenance data should not be sent openly. The controlling fact is: A remote utility gateway broadcasts maintenance configuration without encryption.

Incorrect Answers

The reported condition calls for this action: Require protected provisioning and suppress unnecessary RF disclosure.

The current facts call for this action: require protected provisioning and suppress unnecessary RF disclosure.

Constrained hardware needs proportionate strong security. The scenario does not present the alternate condition: a battery-limited sensor cannot use a heavyweight continuously connected VPN. The proper immediate action is to require protected provisioning and suppress unnecessary RF disclosure.

Question 393

A medical infusion controller is end-of-life but replacement needs regulatory acceptance testing. What is the appropriate security response for this scenario?

Document interim safeguards and plan validated migration with clinical owners.
Separate credentials and control networks by safety function.
Buffer signed events locally for protected delayed transfer.
Broker constrained protocols through a protected interface with auditing.

Explanation

Correct Answer

Change approval and patient safety constrain remediation sequencing. The controlling fact is: A medical infusion controller is end-of-life but replacement needs regulatory acceptance testing.

Incorrect Answers

The current facts call for this action: document interim safeguards and plan validated migration with clinical owners.

Intermittent links must not erase integrity and chronology. The scenario does not present the alternate condition: emergency vehicle telemetry intermittently fails in tunnels and loses evidence of safety events. The proper immediate action is to document interim safeguards and plan validated migration with clinical owners.

The reported condition calls for this action: Document interim safeguards and plan validated migration with clinical owners.

Question 394

An OT partner requires remote access for maintenance outside scheduled windows. What should the enterprise security architect or analyst do NEXT?

Preserve signed or verified logic versions and audit changes.
Use time-limited supervised sessions with logged approvals.
Use buffered protected collection with an approved retention period.
Isolate the gateway and maintain a funded replacement plan.

Explanation

Correct Answer

Third-party OT access must be bounded and attributable. The controlling fact is: An OT partner requires remote access for maintenance outside scheduled windows.

Incorrect Answers

Preserving signed or verified logic versions and auditing changes would not meet the need for time-limited supervised sessions with logged approvals.

OT logs must survive device and network constraints. The scenario does not present the alternate condition: historian logs are overwritten every day although incident analysis needs a month of trends. The proper immediate action is to use time-limited supervised sessions with logged approvals.

Isolate the gateway and maintain a funded replacement plan would not meet the need for time-limited supervised sessions with logged approvals.

Question 395

A configuration deployment changes storage ACLs to public but auto-remediation only patches the live instance. Which action is the BEST response to the security requirement?

Use idempotent state reconciliation and serialized conflicting writes.
Fail closed on validation and expose meaningful deployment status.
Correct and gate the infrastructure code in addition to running rollback.
Bind deployment approval to workspace, account and resource scope.

Explanation

Correct Answer

Source-controlled misconfigurations will otherwise recur. The controlling fact is: A configuration deployment changes storage ACLs to public but auto-remediation only patches the live instance.

Incorrect Answers

Using idempotent state reconciliation and serialized conflicting writes would not correct and gate the infrastructure code in addition to running rollback.

The current facts call for this action: correct and gate the infrastructure code in addition to running rollback.

Bind deployment approval to workspace, account and resource scope would not correct and gate the infrastructure code in addition to running rollback.

Question 396

A cloud webhook retries after a timeout and a containment job runs twice. Which control or decision MOST directly resolves the stated gap?

Gate rollout by asset criticality, testing and maintenance authorization.
Use workload identity or a managed credential provider.
Separate event destinations and enforce recursion limits.
Use event identifiers and idempotent execution with safe retry policy.

Explanation

Correct Answer

At-least-once event delivery must not multiply destructive actions. The controlling fact is: A cloud webhook retries after a timeout and a containment job runs twice.

Incorrect Answers

The reported condition calls for this action: Use event identifiers and idempotent execution with safe retry policy.

The current facts call for this action: use event identifiers and idempotent execution with safe retry policy.

Feedback loops can exhaust automated resources. The scenario does not present the alternate condition: a Lambda-based scanner is triggered recursively by writing its own report file. The proper immediate action is to use event identifiers and idempotent execution with safe retry policy.

Question 397

A patch bot automatically updates every kernel with no rollback verification. What is the appropriate security response for this scenario?

Use staged deployment, recovery image validation and health criteria.
Evaluate contextual impact and whitelist only verified required service flows.
Verify postpatch installed versions and exception inventory.
Require code review, scope tests and least-privileged execution.

Explanation

Correct Answer

Critical patching needs controlled failure recovery. The controlling fact is: A patch bot automatically updates every kernel with no rollback verification.

Incorrect Answers

The current facts call for this action: use staged deployment, recovery image validation and health criteria.

Job completion is not proof of effective remediation. The scenario does not present the alternate condition: a fleet patch report shows 100% successful jobs but several servers still run older package versions. The proper immediate action is to use staged deployment, recovery image validation and health criteria.

The reported condition calls for this action: Use staged deployment, recovery image validation and health criteria.

Question 398

A compliance scanner matches a CVE but the installed product version is not actually affected. What should the enterprise security architect or analyst do NEXT?

Incorporate exposure, exploit activity and asset impact.
Correlate CPE, package evidence and vendor advisories before remediation.
Pin applicable benchmarks and record version-specific deviations.
Adapt supported tests and preserve reliable assessment evidence.

Explanation

Correct Answer

Scanner detection requires platform/version confirmation. The controlling fact is: A compliance scanner matches a CVE but the installed product version is not actually affected.

Incorrect Answers

Incorporate exposure, exploit activity and asset impact would not correlate CPE, package evidence and vendor advisories.

Checklist results depend on evaluated requirements. The scenario does not present the alternate condition: an XCCDF compliance profile passes although the target uses a different benchmark version. The proper immediate action is to correlate CPE, package evidence and vendor advisories before remediation.

Adapt supported tests and preserve reliable assessment evidence would not correlate CPE, package evidence and vendor advisories.

Question 399

A SOAR playbook isolates high-value database hosts on a single low-confidence alert. Which action is MOST defensible given these facts?

Make actions conditional on current case state and idempotent.
Use audited service identities and approval records.
Require confidence, criticality and authorized human approval for disruptive actions.
Validate source confidence and expiry before enforcement.

Explanation

Correct Answer

High-impact containment needs a control gate. The controlling fact is: A SOAR playbook isolates high-value database hosts on a single low-confidence alert.

Incorrect Answers

Making actions conditional on current case state and idempotent would not require confidence, criticality and authorized human approval for disruptive actions.

The current facts call for this action: require confidence, criticality and authorized human approval for disruptive actions.

Validating source confidence and expiry would not require confidence, criticality and authorized human approval for disruptive actions.

Question 400

A PowerShell audit job uses a wildcard matching the wrong production tenant. Which action is the BEST response to the security requirement?

Use safe argument handling and avoid command interpretation of data.
Record parse failures and enforce schema validation.
Use a narrowly privileged service identity and restricted paths.
Validate explicit target scopes and dry-run high-impact operations.

Explanation

Correct Answer

Broad selectors make automation dangerous. The controlling fact is: A PowerShell audit job uses a wildcard matching the wrong production tenant.

Incorrect Answers

The reported condition calls for this action: Validate explicit target scopes and dry-run high-impact operations.

The current facts call for this action: validate explicit target scopes and dry-run high-impact operations.

Automated jobs should have minimum necessary rights. The scenario does not present the alternate condition: a scheduled cleanup task runs as root although it only archives user logs. The proper immediate action is to validate explicit target scopes and dry-run high-impact operations.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
CompTIA CAS-005 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA CAS-005 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA CAS-005 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)
CompTIA CAS-005 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 390

Explanation

Correct Answer

Incorrect Answers

Question 391

Explanation

Correct Answer

Incorrect Answers

Question 392

Explanation

Correct Answer

Incorrect Answers

Question 393

Explanation

Correct Answer

Incorrect Answers

Question 394

Explanation

Correct Answer

Incorrect Answers

Question 395

Explanation

Correct Answer

Incorrect Answers

Question 396

Explanation

Correct Answer

Incorrect Answers

Question 397

Explanation

Correct Answer

Incorrect Answers

Question 398

Explanation

Correct Answer

Incorrect Answers

Question 399

Explanation

Correct Answer

Incorrect Answers

Question 400

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests