CompTIA CAS-005 Practice Test 5

Question 40

Recovery media pass a checksum test but contain corrupted application relationships. Which control or decision MOST directly resolves the stated gap?

Add immutable or segregated recovery copies and test restore access.
Bind signed records to preserved hashes and trusted timestamps.
Enable append-only or remotely protected journals with integrity checks.
Test logical restore consistency and business transactions.

Explanation

Correct Answer

Bit-level integrity is not the same as usable recovered state. The controlling fact is: Recovery media pass a checksum test but contain corrupted application relationships.

Incorrect Answers

The reported condition calls for this action: Test logical restore consistency and business transactions.

The current facts call for this action: test logical restore consistency and business transactions.

Independent records improve postincident reconstruction. The scenario does not present the alternate condition: transaction records are changed without any independent tamper evidence. The proper immediate action is to test logical restore consistency and business transactions.

Question 41

A mitigated application vulnerability still has material third-party access exposure. What is the appropriate security response for this scenario?

Reassess residual risk after validating the control outcome.
Document exposure, alternatives and accountable risk-owner approval.
Compare likelihood, impact and business scenarios before ranking.
Escalate for authorized risk treatment or explicit governance-approved exception.

Explanation

Correct Answer

Installing a control does not guarantee risk reduction. The controlling fact is: A mitigated application vulnerability still has material third-party access exposure.

Incorrect Answers

The current facts call for this action: reassess residual risk after validating the control outcome.

Risk severity should follow a transparent assessment method. The scenario does not present the alternate condition: a team assigns a high label to every risk despite no impact analysis. The proper immediate action is to reassess residual risk after validating the control outcome.

The reported condition calls for this action: Reassess residual risk after validating the control outcome.

Question 42

A business unit purchases cyber insurance and removes all technical controls. What should the enterprise security architect or analyst do NEXT?

Perform postchange validation and investigate the unpatched exceptions.
Keep minimum controls and recognize insurance transfers only financial portions.
Retire the function or remove the unnecessary exposure.
Implement and test a scoped mitigating control with expiry and owner.

Explanation

Correct Answer

Risk transfer is not a substitute for diligence and required safeguards. The controlling fact is: A business unit purchases cyber insurance and removes all technical controls.

Incorrect Answers

Performing postchange validation and investigating the unpatched exceptions would not keep minimum controls and recognize insurance transfers only financial portions.

Avoidance may be safer than maintaining unsupported risk. The scenario does not present the alternate condition: a nonessential legacy portal is exposed and cannot be patched. The proper immediate action is to keep minimum controls and recognize insurance transfers only financial portions.

Implementing and testing a scoped mitigating control with expiry and owner would not keep minimum controls and recognize insurance transfers only financial portions.

Question 43

A customer invokes erasure while a legal hold covers relevant records. Which action is MOST defensible given these facts?

Evaluate necessity, retention and lawful disposal of biometrics.
Assess sovereignty, legal transfer basis and storage location constraints.
Reconcile the request with valid retention and hold obligations.
Start incident assessment, preserve evidence and notify legal/privacy owners.

Explanation

Correct Answer

Rights handling requires an exception decision based on legal duty. The controlling fact is: A customer invokes erasure while a legal hold covers relevant records.

Incorrect Answers

Evaluating necessity, retention and lawful disposal of biometrics would not reconcile the request with valid retention and hold obligations. Rights handling requires an exception decision based on legal duty.

The current facts call for this action: reconcile the request with valid retention and hold obligations.

Start incident assessment, preserve evidence and notify legal/privacy owners would not reconcile the request with valid retention and hold obligations.

Question 44

A recovery exercise restores infrastructure but cannot process a real sample transaction. Which action is the BEST response to the security requirement?

Size backup and replication cadence to accepted data-loss tolerance.
Evaluate common-mode failure and independent recovery access.
Reconcile dependency recovery times and design a feasible recovery chain.
Validate an end-to-end business service acceptance test.

Explanation

Correct Answer

Technical startup alone does not demonstrate business recovery. The controlling fact is: A recovery exercise restores infrastructure but cannot process a real sample transaction.

Incorrect Answers

The reported condition calls for this action: Validate an end-to-end business service acceptance test.

The current facts call for this action: validate an end-to-end business service acceptance test.

RTOs must reflect end-to-end service dependencies. The scenario does not present the alternate condition: a payment platform is targeted for a 10-minute RTO but shared authentication requires 45 minutes to restore. The proper immediate action is to validate an end-to-end business service acceptance test.

Question 45

A supplier changes its subprocessor to another jurisdiction without review. Which control or decision MOST directly resolves the stated gap?

Trigger contractual notification and privacy transfer risk assessment.
Assess fourth-party concentration and contractual outage dependencies.
Define recovery tests, measurable objectives and audit rights.
Request scope-relevant evidence and bridge the coverage gap.

Explanation

Correct Answer

Subprocessor changes can alter regulatory and operational exposure. The controlling fact is: A supplier changes its subprocessor to another jurisdiction without review.

Incorrect Answers

The current facts call for this action: trigger contractual notification and privacy transfer risk assessment.

Resilience claims need independently assessable evidence. The scenario does not present the alternate condition: contract language promises restoration but does not identify backup test evidence. The proper immediate action is to trigger contractual notification and privacy transfer risk assessment.

The reported condition calls for this action: Trigger contractual notification and privacy transfer risk assessment.

Question 46

Contract language promises restoration but does not identify backup test evidence. Which action is the BEST response to the security requirement?

Trigger contractual notification and privacy transfer risk assessment.
Define recovery tests, measurable objectives and audit rights.
Assess fourth-party concentration and contractual outage dependencies.
Request scope-relevant evidence and bridge the coverage gap.

Explanation

Correct Answer

Resilience claims need independently assessable evidence. The controlling fact is: Contract language promises restoration but does not identify backup test evidence.

Incorrect Answers

Trigger contractual notification and privacy transfer risk assessment would not define recovery tests, measurable objectives and audit rights.

Shared dependencies can defeat apparent supplier diversity. The scenario does not present the alternate condition: three critical applications rely on one subcontractor's identity service. The proper immediate action is to define recovery tests, measurable objectives and audit rights.

Requesting scope-relevant evidence and bridge the coverage gap would not define recovery tests, measurable objectives and audit rights.

Question 47

The primary and recovery regions share the same external identity provider. Which control or decision MOST directly resolves the stated gap?

Validate an end-to-end business service acceptance test.
Size backup and replication cadence to accepted data-loss tolerance.
Evaluate common-mode failure and independent recovery access.
Reconcile dependency recovery times and design a feasible recovery chain.

Explanation

Correct Answer

Geographic separation does not eliminate shared dependencies. The controlling fact is: The primary and recovery regions share the same external identity provider.

Incorrect Answers

Validating an end-to-end business service acceptance test would not meet the need for common-mode failure and independent recovery access. Geographic separation does not eliminate shared dependencies.

The current facts call for this action: evaluate common-mode failure and independent recovery access.

Reconciling dependency recovery times and designing a feasible recovery chain would not meet the need for common-mode failure and independent recovery access.

Question 48

A business process needs to prove a record was not silently altered after approval. What is the appropriate security response for this scenario?

Test logical restore consistency and business transactions.
Add immutable or segregated recovery copies and test restore access.
Enable append-only or remotely protected journals with integrity checks.
Bind signed records to preserved hashes and trusted timestamps.

Explanation

Correct Answer

Cryptographic evidence supports later integrity verification. The controlling fact is: A business process needs to prove a record was not silently altered after approval.

Incorrect Answers

The reported condition calls for this action: Bind signed records to preserved hashes and trusted timestamps.

The current facts call for this action: bind signed records to preserved hashes and trusted timestamps.

Independent records improve postincident reconstruction. The scenario does not present the alternate condition: transaction records are changed without any independent tamper evidence. The proper immediate action is to bind signed records to preserved hashes and trusted timestamps.

Question 49

A critical asset remains vulnerable after a patch rollout reports success. What should the enterprise security architect or analyst do NEXT?

Perform postchange validation and investigate the unpatched exceptions.
Retire the function or remove the unnecessary exposure.
Implement and test a scoped mitigating control with expiry and owner.
Keep minimum controls and recognize insurance transfers only financial portions.

Explanation

Correct Answer

Risk treatment is not complete without proof. The controlling fact is: A critical asset remains vulnerable after a patch rollout reports success.

Incorrect Answers

The current facts call for this action: perform postchange validation and investigate the unpatched exceptions.

Temporary mitigation needs measurable effectiveness and sunset. The scenario does not present the alternate condition: a required service can run behind a compensating gateway until its vendor patch arrives. The proper immediate action is to perform postchange validation and investigate the unpatched exceptions.

The reported condition calls for this action: Perform postchange validation and investigate the unpatched exceptions.

Question 50

A vendor proposes accepting a new risk because the patch window is inconvenient. Which action is MOST defensible given these facts?

Reassess residual risk after validating the control outcome.
Document exposure, alternatives and accountable risk-owner approval.
Escalate for authorized risk treatment or explicit governance-approved exception.
Compare likelihood, impact and business scenarios before ranking.

Explanation

Correct Answer

Delivery convenience alone is not a risk acceptance authority. The controlling fact is: A vendor proposes accepting a new risk because the patch window is inconvenient.

Incorrect Answers

Reassess residual risk after validating the control outcome would not document exposure, alternatives and accountable risk-owner approval.

An owner cannot override enterprise tolerance by informal acceptance. The scenario does not present the alternate condition: a system owner accepts a risk whose loss estimate exceeds the board's documented tolerance. The proper immediate action is to document exposure, alternatives and accountable risk-owner approval.

Comparing likelihood, impact and business scenarios would not document exposure, alternatives and accountable risk-owner approval.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 3 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA CAS-005 Practice Test 4 - 10 Questions (Last Reviewed 04-Nov-2026)
CompTIA CAS-005 Practice Test 5 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CAS-005 Practice Test 6 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CAS-005 Practice Test 7 - 10 Questions (Last Reviewed 01-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 40

Explanation

Correct Answer

Incorrect Answers

Question 41

Explanation

Correct Answer

Incorrect Answers

Question 42

Explanation

Correct Answer

Incorrect Answers

Question 43

Explanation

Correct Answer

Incorrect Answers

Question 44

Explanation

Correct Answer

Incorrect Answers

Question 45

Explanation

Correct Answer

Incorrect Answers

Question 46

Explanation

Correct Answer

Incorrect Answers

Question 47

Explanation

Correct Answer

Incorrect Answers

Question 48

Explanation

Correct Answer

Incorrect Answers

Question 49

Explanation

Correct Answer

Incorrect Answers

Question 50

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests