CompTIA CAS-005 Practice Test 49

Question 480

A high-rated vulnerability exists only on a disconnected training image with no active execution. What should the enterprise security architect or analyst do NEXT?

Escalate based on data sensitivity and plausible consequence.
Resolve stable asset IDs and current accountability before dispatch.
Prioritize by active exploitation and business impact rather than base score alone.
Validate actual exposure and avoid treating storage as compromise.

Explanation

Correct Answer

Inventory context influences urgent response. The controlling fact is: A high-rated vulnerability exists only on a disconnected training image with no active execution.

Incorrect Answers

The reported condition calls for this action: Validate actual exposure and avoid treating storage as compromise.

The current facts call for this action: validate actual exposure and avoid treating storage as compromise.

Exposure and criticality can dominate nominal severity. The scenario does not present the alternate condition: a moderate CVSS vulnerability is being exploited on an internet-facing payroll authentication gateway. The proper immediate action is to validate actual exposure and avoid treating storage as compromise.

Question 481

An EDR prevention event says malware was blocked but no execution evidence is available. Which action is MOST defensible given these facts?

Distinguish attempted execution from confirmed process activity.
Verify the legal workflow and data minimization before closing the alert.
Correlate job authorization, account and object scope before escalation.
Correlate artifact signatures and deployment provenance.

Explanation

Correct Answer

Prevention signals are not proof of compromise. The controlling fact is: An EDR prevention event says malware was blocked but no execution evidence is available.

Incorrect Answers

The current facts call for this action: distinguish attempted execution from confirmed process activity.

Transfer volume without context can resemble theft. The scenario does not present the alternate condition: a DLP alert detects a file transfer to an approved encrypted backup endpoint. The proper immediate action is to distinguish attempted execution from confirmed process activity.

The reported condition calls for this action: Distinguish attempted execution from confirmed process activity.

Question 482

Cloud audit logs show deny responses but an executive claims a successful mass data breach. Which action is the BEST response to the security requirement?

Use immutable account and workload identities during aggregation.
Distinguish attempted access from successful object retrieval.
Report the blind spot and repair authorized collection access.
Trace drift to IaC and fix the authoritative source.

Explanation

Correct Answer

Denied requests alone do not establish exfiltration. The controlling fact is: Cloud audit logs show deny responses but an executive claims a successful mass data breach.

Incorrect Answers

Using immutable account and workload identities during aggregation would not distinguish attempted access from successful object retrieval.

A missing data source cannot demonstrate compliance. The scenario does not present the alternate condition: a cloud control is green only because a security collector lacks permissions to read its configuration. The proper immediate action is to distinguish attempted access from successful object retrieval.

Tracing drift to IaC and fixing the authoritative source would not distinguish attempted access from successful object retrieval.

Question 483

A newly promoted engineer's changed role triggers the old least-privilege alerts. Which control or decision MOST directly resolves the stated gap?

Compare behavior to approved work scope before invoking insider-risk procedures.
Inspect workloads, tokens and recent deployment records.
Verify entitlement approval before recalibrating the baseline.
Use destination, client and permitted-protocol context to validate risk.

Explanation

Correct Answer

A legitimate role change requires validated context, not blanket suppression. The controlling fact is: A newly promoted engineer's changed role triggers the old least-privilege alerts.

Incorrect Answers

Comparing behavior to approved work scope would not verify entitlement approval. A legitimate role change requires validated context, not blanket suppression.

The current facts call for this action: verify entitlement approval before recalibrating the baseline.

Using destination, client and permitted-protocol context to validate risk would not verify entitlement approval. A legitimate role change requires validated context, not blanket suppression.

Question 484

A detector never alerts on known adversary emulation because a required log field was dropped. What is the appropriate security response for this scenario?

Tighten the pattern and retest benign and malicious examples.
Provide source evidence, entity context and reconstruction links.
Evaluate precision and recall on representative datasets before tuning.
Repair telemetry coverage and test true-positive detection.

Explanation

Correct Answer

False negatives can arise before rule logic. The controlling fact is: A detector never alerts on known adversary emulation because a required log field was dropped.

Incorrect Answers

The reported condition calls for this action: Repair telemetry coverage and test true-positive detection.

The current facts call for this action: repair telemetry coverage and test true-positive detection.

Reducing event volume is not the same as effectiveness. The scenario does not present the alternate condition: an alert threshold was raised to hide noise but genuine incidents are now missed. The proper immediate action is to repair telemetry coverage and test true-positive detection.

Question 485

A vulnerability feed uses a product name that maps to several incompatible versions. What should the enterprise security architect or analyst do NEXT?

Resolve accurate asset and CPE versions before declaring exposure.
Verify current effective policy and direct reachability.
Validate source relevance before triggering enterprise-wide response.
Confirm current ownership, observations and independent evidence before blocking.

Explanation

Correct Answer

Component identity determines whether an advisory applies. The controlling fact is: A vulnerability feed uses a product name that maps to several incompatible versions.

Incorrect Answers

The current facts call for this action: resolve accurate asset and CPE versions before declaring exposure.

Intelligence relevance must be established. The scenario does not present the alternate condition: an external report references a credential dump but never identifies which organization was affected. The proper immediate action is to resolve accurate asset and CPE versions before declaring exposure.

The reported condition calls for this action: Resolve accurate asset and CPE versions before declaring exposure.

Question 486

A vulnerability dashboard counts duplicate findings from the same asset across two scanners. Which action is MOST defensible given these facts?

Measure telemetry coverage by live and recovery environments.
Normalize asset identifiers and reconcile duplicated CVEs.
Link effectiveness to test evidence, exceptions and time.
Report outcome measures such as detection and response latency by severity.

Explanation

Correct Answer

Accurate metrics require deduplication. The controlling fact is: A vulnerability dashboard counts duplicate findings from the same asset across two scanners.

Incorrect Answers

Measuring telemetry coverage by live and recovery environments would not normalize asset identifiers and reconcile duplicated CVEs.

Deployment status does not guarantee a control works. The scenario does not present the alternate condition: an audit display labels controls effective because owners have marked them installed. The proper immediate action is to normalize asset identifiers and reconcile duplicated CVEs.

Reporting outcome measures such as detection and response latency by severity would not normalize asset identifiers and reconcile duplicated CVEs.

Question 487

The SIEM marks an entire site covered even though its standby network forwards no logs. What should the enterprise security architect or analyst do NEXT?

Report outcome measures such as detection and response latency by severity.
Normalize asset identifiers and reconcile duplicated CVEs.
Measure telemetry coverage by live and recovery environments.
Link effectiveness to test evidence, exceptions and time.

Explanation

Correct Answer

Operational readiness must include failover observability. The controlling fact is: The SIEM marks an entire site covered even though its standby network forwards no logs.

Incorrect Answers

Reporting outcome measures such as detection and response latency by severity would not measure telemetry coverage by live and recovery environments.

The current facts call for this action: measure telemetry coverage by live and recovery environments.

Link effectiveness to test evidence, exceptions and time would not measure telemetry coverage by live and recovery environments.

Question 488

A security ticket targets a hostname that was reassigned to a new business owner. Which action is MOST defensible given these facts?

Validate actual exposure and avoid treating storage as compromise.
Prioritize by active exploitation and business impact rather than base score alone.
Escalate based on data sensitivity and plausible consequence.
Resolve stable asset IDs and current accountability before dispatch.

Explanation

Correct Answer

Stale identifiers misroute remediation. The controlling fact is: A security ticket targets a hostname that was reassigned to a new business owner.

Incorrect Answers

The reported condition calls for this action: Resolve stable asset IDs and current accountability before dispatch.

The current facts call for this action: resolve stable asset IDs and current accountability before dispatch.

Asset type and classification influence prioritization. The scenario does not present the alternate condition: a cloud storage alert affects classified export data but its numeric score is lower than ordinary web noise. The proper immediate action is to resolve stable asset IDs and current accountability before dispatch.

Question 489

A critical server stops emitting telemetry yet the monitoring dashboard remains green. Which action is the BEST response to the security requirement?

Alert on collector heartbeat and expected-event absence.
Align protected retention and retrieval with accepted response needs.
Repair the parser against retained representative source events.
Deduplicate on stable event identity while preserving originals.

Explanation

Correct Answer

No events may indicate sensor failure rather than safety. The controlling fact is: A critical server stops emitting telemetry yet the monitoring dashboard remains green.

Incorrect Answers

The current facts call for this action: alert on collector heartbeat and expected-event absence.

A field-mapping failure can silently defeat correlations. The scenario does not present the alternate condition: a SIEM parser fails after an application changes the JSON field containing destination addresses. The proper immediate action is to alert on collector heartbeat and expected-event absence.

The reported condition calls for this action: Alert on collector heartbeat and expected-event absence.

Question 490

Firewall and packet logs disagree because the observed address was translated at the boundary. Which control or decision MOST directly resolves the stated gap?

Normalize identities through a verified mapping before cross-source joins.
Correlate NAT mapping and observation locations before incident counts.
Rebuild chronology using source timestamps and known clock offsets.
Constrain time windows to a plausible attack chain and validate order.

Explanation

Correct Answer

One flow can have several legitimate address representations. The controlling fact is: Firewall and packet logs disagree because the observed address was translated at the boundary.

Incorrect Answers

Normalizing identities through a verified mapping would not correlate NAT mapping and observation locations.

Delayed data can produce artificial bursts. The scenario does not present the alternate condition: an anomaly dashboard uses ingestion time rather than event time after a backlog flush. The proper immediate action is to correlate NAT mapping and observation locations before incident counts.

Constrain time windows to a plausible attack chain and validate order would not correlate NAT mapping and observation locations.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)
CompTIA CAS-005 Practice Test 48 - 10 Questions (Last Reviewed 21-Sep-2026)
CompTIA CAS-005 Practice Test 49 - 10 Questions (Last Reviewed 20-Sep-2026)
CompTIA CAS-005 Practice Test 50 - 10 Questions (Last Reviewed 19-Sep-2026)
CompTIA CAS-005 Practice Test 51 - 10 Questions (Last Reviewed 18-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 480

Explanation

Correct Answer

Incorrect Answers

Question 481

Explanation

Correct Answer

Incorrect Answers

Question 482

Explanation

Correct Answer

Incorrect Answers

Question 483

Explanation

Correct Answer

Incorrect Answers

Question 484

Explanation

Correct Answer

Incorrect Answers

Question 485

Explanation

Correct Answer

Incorrect Answers

Question 486

Explanation

Correct Answer

Incorrect Answers

Question 487

Explanation

Correct Answer

Incorrect Answers

Question 488

Explanation

Correct Answer

Incorrect Answers

Question 489

Explanation

Correct Answer

Incorrect Answers

Question 490

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests