CompTIA CAS-005 Exam - Topic 3 Question 8 Discussion

Actual exam question for CompTIA's CAS-005 exam

Question #: 8
Topic #: 3

[All CAS-005 Questions]

A user reports application access issues to the help desk. The help desk reviews the logs for the user

Which of the following is most likely The reason for the issue?

AThe user inadvertently tripped the impossible travel security rule in the SSO system.

BA threat actor has compromised the user's account and attempted to lop, m

CThe user is not allowed to access the human resources system outside of business hours

DThe user did not attempt to connect from an approved subnet

Show Suggested Answer

Suggested Answer: A

Based on the provided logs, the user has accessed various applications from different geographic locations within a very short timeframe. This pattern is indicative of the 'impossible travel' security rule, a common feature in Single Sign-On (SSO) systems designed to detect and prevent fraudulent access attempts.

Analysis of Logs:

At 8:47 p.m., the user accessed a VPN from Toronto.

At 8:48 p.m., the user accessed email from Los Angeles.

At 8:48 p.m., the user accessed the human resources system from Los Angeles.

At 8:49 p.m., the user accessed email again from Los Angeles.

At 8:52 p.m., the user attempted to access the human resources system from Toronto, which was denied.

These rapid changes in location are physically impossible and typically trigger security measures to prevent unauthorized access. The SSO system detected these inconsistencies and likely flagged the activity as suspicious, resulting in access denial.

CompTIA SecurityX Study Guide

NIST Special Publication 800-63B, 'Digital Identity Guidelines'

'Impossible Travel Detection,' Microsoft Documentation

by Ma at Jan 13, 2025, 06:21 PM

Limited Time Offer

25%

Off

Get Premium CAS-005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ivette

3 months ago

A is a common issue. I've seen it happen before.

upvoted 0 times

...

Ngoc

3 months ago

D seems too simple. Are we sure it’s not something more serious?

upvoted 0 times

...

Lorean

3 months ago

Wait, could it really be C? I thought HR access was flexible.

upvoted 0 times

...

Kent

4 months ago

Nah, I’m leaning towards B. Sounds like a security breach.

upvoted 0 times

...

Verlene

4 months ago

I think it's definitely A. Impossible travel rules can be tricky.

upvoted 0 times

...

Laura

4 months ago

I vaguely remember something about approved subnets in our last session, so option D might be relevant, but I’m not confident about how strict those rules are.

upvoted 0 times

...

Merissa

4 months ago

I feel like option C is a strong contender since access restrictions based on time are common, but I can't recall if the user was trying to access it after hours.

upvoted 0 times

...

Ozell

4 months ago

I think option B could be a possibility too, especially if there's been recent suspicious activity on the account. It reminds me of a practice question we did on account compromise.

upvoted 0 times

...

Gracia

5 months ago

I remember studying about impossible travel rules in SSO systems, so option A seems plausible, but I'm not entirely sure how it applies here.

upvoted 0 times

...

Lisbeth

5 months ago

Alright, time to put on my detective hat. I'll start by reviewing the logs for any suspicious activity that could indicate an account compromise or unauthorized access attempt.

upvoted 0 times

...

Dorothea

5 months ago

I'm a bit unsure about this one. There are a few different security-related factors to consider, so I'll need to think through each option carefully.

upvoted 0 times

...

Izetta

5 months ago

Ah, this is a classic security-related question. I'm pretty confident I can narrow it down to the right answer by analyzing the information provided in the logs.

upvoted 0 times

...

Meaghan

5 months ago

Okay, let's see here. The user reported access issues, so I'll need to focus on the security-related options like the impossible travel rule or an account compromise.

upvoted 0 times

...