easyMultiple SelectObjective-mapped
CAS-004 Practice Question: A security architect is designing a secure remote…
A security architect is designing a secure remote access solution for contractors who need temporary access to a few internal applications. Which THREE of the following are best practices for controlling contractor access? (Select THREE.)
⚠ Common exam trap
It's easy for candidates to confuse 'full network-level VPN access' (Option D) as secure because it uses encryption, but the exam focuses on the principle of least privilege and the need to restrict access to only the required applications, not the entire network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement just-in-time (JIT) temporary privilege elevation
Just-in-time (JIT) temporary privilege elevation ensures contractors only receive the minimum necessary permissions for a limited duration, reducing the attack surface and preventing standing privileges. This aligns with the principle of least privilege and zero-trust architectures, often implemented via tools like Azure AD PIM or AWS IAM Access Analyzer with time-bound policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow contractors to use a shared account for simplicity
Why it's wrong here
Shared accounts eliminate accountability and make auditing difficult.
- ✓
Implement just-in-time (JIT) temporary privilege elevation
Why this is correct
JIT provides access only when needed, reducing the risk of unused standing privileges.
- ✓
Create time-limited accounts that expire automatically
Why this is correct
Time-limited accounts ensure access is revoked after the contract period.
- ✗
Provide full network-level VPN access
Why it's wrong here
Full VPN access gives contractors unnecessary network visibility and violates least privilege.
- ✓
Use a VPN with application-level access control
Why this is correct
Application-level VPN restricts access to only the required applications.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.