CompTIA CAS-005 Practice Test 47

Question 460

A password reset form sends one-time links without expiration or audience binding. Which control or decision MOST directly resolves the stated gap?

Use phishing-resistant FIDO2/passkey authentication with secure enrollment.
Revoke its credential and enforce current authorization at the service.
Bind certificate acceptance to a trusted issuance and identity proofing process.
Use short-lived purpose-bound tokens with replay protection.

Explanation

Correct Answer

Credential recovery links are authentication secrets. The controlling fact is: A password reset form sends one-time links without expiration or audience binding.

Incorrect Answers

The reported condition calls for this action: Use short-lived purpose-bound tokens with replay protection.

The current facts call for this action: use short-lived purpose-bound tokens with replay protection.

Possessing any key pair is not equivalent to enterprise identity. The scenario does not present the alternate condition: a corporate service uses user-uploaded self-signed certificates as proof of company employment. The proper immediate action is to use short-lived purpose-bound tokens with replay protection.

Question 461

A service uses bare asymmetric encryption for multi-gigabyte files and performance is poor. What is the appropriate security response for this scenario?

Use a hybrid design encrypting content symmetrically and wrapping its key.
Use vetted symmetric encryption with protected per-archive data keys.
Select a reviewed lightweight or standard algorithm appropriate to constraints.
Validate a digital signature and the signer's certificate chain.

Explanation

Correct Answer

Asymmetric mechanisms are poorly suited to bulk data encryption. The controlling fact is: A service uses bare asymmetric encryption for multi-gigabyte files and performance is poor.

Incorrect Answers

The current facts call for this action: use a hybrid design encrypting content symmetrically and wrapping its key.

Constrained devices still need cryptographic assurance. The scenario does not present the alternate condition: an application uses an obsolete homegrown block cipher for low-power sensors. The proper immediate action is to use a hybrid design encrypting content symmetrically and wrapping its key.

The reported condition calls for this action: Use a hybrid design encrypting content symmetrically and wrapping its key.

Question 462

A private signing key leaks through CI logs but no malicious release has been observed. What should the enterprise security architect or analyst do NEXT?

Require verified code signature and trusted signing identity.
Revoke or rotate the signing credential and audit issued artifacts.
Verify final artifact digest and signing at the release boundary.
Validate trusted vendor signature as well as content integrity.

Explanation

Correct Answer

Potential key disclosure undermines signature trust. The controlling fact is: A private signing key leaks through CI logs but no malicious release has been observed.

Incorrect Answers

Requiring verified code signature and trusted signing identity would not revoke or rotate the signing credential and audit issued artifacts.

Postsigning modifications break content integrity. The scenario does not present the alternate condition: a build system signs an artifact but later overwrites its bytes before upload. The proper immediate action is to revoke or rotate the signing credential and audit issued artifacts.

Validating trusted vendor signature as well as content integrity would not revoke or rotate the signing credential and audit issued artifacts.

Question 463

An immutable backup keeps encrypted copies after a subject data-deletion request. What is the appropriate security response for this scenario?

Apply data lifecycle approvals before irreversible key destruction.
Destroy the relevant approved keys and verify copies and snapshots.
Assess lawful retention and key-based disposal options across copies.
Use approved media sanitization or suitable cryptographic erase procedures.

Explanation

Correct Answer

Data rights and immutability require planned lifecycle handling. The controlling fact is: An immutable backup keeps encrypted copies after a subject data-deletion request.

Incorrect Answers

Applying data lifecycle approvals would not assess lawful retention and key-based disposal options across copies.

The current facts call for this action: assess lawful retention and key-based disposal options across copies.

Using approved media sanitization or suitable cryptographic erase procedures would not assess lawful retention and key-based disposal options across copies.

Question 464

A distributed ledger is proposed to prove every employee's attendance record while privacy rules demand deletion. What should the enterprise security architect or analyst do NEXT?

Use individually attributable signed approvals and protected audit records.
Evaluate aggregation, reidentification risk and data-release thresholds.
Use suitable signed secure email and trusted recipient keys.
Evaluate whether an immutable shared ledger is appropriate before deployment.

Explanation

Correct Answer

Immutability can conflict with data minimization and erasure. The controlling fact is: A distributed ledger is proposed to prove every employee's attendance record while privacy rules demand deletion.

Incorrect Answers

The reported condition calls for this action: Evaluate whether an immutable shared ledger is appropriate before deployment.

The current facts call for this action: evaluate whether an immutable shared ledger is appropriate before deployment.

Confidentiality and origin assurance are distinct services. The scenario does not present the alternate condition: an encrypted message must be verifiable by its recipient without exposing it to public observers. The proper immediate action is to evaluate whether an immutable shared ledger is appropriate before deployment.

Question 465

A firmware image is hashed but delivered without authentic origin evidence. Which action is MOST defensible given these facts?

Validate trusted vendor signature as well as content integrity.
Revoke or rotate the signing credential and audit issued artifacts.
Require verified code signature and trusted signing identity.
Verify final artifact digest and signing at the release boundary.

Explanation

Correct Answer

A hash alone is not proof of who supplied bytes. The controlling fact is: A firmware image is hashed but delivered without authentic origin evidence.

Incorrect Answers

The current facts call for this action: validate trusted vendor signature as well as content integrity.

Signatures bind the artifact to its authorized publisher. The scenario does not present the alternate condition: an application is distributed from a public mirror and users need to verify publisher origin. The proper immediate action is to validate trusted vendor signature as well as content integrity.

The reported condition calls for this action: Validate trusted vendor signature as well as content integrity.

Question 466

An application uses an obsolete homegrown block cipher for low-power sensors. Which action is the BEST response to the security requirement?

Use a hybrid design encrypting content symmetrically and wrapping its key.
Select a reviewed lightweight or standard algorithm appropriate to constraints.
Validate a digital signature and the signer's certificate chain.
Use vetted symmetric encryption with protected per-archive data keys.

Explanation

Correct Answer

Constrained devices still need cryptographic assurance. The controlling fact is: An application uses an obsolete homegrown block cipher for low-power sensors.

Incorrect Answers

Using a hybrid design encrypting content symmetrically and wrapping its key would not meet the need for a reviewed lightweight or standard algorithm appropriate to constraints.

Public-key signatures support origin and integrity. The scenario does not present the alternate condition: a remote user must verify a document was signed by an authorized officer. The proper immediate action is to select a reviewed lightweight or standard algorithm appropriate to constraints.

Using vetted symmetric encryption with protected per-archive data keys would not meet the need for a reviewed lightweight or standard algorithm appropriate to constraints.

Question 467

A development team requests live payment details for integration tests. Which control or decision MOST directly resolves the stated gap?

Suppress plaintext log fields and review access to existing copies.
Use approved tokens with access-controlled detokenization boundaries.
Supply synthetic or tokenized nonproduction fixtures.
Assess reidentification risk and lawful processing before disclosure.

Explanation

Correct Answer

Testing should not require actual customer secrets. The controlling fact is: A development team requests live payment details for integration tests.

Incorrect Answers

Suppress plaintext log fields and review access to existing copies would not supply synthetic or tokenized nonproduction fixtures.

The current facts call for this action: supply synthetic or tokenized nonproduction fixtures.

Assessing reidentification risk and lawful processing would not supply synthetic or tokenized nonproduction fixtures.

Question 468

A corporate service uses user-uploaded self-signed certificates as proof of company employment. What is the appropriate security response for this scenario?

Use short-lived purpose-bound tokens with replay protection.
Revoke its credential and enforce current authorization at the service.
Use phishing-resistant FIDO2/passkey authentication with secure enrollment.
Bind certificate acceptance to a trusted issuance and identity proofing process.

Explanation

Correct Answer

Possessing any key pair is not equivalent to enterprise identity. The controlling fact is: A corporate service uses user-uploaded self-signed certificates as proof of company employment.

Incorrect Answers

The reported condition calls for this action: Bind certificate acceptance to a trusted issuance and identity proofing process.

The current facts call for this action: bind certificate acceptance to a trusted issuance and identity proofing process.

Origin-bound authenticators resist common credential capture. The scenario does not present the alternate condition: a privileged portal must resist phishing and credential replay from stolen passwords. The proper immediate action is to bind certificate acceptance to a trusted issuance and identity proofing process.

Question 469

A broad regex triggers on every normal administrative PowerShell script. Which action is MOST defensible given these facts?

Tighten the pattern and retest benign and malicious examples.
Evaluate precision and recall on representative datasets before tuning.
Repair telemetry coverage and test true-positive detection.
Provide source evidence, entity context and reconstruction links.

Explanation

Correct Answer

Rule specificity affects false positives. The controlling fact is: A broad regex triggers on every normal administrative PowerShell script.

Incorrect Answers

The current facts call for this action: tighten the pattern and retest benign and malicious examples.

False negatives can arise before rule logic. The scenario does not present the alternate condition: a detector never alerts on known adversary emulation because a required log field was dropped. The proper immediate action is to tighten the pattern and retest benign and malicious examples.

The reported condition calls for this action: Tighten the pattern and retest benign and malicious examples.

Question 470

Executives are shown the number of closed incidents but not whether critical asset dwell time fell. Which action is the BEST response to the security requirement?

Link effectiveness to test evidence, exceptions and time.
Report outcome measures such as detection and response latency by severity.
Measure telemetry coverage by live and recovery environments.
Normalize asset identifiers and reconcile duplicated CVEs.

Explanation

Correct Answer

Activity counts alone do not prove resilience. The controlling fact is: Executives are shown the number of closed incidents but not whether critical asset dwell time fell.

Incorrect Answers

Link effectiveness to test evidence, exceptions and time would not report outcome measures such as detection and response latency by severity.

Operational readiness must include failover observability. The scenario does not present the alternate condition: the SIEM marks an entire site covered even though its standby network forwards no logs. The proper immediate action is to report outcome measures such as detection and response latency by severity.

Normalizing asset identifiers and reconciling duplicated CVEs would not report outcome measures such as detection and response latency by severity.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 45 - 10 Questions (Last Reviewed 24-Sep-2026)
CompTIA CAS-005 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)
CompTIA CAS-005 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)
CompTIA CAS-005 Practice Test 48 - 10 Questions (Last Reviewed 21-Sep-2026)
CompTIA CAS-005 Practice Test 49 - 10 Questions (Last Reviewed 20-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 460

Explanation

Correct Answer

Incorrect Answers

Question 461

Explanation

Correct Answer

Incorrect Answers

Question 462

Explanation

Correct Answer

Incorrect Answers

Question 463

Explanation

Correct Answer

Incorrect Answers

Question 464

Explanation

Correct Answer

Incorrect Answers

Question 465

Explanation

Correct Answer

Incorrect Answers

Question 466

Explanation

Correct Answer

Incorrect Answers

Question 467

Explanation

Correct Answer

Incorrect Answers

Question 468

Explanation

Correct Answer

Incorrect Answers

Question 469

Explanation

Correct Answer

Incorrect Answers

Question 470

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests