CompTIA CAS-005 Practice Test 41

Question 400

A PowerShell audit job uses a wildcard matching the wrong production tenant. Which action is the BEST response to the security requirement?

Use safe argument handling and avoid command interpretation of data.
Record parse failures and enforce schema validation.
Use a narrowly privileged service identity and restricted paths.
Validate explicit target scopes and dry-run high-impact operations.

Explanation

Correct Answer

Broad selectors make automation dangerous. The controlling fact is: A PowerShell audit job uses a wildcard matching the wrong production tenant.

Incorrect Answers

The reported condition calls for this action: Validate explicit target scopes and dry-run high-impact operations.

The current facts call for this action: validate explicit target scopes and dry-run high-impact operations.

Automated jobs should have minimum necessary rights. The scenario does not present the alternate condition: a scheduled cleanup task runs as root although it only archives user logs. The proper immediate action is to validate explicit target scopes and dry-run high-impact operations.

Question 401

A Bash log-parser pipes untrusted filenames into a shell command string. Which action is MOST defensible given these facts?

Use safe argument handling and avoid command interpretation of data.
Validate explicit target scopes and dry-run high-impact operations.
Use a narrowly privileged service identity and restricted paths.
Record parse failures and enforce schema validation.

Explanation

Correct Answer

Untrusted input can alter intended commands. The controlling fact is: A Bash log-parser pipes untrusted filenames into a shell command string.

Incorrect Answers

The current facts call for this action: use safe argument handling and avoid command interpretation of data.

Automated jobs should have minimum necessary rights. The scenario does not present the alternate condition: a scheduled cleanup task runs as root although it only archives user logs. The proper immediate action is to use safe argument handling and avoid command interpretation of data.

The reported condition calls for this action: Use safe argument handling and avoid command interpretation of data.

Question 402

A Lambda-based scanner is triggered recursively by writing its own report file. Which action is the BEST response to the security requirement?

Use event identifiers and idempotent execution with safe retry policy.
Separate event destinations and enforce recursion limits.
Use workload identity or a managed credential provider.
Gate rollout by asset criticality, testing and maintenance authorization.

Explanation

Correct Answer

Feedback loops can exhaust automated resources. The controlling fact is: A Lambda-based scanner is triggered recursively by writing its own report file.

Incorrect Answers

Using event identifiers and idempotent execution with safe retry policy would not separate event destinations and enforce recursion limits.

Automation secrets must not be embedded in source files. The scenario does not present the alternate condition: a cloud SDK's credentials are hardcoded in a public pipeline script. The proper immediate action is to separate event destinations and enforce recursion limits.

Gate rollout by asset criticality, testing and maintenance authorization would not separate event destinations and enforce recursion limits.

Question 403

An XCCDF compliance profile passes although the target uses a different benchmark version. Which control or decision MOST directly resolves the stated gap?

Incorporate exposure, exploit activity and asset impact.
Adapt supported tests and preserve reliable assessment evidence.
Pin applicable benchmarks and record version-specific deviations.
Correlate CPE, package evidence and vendor advisories before remediation.

Explanation

Correct Answer

Checklist results depend on evaluated requirements. The controlling fact is: An XCCDF compliance profile passes although the target uses a different benchmark version.

Incorrect Answers

Incorporate exposure, exploit activity and asset impact would not address the need for pin applicable benchmarks and record version-specific deviations.

The current facts call for this action: pin applicable benchmarks and record version-specific deviations.

Correlating CPE, package evidence and vendor advisories would not address the need for pin applicable benchmarks and record version-specific deviations.

Question 404

A fleet patch report shows 100% successful jobs but several servers still run older package versions. What is the appropriate security response for this scenario?

Use staged deployment, recovery image validation and health criteria.
Require code review, scope tests and least-privileged execution.
Evaluate contextual impact and whitelist only verified required service flows.
Verify postpatch installed versions and exception inventory.

Explanation

Correct Answer

Job completion is not proof of effective remediation. The controlling fact is: A fleet patch report shows 100% successful jobs but several servers still run older package versions.

Incorrect Answers

The reported condition calls for this action: Verify postpatch installed versions and exception inventory.

The current facts call for this action: verify postpatch installed versions and exception inventory.

Broad indicators can create collateral outages. The scenario does not present the alternate condition: an emergency rule automatically blocks an IP that is also an essential cloud provider endpoint. The proper immediate action is to verify postpatch installed versions and exception inventory.

Question 405

An enrichment playbook accepts unsigned indicators and blocks every listed address automatically. What should the enterprise security architect or analyst do NEXT?

Validate source confidence and expiry before enforcement.
Use audited service identities and approval records.
Require confidence, criticality and authorized human approval for disruptive actions.
Make actions conditional on current case state and idempotent.

Explanation

Correct Answer

Untrusted intelligence should not become immediate denial policy. The controlling fact is: An enrichment playbook accepts unsigned indicators and blocks every listed address automatically.

Incorrect Answers

The current facts call for this action: validate source confidence and expiry before enforcement.

High-impact containment needs a control gate. The scenario does not present the alternate condition: a SOAR playbook isolates high-value database hosts on a single low-confidence alert. The proper immediate action is to validate source confidence and expiry before enforcement.

The reported condition calls for this action: Validate source confidence and expiry before enforcement.

Question 406

IaC reviews trust a generated plan without checking the actual provider account target. Which action is MOST defensible given these facts?

Use idempotent state reconciliation and serialized conflicting writes.
Bind deployment approval to workspace, account and resource scope.
Fail closed on validation and expose meaningful deployment status.
Correct and gate the infrastructure code in addition to running rollback.

Explanation

Correct Answer

Infrastructure automation must verify where changes apply. The controlling fact is: IaC reviews trust a generated plan without checking the actual provider account target.

Incorrect Answers

Using idempotent state reconciliation and serialized conflicting writes would not address the need for bind deployment approval to workspace, account and resource scope.

Automation should not convert errors into compliance evidence. The scenario does not present the alternate condition: a configuration script silently ignores failed controls but reports the server compliant. The proper immediate action is to bind deployment approval to workspace, account and resource scope.

Correcting and gate the infrastructure code in addition to running rollback would not address the need for bind deployment approval to workspace, account and resource scope.

Question 407

A Python parser quietly discards events when source fields are missing. What should the enterprise security architect or analyst do NEXT?

Validate explicit target scopes and dry-run high-impact operations.
Use safe argument handling and avoid command interpretation of data.
Record parse failures and enforce schema validation.
Use a narrowly privileged service identity and restricted paths.

Explanation

Correct Answer

Silent ingestion loss degrades security evidence. The controlling fact is: A Python parser quietly discards events when source fields are missing.

Incorrect Answers

Validating explicit target scopes and dry-run high-impact operations would not record parse failures and enforce schema validation.

The current facts call for this action: record parse failures and enforce schema validation.

Using a narrowly privileged service identity and restricted paths would not record parse failures and enforce schema validation.

Question 408

A token-revocation runbook succeeds technically but lacks operator attribution. Which action is MOST defensible given these facts?

Require confidence, criticality and authorized human approval for disruptive actions.
Validate source confidence and expiry before enforcement.
Make actions conditional on current case state and idempotent.
Use audited service identities and approval records.

Explanation

Correct Answer

Orchestration actions require accountability. The controlling fact is: A token-revocation runbook succeeds technically but lacks operator attribution.

Incorrect Answers

The reported condition calls for this action: Use audited service identities and approval records.

The current facts call for this action: use audited service identities and approval records.

Stale workflow events should not trigger inconsistent response. The scenario does not present the alternate condition: a case-closing playbook runs investigation tasks after the case was already archived. The proper immediate action is to use audited service identities and approval records.

Question 409

An emergency rule automatically blocks an IP that is also an essential cloud provider endpoint. Which action is the BEST response to the security requirement?

Evaluate contextual impact and whitelist only verified required service flows.
Verify postpatch installed versions and exception inventory.
Use staged deployment, recovery image validation and health criteria.
Require code review, scope tests and least-privileged execution.

Explanation

Correct Answer

Broad indicators can create collateral outages. The controlling fact is: An emergency rule automatically blocks an IP that is also an essential cloud provider endpoint.

Incorrect Answers

The current facts call for this action: evaluate contextual impact and whitelist only verified required service flows.

Critical patching needs controlled failure recovery. The scenario does not present the alternate condition: a patch bot automatically updates every kernel with no rollback verification. The proper immediate action is to evaluate contextual impact and whitelist only verified required service flows.

The reported condition calls for this action: Evaluate contextual impact and whitelist only verified required service flows.

Question 410

An OVAL rule fails because the device stores configuration in a vendor-specific path. Which control or decision MOST directly resolves the stated gap?

Pin applicable benchmarks and record version-specific deviations.
Adapt supported tests and preserve reliable assessment evidence.
Incorporate exposure, exploit activity and asset impact.
Correlate CPE, package evidence and vendor advisories before remediation.

Explanation

Correct Answer

Automated content must match the platform being evaluated. The controlling fact is: An OVAL rule fails because the device stores configuration in a vendor-specific path.

Incorrect Answers

Pin applicable benchmarks and record version-specific deviations would not address the need for adapt supported tests and preserve reliable assessment evidence.

Base severity is not the entire operational risk. The scenario does not present the alternate condition: a report ranks a public exploit as low priority solely because base CVSS is moderate. The proper immediate action is to adapt supported tests and preserve reliable assessment evidence.

Correlating CPE, package evidence and vendor advisories would not address the need for adapt supported tests and preserve reliable assessment evidence.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA CAS-005 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA CAS-005 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)
CompTIA CAS-005 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)
CompTIA CAS-005 Practice Test 43 - 10 Questions (Last Reviewed 26-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 400

Explanation

Correct Answer

Incorrect Answers

Question 401

Explanation

Correct Answer

Incorrect Answers

Question 402

Explanation

Correct Answer

Incorrect Answers

Question 403

Explanation

Correct Answer

Incorrect Answers

Question 404

Explanation

Correct Answer

Incorrect Answers

Question 405

Explanation

Correct Answer

Incorrect Answers

Question 406

Explanation

Correct Answer

Incorrect Answers

Question 407

Explanation

Correct Answer

Incorrect Answers

Question 408

Explanation

Correct Answer

Incorrect Answers

Question 409

Explanation

Correct Answer

Incorrect Answers

Question 410

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests