CompTIA CAS-005 Practice Test 54

Question 530

An API accepts object identifiers from authenticated users without checking ownership. Which action is MOST defensible given these facts?

Canonicalize and constrain access to approved storage roots.
Enforce object-level authorization for every requested record.
Use parameterized database access with appropriate input validation.
Encode untrusted output for its rendering context.

Explanation

Correct Answer

Authentication does not grant every object's data. The controlling fact is: An API accepts object identifiers from authenticated users without checking ownership.

Incorrect Answers

Canonicalize and constrain access to approved storage roots would not enforce object-level authorization for every requested record. Authentication does not grant every object's data.

Bind variables rather than interpret them as query syntax. The scenario does not present the alternate condition: an API constructs SQL queries by concatenating user-provided order numbers. The proper immediate action is to enforce object-level authorization for every requested record.

Encode untrusted output for its rendering context would not enforce object-level authorization for every requested record. Authentication does not grant every object's data.

Question 531

A rushed patch changes API authentication semantics and locks out critical users. Which action is the BEST response to the security requirement?

Prioritize tested patch deployment with interim exposure controls.
Verify reachability and package evidence before emergency changes.
Test and stage the security update with planned rollback.
Use segmented compensating controls with dated exception and replacement path.

Explanation

Correct Answer

Urgency does not remove availability and integration needs. The controlling fact is: A rushed patch changes API authentication semantics and locks out critical users.

Incorrect Answers

Prioritizing tested patch deployment with interim exposure controls would not test and stage the security update with planned rollback. Urgency does not remove availability and integration needs.

The current facts call for this action: test and stage the security update with planned rollback.

Using segmented compensating controls with dated exception and replacement path would not test and stage the security update with planned rollback. Urgency does not remove availability and integration needs.

Question 532

A URL shortener follows redirects to private addresses after the initial URL was allowed. Which control or decision MOST directly resolves the stated gap?

Bind privileged headers to trusted authenticated proxy identity.
Constrain outbound destinations and protect metadata service access.
Use appropriate anti-CSRF tokens and same-site protections.
Validate resolved destinations at every redirect and trust crossing.

Explanation

Correct Answer

One initial validation is insufficient for chained requests. The controlling fact is: A URL shortener follows redirects to private addresses after the initial URL was allowed.

Incorrect Answers

The reported condition calls for this action: Validate resolved destinations at every redirect and trust crossing.

The current facts call for this action: validate resolved destinations at every redirect and trust crossing.

Authenticated sessions can be exploited through forged requests. The scenario does not present the alternate condition: an administration action depends on a browser cookie but lacks anti-CSRF state validation. The proper immediate action is to validate resolved destinations at every redirect and trust crossing.

Question 533

A signed data stream is parsed before signature verification and triggers side effects. What is the appropriate security response for this scenario?

Authenticate the message before executing privileged processing.
Reject invalid messages and preserve bounded error handling.
Derive privileges from authenticated server-side identity and authorization.
Use safe serializers and explicit accepted data schemas.

Explanation

Correct Answer

Verification should precede irreversible operations. The controlling fact is: A signed data stream is parsed before signature verification and triggers side effects.

Incorrect Answers

The current facts call for this action: authenticate the message before executing privileged processing.

Client-controlled attributes must not grant privileges. The scenario does not present the alternate condition: a service trusts JSON fields declaring that the requester is an administrator. The proper immediate action is to authenticate the message before executing privileged processing.

The reported condition calls for this action: Authenticate the message before executing privileged processing.

Question 534

A protective WAF rule blocks all customer checkout traffic after a broad update. What should the enterprise security architect or analyst do NEXT?

Use admission control, quotas and workload isolation.
Roll back the faulty rule and deploy tested narrow protection.
Apply capped backoff and circuit breaker behavior.
Apply adaptive rate limits and resource budgets before expensive work.

Explanation

Correct Answer

Security controls must be evaluated for service impact. The controlling fact is: A protective WAF rule blocks all customer checkout traffic after a broad update.

Incorrect Answers

Using admission control, quotas and workload isolation would not address the need for roll back the faulty rule and deploy tested narrow protection.

Unbounded retry storms worsen outages. The scenario does not present the alternate condition: an attacker can trigger endless retries when a dependency returns a failure. The proper immediate action is to roll back the faulty rule and deploy tested narrow protection.

Applying adaptive rate limits and resource budgets would not address the need for roll back the faulty rule and deploy tested narrow protection.

Question 535

An obsolete remote-access daemon remains enabled on a newly provisioned server. Which action is MOST defensible given these facts?

Check revocation, signing date and trusted release provenance.
Validate authorized change records and firmware signatures.
Remove unused services and update the hardened image.
Verify dependency provenance and examine changes before promotion.

Explanation

Correct Answer

Least functionality reduces reachable attack paths. The controlling fact is: An obsolete remote-access daemon remains enabled on a newly provisioned server.

Incorrect Answers

Checking revocation, signing date and trusted release provenance would not remove unused services and update the hardened image.

The current facts call for this action: remove unused services and update the hardened image.

Verifying dependency provenance and examining changes would not remove unused services and update the hardened image.

Question 536

A parsing library is discontinued and its memory corruption bug remains unpatched. Which action is the BEST response to the security requirement?

Use memory-safe parsing with explicit bounds and tests.
Use atomic transaction updates and appropriate isolation.
Use secure atomic creation with protected ownership.
Replace the library or isolate the parser while migration proceeds.

Explanation

Correct Answer

Unsupported vulnerable code needs retirement or containment. The controlling fact is: A parsing library is discontinued and its memory corruption bug remains unpatched.

Incorrect Answers

The reported condition calls for this action: Replace the library or isolate the parser while migration proceeds.

The current facts call for this action: replace the library or isolate the parser while migration proceeds.

TOCTOU and symlink races affect filesystem safety. The scenario does not present the alternate condition: a temporary file is created in a shared directory and later reopened by predictable name. The proper immediate action is to replace the library or isolate the parser while migration proceeds.

Question 537

A SOC wants portable log-based detections for suspicious authentication patterns. What is the appropriate security response for this scenario?

Author and test a Sigma rule mapped to normalized events.
Create scoped YARA detection and validate benign-file collisions.
Use appropriate flow-behavior analytics and relationship context.
Deploy a validated Snort rule with monitored alert quality.

Explanation

Correct Answer

Sigma expresses detection patterns for log analytics. The controlling fact is: A SOC wants portable log-based detections for suspicious authentication patterns.

Incorrect Answers

The current facts call for this action: author and test a Sigma rule mapped to normalized events.

Flow analysis serves a different purpose from file signatures. The scenario does not present the alternate condition: a team needs to study recurring beaconing in collected flow records rather than inspect file contents. The proper immediate action is to author and test a Sigma rule mapped to normalized events.

The reported condition calls for this action: Author and test a Sigma rule mapped to normalized events.

Question 538

A public code repository reveals internal subdomain names and service topology. What should the enterprise security architect or analyst do NEXT?

Privately validate and revoke affected credentials through the authorized owner.
Assess whether published metadata exposes new reachable attack paths.
Treat the name as a hypothesis and seek corroborating artifacts.
Enumerate owned public assets and decommission unsafe exposure.

Explanation

Correct Answer

Open-source discoveries can change the attack surface. The controlling fact is: A public code repository reveals internal subdomain names and service topology.

Incorrect Answers

Credential management would not assess whether published metadata exposes new reachable attack paths.

Threat naming is not evidence of behavior. The scenario does not present the alternate condition: a forum post names a new malware family but lacks technical indicators or samples. The proper immediate action is to assess whether published metadata exposes new reachable attack paths.

Enumerate owned public assets and decommission unsafe exposure would not assess whether published metadata exposes new reachable attack paths.

Question 539

A blue-team exercise triggers the planned detection but fails to create a response case. Which action is MOST defensible given these facts?

Verify scope, retain test evidence and tune exercise coordination.
Distinguish detection-rule quality from telemetry coverage.
Review the alert-to-case workflow and document the tested gap.
Control environment differences before attributing performance changes.

Explanation

Correct Answer

Detection without operational response is incomplete coverage. The controlling fact is: A blue-team exercise triggers the planned detection but fails to create a response case.

Incorrect Answers

Exercise scope and coordination matter, but the reported failure is the missing response case after a detection fired.

Comparing detection rules with telemetry coverage cannot determine why the alert-to-case workflow failed.

Environmental differences may affect a test, but they do not establish why this detection failed to open a response case.

Question 540

A report describes attacker persistence via scheduled tasks but supplies no IOCs. Which action is the BEST response to the security requirement?

Separate technique matching from actor attribution and confidence.
Pivot to identity, process and destination events before confirmation.
Measure telemetry coverage before interpreting the negative result.
Hunt for anomalous task creation and execution sequences across endpoints.

Explanation

Correct Answer

Behavior-based detection works without a specific hash. The controlling fact is: A report describes attacker persistence via scheduled tasks but supplies no IOCs.

Incorrect Answers

The reported condition calls for this action: Hunt for anomalous task creation and execution sequences across endpoints.

The current facts call for this action: hunt for anomalous task creation and execution sequences across endpoints.

A missing observation is not evidence the behavior never occurred. The scenario does not present the alternate condition: a hunt finds no domain-matching logs from half the fleet. The proper immediate action is to hunt for anomalous task creation and execution sequences across endpoints.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 52 - 10 Questions (Last Reviewed 17-Sep-2026)
CompTIA CAS-005 Practice Test 53 - 10 Questions (Last Reviewed 16-Sep-2026)
CompTIA CAS-005 Practice Test 54 - 10 Questions (Last Reviewed 15-Sep-2026)
CompTIA CAS-005 Practice Test 55 - 10 Questions (Last Reviewed 14-Sep-2026)
CompTIA CAS-005 Practice Test 56 - 10 Questions (Last Reviewed 13-Sep-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 530

Explanation

Correct Answer

Incorrect Answers

Question 531

Explanation

Correct Answer

Incorrect Answers

Question 532

Explanation

Correct Answer

Incorrect Answers

Question 533

Explanation

Correct Answer

Incorrect Answers

Question 534

Explanation

Correct Answer

Incorrect Answers

Question 535

Explanation

Correct Answer

Incorrect Answers

Question 536

Explanation

Correct Answer

Incorrect Answers

Question 537

Explanation

Correct Answer

Incorrect Answers

Question 538

Explanation

Correct Answer

Incorrect Answers

Question 539

Explanation

Correct Answer

Incorrect Answers

Question 540

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests