Pass Your CompTIA CAS-005 Exam Easy!

The reported condition calls for this action: Map observed behavior to supported ATT&CK techniques only.

The current facts call for this action: map observed behavior to supported ATT&CK techniques only.

Attack patterns organize recurring exploitation behaviors. The scenario does not present the alternate condition: a design team wants reusable examples of how attackers abuse password reset workflows. The proper immediate action is to map observed behavior to supported ATT&CK techniques only.

The current facts call for this action: build a path graph showing the privilege escalation route and place a control at that edge.

Control investment should follow credible, consequential paths. The scenario does not present the alternate condition: a threat model lists 40 theoretical attacks but provides no decision ranking. The proper immediate action is to build a path graph showing the privilege escalation route and place a control at that edge.

The reported condition calls for this action: Build a path graph showing the privilege escalation route and place a control at that edge.

Model denial-of-service abuse and bound resource admission would not address the need for model spoofing and elevation risks at the authorization boundary.

Nonbusiness telemetry can cross confidentiality boundaries. The scenario does not present the alternate condition: a batch processor logs personal fields to a broad telemetry channel. The proper immediate action is to model spoofing and elevation risks at the authorization boundary.

Model tampering and repudiation threats and add accountable integrity logs would not address the need for model spoofing and elevation risks at the authorization boundary.

Reassess workflow abuse and separation-of-duty threats would not address the need for draw explicit trust boundaries and test cross-tenant access paths.

The current facts call for this action: draw explicit trust boundaries and test cross-tenant access paths.

Model how a malicious actor could abuse recovery and identity proofing would not address the need for draw explicit trust boundaries and test cross-tenant access paths.

The reported condition calls for this action: Map the data flow and review trust crossings and third-party controls.

The current facts call for this action: map the data flow and review trust crossings and third-party controls.

Information leakage can ease adversary reconnaissance. The scenario does not present the alternate condition: a website reveals sensitive internal service naming in public configuration files. The proper immediate action is to map the data flow and review trust crossings and third-party controls.

The current facts call for this action: model tampering and repudiation threats and add accountable integrity logs.

Nonbusiness telemetry can cross confidentiality boundaries. The scenario does not present the alternate condition: a batch processor logs personal fields to a broad telemetry channel. The proper immediate action is to model tampering and repudiation threats and add accountable integrity logs.

The reported condition calls for this action: Model tampering and repudiation threats and add accountable integrity logs.

Prioritizing account takeover and transaction misuse threat scenarios would not address the need for model integrity and operational impacts.

Supply-chain access changes plausible attack likelihood. The scenario does not present the alternate condition: a research laboratory stores high-value design files and has supplier engineering access. The proper immediate action is to model integrity and operational impacts before choosing mitigations.

Model availability and integrity abuse proportionately to attacker capability would not address the need for model integrity and operational impacts.

Rank feasible paths by prerequisites, exposure and business impact would not address the need for model the shared failure node.

The current facts call for this action: model the shared failure node before finalizing resilience controls.

Building a path graph showing the privilege escalation route and placing a control at that edge would not address the need for model the shared failure node.

The reported condition calls for this action: Use CAPEC patterns to enumerate relevant abuse cases.

The current facts call for this action: use CAPEC patterns to enumerate relevant abuse cases.

Lifecycle mapping identifies missing telemetry coverage. The scenario does not present the alternate condition: threat hunters focus only on initial access and ignore persistence and exfiltration. The proper immediate action is to use CAPEC patterns to enumerate relevant abuse cases.

The current facts call for this action: model information disclosure from the changed data flow.

Untrusted requests can exhaust shared resources. The scenario does not present the alternate condition: a public endpoint queues unbounded expensive reports for any visitor. The proper immediate action is to model information disclosure from the changed data flow.

The reported condition calls for this action: Model information disclosure from the changed data flow.

Model how a malicious actor could abuse recovery and identity proofing would not address the need for reassess workflow abuse and separation-of-duty threats.

Different subjects create different threat opportunities. The scenario does not present the alternate condition: a service grants the same permissions to batch automation and interactive staff. The proper immediate action is to reassess workflow abuse and separation-of-duty threats.

Draw explicit trust boundaries and test cross-tenant access paths would not address the need for reassess workflow abuse and separation-of-duty threats.