CompTIA CAS-005 Practice Test 59

Question 580

Postincident reviews identify only a careless user despite absent MFA and uncontrolled token reuse. What should the enterprise security architect or analyst do NEXT?

Build a normalized event timeline retaining raw source timestamps.
Assign accountable remediation, due dates and follow-up tests.
Trace identity and endpoint events to explain the privilege path.
Examine systemic control gaps and contributing factors without blame.

Explanation

Correct Answer

Root cause analysis should improve defenses. The controlling fact is: Postincident reviews identify only a careless user despite absent MFA and uncontrolled token reuse.

Incorrect Answers

The reported condition calls for this action: Examine systemic control gaps and contributing factors without blame.

The current facts call for this action: examine systemic control gaps and contributing factors without blame.

A useful causal account must cover enabling conditions. The scenario does not present the alternate condition: an incident report includes evidence of lateral movement but no account of how privileges were obtained. The proper immediate action is to examine systemic control gaps and contributing factors without blame.

Question 581

A compromised SaaS account has active OAuth grants after password reset. Which action is MOST defensible given these facts?

Review grants and revoke unauthorized tokens and sessions.
Record exposure window without asserting confirmed data theft.
Bind events to canonical immutable account and resource identifiers.
Snapshot appropriate disks and retain control-plane identity and execution logs.

Explanation

Correct Answer

Password changes do not necessarily terminate delegated access. The controlling fact is: A compromised SaaS account has active OAuth grants after password reset.

Incorrect Answers

The current facts call for this action: review grants and revoke unauthorized tokens and sessions.

Cloud attribution requires stable identities. The scenario does not present the alternate condition: investigators cannot correlate API actions because cloud accounts use different local display names. The proper immediate action is to review grants and revoke unauthorized tokens and sessions.

The reported condition calls for this action: Review grants and revoke unauthorized tokens and sessions.

Question 582

Responders copy memory files to a personal USB stick without chain-of-custody records. Which action is the BEST response to the security requirement?

Minimize and protect sensitive content through controlled exchange.
Use approved acquisition storage, hashes and custody records.
Label missing portions and repeat a verified acquisition if feasible.
Capture authorized volatile evidence before reboot where safety permits.

Explanation

Correct Answer

Evidence integrity and provenance are essential. The controlling fact is: Responders copy memory files to a personal USB stick without chain-of-custody records.

Incorrect Answers

Minimize and protect sensitive content through controlled exchange would not meet the need for approved acquisition storage, hashes and custody records.

Partial images cannot support complete conclusions. The scenario does not present the alternate condition: a collected memory image is incomplete because the acquisition tool crashed. The proper immediate action is to use approved acquisition storage, hashes and custody records.

Capturing authorized volatile evidence would not meet the need for approved acquisition storage, hashes and custody records.

Question 583

Packet counts differ between the host and a span port with known drops. Which control or decision MOST directly resolves the stated gap?

Investigate filtering, response path and sensor vantage before declaring connection success.
Use authorized TLS metadata and endpoint process evidence for context.
Measure capture loss and corroborate with flow and endpoint counters.
Safely reassemble the transferred object and hash the extracted evidence.

Explanation

Correct Answer

Evidence volume depends on observation quality. The controlling fact is: Packet counts differ between the host and a span port with known drops.

Incorrect Answers

Investigating filtering, response path and sensor vantage would not measure capture loss and corroborate with flow and endpoint counters.

The current facts call for this action: measure capture loss and corroborate with flow and endpoint counters.

Safely reassemble the transferred object and hash the extracted evidence would not measure capture loss and corroborate with flow and endpoint counters.

Question 584

A sample does nothing in the sandbox but checks for virtual machines. What is the appropriate security response for this scenario?

Use approved private analysis and review disclosure restrictions.
Use an isolated sandbox with controlled network simulation.
Treat the domain as a hypothesis and correlate with execution evidence.
Supplement dynamic analysis with static inspection and alternative isolated conditions.

Explanation

Correct Answer

Environment-aware malware can evade naive sandboxes. The controlling fact is: A sample does nothing in the sandbox but checks for virtual machines.

Incorrect Answers

The reported condition calls for this action: Supplement dynamic analysis with static inspection and alternative isolated conditions.

The current facts call for this action: supplement dynamic analysis with static inspection and alternative isolated conditions.

Static indicators alone do not prove contacted infrastructure. The scenario does not present the alternate condition: a sample's strings contain a domain but there are no observed network connections. The proper immediate action is to supplement dynamic analysis with static inspection and alternative isolated conditions.

Question 585

Analysts assume HTTPS traffic is harmless because its payload is encrypted. Which control or decision MOST directly resolves the stated gap?

Use authorized TLS metadata and endpoint process evidence for context.
Investigate filtering, response path and sensor vantage before declaring connection success.
Measure capture loss and corroborate with flow and endpoint counters.
Safely reassemble the transferred object and hash the extracted evidence.

Explanation

Correct Answer

Encryption hides content but not all behavioral indicators. The controlling fact is: Analysts assume HTTPS traffic is harmless because its payload is encrypted.

Incorrect Answers

The current facts call for this action: use authorized TLS metadata and endpoint process evidence for context.

Evidence volume depends on observation quality. The scenario does not present the alternate condition: packet counts differ between the host and a span port with known drops. The proper immediate action is to use authorized TLS metadata and endpoint process evidence for context.

The reported condition calls for this action: Use authorized TLS metadata and endpoint process evidence for context.

Question 586

A security team plans to wipe a suspected endpoint before collecting necessary evidence. What is the appropriate security response for this scenario?

Prefer scoped account or workload restrictions before global denial.
Preserve required artifacts before irreversible recovery where feasible.
Coordinate isolation using a safety-approved alternative workflow.
Revoke sessions and credentials under authorized incident controls.

Explanation

Correct Answer

Eradication actions can destroy investigation evidence. The controlling fact is: A security team plans to wipe a suspected endpoint before collecting necessary evidence.

Incorrect Answers

Prefer scoped account or workload restrictions would not preserve required artifacts.

Containment must consider patient and service impacts. The scenario does not present the alternate condition: a ransomware incident affects a clinical scheduling server supporting urgent care. The proper immediate action is to preserve required artifacts before irreversible recovery where feasible.

The reported condition calls for this action: Preserve required artifacts before irreversible recovery where feasible.

Question 587

An employee proposes submitting a proprietary company binary to a public scanning portal. What should the enterprise security architect or analyst do NEXT?

Use an isolated sandbox with controlled network simulation.
Supplement dynamic analysis with static inspection and alternative isolated conditions.
Use approved private analysis and review disclosure restrictions.
Treat the domain as a hypothesis and correlate with execution evidence.

Explanation

Correct Answer

Public uploads can expose confidential content. The controlling fact is: An employee proposes submitting a proprietary company binary to a public scanning portal.

Incorrect Answers

Using an isolated sandbox with controlled network simulation would not meet the need for approved private analysis and review disclosure restrictions.

The current facts call for this action: use approved private analysis and review disclosure restrictions.

Treat the domain as a hypothesis and correlate with execution evidence would not meet the need for approved private analysis and review disclosure restrictions.

Question 588

An incident report includes evidence of lateral movement but no account of how privileges were obtained. Which action is MOST defensible given these facts?

Build a normalized event timeline retaining raw source timestamps.
Assign accountable remediation, due dates and follow-up tests.
Examine systemic control gaps and contributing factors without blame.
Trace identity and endpoint events to explain the privilege path.

Explanation

Correct Answer

A useful causal account must cover enabling conditions. The controlling fact is: An incident report includes evidence of lateral movement but no account of how privileges were obtained.

Incorrect Answers

The reported condition calls for this action: Trace identity and endpoint events to explain the privilege path.

The current facts call for this action: trace identity and endpoint events to explain the privilege path.

Root cause analysis should improve defenses. The scenario does not present the alternate condition: postincident reviews identify only a careless user despite absent MFA and uncontrolled token reuse. The proper immediate action is to trace identity and endpoint events to explain the privilege path.

Question 589

An investigator requests monitoring all employees' private messages after one suspicious event. Which action is the BEST response to the security requirement?

Use approved proportional and privacy-aware investigative scope.
Label facts, uncertainty and corroboration needs.
Review job duties, authorization and contextual transfer evidence fairly.
Preserve authorization and session evidence and contain any active grant.

Explanation

Correct Answer

Insider response needs legal boundaries and minimization. The controlling fact is: An investigator requests monitoring all employees' private messages after one suspicious event.

Incorrect Answers

The current facts call for this action: use approved proportional and privacy-aware investigative scope.

Unusual volume does not automatically establish malicious intent. The scenario does not present the alternate condition: a departing employee downloads more documents than their historical baseline. The proper immediate action is to use approved proportional and privacy-aware investigative scope.

The reported condition calls for this action: Use approved proportional and privacy-aware investigative scope.

Question 590

A cloud bucket becomes public but access logs show only denied reads. Which control or decision MOST directly resolves the stated gap?

Snapshot appropriate disks and retain control-plane identity and execution logs.
Record exposure window without asserting confirmed data theft.
Review grants and revoke unauthorized tokens and sessions.
Bind events to canonical immutable account and resource identifiers.

Explanation

Correct Answer

Configuration risk and observed exfiltration are distinct. The controlling fact is: A cloud bucket becomes public but access logs show only denied reads.

Incorrect Answers

Snapshot appropriate disks and retain control-plane identity and execution logs would not record exposure window without asserting confirmed data theft.

Password changes do not necessarily terminate delegated access. The scenario does not present the alternate condition: a compromised SaaS account has active OAuth grants after password reset. The proper immediate action is to record exposure window without asserting confirmed data theft.

Immutable evidence retention would not record exposure window without asserting confirmed data theft.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 57 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA CAS-005 Practice Test 58 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA CAS-005 Practice Test 59 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA CAS-005 Practice Test 60 - 10 Questions (Last Reviewed 05-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 580

Explanation

Correct Answer

Incorrect Answers

Question 581

Explanation

Correct Answer

Incorrect Answers

Question 582

Explanation

Correct Answer

Incorrect Answers

Question 583

Explanation

Correct Answer

Incorrect Answers

Question 584

Explanation

Correct Answer

Incorrect Answers

Question 585

Explanation

Correct Answer

Incorrect Answers

Question 586

Explanation

Correct Answer

Incorrect Answers

Question 587

Explanation

Correct Answer

Incorrect Answers

Question 588

Explanation

Correct Answer

Incorrect Answers

Question 589

Explanation

Correct Answer

Incorrect Answers

Question 590

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests