Pass Your CompTIA CAS-005 Exam Easy!

Applying data lifecycle approvals would not address the need for destroy the relevant approved keys and verify copies and snapshots.

Filesystem deletion does not ensure physical removal. The scenario does not present the alternate condition: a storage device exposes remnants in spare blocks after normal file deletion. The proper immediate action is to destroy the relevant approved keys and verify copies and snapshots.

Assessing lawful retention and key-based disposal options across copies would not address the need for destroy the relevant approved keys and verify copies and snapshots.

Destroy the relevant approved keys and verify copies and snapshots would not apply data lifecycle approvals.

The current facts call for this action: apply data lifecycle approvals before irreversible key destruction.

Assessing lawful retention and key-based disposal options across copies would not apply data lifecycle approvals.

The reported condition calls for this action: Assess reidentification risk and lawful processing before disclosure.

The current facts call for this action: assess reidentification risk and lawful processing before disclosure.

Encryption at rest does not protect separately exposed records. The scenario does not present the alternate condition: a database encrypts personal identifiers but logs their plaintext in application traces. The proper immediate action is to assess reidentification risk and lawful processing before disclosure.

The current facts call for this action: validate a digital signature and the signer's certificate chain.

Symmetric algorithms efficiently protect large data volumes. The scenario does not present the alternate condition: a high-volume archive needs efficient bulk encryption with controlled key distribution. The proper immediate action is to validate a digital signature and the signer's certificate chain.

The reported condition calls for this action: Validate a digital signature and the signer's certificate chain.

Validating trusted vendor signature as well as content integrity would not verify final artifact digest and signing at the release boundary.

Potential key disclosure undermines signature trust. The scenario does not present the alternate condition: a private signing key leaks through CI logs but no malicious release has been observed. The proper immediate action is to verify final artifact digest and signing at the release boundary.

Requiring verified code signature and trusted signing identity would not verify final artifact digest and signing at the release boundary.

Bind certificate acceptance to a trusted issuance and identity proofing process would not revoke its credential and enforce current authorization at the service.

The current facts call for this action: revoke its credential and enforce current authorization at the service.

Using short-lived purpose-bound tokens with replay protection would not revoke its credential and enforce current authorization at the service.

The reported condition calls for this action: Evaluate aggregation, reidentification risk and data-release thresholds.

The current facts call for this action: evaluate aggregation, reidentification risk and data-release thresholds.

Immutability can conflict with data minimization and erasure. The scenario does not present the alternate condition: a distributed ledger is proposed to prove every employee's attendance record while privacy rules demand deletion. The proper immediate action is to evaluate aggregation, reidentification risk and data-release thresholds.

The current facts call for this action: use approved media sanitization or suitable cryptographic erase procedures.

Data rights and immutability require planned lifecycle handling. The scenario does not present the alternate condition: an immutable backup keeps encrypted copies after a subject data-deletion request. The proper immediate action is to use approved media sanitization or suitable cryptographic erase procedures.

The reported condition calls for this action: Use approved media sanitization or suitable cryptographic erase procedures.

Assessing reidentification risk and lawful processing would not address the need for suppress plaintext log fields and review access to existing copies. Encryption at rest does not protect separately exposed records.

Tokens reduce exposure when their mapping vault is protected. The scenario does not present the alternate condition: a payment application must identify repeat customers without storing full card numbers in analytics. The proper immediate action is to suppress plaintext log fields and review access to existing copies.

Supplying synthetic or tokenized nonproduction fixtures would not address the need for suppress plaintext log fields and review access to existing copies. Encryption at rest does not protect separately exposed records.

Evaluating whether an immutable shared ledger is appropriate would not meet the need for suitable signed secure email and trusted recipient keys.

The current facts call for this action: use suitable signed secure email and trusted recipient keys.

Using individually attributable signed approvals and protected audit records would not meet the need for suitable signed secure email and trusted recipient keys.

The reported condition calls for this action: Use short-lived purpose-bound tokens with replay protection.

The current facts call for this action: use short-lived purpose-bound tokens with replay protection.

Possessing any key pair is not equivalent to enterprise identity. The scenario does not present the alternate condition: a corporate service uses user-uploaded self-signed certificates as proof of company employment. The proper immediate action is to use short-lived purpose-bound tokens with replay protection.