CompTIA CAS-005 Practice Test 52

Question 510

A public service runs a library with an actively exploited issue and a patch is available. Which action is the BEST response to the security requirement?

Test and stage the security update with planned rollback.
Prioritize tested patch deployment with interim exposure controls.
Verify reachability and package evidence before emergency changes.
Use segmented compensating controls with dated exception and replacement path.

Explanation

Correct Answer

Active exploitation and reachability increase urgency. The controlling fact is: A public service runs a library with an actively exploited issue and a patch is available.

Incorrect Answers

Testing and stage the security update with planned rollback would not prioritize tested patch deployment with interim exposure controls.

Detection signatures are not direct proof of exposure. The scenario does not present the alternate condition: a scanner flags a vulnerable version but the affected component is not installed in the running artifact. The proper immediate action is to prioritize tested patch deployment with interim exposure controls.

Using segmented compensating controls with dated exception and replacement path would not prioritize tested patch deployment with interim exposure controls.

Question 511

An updated open-source library adds a network callback not present in prior releases. Which control or decision MOST directly resolves the stated gap?

Check revocation, signing date and trusted release provenance.
Remove unused services and update the hardened image.
Verify dependency provenance and examine changes before promotion.
Validate authorized change records and firmware signatures.

Explanation

Correct Answer

Supply-chain review should detect unexpected behavior. The controlling fact is: An updated open-source library adds a network callback not present in prior releases.

Incorrect Answers

Checking revocation, signing date and trusted release provenance would not verify dependency provenance and examine changes.

The current facts call for this action: verify dependency provenance and examine changes before promotion.

Validating authorized change records and firmware signatures would not verify dependency provenance and examine changes.

Question 512

A cloud image conversion service fetches arbitrary user URLs and can reach its metadata endpoint. What is the appropriate security response for this scenario?

Use appropriate anti-CSRF tokens and same-site protections.
Validate resolved destinations at every redirect and trust crossing.
Bind privileged headers to trusted authenticated proxy identity.
Constrain outbound destinations and protect metadata service access.

Explanation

Correct Answer

SSRF can reach internal-only resources. The controlling fact is: A cloud image conversion service fetches arbitrary user URLs and can reach its metadata endpoint.

Incorrect Answers

The reported condition calls for this action: Constrain outbound destinations and protect metadata service access.

The current facts call for this action: constrain outbound destinations and protect metadata service access.

Untrusted callers must not impersonate a deputy's authority. The scenario does not present the alternate condition: a trusted proxy adds privileged headers based on caller-supplied input. The proper immediate action is to constrain outbound destinations and protect metadata service access.

Question 513

A web search page echoes customer input as active HTML. Which control or decision MOST directly resolves the stated gap?

Encode untrusted output for its rendering context.
Canonicalize and constrain access to approved storage roots.
Use parameterized database access with appropriate input validation.
Enforce object-level authorization for every requested record.

Explanation

Correct Answer

Output encoding prevents reflected browser script execution. The controlling fact is: A web search page echoes customer input as active HTML.

Incorrect Answers

The current facts call for this action: encode untrusted output for its rendering context.

Bind variables rather than interpret them as query syntax. The scenario does not present the alternate condition: an API constructs SQL queries by concatenating user-provided order numbers. The proper immediate action is to encode untrusted output for its rendering context.

The reported condition calls for this action: Encode untrusted output for its rendering context.

Question 514

A service trusts JSON fields declaring that the requester is an administrator. What is the appropriate security response for this scenario?

Use safe serializers and explicit accepted data schemas.
Derive privileges from authenticated server-side identity and authorization.
Reject invalid messages and preserve bounded error handling.
Authenticate the message before executing privileged processing.

Explanation

Correct Answer

Client-controlled attributes must not grant privileges. The controlling fact is: A service trusts JSON fields declaring that the requester is an administrator.

Incorrect Answers

Using safe serializers and explicit accepted data schemas would not address the need for derive privileges from authenticated server-side identity and authorization.

Failure modes should not grant access. The scenario does not present the alternate condition: a message consumer fails open when a malformed authorization record is received. The proper immediate action is to derive privileges from authenticated server-side identity and authorization.

The reported condition calls for this action: Derive privileges from authenticated server-side identity and authorization.

Question 515

A scanner flags a vulnerable version but the affected component is not installed in the running artifact. What should the enterprise security architect or analyst do NEXT?

Prioritize tested patch deployment with interim exposure controls.
Use segmented compensating controls with dated exception and replacement path.
Verify reachability and package evidence before emergency changes.
Test and stage the security update with planned rollback.

Explanation

Correct Answer

Detection signatures are not direct proof of exposure. The controlling fact is: A scanner flags a vulnerable version but the affected component is not installed in the running artifact.

Incorrect Answers

Prioritizing tested patch deployment with interim exposure controls would not verify reachability and package evidence.

The current facts call for this action: verify reachability and package evidence before emergency changes.

Testing and stage the security update with planned rollback would not verify reachability and package evidence.

Question 516

Two concurrent requests withdraw funds after reading the same account balance. Which action is MOST defensible given these facts?

Use secure atomic creation with protected ownership.
Use memory-safe parsing with explicit bounds and tests.
Replace the library or isolate the parser while migration proceeds.
Use atomic transaction updates and appropriate isolation.

Explanation

Correct Answer

Check-then-act races can violate business integrity. The controlling fact is: Two concurrent requests withdraw funds after reading the same account balance.

Incorrect Answers

The reported condition calls for this action: Use atomic transaction updates and appropriate isolation.

The current facts call for this action: use atomic transaction updates and appropriate isolation.

Unsupported vulnerable code needs retirement or containment. The scenario does not present the alternate condition: a parsing library is discontinued and its memory corruption bug remains unpatched. The proper immediate action is to use atomic transaction updates and appropriate isolation.

Question 517

A vendor image has a legitimate signature but an outdated compromised signing key. Which action is the BEST response to the security requirement?

Check revocation, signing date and trusted release provenance.
Verify dependency provenance and examine changes before promotion.
Validate authorized change records and firmware signatures.
Remove unused services and update the hardened image.

Explanation

Correct Answer

Signature presence is not complete release assurance. The controlling fact is: A vendor image has a legitimate signature but an outdated compromised signing key.

Incorrect Answers

The current facts call for this action: check revocation, signing date and trusted release provenance.

Firmware drift needs attribution and integrity evidence. The scenario does not present the alternate condition: a device's firmware hash differs from the approved baseline after a support visit. The proper immediate action is to check revocation, signing date and trusted release provenance.

The reported condition calls for this action: Check revocation, signing date and trusted release provenance.

Question 518

Developers store database passwords in container environment logs. Which control or decision MOST directly resolves the stated gap?

Remove excessive group membership and review inheritance.
Rotate exposed secrets and eliminate logging at the source.
Use distinct keys and scopes with appropriate rotation.
Constrain role trust to specific authenticated workloads and actions.

Explanation

Correct Answer

Log systems can turn secrets into broadly accessible artifacts. The controlling fact is: Developers store database passwords in container environment logs.

Incorrect Answers

Removing excessive group membership and reviewing inheritance would not address the need for rotate exposed secrets and eliminate logging at the source.

Key reuse amplifies compromise across environments. The scenario does not present the alternate condition: a signing key is shared among three unrelated deployment environments. The proper immediate action is to rotate exposed secrets and eliminate logging at the source.

Constrain role trust to specific authenticated workloads and actions would not address the need for rotate exposed secrets and eliminate logging at the source.

Question 519

An administration action depends on a browser cookie but lacks anti-CSRF state validation. What is the appropriate security response for this scenario?

Bind privileged headers to trusted authenticated proxy identity.
Validate resolved destinations at every redirect and trust crossing.
Use appropriate anti-CSRF tokens and same-site protections.
Constrain outbound destinations and protect metadata service access.

Explanation

Correct Answer

Authenticated sessions can be exploited through forged requests. The controlling fact is: An administration action depends on a browser cookie but lacks anti-CSRF state validation.

Incorrect Answers

Bind privileged headers to trusted authenticated proxy identity would not meet the need for appropriate anti-CSRF tokens and same-site protections.

The current facts call for this action: use appropriate anti-CSRF tokens and same-site protections.

Constrain outbound destinations and protect metadata service access would not meet the need for appropriate anti-CSRF tokens and same-site protections.

Question 520

A low-privilege user can submit a massive report job that locks a shared database. What should the enterprise security architect or analyst do NEXT?

Apply capped backoff and circuit breaker behavior.
Roll back the faulty rule and deploy tested narrow protection.
Apply adaptive rate limits and resource budgets before expensive work.
Use admission control, quotas and workload isolation.

Explanation

Correct Answer

Authorized features still need resource governance. The controlling fact is: A low-privilege user can submit a massive report job that locks a shared database.

Incorrect Answers

The reported condition calls for this action: Use admission control, quotas and workload isolation.

The current facts call for this action: use admission control, quotas and workload isolation.

Resource exhaustion can occur without novel exploit code. The scenario does not present the alternate condition: a public login page allows unlimited costly password hash comparisons per source. The proper immediate action is to use admission control, quotas and workload isolation.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 50 - 10 Questions (Last Reviewed 19-Sep-2026)
CompTIA CAS-005 Practice Test 51 - 10 Questions (Last Reviewed 18-Sep-2026)
CompTIA CAS-005 Practice Test 52 - 10 Questions (Last Reviewed 17-Sep-2026)
CompTIA CAS-005 Practice Test 53 - 10 Questions (Last Reviewed 16-Sep-2026)
CompTIA CAS-005 Practice Test 54 - 10 Questions (Last Reviewed 15-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 510

Explanation

Correct Answer

Incorrect Answers

Question 511

Explanation

Correct Answer

Incorrect Answers

Question 512

Explanation

Correct Answer

Incorrect Answers

Question 513

Explanation

Correct Answer

Incorrect Answers

Question 514

Explanation

Correct Answer

Incorrect Answers

Question 515

Explanation

Correct Answer

Incorrect Answers

Question 516

Explanation

Correct Answer

Incorrect Answers

Question 517

Explanation

Correct Answer

Incorrect Answers

Question 518

Explanation

Correct Answer

Incorrect Answers

Question 519

Explanation

Correct Answer

Incorrect Answers

Question 520

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests