CompTIA CAS-005 Practice Test 51

Question 500

A CSPM tool reports an exposed cloud resource but its scanner used an outdated read permission. Which action is MOST defensible given these facts?

Validate source relevance before triggering enterprise-wide response.
Confirm current ownership, observations and independent evidence before blocking.
Resolve accurate asset and CPE versions before declaring exposure.
Verify current effective policy and direct reachability.

Explanation

Correct Answer

Posture scanner limitations must be disclosed. The controlling fact is: A CSPM tool reports an exposed cloud resource but its scanner used an outdated read permission.

Incorrect Answers

The reported condition calls for this action: Verify current effective policy and direct reachability.

The current facts call for this action: verify current effective policy and direct reachability.

Component identity determines whether an advisory applies. The scenario does not present the alternate condition: a vulnerability feed uses a product name that maps to several incompatible versions. The proper immediate action is to verify current effective policy and direct reachability.

Question 501

A file-integrity alert appears after signed maintenance but no change record links to the affected server. Which action is the BEST response to the security requirement?

Correlate artifact signatures and deployment provenance.
Verify the legal workflow and data minimization before closing the alert.
Distinguish attempted execution from confirmed process activity.
Correlate job authorization, account and object scope before escalation.

Explanation

Correct Answer

Change legitimacy requires verified linkage. The controlling fact is: A file-integrity alert appears after signed maintenance but no change record links to the affected server.

Incorrect Answers

The current facts call for this action: correlate artifact signatures and deployment provenance.

Prevention signals are not proof of compromise. The scenario does not present the alternate condition: an EDR prevention event says malware was blocked but no execution evidence is available. The proper immediate action is to correlate artifact signatures and deployment provenance.

The reported condition calls for this action: Correlate artifact signatures and deployment provenance.

Question 502

A cloud control is green only because a security collector lacks permissions to read its configuration. Which control or decision MOST directly resolves the stated gap?

Use immutable account and workload identities during aggregation.
Report the blind spot and repair authorized collection access.
Distinguish attempted access from successful object retrieval.
Trace drift to IaC and fix the authoritative source.

Explanation

Correct Answer

A missing data source cannot demonstrate compliance. The controlling fact is: A cloud control is green only because a security collector lacks permissions to read its configuration.

Incorrect Answers

Using immutable account and workload identities during aggregation would not report the blind spot and repair authorized collection access. A missing data source cannot demonstrate compliance.

Denied requests alone do not establish exfiltration. The scenario does not present the alternate condition: cloud audit logs show deny responses but an executive claims a successful mass data breach. The proper immediate action is to report the blind spot and repair authorized collection access.

Tracing drift to IaC and fixing the authoritative source would not report the blind spot and repair authorized collection access. A missing data source cannot demonstrate compliance.

Question 503

A monitoring rule treats every encrypted DNS connection as command-and-control traffic. What is the appropriate security response for this scenario?

Verify entitlement approval before recalibrating the baseline.
Compare behavior to approved work scope before invoking insider-risk procedures.
Use destination, client and permitted-protocol context to validate risk.
Inspect workloads, tokens and recent deployment records.

Explanation

Correct Answer

An encryption feature alone is not proof of malicious intent. The controlling fact is: A monitoring rule treats every encrypted DNS connection as command-and-control traffic.

Incorrect Answers

Verifying entitlement approval would not meet the need for destination, client and permitted-protocol context to validate risk.

The current facts call for this action: use destination, client and permitted-protocol context to validate risk.

Inspecting workloads, tokens and recent deployment records would not meet the need for destination, client and permitted-protocol context to validate risk.

Question 504

The SOC retains only seven days of events despite an approved 90-day investigation requirement. What should the enterprise security architect or analyst do NEXT?

Repair the parser against retained representative source events.
Deduplicate on stable event identity while preserving originals.
Alert on collector heartbeat and expected-event absence.
Align protected retention and retrieval with accepted response needs.

Explanation

Correct Answer

Evidence availability must match operational and legal duties. The controlling fact is: The SOC retains only seven days of events despite an approved 90-day investigation requirement.

Incorrect Answers

The reported condition calls for this action: Align protected retention and retrieval with accepted response needs.

The current facts call for this action: align protected retention and retrieval with accepted response needs.

No events may indicate sensor failure rather than safety. The scenario does not present the alternate condition: a critical server stops emitting telemetry yet the monitoring dashboard remains green. The proper immediate action is to align protected retention and retrieval with accepted response needs.

Question 505

A service parses untrusted binary payloads into fixed-size buffers without checked lengths. Which action is the BEST response to the security requirement?

Use memory-safe parsing with explicit bounds and tests.
Replace the library or isolate the parser while migration proceeds.
Use atomic transaction updates and appropriate isolation.
Use secure atomic creation with protected ownership.

Explanation

Correct Answer

Unchecked input sizes can corrupt memory. The controlling fact is: A service parses untrusted binary payloads into fixed-size buffers without checked lengths.

Incorrect Answers

The current facts call for this action: use memory-safe parsing with explicit bounds and tests.

Check-then-act races can violate business integrity. The scenario does not present the alternate condition: two concurrent requests withdraw funds after reading the same account balance. The proper immediate action is to use memory-safe parsing with explicit bounds and tests.

The reported condition calls for this action: Use memory-safe parsing with explicit bounds and tests.

Question 506

A service account is nested into a powerful directory group without current business need. Which control or decision MOST directly resolves the stated gap?

Constrain role trust to specific authenticated workloads and actions.
Remove excessive group membership and review inheritance.
Rotate exposed secrets and eliminate logging at the source.
Use distinct keys and scopes with appropriate rotation.

Explanation

Correct Answer

Nested privileges can expand reach unexpectedly. The controlling fact is: A service account is nested into a powerful directory group without current business need.

Incorrect Answers

Constrain role trust to specific authenticated workloads and actions would not remove excessive group membership and review inheritance.

Log systems can turn secrets into broadly accessible artifacts. The scenario does not present the alternate condition: developers store database passwords in container environment logs. The proper immediate action is to remove excessive group membership and review inheritance.

Using distinct keys and scopes with appropriate rotation would not remove excessive group membership and review inheritance.

Question 507

An application accepts serialized objects that can instantiate arbitrary classes from untrusted clients. What is the appropriate security response for this scenario?

Reject invalid messages and preserve bounded error handling.
Derive privileges from authenticated server-side identity and authorization.
Use safe serializers and explicit accepted data schemas.
Authenticate the message before executing privileged processing.

Explanation

Correct Answer

Untrusted object construction can trigger unexpected behavior. The controlling fact is: An application accepts serialized objects that can instantiate arbitrary classes from untrusted clients.

Incorrect Answers

Rejecting invalid messages and preserving bounded error handling would not meet the need for safe serializers and explicit accepted data schemas.

The current facts call for this action: use safe serializers and explicit accepted data schemas.

The reported condition calls for this action: Use safe serializers and explicit accepted data schemas.

Question 508

An API constructs SQL queries by concatenating user-provided order numbers. What should the enterprise security architect or analyst do NEXT?

Enforce object-level authorization for every requested record.
Canonicalize and constrain access to approved storage roots.
Encode untrusted output for its rendering context.
Use parameterized database access with appropriate input validation.

Explanation

Correct Answer

Bind variables rather than interpret them as query syntax. The controlling fact is: An API constructs SQL queries by concatenating user-provided order numbers.

Incorrect Answers

The reported condition calls for this action: Use parameterized database access with appropriate input validation.

The current facts call for this action: use parameterized database access with appropriate input validation.

Output encoding prevents reflected browser script execution. The scenario does not present the alternate condition: a web search page echoes customer input as active HTML. The proper immediate action is to use parameterized database access with appropriate input validation.

Question 509

A public login page allows unlimited costly password hash comparisons per source. Which action is MOST defensible given these facts?

Apply adaptive rate limits and resource budgets before expensive work.
Apply capped backoff and circuit breaker behavior.
Roll back the faulty rule and deploy tested narrow protection.
Use admission control, quotas and workload isolation.

Explanation

Correct Answer

Resource exhaustion can occur without novel exploit code. The controlling fact is: A public login page allows unlimited costly password hash comparisons per source.

Incorrect Answers

The current facts call for this action: apply adaptive rate limits and resource budgets before expensive work.

Security controls must be evaluated for service impact. The scenario does not present the alternate condition: a protective WAF rule blocks all customer checkout traffic after a broad update. The proper immediate action is to apply adaptive rate limits and resource budgets before expensive work.

The reported condition calls for this action: Apply adaptive rate limits and resource budgets before expensive work.

Question 510

A public service runs a library with an actively exploited issue and a patch is available. Which action is the BEST response to the security requirement?

Test and stage the security update with planned rollback.
Prioritize tested patch deployment with interim exposure controls.
Verify reachability and package evidence before emergency changes.
Use segmented compensating controls with dated exception and replacement path.

Explanation

Correct Answer

Active exploitation and reachability increase urgency. The controlling fact is: A public service runs a library with an actively exploited issue and a patch is available.

Incorrect Answers

Testing and stage the security update with planned rollback would not prioritize tested patch deployment with interim exposure controls.

Detection signatures are not direct proof of exposure. The scenario does not present the alternate condition: a scanner flags a vulnerable version but the affected component is not installed in the running artifact. The proper immediate action is to prioritize tested patch deployment with interim exposure controls.

Using segmented compensating controls with dated exception and replacement path would not prioritize tested patch deployment with interim exposure controls.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 49 - 10 Questions (Last Reviewed 20-Sep-2026)
CompTIA CAS-005 Practice Test 50 - 10 Questions (Last Reviewed 19-Sep-2026)
CompTIA CAS-005 Practice Test 51 - 10 Questions (Last Reviewed 18-Sep-2026)
CompTIA CAS-005 Practice Test 52 - 10 Questions (Last Reviewed 17-Sep-2026)
CompTIA CAS-005 Practice Test 53 - 10 Questions (Last Reviewed 16-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 500

Explanation

Correct Answer

Incorrect Answers

Question 501

Explanation

Correct Answer

Incorrect Answers

Question 502

Explanation

Correct Answer

Incorrect Answers

Question 503

Explanation

Correct Answer

Incorrect Answers

Question 504

Explanation

Correct Answer

Incorrect Answers

Question 505

Explanation

Correct Answer

Incorrect Answers

Question 506

Explanation

Correct Answer

Incorrect Answers

Question 507

Explanation

Correct Answer

Incorrect Answers

Question 508

Explanation

Correct Answer

Incorrect Answers

Question 509

Explanation

Correct Answer

Incorrect Answers

Question 510

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests