CompTIA CAS-005 Practice Test 42

Question 410

An OVAL rule fails because the device stores configuration in a vendor-specific path. Which control or decision MOST directly resolves the stated gap?

Pin applicable benchmarks and record version-specific deviations.
Adapt supported tests and preserve reliable assessment evidence.
Incorporate exposure, exploit activity and asset impact.
Correlate CPE, package evidence and vendor advisories before remediation.

Explanation

Correct Answer

Automated content must match the platform being evaluated. The controlling fact is: An OVAL rule fails because the device stores configuration in a vendor-specific path.

Incorrect Answers

Pin applicable benchmarks and record version-specific deviations would not address the need for adapt supported tests and preserve reliable assessment evidence.

Base severity is not the entire operational risk. The scenario does not present the alternate condition: a report ranks a public exploit as low priority solely because base CVSS is moderate. The proper immediate action is to adapt supported tests and preserve reliable assessment evidence.

Correlating CPE, package evidence and vendor advisories would not address the need for adapt supported tests and preserve reliable assessment evidence.

Question 411

Two automation jobs race to alter the same firewall object and cause oscillation. What is the appropriate security response for this scenario?

Bind deployment approval to workspace, account and resource scope.
Correct and gate the infrastructure code in addition to running rollback.
Use idempotent state reconciliation and serialized conflicting writes.
Fail closed on validation and expose meaningful deployment status.

Explanation

Correct Answer

Race conditions can defeat intended policy. The controlling fact is: Two automation jobs race to alter the same firewall object and cause oscillation.

Incorrect Answers

Bind deployment approval to workspace, account and resource scope would not meet the need for idempotent state reconciliation and serialized conflicting writes.

The current facts call for this action: use idempotent state reconciliation and serialized conflicting writes.

Fail closed on validation and expose meaningful deployment status would not meet the need for idempotent state reconciliation and serialized conflicting writes.

Question 412

A cloud SDK's credentials are hardcoded in a public pipeline script. What should the enterprise security architect or analyst do NEXT?

Gate rollout by asset criticality, testing and maintenance authorization.
Separate event destinations and enforce recursion limits.
Use event identifiers and idempotent execution with safe retry policy.
Use workload identity or a managed credential provider.

Explanation

Correct Answer

Automation secrets must not be embedded in source files. The controlling fact is: A cloud SDK's credentials are hardcoded in a public pipeline script.

Incorrect Answers

The reported condition calls for this action: Use workload identity or a managed credential provider.

The current facts call for this action: use workload identity or a managed credential provider.

At-least-once event delivery must not multiply destructive actions. The scenario does not present the alternate condition: a cloud webhook retries after a timeout and a containment job runs twice. The proper immediate action is to use workload identity or a managed credential provider.

Question 413

A configuration script silently ignores failed controls but reports the server compliant. What is the appropriate security response for this scenario?

Fail closed on validation and expose meaningful deployment status.
Correct and gate the infrastructure code in addition to running rollback.
Bind deployment approval to workspace, account and resource scope.
Use idempotent state reconciliation and serialized conflicting writes.

Explanation

Correct Answer

Automation should not convert errors into compliance evidence. The controlling fact is: A configuration script silently ignores failed controls but reports the server compliant.

Incorrect Answers

The current facts call for this action: fail closed on validation and expose meaningful deployment status.

Infrastructure automation must verify where changes apply. The scenario does not present the alternate condition: iaC reviews trust a generated plan without checking the actual provider account target. The proper immediate action is to fail closed on validation and expose meaningful deployment status.

The reported condition calls for this action: Fail closed on validation and expose meaningful deployment status.

Question 414

An event-based patch workflow runs on untested critical assets whenever a new advisory appears. What should the enterprise security architect or analyst do NEXT?

Use workload identity or a managed credential provider.
Gate rollout by asset criticality, testing and maintenance authorization.
Use event identifiers and idempotent execution with safe retry policy.
Separate event destinations and enforce recursion limits.

Explanation

Correct Answer

Event triggers must respect operational change controls. The controlling fact is: An event-based patch workflow runs on untested critical assets whenever a new advisory appears.

Incorrect Answers

Using workload identity or a managed credential provider would not address the need for gate rollout by asset criticality, testing and maintenance authorization.

At-least-once event delivery must not multiply destructive actions. The scenario does not present the alternate condition: a cloud webhook retries after a timeout and a containment job runs twice. The proper immediate action is to gate rollout by asset criticality, testing and maintenance authorization.

Separating event destinations and enforcing recursion limits would not address the need for gate rollout by asset criticality, testing and maintenance authorization.

Question 415

Generative AI writes a remediation script that has never been reviewed for destructive commands. Which action is MOST defensible given these facts?

Evaluate contextual impact and whitelist only verified required service flows.
Use staged deployment, recovery image validation and health criteria.
Require code review, scope tests and least-privileged execution.
Verify postpatch installed versions and exception inventory.

Explanation

Correct Answer

AI-generated automation is not automatically safe. The controlling fact is: Generative AI writes a remediation script that has never been reviewed for destructive commands.

Incorrect Answers

Evaluating contextual impact and whitelist only verified required service flows would not require code review, scope tests and least-privileged execution.

The current facts call for this action: require code review, scope tests and least-privileged execution.

Verifying postpatch installed versions and exception inventory would not require code review, scope tests and least-privileged execution.

Question 416

A report ranks a public exploit as low priority solely because base CVSS is moderate. Which action is the BEST response to the security requirement?

Pin applicable benchmarks and record version-specific deviations.
Correlate CPE, package evidence and vendor advisories before remediation.
Adapt supported tests and preserve reliable assessment evidence.
Incorporate exposure, exploit activity and asset impact.

Explanation

Correct Answer

Base severity is not the entire operational risk. The controlling fact is: A report ranks a public exploit as low priority solely because base CVSS is moderate.

Incorrect Answers

The reported condition calls for this action: Incorporate exposure, exploit activity and asset impact.

The current facts call for this action: incorporate exposure, exploit activity and asset impact.

Automated content must match the platform being evaluated. The scenario does not present the alternate condition: an OVAL rule fails because the device stores configuration in a vendor-specific path. The proper immediate action is to incorporate exposure, exploit activity and asset impact.

Question 417

A scheduled cleanup task runs as root although it only archives user logs. Which control or decision MOST directly resolves the stated gap?

Use a narrowly privileged service identity and restricted paths.
Validate explicit target scopes and dry-run high-impact operations.
Record parse failures and enforce schema validation.
Use safe argument handling and avoid command interpretation of data.

Explanation

Correct Answer

Automated jobs should have minimum necessary rights. The controlling fact is: A scheduled cleanup task runs as root although it only archives user logs.

Incorrect Answers

The current facts call for this action: use a narrowly privileged service identity and restricted paths.

Silent ingestion loss degrades security evidence. The scenario does not present the alternate condition: a Python parser quietly discards events when source fields are missing. The proper immediate action is to use a narrowly privileged service identity and restricted paths.

The reported condition calls for this action: Use a narrowly privileged service identity and restricted paths.

Question 418

A case-closing playbook runs investigation tasks after the case was already archived. What is the appropriate security response for this scenario?

Require confidence, criticality and authorized human approval for disruptive actions.
Make actions conditional on current case state and idempotent.
Use audited service identities and approval records.
Validate source confidence and expiry before enforcement.

Explanation

Correct Answer

Stale workflow events should not trigger inconsistent response. The controlling fact is: A case-closing playbook runs investigation tasks after the case was already archived.

Incorrect Answers

Requiring confidence, criticality and authorized human approval for disruptive actions would not make actions conditional on current case state and idempotent.

Orchestration actions require accountability. The scenario does not present the alternate condition: a token-revocation runbook succeeds technically but lacks operator attribution. The proper immediate action is to make actions conditional on current case state and idempotent.

Validating source confidence and expiry would not make actions conditional on current case state and idempotent.

Question 419

A long-term confidential archive uses only conventional public-key exchange with a 20-year secrecy requirement. Which action is MOST defensible given these facts?

Test interoperable cryptographic negotiation end to end.
Prefer standardized reviewed algorithms and validate implementation provenance.
Plan hybrid migration to standardized postquantum key establishment where supported.
Evaluate standardized postquantum digital signatures in the lifecycle plan.

Explanation

Correct Answer

Harvest-now-decrypt-later risk concerns long-lived confidentiality. The controlling fact is: A long-term confidential archive uses only conventional public-key exchange with a 20-year secrecy requirement.

Incorrect Answers

Testing interoperable cryptographic negotiation end to end would not plan hybrid migration to standardized postquantum key establishment where supported.

The current facts call for this action: plan hybrid migration to standardized postquantum key establishment where supported.

Evaluating standardized postquantum digital signatures in the lifecycle plan would not plan hybrid migration to standardized postquantum key establishment where supported.

Question 420

A storage service encrypts fields but attackers can modify ciphertext without detection. Which action is the BEST response to the security requirement?

Enforce unique nonces or use an approved misuse-resistant construction.
Include the label as associated authenticated data.
Reject unauthenticated ciphertext and report the integrity fault.
Use authenticated encryption with verified tags and nonce discipline.

Explanation

Correct Answer

Confidentiality alone does not prevent unauthorized modification. The controlling fact is: A storage service encrypts fields but attackers can modify ciphertext without detection.

Incorrect Answers

The reported condition calls for this action: Use authenticated encryption with verified tags and nonce discipline.

The current facts call for this action: use authenticated encryption with verified tags and nonce discipline.

Failing open defeats authenticity guarantees. The scenario does not present the alternate condition: a decryptor ignores authentication tag failures to keep a service available. The proper immediate action is to use authenticated encryption with verified tags and nonce discipline.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA CAS-005 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)
CompTIA CAS-005 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)
CompTIA CAS-005 Practice Test 43 - 10 Questions (Last Reviewed 26-Sep-2026)
CompTIA CAS-005 Practice Test 44 - 10 Questions (Last Reviewed 25-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 410

Explanation

Correct Answer

Incorrect Answers

Question 411

Explanation

Correct Answer

Incorrect Answers

Question 412

Explanation

Correct Answer

Incorrect Answers

Question 413

Explanation

Correct Answer

Incorrect Answers

Question 414

Explanation

Correct Answer

Incorrect Answers

Question 415

Explanation

Correct Answer

Incorrect Answers

Question 416

Explanation

Correct Answer

Incorrect Answers

Question 417

Explanation

Correct Answer

Incorrect Answers

Question 418

Explanation

Correct Answer

Incorrect Answers

Question 419

Explanation

Correct Answer

Incorrect Answers

Question 420

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests