CompTIA CAS-005 Practice Test 6

Question 50

A vendor proposes accepting a new risk because the patch window is inconvenient. Which action is MOST defensible given these facts?

Reassess residual risk after validating the control outcome.
Document exposure, alternatives and accountable risk-owner approval.
Escalate for authorized risk treatment or explicit governance-approved exception.
Compare likelihood, impact and business scenarios before ranking.

Explanation

Correct Answer

Delivery convenience alone is not a risk acceptance authority. The controlling fact is: A vendor proposes accepting a new risk because the patch window is inconvenient.

Incorrect Answers

Reassess residual risk after validating the control outcome would not document exposure, alternatives and accountable risk-owner approval.

An owner cannot override enterprise tolerance by informal acceptance. The scenario does not present the alternate condition: a system owner accepts a risk whose loss estimate exceeds the board's documented tolerance. The proper immediate action is to document exposure, alternatives and accountable risk-owner approval.

Comparing likelihood, impact and business scenarios would not document exposure, alternatives and accountable risk-owner approval.

Question 51

Two risk models disagree because one assumes the provider automatically restores data. Which action is the BEST response to the security requirement?

Use clearly defined qualitative scenarios and uncertainty ratings.
Estimate annualized loss exposure with calibrated assumptions and ranges.
Validate the shared-responsibility and recovery assumptions before comparison.
Include correlated service dependencies in extreme-but-plausible scenarios.

Explanation

Correct Answer

A model result depends on its factual assumptions. The controlling fact is: Two risk models disagree because one assumes the provider automatically restores data.

Incorrect Answers

Using clearly defined qualitative scenarios and uncertainty ratings would not validate the shared-responsibility and recovery assumptions. A model result depends on its factual assumptions.

The current facts call for this action: validate the shared-responsibility and recovery assumptions before comparison.

Including correlated service dependencies in extreme-but-plausible scenarios would not validate the shared-responsibility and recovery assumptions. A model result depends on its factual assumptions.

Question 52

A suspected database disclosure has unclear scope and response deadlines. Which control or decision MOST directly resolves the stated gap?

Evaluate necessity, retention and lawful disposal of biometrics.
Assess sovereignty, legal transfer basis and storage location constraints.
Reconcile the request with valid retention and hold obligations.
Start incident assessment, preserve evidence and notify legal/privacy owners.

Explanation

Correct Answer

Breach decisions depend on verified scope and regulatory timelines. The controlling fact is: A suspected database disclosure has unclear scope and response deadlines.

Incorrect Answers

The reported condition calls for this action: Start incident assessment, preserve evidence and notify legal/privacy owners.

The current facts call for this action: start incident assessment, preserve evidence and notify legal/privacy owners.

Rights handling requires an exception decision based on legal duty. The scenario does not present the alternate condition: a customer invokes erasure while a legal hold covers relevant records. The proper immediate action is to start incident assessment, preserve evidence and notify legal/privacy owners.

Question 53

Litigation counsel orders a legal hold but automated deletion continues on affected mailboxes. What should the enterprise security architect or analyst do NEXT?

Suspend relevant deletion, preserve evidence and record hold scope.
Preserve required records and update the governance process prospectively.
Review jurisdictional and discovery transfer requirements with counsel.
Publish verified facts, clearly labeled uncertainty and protected evidence.

Explanation

Correct Answer

Preservation obligations supersede ordinary disposal for scoped records. The controlling fact is: Litigation counsel orders a legal hold but automated deletion continues on affected mailboxes.

Incorrect Answers

The current facts call for this action: suspend relevant deletion, preserve evidence and record hold scope.

Legal discovery does not erase privacy obligations. The scenario does not present the alternate condition: an investigator copies employee chat records overseas without checking transfer restrictions. The proper immediate action is to suspend relevant deletion, preserve evidence and record hold scope.

The reported condition calls for this action: Suspend relevant deletion, preserve evidence and record hold scope.

Question 54

An EU subject submits a verified access request but customer support lacks an ownership process. Which action is MOST defensible given these facts?

Evaluate age-specific protections and consent obligations with counsel.
Route the request through a documented rights workflow with deadlines.
Review lawful purpose, notices and required consent before reuse.
Assess controller/processor obligations and applicable transfer mechanisms.

Explanation

Correct Answer

Subject requests require accountable handling, not ad-hoc email. The controlling fact is: An EU subject submits a verified access request but customer support lacks an ownership process.

Incorrect Answers

Evaluating age-specific protections and consent obligations with counsel would not route the request through a documented rights workflow with deadlines.

Data reuse may exceed the original collection basis. The scenario does not present the alternate condition: a marketing service changes its purpose for collected data without notifying customers. The proper immediate action is to route the request through a documented rights workflow with deadlines.

Assessing controller/processor obligations and applicable transfer mechanisms would not route the request through a documented rights workflow with deadlines.

Question 55

An international product exports restricted cryptographic modules without a trade review. Which action is the BEST response to the security requirement?

Assign contractual trigger detection and notification accountability.
Check certification scope, entity and validity against the actual workload.
Check applicable export-control requirements before distribution.
Specify processor/controller roles and data subject response duties.

Explanation

Correct Answer

Security software can be regulated across borders. The controlling fact is: An international product exports restricted cryptographic modules without a trade review.

Incorrect Answers

Assigning contractual trigger detection and notification accountability would not check applicable export-control requirements.

The current facts call for this action: check applicable export-control requirements before distribution.

Specifying processor/controller roles and data subject response duties would not check applicable export-control requirements.

Question 56

A company maps NIST CSF functions directly to employee disciplinary outcomes. Which control or decision MOST directly resolves the stated gap?

Use configuration assessments to test relevant benchmark safeguards.
Build a service-specific control and responsibility mapping.
Assign governance decision structures and service-management procedures appropriately.
Use CSF to organize cybersecurity outcomes and governance improvements.

Explanation

Correct Answer

The framework is not a personnel punishment matrix. The controlling fact is: A company maps NIST CSF functions directly to employee disciplinary outcomes.

Incorrect Answers

The reported condition calls for this action: Use CSF to organize cybersecurity outcomes and governance improvements.

The current facts call for this action: use CSF to organize cybersecurity outcomes and governance improvements.

Governance and service operation solve different problems. The scenario does not present the alternate condition: security leaders confuse COBIT governance with the IT service change workflow. The proper immediate action is to use CSF to organize cybersecurity outcomes and governance improvements.

Question 57

Management requests a SOC 2 Type II report but receives an uncertified policy slide deck. What is the appropriate security response for this scenario?

Obtain an appropriate period-of-operation assurance report for the scoped system.
Verify completed remediation against objective test artifacts.
Provide least-privilege, supervised evidence access under audit protocol.
Distinguish internal assessment from accredited external certification.

Explanation

Correct Answer

Policy claims are not operating-effectiveness evidence. The controlling fact is: Management requests a SOC 2 Type II report but receives an uncertified policy slide deck.

Incorrect Answers

The current facts call for this action: obtain an appropriate period-of-operation assurance report for the scoped system.

Audit rights still require protection of sensitive systems. The scenario does not present the alternate condition: an auditor requests unrestricted production access to gather samples. The proper immediate action is to obtain an appropriate period-of-operation assurance report for the scoped system.

The reported condition calls for this action: Obtain an appropriate period-of-operation assurance report for the scoped system.

Question 58

A retail site stores full card numbers in error logs outside its approved cardholder-data environment. What should the enterprise security architect or analyst do NEXT?

Map PCI responsibilities across customer configuration and provider infrastructure.
Remove card data from logs and assess the expanded PCI scope.
Validate token vault and data-flow boundaries against PCI requirements.
Apply approved data minimization, secure transfer and environment controls.

Explanation

Correct Answer

Payment data exposure changes control boundaries. The controlling fact is: A retail site stores full card numbers in error logs outside its approved cardholder-data environment.

Incorrect Answers

Mapping PCI responsibilities across customer configuration and provider infrastructure would not remove card data from logs and assess the expanded PCI scope.

Tokenization reduces but may not eliminate compliance scope. The scenario does not present the alternate condition: a supplier says payment tokenization makes all remaining payment services out of scope. The proper immediate action is to remove card data from logs and assess the expanded PCI scope.

Applying approved data minimization, secure transfer and environment controls would not remove card data from logs and assess the expanded PCI scope.

Question 59

A marketing service changes its purpose for collected data without notifying customers. What is the appropriate security response for this scenario?

Assess controller/processor obligations and applicable transfer mechanisms.
Evaluate age-specific protections and consent obligations with counsel.
Review lawful purpose, notices and required consent before reuse.
Route the request through a documented rights workflow with deadlines.

Explanation

Correct Answer

Data reuse may exceed the original collection basis. The controlling fact is: A marketing service changes its purpose for collected data without notifying customers.

Incorrect Answers

Assessing controller/processor obligations and applicable transfer mechanisms would not review lawful purpose, notices and required consent.

The current facts call for this action: review lawful purpose, notices and required consent before reuse.

Routing the request through a documented rights workflow with deadlines would not review lawful purpose, notices and required consent.

Question 60

A subcontract requires incident notification within a short window but no response owner exists. What should the enterprise security architect or analyst do NEXT?

Check applicable export-control requirements before distribution.
Specify processor/controller roles and data subject response duties.
Check certification scope, entity and validity against the actual workload.
Assign contractual trigger detection and notification accountability.

Explanation

Correct Answer

Contract promises require an executable response process. The controlling fact is: A subcontract requires incident notification within a short window but no response owner exists.

Incorrect Answers

The reported condition calls for this action: Assign contractual trigger detection and notification accountability.

The current facts call for this action: assign contractual trigger detection and notification accountability.

Certification must cover the service being relied on. The scenario does not present the alternate condition: a cloud migration advertises an ISO 27001 certificate from an unrelated corporate subsidiary. The proper immediate action is to assign contractual trigger detection and notification accountability.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 4 - 10 Questions (Last Reviewed 04-Nov-2026)
CompTIA CAS-005 Practice Test 5 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CAS-005 Practice Test 6 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CAS-005 Practice Test 7 - 10 Questions (Last Reviewed 01-Nov-2026)
CompTIA CAS-005 Practice Test 8 - 10 Questions (Last Reviewed 31-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 50

Explanation

Correct Answer

Incorrect Answers

Question 51

Explanation

Correct Answer

Incorrect Answers

Question 52

Explanation

Correct Answer

Incorrect Answers

Question 53

Explanation

Correct Answer

Incorrect Answers

Question 54

Explanation

Correct Answer

Incorrect Answers

Question 55

Explanation

Correct Answer

Incorrect Answers

Question 56

Explanation

Correct Answer

Incorrect Answers

Question 57

Explanation

Correct Answer

Incorrect Answers

Question 58

Explanation

Correct Answer

Incorrect Answers

Question 59

Explanation

Correct Answer

Incorrect Answers

Question 60

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests