CAS-004 Security Architecture Practice Question
A financial services firm is designing its identity architecture for a Zero Trust program. Auditors require that authentication strength be continuously evaluated and that a compromised endpoint lose access to sensitive trading applications even after the user has already authenticated. The security architect must select TWO capabilities that directly support continuous, context-aware authorization decisions. (Choose two.)
⚠ Common exam trap
The trap here is equating stronger initial authentication or longer token lifetimes with continuous authorization, when the requirement is real-time re-evaluation after login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Continuous access evaluation that revokes active sessions when risk signals change
Continuous access evaluation and device posture attestation together give the policy engine live signals to make and revisit authorization decisions. Continuous access evaluation enforces revocation the moment risk changes, while posture attestation supplies the endpoint trust data that fuels those decisions. Combined, they ensure that a compromised device loses access to sensitive applications mid-session, satisfying the auditors' requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single sign-on portal that caches user credentials for the trading session
Why it's wrong here
Caching credentials in an SSO portal improves user experience but creates a static trust state. It does not evaluate device health, location, or behavioral risk during the session, and a cached credential can be replayed by an attacker on a compromised endpoint. This approach is contrary to continuous verification because access persists regardless of changing risk signals.
- ✗
Password complexity rules requiring rotation every 30 days for all identities
Why it's wrong here
Frequent password rotation and complexity rules address credential guessing but say nothing about endpoint compromise or session state. Once a user authenticates, these controls cannot revoke access or re-evaluate risk. Modern guidance discourages arbitrary rotation because it drives weaker, predictable passwords, and it does not deliver the continuous context-aware authorization the scenario requires.
- ✓
Continuous access evaluation that revokes active sessions when risk signals change
Why this is correct
Continuous access evaluation lets the policy engine react to new risk signals, such as a disabled account, a changed network location, or a flagged device, and revoke or re-challenge active sessions in near real time. This directly meets the auditor requirement that a compromised endpoint lose access even after successful authentication, rather than waiting for token expiry.
- ✗
Longer-lived refresh tokens to reduce reauthentication prompts for trading users
Why it's wrong here
Extending refresh token lifetime reduces friction but works against continuous evaluation because a stolen or compromised token remains valid longer. It increases the window of exposure after a device is compromised and does not provide the real-time revocation the auditors demand. This option optimizes convenience at the expense of the stated security objective.
- ✓
Device posture and health attestation sent to the policy decision point
Why this is correct
Device posture attestation supplies the policy decision point with current signals such as patch level, disk encryption, and endpoint detection agent status. Without these signals, authorization would rest only on the initial login. Feeding posture into each decision enables the engine to deny sensitive application access when the endpoint is later found compromised or noncompliant.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.