CompTIA CAS-005 Practice Test 48

Question 470

Executives are shown the number of closed incidents but not whether critical asset dwell time fell. Which action is the BEST response to the security requirement?

Link effectiveness to test evidence, exceptions and time.
Report outcome measures such as detection and response latency by severity.
Measure telemetry coverage by live and recovery environments.
Normalize asset identifiers and reconcile duplicated CVEs.

Explanation

Correct Answer

Activity counts alone do not prove resilience. The controlling fact is: Executives are shown the number of closed incidents but not whether critical asset dwell time fell.

Incorrect Answers

Link effectiveness to test evidence, exceptions and time would not report outcome measures such as detection and response latency by severity.

Operational readiness must include failover observability. The scenario does not present the alternate condition: the SIEM marks an entire site covered even though its standby network forwards no logs. The proper immediate action is to report outcome measures such as detection and response latency by severity.

Normalizing asset identifiers and reconciling duplicated CVEs would not report outcome measures such as detection and response latency by severity.

Question 471

A feed marks an IP malicious based on reports from five years ago. Which control or decision MOST directly resolves the stated gap?

Verify current effective policy and direct reachability.
Validate source relevance before triggering enterprise-wide response.
Confirm current ownership, observations and independent evidence before blocking.
Resolve accurate asset and CPE versions before declaring exposure.

Explanation

Correct Answer

Threat infrastructure context changes over time. The controlling fact is: A feed marks an IP malicious based on reports from five years ago.

Incorrect Answers

Verifying current effective policy and directing reachability would not confirm current ownership, observations and independent evidence.

The current facts call for this action: confirm current ownership, observations and independent evidence before blocking.

Resolving accurate asset and CPE versions would not confirm current ownership, observations and independent evidence.

Question 472

VPN session identities appear as email addresses while EDR uses directory object identifiers. What is the appropriate security response for this scenario?

Constrain time windows to a plausible attack chain and validate order.
Rebuild chronology using source timestamps and known clock offsets.
Correlate NAT mapping and observation locations before incident counts.
Normalize identities through a verified mapping before cross-source joins.

Explanation

Correct Answer

Cross-system correlation needs stable attributable subjects. The controlling fact is: VPN session identities appear as email addresses while EDR uses directory object identifiers.

Incorrect Answers

The reported condition calls for this action: Normalize identities through a verified mapping before cross-source joins.

The current facts call for this action: normalize identities through a verified mapping before cross-source joins.

One flow can have several legitimate address representations. The scenario does not present the alternate condition: firewall and packet logs disagree because the observed address was translated at the boundary. The proper immediate action is to normalize identities through a verified mapping before cross-source joins.

Question 473

A moderate CVSS vulnerability is being exploited on an internet-facing payroll authentication gateway. What should the enterprise security architect or analyst do NEXT?

Prioritize by active exploitation and business impact rather than base score alone.
Validate actual exposure and avoid treating storage as compromise.
Escalate based on data sensitivity and plausible consequence.
Resolve stable asset IDs and current accountability before dispatch.

Explanation

Correct Answer

Exposure and criticality can dominate nominal severity. The controlling fact is: A moderate CVSS vulnerability is being exploited on an internet-facing payroll authentication gateway.

Incorrect Answers

The current facts call for this action: prioritize by active exploitation and business impact rather than base score alone.

Asset type and classification influence prioritization. The scenario does not present the alternate condition: a cloud storage alert affects classified export data but its numeric score is lower than ordinary web noise. The proper immediate action is to prioritize by active exploitation and business impact rather than base score alone.

The reported condition calls for this action: Prioritize by active exploitation and business impact rather than base score alone.

Question 474

A DLP alert detects a file transfer to an approved encrypted backup endpoint. Which action is MOST defensible given these facts?

Correlate artifact signatures and deployment provenance.
Correlate job authorization, account and object scope before escalation.
Verify the legal workflow and data minimization before closing the alert.
Distinguish attempted execution from confirmed process activity.

Explanation

Correct Answer

Transfer volume without context can resemble theft. The controlling fact is: A DLP alert detects a file transfer to an approved encrypted backup endpoint.

Incorrect Answers

Correlating artifact signatures and deployment provenance would not correlate job authorization, account and object scope.

Authorized disclosure requires precise scope. The scenario does not present the alternate condition: a storage control flags a customer export after approved legal disclosure. The proper immediate action is to correlate job authorization, account and object scope before escalation.

Distinguishing attempted execution from confirmed process activity would not correlate job authorization, account and object scope.

Question 475

A SIEM parser fails after an application changes the JSON field containing destination addresses. Which action is the BEST response to the security requirement?

Align protected retention and retrieval with accepted response needs.
Deduplicate on stable event identity while preserving originals.
Repair the parser against retained representative source events.
Alert on collector heartbeat and expected-event absence.

Explanation

Correct Answer

A field-mapping failure can silently defeat correlations. The controlling fact is: A SIEM parser fails after an application changes the JSON field containing destination addresses.

Incorrect Answers

Aligning protected retention and retrieval with accepted response needs would not repair the parser against retained representative source events.

The current facts call for this action: repair the parser against retained representative source events.

The reported condition calls for this action: Repair the parser against retained representative source events.

Question 476

A finance employee downloads large files during a documented approved migration. Which control or decision MOST directly resolves the stated gap?

Verify entitlement approval before recalibrating the baseline.
Inspect workloads, tokens and recent deployment records.
Use destination, client and permitted-protocol context to validate risk.
Compare behavior to approved work scope before invoking insider-risk procedures.

Explanation

Correct Answer

Anomaly detection needs business context. The controlling fact is: A finance employee downloads large files during a documented approved migration.

Incorrect Answers

The reported condition calls for this action: Compare behavior to approved work scope before invoking insider-risk procedures.

The current facts call for this action: compare behavior to approved work scope before invoking insider-risk procedures.

An encryption feature alone is not proof of malicious intent. The scenario does not present the alternate condition: a monitoring rule treats every encrypted DNS connection as command-and-control traffic. The proper immediate action is to compare behavior to approved work scope before invoking insider-risk procedures.

Question 477

A public storage exposure alert is resolved in the console but infrastructure-as-code reopens it nightly. What is the appropriate security response for this scenario?

Trace drift to IaC and fix the authoritative source.
Use immutable account and workload identities during aggregation.
Distinguish attempted access from successful object retrieval.
Report the blind spot and repair authorized collection access.

Explanation

Correct Answer

Runtime-only repairs will not survive reconciliation. The controlling fact is: A public storage exposure alert is resolved in the console but infrastructure-as-code reopens it nightly.

Incorrect Answers

The current facts call for this action: trace drift to IaC and fix the authoritative source.

Denied requests alone do not establish exfiltration. The scenario does not present the alternate condition: cloud audit logs show deny responses but an executive claims a successful mass data breach. The proper immediate action is to trace drift to IaC and fix the authoritative source.

The reported condition calls for this action: Trace drift to IaC and fix the authoritative source.

Question 478

An anomaly dashboard uses ingestion time rather than event time after a backlog flush. Which control or decision MOST directly resolves the stated gap?

Correlate NAT mapping and observation locations before incident counts.
Rebuild chronology using source timestamps and known clock offsets.
Normalize identities through a verified mapping before cross-source joins.
Constrain time windows to a plausible attack chain and validate order.

Explanation

Correct Answer

Delayed data can produce artificial bursts. The controlling fact is: An anomaly dashboard uses ingestion time rather than event time after a backlog flush.

Incorrect Answers

Correlating NAT mapping and observation locations would not rebuild chronology using source timestamps and known clock offsets.

Cross-system correlation needs stable attributable subjects. The scenario does not present the alternate condition: vPN session identities appear as email addresses while EDR uses directory object identifiers. The proper immediate action is to rebuild chronology using source timestamps and known clock offsets.

Constrain time windows to a plausible attack chain and validate order would not rebuild chronology using source timestamps and known clock offsets.

Question 479

Two collectors forward the same event IDs and an incident dashboard doubles its severity count. What is the appropriate security response for this scenario?

Alert on collector heartbeat and expected-event absence.
Align protected retention and retrieval with accepted response needs.
Deduplicate on stable event identity while preserving originals.
Repair the parser against retained representative source events.

Explanation

Correct Answer

Duplicate transport is not duplicate adversary activity. The controlling fact is: Two collectors forward the same event IDs and an incident dashboard doubles its severity count.

Incorrect Answers

The reported condition calls for this action: Deduplicate on stable event identity while preserving originals.

The current facts call for this action: deduplicate on stable event identity while preserving originals.

Repairing the parser against retained representative source events would not address the need for deduplicate on stable event identity while preserving originals.

Question 480

A high-rated vulnerability exists only on a disconnected training image with no active execution. What should the enterprise security architect or analyst do NEXT?

Escalate based on data sensitivity and plausible consequence.
Resolve stable asset IDs and current accountability before dispatch.
Prioritize by active exploitation and business impact rather than base score alone.
Validate actual exposure and avoid treating storage as compromise.

Explanation

Correct Answer

Inventory context influences urgent response. The controlling fact is: A high-rated vulnerability exists only on a disconnected training image with no active execution.

Incorrect Answers

The reported condition calls for this action: Validate actual exposure and avoid treating storage as compromise.

The current facts call for this action: validate actual exposure and avoid treating storage as compromise.

Exposure and criticality can dominate nominal severity. The scenario does not present the alternate condition: a moderate CVSS vulnerability is being exploited on an internet-facing payroll authentication gateway. The proper immediate action is to validate actual exposure and avoid treating storage as compromise.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)
CompTIA CAS-005 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)
CompTIA CAS-005 Practice Test 48 - 10 Questions (Last Reviewed 21-Sep-2026)
CompTIA CAS-005 Practice Test 49 - 10 Questions (Last Reviewed 20-Sep-2026)
CompTIA CAS-005 Practice Test 50 - 10 Questions (Last Reviewed 19-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 470

Explanation

Correct Answer

Incorrect Answers

Question 471

Explanation

Correct Answer

Incorrect Answers

Question 472

Explanation

Correct Answer

Incorrect Answers

Question 473

Explanation

Correct Answer

Incorrect Answers

Question 474

Explanation

Correct Answer

Incorrect Answers

Question 475

Explanation

Correct Answer

Incorrect Answers

Question 476

Explanation

Correct Answer

Incorrect Answers

Question 477

Explanation

Correct Answer

Incorrect Answers

Question 478

Explanation

Correct Answer

Incorrect Answers

Question 479

Explanation

Correct Answer

Incorrect Answers

Question 480

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests