CompTIA CAS-005 Practice Test 45

Question 440

A service must recover encrypted historical archives but deletes the only decryption key after each session. Which action is MOST defensible given these facts?

Verify the negotiated ephemeral key exchange rather than certificate age.
Protect or avoid storing session keys outside the negotiated session lifecycle.
Migrate to ephemeral key agreement supporting forward secrecy.
Separate archived data key lifecycle from ephemeral transport sessions.

Explanation

Correct Answer

Transport forward secrecy and durable data recovery have different needs. The controlling fact is: A service must recover encrypted historical archives but deletes the only decryption key after each session.

Incorrect Answers

The reported condition calls for this action: Separate archived data key lifecycle from ephemeral transport sessions.

The current facts call for this action: separate archived data key lifecycle from ephemeral transport sessions.

Ephemeral session secrets limit retroactive exposure. The scenario does not present the alternate condition: a web server uses a static long-term key exchange and its certificate key is later stolen. The proper immediate action is to separate archived data key lifecycle from ephemeral transport sessions.

Question 441

Secure computation is too slow for a strict online transaction latency budget. Which action is the BEST response to the security requirement?

Measure performance and consider a bounded offline processing model.
Consider approved secure multiparty computation for cross-party aggregation.
Evaluate the appropriate homomorphic encryption capability and performance cost.
Assess access patterns, output leakage and auxiliary information.

Explanation

Correct Answer

Advanced privacy techniques have operational trade-offs. The controlling fact is: Secure computation is too slow for a strict online transaction latency budget.

Incorrect Answers

The current facts call for this action: measure performance and consider a bounded offline processing model.

Certain computations can be performed on ciphertext. The scenario does not present the alternate condition: a service needs limited calculations on encrypted inputs without decrypting them at the processor. The proper immediate action is to measure performance and consider a bounded offline processing model.

The reported condition calls for this action: Measure performance and consider a bounded offline processing model.

Question 442

A decryptor ignores authentication tag failures to keep a service available. Which control or decision MOST directly resolves the stated gap?

Use authenticated encryption with verified tags and nonce discipline.
Reject unauthenticated ciphertext and report the integrity fault.
Enforce unique nonces or use an approved misuse-resistant construction.
Include the label as associated authenticated data.

Explanation

Correct Answer

Failing open defeats authenticity guarantees. The controlling fact is: A decryptor ignores authentication tag failures to keep a service available.

Incorrect Answers

Using authenticated encryption with verified tags and nonce discipline would not reject unauthenticated ciphertext and report the integrity fault.

Nonce misuse can break encryption assurances. The scenario does not present the alternate condition: a developer reuses an AES-GCM nonce under the same key for thousands of records. The proper immediate action is to reject unauthenticated ciphertext and report the integrity fault.

Including the label as associated authenticated data would not reject unauthenticated ciphertext and report the integrity fault.

Question 443

A signed software-update process will need authenticity protection beyond long-term quantum threats. What is the appropriate security response for this scenario?

Plan hybrid migration to standardized postquantum key establishment where supported.
Prefer standardized reviewed algorithms and validate implementation provenance.
Evaluate standardized postquantum digital signatures in the lifecycle plan.
Test interoperable cryptographic negotiation end to end.

Explanation

Correct Answer

Key exchange and signature migration solve different problems. The controlling fact is: A signed software-update process will need authenticity protection beyond long-term quantum threats.

Incorrect Answers

Planning hybrid migration to standardized postquantum key establishment where supported would not meet the need for standardized postquantum digital signatures in the lifecycle plan.

The current facts call for this action: evaluate standardized postquantum digital signatures in the lifecycle plan.

Testing interoperable cryptographic negotiation end to end would not meet the need for standardized postquantum digital signatures in the lifecycle plan.

Question 444

An employee role gains KMS decrypt access even though it only writes encrypted backups. What should the enterprise security architect or analyst do NEXT?

Distinguish wrapping-key rotation from explicit data re-encryption policy.
Design and test approved key availability for disaster recovery.
Use per-object data keys wrapped by a protected key-encryption key.
Separate encrypt and decrypt permissions by service purpose.

Explanation

Correct Answer

Key permissions should match the required operation. The controlling fact is: An employee role gains KMS decrypt access even though it only writes encrypted backups.

Incorrect Answers

The reported condition calls for this action: Separate encrypt and decrypt permissions by service purpose.

The current facts call for this action: separate encrypt and decrypt permissions by service purpose.

Envelope design separates data encryption from root custody. The scenario does not present the alternate condition: a cloud service encrypts every object with the same directly stored root key. The proper immediate action is to separate encrypt and decrypt permissions by service purpose.

Question 445

An application is distributed from a public mirror and users need to verify publisher origin. Which action is the BEST response to the security requirement?

Require verified code signature and trusted signing identity.
Revoke or rotate the signing credential and audit issued artifacts.
Verify final artifact digest and signing at the release boundary.
Validate trusted vendor signature as well as content integrity.

Explanation

Correct Answer

Signatures bind the artifact to its authorized publisher. The controlling fact is: An application is distributed from a public mirror and users need to verify publisher origin.

Incorrect Answers

The current facts call for this action: require verified code signature and trusted signing identity.

Postsigning modifications break content integrity. The scenario does not present the alternate condition: a build system signs an artifact but later overwrites its bytes before upload. The proper immediate action is to require verified code signature and trusted signing identity.

The reported condition calls for this action: Require verified code signature and trusted signing identity.

Question 446

A payment application must identify repeat customers without storing full card numbers in analytics. Which control or decision MOST directly resolves the stated gap?

Supply synthetic or tokenized nonproduction fixtures.
Use approved tokens with access-controlled detokenization boundaries.
Assess reidentification risk and lawful processing before disclosure.
Suppress plaintext log fields and review access to existing copies.

Explanation

Correct Answer

Tokens reduce exposure when their mapping vault is protected. The controlling fact is: A payment application must identify repeat customers without storing full card numbers in analytics.

Incorrect Answers

Supplying synthetic or tokenized nonproduction fixtures would not meet the need for approved tokens with access-controlled detokenization boundaries.

Pseudonymization is not the same as anonymous data. The scenario does not present the alternate condition: an analyst claims pseudonymous identifiers can be published without privacy review. The proper immediate action is to use approved tokens with access-controlled detokenization boundaries.

Suppress plaintext log fields and review access to existing copies would not meet the need for approved tokens with access-controlled detokenization boundaries.

Question 447

A privileged portal must resist phishing and credential replay from stolen passwords. What is the appropriate security response for this scenario?

Use short-lived purpose-bound tokens with replay protection.
Bind certificate acceptance to a trusted issuance and identity proofing process.
Use phishing-resistant FIDO2/passkey authentication with secure enrollment.
Revoke its credential and enforce current authorization at the service.

Explanation

Correct Answer

Origin-bound authenticators resist common credential capture. The controlling fact is: A privileged portal must resist phishing and credential replay from stolen passwords.

Incorrect Answers

Using short-lived purpose-bound tokens with replay protection would not meet the need for phishing-resistant FIDO2/passkey authentication with secure enrollment.

The current facts call for this action: use phishing-resistant FIDO2/passkey authentication with secure enrollment.

Revoking its credential and enforcing current authorization at the service would not meet the need for phishing-resistant FIDO2/passkey authentication with secure enrollment.

Question 448

A procurement approver disputes a contract decision but records only show a shared account login. What should the enterprise security architect or analyst do NEXT?

Evaluate whether an immutable shared ledger is appropriate before deployment.
Use suitable signed secure email and trusted recipient keys.
Evaluate aggregation, reidentification risk and data-release thresholds.
Use individually attributable signed approvals and protected audit records.

Explanation

Correct Answer

Nonrepudiation depends on binding action to a specific principal. The controlling fact is: A procurement approver disputes a contract decision but records only show a shared account login.

Incorrect Answers

The reported condition calls for this action: Use individually attributable signed approvals and protected audit records.

The current facts call for this action: use individually attributable signed approvals and protected audit records.

Context can turn low-sensitivity datasets into personal information. The scenario does not present the alternate condition: an anonymous research dataset is later joined to small geographic groups and individuals can be inferred. The proper immediate action is to use individually attributable signed approvals and protected audit records.

Question 449

A high-volume archive needs efficient bulk encryption with controlled key distribution. Which action is MOST defensible given these facts?

Use vetted symmetric encryption with protected per-archive data keys.
Use a hybrid design encrypting content symmetrically and wrapping its key.
Validate a digital signature and the signer's certificate chain.
Select a reviewed lightweight or standard algorithm appropriate to constraints.

Explanation

Correct Answer

Symmetric algorithms efficiently protect large data volumes. The controlling fact is: A high-volume archive needs efficient bulk encryption with controlled key distribution.

Incorrect Answers

The current facts call for this action: use vetted symmetric encryption with protected per-archive data keys.

Public-key signatures support origin and integrity. The scenario does not present the alternate condition: a remote user must verify a document was signed by an authorized officer. The proper immediate action is to use vetted symmetric encryption with protected per-archive data keys.

The reported condition calls for this action: Use vetted symmetric encryption with protected per-archive data keys.

Question 450

Decommissioned encrypted drives retain valid keys in an accessible management vault. Which action is the BEST response to the security requirement?

Apply data lifecycle approvals before irreversible key destruction.
Destroy the relevant approved keys and verify copies and snapshots.
Use approved media sanitization or suitable cryptographic erase procedures.
Assess lawful retention and key-based disposal options across copies.

Explanation

Correct Answer

Cryptographic erasure relies on inaccessible key material. The controlling fact is: Decommissioned encrypted drives retain valid keys in an accessible management vault.

Incorrect Answers

Applying data lifecycle approvals would not address the need for destroy the relevant approved keys and verify copies and snapshots.

Filesystem deletion does not ensure physical removal. The scenario does not present the alternate condition: a storage device exposes remnants in spare blocks after normal file deletion. The proper immediate action is to destroy the relevant approved keys and verify copies and snapshots.

Assessing lawful retention and key-based disposal options across copies would not address the need for destroy the relevant approved keys and verify copies and snapshots.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 43 - 10 Questions (Last Reviewed 26-Sep-2026)
CompTIA CAS-005 Practice Test 44 - 10 Questions (Last Reviewed 25-Sep-2026)
CompTIA CAS-005 Practice Test 45 - 10 Questions (Last Reviewed 24-Sep-2026)
CompTIA CAS-005 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)
CompTIA CAS-005 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 440

Explanation

Correct Answer

Incorrect Answers

Question 441

Explanation

Correct Answer

Incorrect Answers

Question 442

Explanation

Correct Answer

Incorrect Answers

Question 443

Explanation

Correct Answer

Incorrect Answers

Question 444

Explanation

Correct Answer

Incorrect Answers

Question 445

Explanation

Correct Answer

Incorrect Answers

Question 446

Explanation

Correct Answer

Incorrect Answers

Question 447

Explanation

Correct Answer

Incorrect Answers

Question 448

Explanation

Correct Answer

Incorrect Answers

Question 449

Explanation

Correct Answer

Incorrect Answers

Question 450

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests