CompTIA CAS-005 Practice Test 7

Question 60

A subcontract requires incident notification within a short window but no response owner exists. What should the enterprise security architect or analyst do NEXT?

Check applicable export-control requirements before distribution.
Specify processor/controller roles and data subject response duties.
Check certification scope, entity and validity against the actual workload.
Assign contractual trigger detection and notification accountability.

Explanation

Correct Answer

Contract promises require an executable response process. The controlling fact is: A subcontract requires incident notification within a short window but no response owner exists.

Incorrect Answers

The reported condition calls for this action: Assign contractual trigger detection and notification accountability.

The current facts call for this action: assign contractual trigger detection and notification accountability.

Certification must cover the service being relied on. The scenario does not present the alternate condition: a cloud migration advertises an ISO 27001 certificate from an unrelated corporate subsidiary. The proper immediate action is to assign contractual trigger detection and notification accountability.

Question 61

A control catalogue lists CIS Benchmarks but never checks deployed host settings. Which action is MOST defensible given these facts?

Use configuration assessments to test relevant benchmark safeguards.
Build a service-specific control and responsibility mapping.
Use CSF to organize cybersecurity outcomes and governance improvements.
Assign governance decision structures and service-management procedures appropriately.

Explanation

Correct Answer

A benchmark reference is not proof of implementation. The controlling fact is: A control catalogue lists CIS Benchmarks but never checks deployed host settings.

Incorrect Answers

The current facts call for this action: use configuration assessments to test relevant benchmark safeguards.

The framework is not a personnel punishment matrix. The scenario does not present the alternate condition: a company maps NIST CSF functions directly to employee disciplinary outcomes. The proper immediate action is to use configuration assessments to test relevant benchmark safeguards.

The reported condition calls for this action: Use configuration assessments to test relevant benchmark safeguards.

Question 62

An internal assessor tests control design and calls the result an independent certification. Which action is the BEST response to the security requirement?

Obtain an appropriate period-of-operation assurance report for the scoped system.
Distinguish internal assessment from accredited external certification.
Verify completed remediation against objective test artifacts.
Provide least-privilege, supervised evidence access under audit protocol.

Explanation

Correct Answer

Assurance terminology must match who evaluated what. The controlling fact is: An internal assessor tests control design and calls the result an independent certification.

Incorrect Answers

Obtaining an appropriate period-of-operation assurance report for the scoped system would not distinguish internal assessment from accredited external certification.

A closure declaration cannot substitute for validation. The scenario does not present the alternate condition: a compliance review finds corrective actions but lacks evidence they were closed. The proper immediate action is to distinguish internal assessment from accredited external certification.

Providing least-privilege, supervised evidence access under audit protocol would not distinguish internal assessment from accredited external certification.

Question 63

An investigator copies employee chat records overseas without checking transfer restrictions. Which control or decision MOST directly resolves the stated gap?

Suspend relevant deletion, preserve evidence and record hold scope.
Publish verified facts, clearly labeled uncertainty and protected evidence.
Review jurisdictional and discovery transfer requirements with counsel.
Preserve required records and update the governance process prospectively.

Explanation

Correct Answer

Legal discovery does not erase privacy obligations. The controlling fact is: An investigator copies employee chat records overseas without checking transfer restrictions.

Incorrect Answers

Suspend relevant deletion, preserve evidence and record hold scope would not review jurisdictional and discovery transfer requirements with counsel. Legal discovery does not erase privacy obligations.

The current facts call for this action: review jurisdictional and discovery transfer requirements with counsel.

Preserving required records and updating the governance process prospectively would not review jurisdictional and discovery transfer requirements with counsel. Legal discovery does not erase privacy obligations.

Question 64

A supplier says payment tokenization makes all remaining payment services out of scope. What is the appropriate security response for this scenario?

Map PCI responsibilities across customer configuration and provider infrastructure.
Remove card data from logs and assess the expanded PCI scope.
Apply approved data minimization, secure transfer and environment controls.
Validate token vault and data-flow boundaries against PCI requirements.

Explanation

Correct Answer

Tokenization reduces but may not eliminate compliance scope. The controlling fact is: A supplier says payment tokenization makes all remaining payment services out of scope.

Incorrect Answers

The reported condition calls for this action: Validate token vault and data-flow boundaries against PCI requirements.

The current facts call for this action: validate token vault and data-flow boundaries against PCI requirements.

A testing purpose does not waive card-data safeguards. The scenario does not present the alternate condition: a payment processor plans to copy unencrypted transaction payloads into a debugging tenant. The proper immediate action is to validate token vault and data-flow boundaries against PCI requirements.

Question 65

A compliance review finds corrective actions but lacks evidence they were closed. Which control or decision MOST directly resolves the stated gap?

Verify completed remediation against objective test artifacts.
Provide least-privilege, supervised evidence access under audit protocol.
Distinguish internal assessment from accredited external certification.
Obtain an appropriate period-of-operation assurance report for the scoped system.

Explanation

Correct Answer

A closure declaration cannot substitute for validation. The controlling fact is: A compliance review finds corrective actions but lacks evidence they were closed.

Incorrect Answers

The current facts call for this action: verify completed remediation against objective test artifacts.

Assurance terminology must match who evaluated what. The scenario does not present the alternate condition: an internal assessor tests control design and calls the result an independent certification. The proper immediate action is to verify completed remediation against objective test artifacts.

The reported condition calls for this action: Verify completed remediation against objective test artifacts.

Question 66

A merchant disables vulnerability scans because the provider maintains the operating system. What is the appropriate security response for this scenario?

Apply approved data minimization, secure transfer and environment controls.
Map PCI responsibilities across customer configuration and provider infrastructure.
Validate token vault and data-flow boundaries against PCI requirements.
Remove card data from logs and assess the expanded PCI scope.

Explanation

Correct Answer

Shared responsibility must be verified for the actual service. The controlling fact is: A merchant disables vulnerability scans because the provider maintains the operating system.

Incorrect Answers

Applying approved data minimization, secure transfer and environment controls would not map PCI responsibilities across customer configuration and provider infrastructure.

Tokenization reduces but may not eliminate compliance scope. The scenario does not present the alternate condition: a supplier says payment tokenization makes all remaining payment services out of scope. The proper immediate action is to map PCI responsibilities across customer configuration and provider infrastructure.

Removing card data from logs and assessing the expanded PCI scope would not map PCI responsibilities across customer configuration and provider infrastructure.

Question 67

A healthcare partnership signs a data contract without defining which party handles requests. What should the enterprise security architect or analyst do NEXT?

Check applicable export-control requirements before distribution.
Assign contractual trigger detection and notification accountability.
Specify processor/controller roles and data subject response duties.
Check certification scope, entity and validity against the actual workload.

Explanation

Correct Answer

Ambiguous roles weaken regulatory compliance. The controlling fact is: A healthcare partnership signs a data contract without defining which party handles requests.

Incorrect Answers

Checking applicable export-control requirements would not specify processor/controller roles and data subject response duties.

The current facts call for this action: specify processor/controller roles and data subject response duties.

Checking certification scope, entity and validity against the actual workload would not specify processor/controller roles and data subject response duties.

Question 68

A multinational firm shares user profiles with a new offshore analytics vendor. Which action is MOST defensible given these facts?

Route the request through a documented rights workflow with deadlines.
Review lawful purpose, notices and required consent before reuse.
Evaluate age-specific protections and consent obligations with counsel.
Assess controller/processor obligations and applicable transfer mechanisms.

Explanation

Correct Answer

Cross-border sharing requires valid legal and contractual grounds. The controlling fact is: A multinational firm shares user profiles with a new offshore analytics vendor.

Incorrect Answers

The reported condition calls for this action: Assess controller/processor obligations and applicable transfer mechanisms.

The current facts call for this action: assess controller/processor obligations and applicable transfer mechanisms.

Special rules can apply when services target children. The scenario does not present the alternate condition: a children-focused service plans new tracking and claims ordinary adult consent is sufficient. The proper immediate action is to assess controller/processor obligations and applicable transfer mechanisms.

Question 69

Security leaders confuse COBIT governance with the IT service change workflow. Which action is the BEST response to the security requirement?

Assign governance decision structures and service-management procedures appropriately.
Use configuration assessments to test relevant benchmark safeguards.
Use CSF to organize cybersecurity outcomes and governance improvements.
Build a service-specific control and responsibility mapping.

Explanation

Correct Answer

Governance and service operation solve different problems. The controlling fact is: Security leaders confuse COBIT governance with the IT service change workflow.

Incorrect Answers

The current facts call for this action: assign governance decision structures and service-management procedures appropriately.

The framework is not a personnel punishment matrix. The scenario does not present the alternate condition: a company maps NIST CSF functions directly to employee disciplinary outcomes. The proper immediate action is to assign governance decision structures and service-management procedures appropriately.

The reported condition calls for this action: Assign governance decision structures and service-management procedures appropriately.

Question 70

A regulator requests a historical audit trail and the retention policy has no exception path. Which control or decision MOST directly resolves the stated gap?

Suspend relevant deletion, preserve evidence and record hold scope.
Preserve required records and update the governance process prospectively.
Publish verified facts, clearly labeled uncertainty and protected evidence.
Review jurisdictional and discovery transfer requirements with counsel.

Explanation

Correct Answer

Mandatory retention must be represented in policy and controls. The controlling fact is: A regulator requests a historical audit trail and the retention policy has no exception path.

Incorrect Answers

Suspend relevant deletion, preserve evidence and record hold scope would not preserve required records and update the governance process prospectively.

Truthful reporting is essential in legal processes. The scenario does not present the alternate condition: a legal team requests an incident report before the facts are established. The proper immediate action is to preserve required records and update the governance process prospectively.

Reviewing jurisdictional and discovery transfer requirements with counsel would not preserve required records and update the governance process prospectively.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 5 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CAS-005 Practice Test 6 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CAS-005 Practice Test 7 - 10 Questions (Last Reviewed 01-Nov-2026)
CompTIA CAS-005 Practice Test 8 - 10 Questions (Last Reviewed 31-Oct-2026)
CompTIA CAS-005 Practice Test 9 - 10 Questions (Last Reviewed 30-Oct-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 60

Explanation

Correct Answer

Incorrect Answers

Question 61

Explanation

Correct Answer

Incorrect Answers

Question 62

Explanation

Correct Answer

Incorrect Answers

Question 63

Explanation

Correct Answer

Incorrect Answers

Question 64

Explanation

Correct Answer

Incorrect Answers

Question 65

Explanation

Correct Answer

Incorrect Answers

Question 66

Explanation

Correct Answer

Incorrect Answers

Question 67

Explanation

Correct Answer

Incorrect Answers

Question 68

Explanation

Correct Answer

Incorrect Answers

Question 69

Explanation

Correct Answer

Incorrect Answers

Question 70

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests