CompTIA CAS-005 Practice Test 60

Question 590

A cloud bucket becomes public but access logs show only denied reads. Which control or decision MOST directly resolves the stated gap?

Snapshot appropriate disks and retain control-plane identity and execution logs.
Record exposure window without asserting confirmed data theft.
Review grants and revoke unauthorized tokens and sessions.
Bind events to canonical immutable account and resource identifiers.

Explanation

Correct Answer

Configuration risk and observed exfiltration are distinct. The controlling fact is: A cloud bucket becomes public but access logs show only denied reads.

Incorrect Answers

Snapshot appropriate disks and retain control-plane identity and execution logs would not record exposure window without asserting confirmed data theft.

Password changes do not necessarily terminate delegated access. The scenario does not present the alternate condition: a compromised SaaS account has active OAuth grants after password reset. The proper immediate action is to record exposure window without asserting confirmed data theft.

Immutable evidence retention would not record exposure window without asserting confirmed data theft.

Question 591

A memory dump contains user credentials and must be shared with an external expert. What is the appropriate security response for this scenario?

Label missing portions and repeat a verified acquisition if feasible.
Capture authorized volatile evidence before reboot where safety permits.
Minimize and protect sensitive content through controlled exchange.
Use approved acquisition storage, hashes and custody records.

Explanation

Correct Answer

Forensic evidence may carry secrets unrelated to the investigation. The controlling fact is: A memory dump contains user credentials and must be shared with an external expert.

Incorrect Answers

Label missing portions and repeat a verified acquisition if feasible would not address the need for minimize and protect sensitive content through controlled exchange.

The current facts call for this action: minimize and protect sensitive content through controlled exchange.

Using approved acquisition storage, hashes and custody records would not address the need for minimize and protect sensitive content through controlled exchange.

Question 592

A public incident statement is drafted before legal and investigation teams verify affected data. What should the enterprise security architect or analyst do NEXT?

Validate remediation through controlled retesting.
Define decision authority and communications roles in the plan.
Rehearse full business transaction recovery with shared dependencies.
Coordinate factual disclosures with authorized communications and counsel.

Explanation

Correct Answer

External reporting should preserve truth and obligations. The controlling fact is: A public incident statement is drafted before legal and investigation teams verify affected data.

Incorrect Answers

The reported condition calls for this action: Coordinate factual disclosures with authorized communications and counsel.

The current facts call for this action: coordinate factual disclosures with authorized communications and counsel.

A restored server is not necessarily a restored service. The scenario does not present the alternate condition: a disaster recovery drill restores infrastructure but not the business service's dependent identity provider. The proper immediate action is to coordinate factual disclosures with authorized communications and counsel.

Question 593

A sample's strings contain a domain but there are no observed network connections. What is the appropriate security response for this scenario?

Treat the domain as a hypothesis and correlate with execution evidence.
Supplement dynamic analysis with static inspection and alternative isolated conditions.
Use an isolated sandbox with controlled network simulation.
Use approved private analysis and review disclosure restrictions.

Explanation

Correct Answer

Static indicators alone do not prove contacted infrastructure. The controlling fact is: A sample's strings contain a domain but there are no observed network connections.

Incorrect Answers

The current facts call for this action: treat the domain as a hypothesis and correlate with execution evidence.

Dynamic analysis should not expose production systems. The scenario does not present the alternate condition: a suspect executable requires detonation to reveal its persistent behavior. The proper immediate action is to treat the domain as a hypothesis and correlate with execution evidence.

The reported condition calls for this action: Treat the domain as a hypothesis and correlate with execution evidence.

Question 594

An incident exercise reaches resolution but never tests whether the same access path remains open. What should the enterprise security architect or analyst do NEXT?

Coordinate factual disclosures with authorized communications and counsel.
Validate remediation through controlled retesting.
Define decision authority and communications roles in the plan.
Rehearse full business transaction recovery with shared dependencies.

Explanation

Correct Answer

Recovery needs evidence of reduced residual exposure. The controlling fact is: An incident exercise reaches resolution but never tests whether the same access path remains open.

Incorrect Answers

Coordinate factual disclosures with authorized communications and counsel would not validate remediation through controlled retesting.

Clear escalation boundaries reduce response delay. The scenario does not present the alternate condition: a tabletop exposes confusion between technical incident commander and executive crisis owner. The proper immediate action is to validate remediation through controlled retesting.

Rehearse full business transaction recovery with shared dependencies would not validate remediation through controlled retesting.

Question 595

A network trace includes a file transfer that responders need to preserve for analysis. Which action is MOST defensible given these facts?

Investigate filtering, response path and sensor vantage before declaring connection success.
Measure capture loss and corroborate with flow and endpoint counters.
Safely reassemble the transferred object and hash the extracted evidence.
Use authorized TLS metadata and endpoint process evidence for context.

Explanation

Correct Answer

Reproducible artifact acquisition supports later review. The controlling fact is: A network trace includes a file transfer that responders need to preserve for analysis.

Incorrect Answers

Investigating filtering, response path and sensor vantage would not address the need for safely reassemble the transferred object and hash the extracted evidence.

The current facts call for this action: safely reassemble the transferred object and hash the extracted evidence.

Using authorized TLS metadata and endpoint process evidence for context would not address the need for safely reassemble the transferred object and hash the extracted evidence.

Question 596

A containment rule will block a shared SaaS endpoint used by every department. Which action is the BEST response to the security requirement?

Coordinate isolation using a safety-approved alternative workflow.
Revoke sessions and credentials under authorized incident controls.
Preserve required artifacts before irreversible recovery where feasible.
Prefer scoped account or workload restrictions before global denial.

Explanation

Correct Answer

Broad controls may cause avoidable business outages. The controlling fact is: A containment rule will block a shared SaaS endpoint used by every department.

Incorrect Answers

The reported condition calls for this action: Prefer scoped account or workload restrictions before global denial.

The current facts call for this action: prefer scoped account or workload restrictions before global denial.

Eradication actions can destroy investigation evidence. The scenario does not present the alternate condition: a security team plans to wipe a suspected endpoint before collecting necessary evidence. The proper immediate action is to prefer scoped account or workload restrictions before global denial.

Question 597

A collected memory image is incomplete because the acquisition tool crashed. Which control or decision MOST directly resolves the stated gap?

Label missing portions and repeat a verified acquisition if feasible.
Minimize and protect sensitive content through controlled exchange.
Use approved acquisition storage, hashes and custody records.
Capture authorized volatile evidence before reboot where safety permits.

Explanation

Correct Answer

Partial images cannot support complete conclusions. The controlling fact is: A collected memory image is incomplete because the acquisition tool crashed.

Incorrect Answers

The current facts call for this action: label missing portions and repeat a verified acquisition if feasible.

Evidence integrity and provenance are essential. The scenario does not present the alternate condition: responders copy memory files to a personal USB stick without chain-of-custody records. The proper immediate action is to label missing portions and repeat a verified acquisition if feasible.

The reported condition calls for this action: Label missing portions and repeat a verified acquisition if feasible.

Question 598

A compliance report names a person as a malicious insider based solely on one anomalous login. What is the appropriate security response for this scenario?

Preserve authorization and session evidence and contain any active grant.
Label facts, uncertainty and corroboration needs.
Review job duties, authorization and contextual transfer evidence fairly.
Use approved proportional and privacy-aware investigative scope.

Explanation

Correct Answer

Attribution should not outrun evidence. The controlling fact is: A compliance report names a person as a malicious insider based solely on one anomalous login.

Incorrect Answers

Preserving authorization and session evidence and contain any active grant would not address the need for label facts, uncertainty and corroboration needs.

Unusual volume does not automatically establish malicious intent. The scenario does not present the alternate condition: a departing employee downloads more documents than their historical baseline. The proper immediate action is to label facts, uncertainty and corroboration needs.

Using approved proportional and privacy-aware investigative scope would not address the need for label facts, uncertainty and corroboration needs.

Question 599

Investigators cannot correlate API actions because cloud accounts use different local display names. What should the enterprise security architect or analyst do NEXT?

Record exposure window without asserting confirmed data theft.
Snapshot appropriate disks and retain control-plane identity and execution logs.
Bind events to canonical immutable account and resource identifiers.
Review grants and revoke unauthorized tokens and sessions.

Explanation

Correct Answer

Cloud attribution requires stable identities. The controlling fact is: Investigators cannot correlate API actions because cloud accounts use different local display names.

Incorrect Answers

Recording exposure window without asserting confirmed data theft would not address the need for immutable evidence retention.

The current facts call for this action: bind events to canonical immutable account and resource identifiers.

Reviewing grants and revoking unauthorized tokens and sessions would not address the need for immutable evidence retention.

Question 600

Lessons learned produce a list of recommendations without owners or validation dates. Which action is MOST defensible given these facts?

Examine systemic control gaps and contributing factors without blame.
Trace identity and endpoint events to explain the privilege path.
Build a normalized event timeline retaining raw source timestamps.
Assign accountable remediation, due dates and follow-up tests.

Explanation

Correct Answer

Lessons have value only when controls change. The controlling fact is: Lessons learned produce a list of recommendations without owners or validation dates.

Incorrect Answers

The reported condition calls for this action: Assign accountable remediation, due dates and follow-up tests.

The current facts call for this action: assign accountable remediation, due dates and follow-up tests.

Reliable chronology requires temporal context. The scenario does not present the alternate condition: teams combine audit logs from multiple time zones without normalizing clock offsets. The proper immediate action is to assign accountable remediation, due dates and follow-up tests.

Pass Your CompTIA CAS-005 Exam Easy!

Question 590

Explanation

Correct Answer

Incorrect Answers

Question 591

Explanation

Correct Answer

Incorrect Answers

Question 592

Explanation

Correct Answer

Incorrect Answers

Question 593

Explanation

Correct Answer

Incorrect Answers

Question 594

Explanation

Correct Answer

Incorrect Answers

Question 595

Explanation

Correct Answer

Incorrect Answers

Question 596

Explanation

Correct Answer

Incorrect Answers

Question 597

Explanation

Correct Answer

Incorrect Answers

Question 598

Explanation

Correct Answer

Incorrect Answers

Question 599

Explanation

Correct Answer

Incorrect Answers

Question 600

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests