Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Use admission control, quotas and workload isolation.

The current facts call for this action: use admission control, quotas and workload isolation.

Resource exhaustion can occur without novel exploit code. The scenario does not present the alternate condition: a public login page allows unlimited costly password hash comparisons per source. The proper immediate action is to use admission control, quotas and workload isolation.

The current facts call for this action: validate authorized change records and firmware signatures.

Least functionality reduces reachable attack paths. The scenario does not present the alternate condition: an obsolete remote-access daemon remains enabled on a newly provisioned server. The proper immediate action is to validate authorized change records and firmware signatures.

The reported condition calls for this action: Validate authorized change records and firmware signatures.

Constrain outbound destinations and protect metadata service access would not address the need for bind privileged headers to trusted authenticated proxy identity.

One initial validation is insufficient for chained requests. The scenario does not present the alternate condition: a URL shortener follows redirects to private addresses after the initial URL was allowed. The proper immediate action is to bind privileged headers to trusted authenticated proxy identity.

Using appropriate anti-CSRF tokens and same-site protections would not address the need for bind privileged headers to trusted authenticated proxy identity.

Constrain role trust to specific authenticated workloads and actions would not meet the need for distinct keys and scopes with appropriate rotation.

The current facts call for this action: use distinct keys and scopes with appropriate rotation.

Rotate exposed secrets and eliminate logging at the source would not meet the need for distinct keys and scopes with appropriate rotation.

The reported condition calls for this action: Apply capped backoff and circuit breaker behavior.

The current facts call for this action: apply capped backoff and circuit breaker behavior.

Security controls must be evaluated for service impact. The scenario does not present the alternate condition: a protective WAF rule blocks all customer checkout traffic after a broad update. The proper immediate action is to apply capped backoff and circuit breaker behavior.

The current facts call for this action: reject invalid messages and preserve bounded error handling.

Verification should precede irreversible operations. The scenario does not present the alternate condition: a signed data stream is parsed before signature verification and triggers side effects. The proper immediate action is to reject invalid messages and preserve bounded error handling.

The reported condition calls for this action: Reject invalid messages and preserve bounded error handling.

Enforcing object-level authorization for every requested record would not address the need for canonicalize and constrain access to approved storage roots.

Output encoding prevents reflected browser script execution. The scenario does not present the alternate condition: a web search page echoes customer input as active HTML. The proper immediate action is to canonicalize and constrain access to approved storage roots.

Using parameterized database access with appropriate input validation would not address the need for canonicalize and constrain access to approved storage roots.

Prioritizing tested patch deployment with interim exposure controls would not meet the need for segmented compensating controls with dated exception and replacement path.

The current facts call for this action: use segmented compensating controls with dated exception and replacement path.

Testing and stage the security update with planned rollback would not meet the need for segmented compensating controls with dated exception and replacement path.

The reported condition calls for this action: Use secure atomic creation with protected ownership.

The current facts call for this action: use secure atomic creation with protected ownership.

Check-then-act races can violate business integrity. The scenario does not present the alternate condition: two concurrent requests withdraw funds after reading the same account balance. The proper immediate action is to use secure atomic creation with protected ownership.

The current facts call for this action: constrain role trust to specific authenticated workloads and actions.

Log systems can turn secrets into broadly accessible artifacts. The scenario does not present the alternate condition: developers store database passwords in container environment logs. The proper immediate action is to constrain role trust to specific authenticated workloads and actions.

The reported condition calls for this action: Constrain role trust to specific authenticated workloads and actions.

Canonicalize and constrain access to approved storage roots would not enforce object-level authorization for every requested record. Authentication does not grant every object's data.

Bind variables rather than interpret them as query syntax. The scenario does not present the alternate condition: an API constructs SQL queries by concatenating user-provided order numbers. The proper immediate action is to enforce object-level authorization for every requested record.

Encode untrusted output for its rendering context would not enforce object-level authorization for every requested record. Authentication does not grant every object's data.