CompTIA CAS-005 Practice Test 44

Question 430

A client accepts any valid certificate from the enterprise CA for an unrelated server. What should the enterprise security architect or analyst do NEXT?

Design controlled certificate replacement with safe maintenance windows.
Verify the intended server identity and certificate usage.
Issue unique client credentials and revoke the shared identity.
Require mutual workload identity and service-to-service authorization.

Explanation

Correct Answer

A trusted issuer is not a universal name match. The controlling fact is: A client accepts any valid certificate from the enterprise CA for an unrelated server.

Incorrect Answers

Designing controlled certificate replacement with safe maintenance windows would not verify the intended server identity and certificate usage.

Shared credentials defeat peer attribution. The scenario does not present the alternate condition: two mutually authenticated components share the same cloned client certificate. The proper immediate action is to verify the intended server identity and certificate usage.

Requiring mutual workload identity and service-to-service authorization would not verify the intended server identity and certificate usage.

Question 431

An engineer believes changing the TLS certificate each year automatically gives forward secrecy. Which action is MOST defensible given these facts?

Separate archived data key lifecycle from ephemeral transport sessions.
Protect or avoid storing session keys outside the negotiated session lifecycle.
Verify the negotiated ephemeral key exchange rather than certificate age.
Migrate to ephemeral key agreement supporting forward secrecy.

Explanation

Correct Answer

Certificate rotation is not equivalent to per-session secret derivation. The controlling fact is: An engineer believes changing the TLS certificate each year automatically gives forward secrecy.

Incorrect Answers

Separating archived data key lifecycle from ephemeral transport sessions would not verify the negotiated ephemeral key exchange rather than certificate age.

The current facts call for this action: verify the negotiated ephemeral key exchange rather than certificate age.

Migrating to ephemeral key agreement supporting forward secrecy would not verify the negotiated ephemeral key exchange rather than certificate age.

Question 432

A service needs limited calculations on encrypted inputs without decrypting them at the processor. Which action is the BEST response to the security requirement?

Consider approved secure multiparty computation for cross-party aggregation.
Assess access patterns, output leakage and auxiliary information.
Measure performance and consider a bounded offline processing model.
Evaluate the appropriate homomorphic encryption capability and performance cost.

Explanation

Correct Answer

Certain computations can be performed on ciphertext. The controlling fact is: A service needs limited calculations on encrypted inputs without decrypting them at the processor.

Incorrect Answers

The reported condition calls for this action: Evaluate the appropriate homomorphic encryption capability and performance cost.

The current facts call for this action: evaluate the appropriate homomorphic encryption capability and performance cost.

Advanced privacy techniques have operational trade-offs. The scenario does not present the alternate condition: secure computation is too slow for a strict online transaction latency budget. The proper immediate action is to evaluate the appropriate homomorphic encryption capability and performance cost.

Question 433

An application caches session secrets on a shared diagnostic filesystem. Which action is MOST defensible given these facts?

Protect or avoid storing session keys outside the negotiated session lifecycle.
Separate archived data key lifecycle from ephemeral transport sessions.
Migrate to ephemeral key agreement supporting forward secrecy.
Verify the negotiated ephemeral key exchange rather than certificate age.

Explanation

Correct Answer

Forward secrecy can be undermined by leaking session secrets. The controlling fact is: An application caches session secrets on a shared diagnostic filesystem.

Incorrect Answers

The current facts call for this action: protect or avoid storing session keys outside the negotiated session lifecycle.

Ephemeral session secrets limit retroactive exposure. The scenario does not present the alternate condition: a web server uses a static long-term key exchange and its certificate key is later stolen. The proper immediate action is to protect or avoid storing session keys outside the negotiated session lifecycle.

The reported condition calls for this action: Protect or avoid storing session keys outside the negotiated session lifecycle.

Question 434

A key custodian proposes emailing all split shares to one project mailbox for convenience. Which action is the BEST response to the security requirement?

Distribute custodians and test their availability under realistic outages.
Keep shares protected and independently controlled.
Use key splitting or threshold custody with independent authorized holders.
Enforce independent identities and quorum policy.

Explanation

Correct Answer

Combining shares defeats split-custody protection. The controlling fact is: A key custodian proposes emailing all split shares to one project mailbox for convenience.

Incorrect Answers

Distributing custodians and testing their availability under realistic outages would not keep shares protected and independently controlled.

No single person should unilaterally recover the root key. The scenario does not present the alternate condition: a company holds its root CA recovery secret with one contractor. The proper immediate action is to keep shares protected and independently controlled.

Enforcing independent identities and quorum policy would not keep shares protected and independently controlled.

Question 435

Two mutually authenticated components share the same cloned client certificate. Which control or decision MOST directly resolves the stated gap?

Require mutual workload identity and service-to-service authorization.
Verify the intended server identity and certificate usage.
Issue unique client credentials and revoke the shared identity.
Design controlled certificate replacement with safe maintenance windows.

Explanation

Correct Answer

Shared credentials defeat peer attribution. The controlling fact is: Two mutually authenticated components share the same cloned client certificate.

Incorrect Answers

Mutual authentication alone cannot distinguish the two components if they continue sharing the same cloned client certificate.

Verifying the server certificate checks the server, not the shared client identity used by both components.

A certificate-replacement schedule does not give the two components distinct client credentials or revoke the copied certificate.

Question 436

A device adds a routing label to a message that must be authenticated but remain visible. What is the appropriate security response for this scenario?

Use authenticated encryption with verified tags and nonce discipline.
Enforce unique nonces or use an approved misuse-resistant construction.
Reject unauthenticated ciphertext and report the integrity fault.
Include the label as associated authenticated data.

Explanation

Correct Answer

AEAD can integrity-protect metadata without encrypting it. The controlling fact is: A device adds a routing label to a message that must be authenticated but remain visible.

Incorrect Answers

The reported condition calls for this action: Include the label as associated authenticated data.

The current facts call for this action: include the label as associated authenticated data.

Failing open defeats authenticity guarantees. The scenario does not present the alternate condition: a decryptor ignores authentication tag failures to keep a service available. The proper immediate action is to include the label as associated authenticated data.

Question 437

A recovery region can retrieve ciphertext but not the key needed to unwrap data keys. What should the enterprise security architect or analyst do NEXT?

Design and test approved key availability for disaster recovery.
Use per-object data keys wrapped by a protected key-encryption key.
Separate encrypt and decrypt permissions by service purpose.
Distinguish wrapping-key rotation from explicit data re-encryption policy.

Explanation

Correct Answer

Data restoration requires access to valid cryptographic material. The controlling fact is: A recovery region can retrieve ciphertext but not the key needed to unwrap data keys.

Incorrect Answers

The current facts call for this action: design and test approved key availability for disaster recovery.

Key permissions should match the required operation. The scenario does not present the alternate condition: an employee role gains KMS decrypt access even though it only writes encrypted backups. The proper immediate action is to design and test approved key availability for disaster recovery.

The reported condition calls for this action: Design and test approved key availability for disaster recovery.

Question 438

Two peers cannot negotiate a supported hybrid key exchange because the load balancer strips unknown extensions. Which action is MOST defensible given these facts?

Plan hybrid migration to standardized postquantum key establishment where supported.
Test interoperable cryptographic negotiation end to end.
Prefer standardized reviewed algorithms and validate implementation provenance.
Evaluate standardized postquantum digital signatures in the lifecycle plan.

Explanation

Correct Answer

Transition failures may arise in intermediary equipment. The controlling fact is: Two peers cannot negotiate a supported hybrid key exchange because the load balancer strips unknown extensions.

Incorrect Answers

Planning hybrid migration to standardized postquantum key establishment where supported would not test interoperable cryptographic negotiation end to end.

Unreviewed cryptography can introduce serious design risks. The scenario does not present the alternate condition: a vendor says its new custom quantum-safe algorithm is secure but has no independent assessment. The proper immediate action is to test interoperable cryptographic negotiation end to end.

Evaluating standardized postquantum digital signatures in the lifecycle plan would not test interoperable cryptographic negotiation end to end.

Question 439

A team claims encrypted data processing prevents all metadata disclosure. Which action is the BEST response to the security requirement?

Measure performance and consider a bounded offline processing model.
Consider approved secure multiparty computation for cross-party aggregation.
Assess access patterns, output leakage and auxiliary information.
Evaluate the appropriate homomorphic encryption capability and performance cost.

Explanation

Correct Answer

Encryption of inputs does not eliminate every inference risk. The controlling fact is: A team claims encrypted data processing prevents all metadata disclosure.

Incorrect Answers

Measuring performance and consider a bounded offline processing model would not assess access patterns, output leakage and auxiliary information. Encryption of inputs does not eliminate every inference risk.

The current facts call for this action: assess access patterns, output leakage and auxiliary information.

Evaluating the appropriate homomorphic encryption capability and performance cost would not assess access patterns, output leakage and auxiliary information.

Question 440

A service must recover encrypted historical archives but deletes the only decryption key after each session. Which action is MOST defensible given these facts?

Verify the negotiated ephemeral key exchange rather than certificate age.
Protect or avoid storing session keys outside the negotiated session lifecycle.
Migrate to ephemeral key agreement supporting forward secrecy.
Separate archived data key lifecycle from ephemeral transport sessions.

Explanation

Correct Answer

Transport forward secrecy and durable data recovery have different needs. The controlling fact is: A service must recover encrypted historical archives but deletes the only decryption key after each session.

Incorrect Answers

The reported condition calls for this action: Separate archived data key lifecycle from ephemeral transport sessions.

The current facts call for this action: separate archived data key lifecycle from ephemeral transport sessions.

Ephemeral session secrets limit retroactive exposure. The scenario does not present the alternate condition: a web server uses a static long-term key exchange and its certificate key is later stolen. The proper immediate action is to separate archived data key lifecycle from ephemeral transport sessions.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)
CompTIA CAS-005 Practice Test 43 - 10 Questions (Last Reviewed 26-Sep-2026)
CompTIA CAS-005 Practice Test 44 - 10 Questions (Last Reviewed 25-Sep-2026)
CompTIA CAS-005 Practice Test 45 - 10 Questions (Last Reviewed 24-Sep-2026)
CompTIA CAS-005 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 430

Explanation

Correct Answer

Incorrect Answers

Question 431

Explanation

Correct Answer

Incorrect Answers

Question 432

Explanation

Correct Answer

Incorrect Answers

Question 433

Explanation

Correct Answer

Incorrect Answers

Question 434

Explanation

Correct Answer

Incorrect Answers

Question 435

Explanation

Correct Answer

Incorrect Answers

Question 436

Explanation

Correct Answer

Incorrect Answers

Question 437

Explanation

Correct Answer

Incorrect Answers

Question 438

Explanation

Correct Answer

Incorrect Answers

Question 439

Explanation

Correct Answer

Incorrect Answers

Question 440

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests