Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Use authenticated encryption with verified tags and nonce discipline.

The current facts call for this action: use authenticated encryption with verified tags and nonce discipline.

Failing open defeats authenticity guarantees. The scenario does not present the alternate condition: a decryptor ignores authentication tag failures to keep a service available. The proper immediate action is to use authenticated encryption with verified tags and nonce discipline.

The current facts call for this action: require mutual workload identity and service-to-service authorization.

Mutual authentication depends on executable credential lifecycle. The scenario does not present the alternate condition: a medical device cannot rotate its certificate because it only supports manual firmware updates. The proper immediate action is to require mutual workload identity and service-to-service authorization.

The reported condition calls for this action: Require mutual workload identity and service-to-service authorization.

Separating archived data key lifecycle from ephemeral transport sessions would not migrate to ephemeral key agreement supporting forward secrecy.

Certificate rotation is not equivalent to per-session secret derivation. The scenario does not present the alternate condition: an engineer believes changing the TLS certificate each year automatically gives forward secrecy. The proper immediate action is to migrate to ephemeral key agreement supporting forward secrecy.

The reported condition calls for this action: Migrate to ephemeral key agreement supporting forward secrecy.

Measuring performance and consider a bounded offline processing model would not address the need for consider approved secure multiparty computation for cross-party aggregation.

The current facts call for this action: consider approved secure multiparty computation for cross-party aggregation.

Evaluating the appropriate homomorphic encryption capability and performance cost would not address the need for consider approved secure multiparty computation for cross-party aggregation.

The reported condition calls for this action: Use key splitting or threshold custody with independent authorized holders.

The current facts call for this action: use key splitting or threshold custody with independent authorized holders.

Threshold arrangements can still fail from correlated unavailability. The scenario does not present the alternate condition: a disaster drill finds three required key shareholders all work in the same inaccessible building. The proper immediate action is to use key splitting or threshold custody with independent authorized holders.

The current facts call for this action: use per-object data keys wrapped by a protected key-encryption key.

Data restoration requires access to valid cryptographic material. The scenario does not present the alternate condition: a recovery region can retrieve ciphertext but not the key needed to unwrap data keys. The proper immediate action is to use per-object data keys wrapped by a protected key-encryption key.

The reported condition calls for this action: Use per-object data keys wrapped by a protected key-encryption key.

Planning hybrid migration to standardized postquantum key establishment where supported would not address the need for prefer standardized reviewed algorithms and validate implementation provenance.

Key exchange and signature migration solve different problems. The scenario does not present the alternate condition: a signed software-update process will need authenticity protection beyond long-term quantum threats. The proper immediate action is to prefer standardized reviewed algorithms and validate implementation provenance.

Testing interoperable cryptographic negotiation end to end would not address the need for prefer standardized reviewed algorithms and validate implementation provenance.

Separating encrypt and decrypt permissions by service purpose would not distinguish wrapping-key rotation from explicit data re-encryption policy.

The current facts call for this action: distinguish wrapping-key rotation from explicit data re-encryption policy.

Using per-object data keys wrapped by a protected key-encryption key would not distinguish wrapping-key rotation from explicit data re-encryption policy.

The reported condition calls for this action: Enforce unique nonces or use an approved misuse-resistant construction.

The current facts call for this action: enforce unique nonces or use an approved misuse-resistant construction.

AEAD can integrity-protect metadata without encrypting it. The scenario does not present the alternate condition: a device adds a routing label to a message that must be authenticated but remain visible. The proper immediate action is to enforce unique nonces or use an approved misuse-resistant construction.

The current facts call for this action: distribute custodians and test their availability under realistic outages.

No single person should unilaterally recover the root key. The scenario does not present the alternate condition: a company holds its root CA recovery secret with one contractor. The proper immediate action is to distribute custodians and test their availability under realistic outages.

The reported condition calls for this action: Distribute custodians and test their availability under realistic outages.

Designing controlled certificate replacement with safe maintenance windows would not verify the intended server identity and certificate usage.

Shared credentials defeat peer attribution. The scenario does not present the alternate condition: two mutually authenticated components share the same cloned client certificate. The proper immediate action is to verify the intended server identity and certificate usage.

Requiring mutual workload identity and service-to-service authorization would not verify the intended server identity and certificate usage.