Pass Your CompTIA CAS-005 Exam Easy!

Suspend relevant deletion, preserve evidence and record hold scope would not preserve required records and update the governance process prospectively.

Truthful reporting is essential in legal processes. The scenario does not present the alternate condition: a legal team requests an incident report before the facts are established. The proper immediate action is to preserve required records and update the governance process prospectively.

Reviewing jurisdictional and discovery transfer requirements with counsel would not preserve required records and update the governance process prospectively.

Routing the request through a documented rights workflow with deadlines would not meet the need for age-specific protections and consent obligations with counsel.

The current facts call for this action: evaluate age-specific protections and consent obligations with counsel.

Assessing controller/processor obligations and applicable transfer mechanisms would not meet the need for age-specific protections and consent obligations with counsel.

The reported condition calls for this action: Apply approved data minimization, secure transfer and environment controls.

The current facts call for this action: apply approved data minimization, secure transfer and environment controls.

Payment data exposure changes control boundaries. The scenario does not present the alternate condition: a retail site stores full card numbers in error logs outside its approved cardholder-data environment. The proper immediate action is to apply approved data minimization, secure transfer and environment controls.

The current facts call for this action: publish verified facts, clearly labeled uncertainty and protected evidence.

Mandatory retention must be represented in policy and controls. The scenario does not present the alternate condition: a regulator requests a historical audit trail and the retention policy has no exception path. The proper immediate action is to publish verified facts, clearly labeled uncertainty and protected evidence.

The reported condition calls for this action: Publish verified facts, clearly labeled uncertainty and protected evidence.

Verifying completed remediation against objective test artifacts would not provide least-privilege, supervised evidence access under audit protocol.

Assurance terminology must match who evaluated what. The scenario does not present the alternate condition: an internal assessor tests control design and calls the result an independent certification. The proper immediate action is to provide least-privilege, supervised evidence access under audit protocol.

Obtaining an appropriate period-of-operation assurance report for the scoped system would not provide least-privilege, supervised evidence access under audit protocol.

Assigning contractual trigger detection and notification accountability would not check certification scope, entity and validity against the actual workload.

The current facts call for this action: check certification scope, entity and validity against the actual workload.

Checking applicable export-control requirements would not check certification scope, entity and validity against the actual workload.

The reported condition calls for this action: Build a service-specific control and responsibility mapping.

The current facts call for this action: build a service-specific control and responsibility mapping.

A benchmark reference is not proof of implementation. The scenario does not present the alternate condition: a control catalogue lists CIS Benchmarks but never checks deployed host settings. The proper immediate action is to build a service-specific control and responsibility mapping.

The current facts call for this action: model how a malicious actor could abuse recovery and identity proofing.

Organizational change can invalidate earlier controls. The scenario does not present the alternate condition: a release removes approval steps after a staffing change. The proper immediate action is to model how a malicious actor could abuse recovery and identity proofing.

The reported condition calls for this action: Model how a malicious actor could abuse recovery and identity proofing.

Identifying unsanctioned cloud services and assessing sensitive data exposure would not address the need for enumerate inherited external assets and assign accountable owners.

Information leakage can ease adversary reconnaissance. The scenario does not present the alternate condition: a website reveals sensitive internal service naming in public configuration files. The proper immediate action is to enumerate inherited external assets and assign accountable owners.

Mapping the data flow and reviewing trust crossings and third-party controls would not address the need for enumerate inherited external assets and assign accountable owners.

Model integrity and operational impacts would not prioritize account takeover and transaction misuse threat scenarios.

The current facts call for this action: prioritize account takeover and transaction misuse threat scenarios.

Prioritizing credible espionage paths across supplier trust connections would not prioritize account takeover and transaction misuse threat scenarios.

The reported condition calls for this action: Map observed behavior to supported ATT&CK techniques only.

The current facts call for this action: map observed behavior to supported ATT&CK techniques only.

Attack patterns organize recurring exploitation behaviors. The scenario does not present the alternate condition: a design team wants reusable examples of how attackers abuse password reset workflows. The proper immediate action is to map observed behavior to supported ATT&CK techniques only.