CompTIA Updated CAS-005 Exam Questions and Answers by mattias

To mitigate the issue of excessive permissions and privilege creep, the best solutions are:

Implementing a Role-Based Access Policy:

Role-Based Access Control (RBAC): This policy ensures that access permissions are granted based on the user ' s role within the organization, aligning with the principle of least privilege. Users are only granted access necessary for their role, reducing the risk of excessive permissions.

The best answer is B. Privilege escalation . The most critical issue is the JWT header value " alg " : " None " , which indicates an unsigned token. If a workload accepts such a token, an attacker may be able to alter claims such as subject, role, scope, or account identity and then present the modified token as valid. Because the sample already references a service account in the token claims, the most concerning IAM consequence is unauthorized elevation of access through token forgery or manipulation. CompTIA’s SecurityX objectives include IAM and secure implementation of authentication and authorization controls; a broken token-validation scheme directly undermines authorization integrity.

Why the other options are not best:

A. Lateral movement could be a downstream result, but the immediate and primary risk in the token itself is unauthorized privilege gain. C. Credential stuffing involves reuse of stolen usernames and passwords, which is unrelated to this JWT issue. D. RCE from deserialization is a different application vulnerability class and is not the main concern shown by the JWT header and claims. The most direct risk here is privilege escalation via forged or altered tokens.

The best answer is D. Host-based encryption . The strongest clue is that the company has proprietary information on its hard drives and consultants must travel with company-managed devices because BYOD is prohibited. That makes protection of data at rest on the endpoint the primary concern. Host-based encryption protects the contents of the drive if a laptop is lost, stolen, or physically accessed during travel. CompTIA’s SecurityX certification emphasizes building secure solutions across complex environments and supporting resilient enterprise protection, which includes securing endpoints and sensitive data stored on them.

Why the other options are not best:

A. Virtual hardware does not directly protect the data on the hard drive if the device is lost or stolen. B. Measured boot helps validate platform integrity at startup, but it does not primarily protect confidential data at rest. C. Secure enclave can protect certain secrets and key material, but it is narrower than full host-based encryption for an entire laptop drive. Because the requirement is specifically about proprietary data on traveling endpoints, full device or host-based encryption is the most beneficial control.