CompTIA CAS-005 Practice Test 57

Question 560

An ISAC advisory identifies a sector-wide technique but no known IPs. Which control or decision MOST directly resolves the stated gap?

Validate with internal evidence before public breach conclusions.
Reassess age, current ownership and internal relevance.
Normalize provenance, last-seen and confidence before automation.
Prioritize technique-aligned hunting rather than invent exact indicators.

Explanation

Correct Answer

Collective intelligence often informs behavior rather than hashes. The controlling fact is: An ISAC advisory identifies a sector-wide technique but no known IPs.

Incorrect Answers

The reported condition calls for this action: Prioritize technique-aligned hunting rather than invent exact indicators.

The current facts call for this action: prioritize technique-aligned hunting rather than invent exact indicators.

Unclean intelligence can distort response prioritization. The scenario does not present the alternate condition: a vendor's feed includes hundreds of duplicate indicators with inconsistent severity. The proper immediate action is to prioritize technique-aligned hunting rather than invent exact indicators.

Question 561

A feed subscriber imports classified victim identities into a public sharing channel. Which action is the BEST response to the security requirement?

Apply classification, authorization and handling restrictions before sharing.
Share appropriately scoped STIX objects preserving provenance.
Update indicator validity and context for recipients.
Use TAXII for delivery and STIX for the represented objects.

Explanation

Correct Answer

Indicator exchange cannot ignore sensitive context. The controlling fact is: A feed subscriber imports classified victim identities into a public sharing channel.

Incorrect Answers

The current facts call for this action: apply classification, authorization and handling restrictions before sharing.

Outdated indicators can cause harmful false positives. The scenario does not present the alternate condition: an indicator is shared after its associated infrastructure was legally sinkholed. The proper immediate action is to apply classification, authorization and handling restrictions before sharing.

The reported condition calls for this action: Apply classification, authorization and handling restrictions before sharing.

Question 562

A team needs to study recurring beaconing in collected flow records rather than inspect file contents. Which control or decision MOST directly resolves the stated gap?

Deploy a validated Snort rule with monitored alert quality.
Use appropriate flow-behavior analytics and relationship context.
Author and test a Sigma rule mapped to normalized events.
Create scoped YARA detection and validate benign-file collisions.

Explanation

Correct Answer

Flow analysis serves a different purpose from file signatures. The controlling fact is: A team needs to study recurring beaconing in collected flow records rather than inspect file contents.

Incorrect Answers

The reported condition calls for this action: Use appropriate flow-behavior analytics and relationship context.

Sigma expresses detection patterns for log analytics. The scenario does not present the alternate condition: a SOC wants portable log-based detections for suspicious authentication patterns. The proper immediate action is to use appropriate flow-behavior analytics and relationship context.

Creating scoped YARA detection and validating benign-file collisions would not meet the need for appropriate flow-behavior analytics and relationship context.

Question 563

Analysts compare exercise outcomes but the scenarios used different endpoint software versions. What is the appropriate security response for this scenario?

Review the alert-to-case workflow and document the tested gap.
Distinguish detection-rule quality from telemetry coverage.
Control environment differences before attributing performance changes.
Verify scope, retain test evidence and tune exercise coordination.

Explanation

Correct Answer

Measurement requires comparable conditions. The controlling fact is: Analysts compare exercise outcomes but the scenarios used different endpoint software versions.

Incorrect Answers

The reported condition calls for this action: Control environment differences before attributing performance changes.

The current facts call for this action: control environment differences before attributing performance changes.

Verifying scope, retain test evidence and tune exercise coordination would not address the need for control environment differences.

Question 564

A new merger expands the company digital footprint with abandoned domains. What should the enterprise security architect or analyst do NEXT?

Assess whether published metadata exposes new reachable attack paths.
Treat the name as a hypothesis and seek corroborating artifacts.
Privately validate and revoke affected credentials through the authorized owner.
Enumerate owned public assets and decommission unsafe exposure.

Explanation

Correct Answer

Organizational change creates OSINT-accessible surfaces. The controlling fact is: A new merger expands the company digital footprint with abandoned domains.

Incorrect Answers

The reported condition calls for this action: Enumerate owned public assets and decommission unsafe exposure.

The current facts call for this action: enumerate owned public assets and decommission unsafe exposure.

Public leaks require controlled credential response. The scenario does not present the alternate condition: a threat intelligence analyst finds leaked tokens online but cannot verify whether they remain active. The proper immediate action is to enumerate owned public assets and decommission unsafe exposure.

Question 565

Threat hunters see several related incidents but differ on the initial access vector. Which action is MOST defensible given these facts?

Build a confidence-labeled timeline and note unresolved paths.
Represent infrastructure overlap without claiming identical authorship.
Separate hypotheses about motive from verified technical observations.
Map the observed technique and test realistic defensive analytics.

Explanation

Correct Answer

Transparent uncertainty improves intelligence quality. The controlling fact is: Threat hunters see several related incidents but differ on the initial access vector.

Incorrect Answers

The current facts call for this action: build a confidence-labeled timeline and note unresolved paths.

Attribution requires a higher evidentiary threshold. The scenario does not present the alternate condition: a campaign report includes geopolitical assertions unsupported by any victim or activity evidence. The proper immediate action is to build a confidence-labeled timeline and note unresolved paths.

The reported condition calls for this action: Build a confidence-labeled timeline and note unresolved paths.

Question 566

Analysts claim a single ATT&CK mapping proves a named threat group is present. Which action is the BEST response to the security requirement?

Pivot to identity, process and destination events before confirmation.
Separate technique matching from actor attribution and confidence.
Measure telemetry coverage before interpreting the negative result.
Hunt for anomalous task creation and execution sequences across endpoints.

Explanation

Correct Answer

Shared techniques do not uniquely identify an adversary. The controlling fact is: Analysts claim a single ATT&CK mapping proves a named threat group is present.

Incorrect Answers

Pivot to identity, process and destination events would not separate technique matching from actor attribution and confidence.

A missing observation is not evidence the behavior never occurred. The scenario does not present the alternate condition: a hunt finds no domain-matching logs from half the fleet. The proper immediate action is to separate technique matching from actor attribution and confidence.

Hunt for anomalous task creation and execution sequences across endpoints would not separate technique matching from actor attribution and confidence.

Question 567

A vendor's feed includes hundreds of duplicate indicators with inconsistent severity. Which control or decision MOST directly resolves the stated gap?

Reassess age, current ownership and internal relevance.
Prioritize technique-aligned hunting rather than invent exact indicators.
Normalize provenance, last-seen and confidence before automation.
Validate with internal evidence before public breach conclusions.

Explanation

Correct Answer

Unclean intelligence can distort response prioritization. The controlling fact is: A vendor's feed includes hundreds of duplicate indicators with inconsistent severity.

Incorrect Answers

Reassess age, current ownership and internal relevance would not normalize provenance, last-seen and confidence.

The current facts call for this action: normalize provenance, last-seen and confidence before automation.

Validating with internal evidence would not normalize provenance, last-seen and confidence.

Question 568

An automated decoy response attempts to pivot into external attacker infrastructure. What is the appropriate security response for this scenario?

Preserve isolated interaction telemetry and investigate the actor sequence.
Remove secrets and isolate the decoy from production identities.
Validate exercise scope before classifying the actor as hostile.
Keep the collection passive and within authorized engagement boundaries.

Explanation

Correct Answer

Counterintelligence must respect legal and safety limits. The controlling fact is: An automated decoy response attempts to pivot into external attacker infrastructure.

Incorrect Answers

The reported condition calls for this action: Keep the collection passive and within authorized engagement boundaries.

The current facts call for this action: keep the collection passive and within authorized engagement boundaries.

Authorized testing can match malicious behaviors. The scenario does not present the alternate condition: a honeynet captures attack traffic from a source that appears on a sanctioned red-team schedule. The proper immediate action is to keep the collection passive and within authorized engagement boundaries.

Question 569

A ransomware incident affects a clinical scheduling server supporting urgent care. Which action is MOST defensible given these facts?

Coordinate isolation using a safety-approved alternative workflow.
Preserve required artifacts before irreversible recovery where feasible.
Prefer scoped account or workload restrictions before global denial.
Revoke sessions and credentials under authorized incident controls.

Explanation

Correct Answer

Containment must consider patient and service impacts. The controlling fact is: A ransomware incident affects a clinical scheduling server supporting urgent care.

Incorrect Answers

The current facts call for this action: coordinate isolation using a safety-approved alternative workflow.

Broad controls may cause avoidable business outages. The scenario does not present the alternate condition: a containment rule will block a shared SaaS endpoint used by every department. The proper immediate action is to coordinate isolation using a safety-approved alternative workflow.

The reported condition calls for this action: Coordinate isolation using a safety-approved alternative workflow.

Question 570

A departing employee downloads more documents than their historical baseline. Which action is the BEST response to the security requirement?

Preserve authorization and session evidence and contain any active grant.
Review job duties, authorization and contextual transfer evidence fairly.
Use approved proportional and privacy-aware investigative scope.
Label facts, uncertainty and corroboration needs.

Explanation

Correct Answer

Unusual volume does not automatically establish malicious intent. The controlling fact is: A departing employee downloads more documents than their historical baseline.

Incorrect Answers

Preserving authorization and session evidence and contain any active grant would not review job duties, authorization and contextual transfer evidence fairly.

Insider response needs legal boundaries and minimization. The scenario does not present the alternate condition: an investigator requests monitoring all employees' private messages after one suspicious event. The proper immediate action is to review job duties, authorization and contextual transfer evidence fairly.

Label facts, uncertainty and corroboration needs would not review job duties, authorization and contextual transfer evidence fairly. Unusual volume does not automatically establish malicious intent.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 55 - 10 Questions (Last Reviewed 14-Sep-2026)
CompTIA CAS-005 Practice Test 56 - 10 Questions (Last Reviewed 13-Sep-2026)
CompTIA CAS-005 Practice Test 57 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA CAS-005 Practice Test 58 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA CAS-005 Practice Test 59 - 10 Questions (Last Reviewed 06-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 560

Explanation

Correct Answer

Incorrect Answers

Question 561

Explanation

Correct Answer

Incorrect Answers

Question 562

Explanation

Correct Answer

Incorrect Answers

Question 563

Explanation

Correct Answer

Incorrect Answers

Question 564

Explanation

Correct Answer

Incorrect Answers

Question 565

Explanation

Correct Answer

Incorrect Answers

Question 566

Explanation

Correct Answer

Incorrect Answers

Question 567

Explanation

Correct Answer

Incorrect Answers

Question 568

Explanation

Correct Answer

Incorrect Answers

Question 569

Explanation

Correct Answer

Incorrect Answers

Question 570

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests