Pass Your CompTIA CAS-005 Exam Easy!

Preserving authorization and session evidence and contain any active grant would not review job duties, authorization and contextual transfer evidence fairly.

Insider response needs legal boundaries and minimization. The scenario does not present the alternate condition: an investigator requests monitoring all employees' private messages after one suspicious event. The proper immediate action is to review job duties, authorization and contextual transfer evidence fairly.

Label facts, uncertainty and corroboration needs would not review job duties, authorization and contextual transfer evidence fairly. Unusual volume does not automatically establish malicious intent.

Label missing portions and repeat a verified acquisition if feasible would not capture authorized volatile evidence.

The current facts call for this action: capture authorized volatile evidence before reboot where safety permits.

Minimize and protect sensitive content through controlled exchange would not capture authorized volatile evidence.

The reported condition calls for this action: Investigate filtering, response path and sensor vantage before declaring connection success.

The current facts call for this action: investigate filtering, response path and sensor vantage before declaring connection success.

Encryption hides content but not all behavioral indicators. The scenario does not present the alternate condition: analysts assume HTTPS traffic is harmless because its payload is encrypted. The proper immediate action is to investigate filtering, response path and sensor vantage before declaring connection success.

The current facts call for this action: use an isolated sandbox with controlled network simulation.

Environment-aware malware can evade naive sandboxes. The scenario does not present the alternate condition: a sample does nothing in the sandbox but checks for virtual machines. The proper immediate action is to use an isolated sandbox with controlled network simulation.

The reported condition calls for this action: Use an isolated sandbox with controlled network simulation.

Tracing identity and endpoint events to explain the privilege path would not build a normalized event timeline retaining raw source timestamps.

Lessons have value only when controls change. The scenario does not present the alternate condition: lessons learned produce a list of recommendations without owners or validation dates. The proper immediate action is to build a normalized event timeline retaining raw source timestamps.

Examining systemic control gaps and contributing factors without blame would not build a normalized event timeline retaining raw source timestamps.

Immutable evidence retention would not address the need for snapshot appropriate disks and retain control-plane identity and execution logs.

The current facts call for this action: snapshot appropriate disks and retain control-plane identity and execution logs.

Recording exposure window without asserting confirmed data theft would not address the need for snapshot appropriate disks and retain control-plane identity and execution logs.

The reported condition calls for this action: Define decision authority and communications roles in the plan.

The current facts call for this action: define decision authority and communications roles in the plan.

External reporting should preserve truth and obligations. The scenario does not present the alternate condition: a public incident statement is drafted before legal and investigation teams verify affected data. The proper immediate action is to define decision authority and communications roles in the plan.

The current facts call for this action: rehearse full business transaction recovery with shared dependencies.

External reporting should preserve truth and obligations. The scenario does not present the alternate condition: a public incident statement is drafted before legal and investigation teams verify affected data. The proper immediate action is to rehearse full business transaction recovery with shared dependencies.

The reported condition calls for this action: Rehearse full business transaction recovery with shared dependencies.

Reviewing job duties, authorization and contextual transfer evidence fairly would not preserve authorization and session evidence and contain any active grant.

Insider response needs legal boundaries and minimization. The scenario does not present the alternate condition: an investigator requests monitoring all employees' private messages after one suspicious event. The proper immediate action is to preserve authorization and session evidence and contain any active grant.

Label facts, uncertainty and corroboration needs would not preserve authorization and session evidence and contain any active grant.

An alternative isolation workflow may protect systems, but it does not immediately revoke an attacker’s active administrator sessions.

Preserving artifacts is important, yet the compromised account can continue establishing remote sessions until access is revoked.

Scoped restrictions can reduce exposure, but the active compromised sessions and credentials still require immediate revocation.

The reported condition calls for this action: Examine systemic control gaps and contributing factors without blame.

The current facts call for this action: examine systemic control gaps and contributing factors without blame.

A useful causal account must cover enabling conditions. The scenario does not present the alternate condition: an incident report includes evidence of lateral movement but no account of how privileges were obtained. The proper immediate action is to examine systemic control gaps and contributing factors without blame.