easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Deploying a new cloud-based application that…
A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.
Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted. Since the identity-aware proxy is correctly configured and SSO is working, but access is still failing, and the architect suspects microsegmentation rules are blocking traffic, the most direct first step is to review those rules. Option A (Deploy a VPN) would bypass zero-trust principles and is not the first step. Option B (Reset credentials) does not address the suspected firewall issue. Option D (Increase logging) is a diagnostic step but should come after checking the likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a VPN to provide a secure tunnel for remote users.
Why it's wrong here
VPNs conflict with zero-trust architecture and do not address the microsegmentation issue.
- ✗
Reset the affected users' credentials and force them to re-authenticate.
Why it's wrong here
Authentication is working; credential reset would not resolve the access issue.
- ✓
Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.
Why this is correct
The architect suspects microsegmentation; reviewing rules is the logical first step.
- ✗
Increase logging verbosity on the identity-aware proxy to capture more details.
Why it's wrong here
While logging helps, it is secondary to directly checking the suspected firewall rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.