hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Has implemented a zero-trust architecture for its…
An organization has implemented a zero-trust architecture for its mobile workforce. Employees use company-managed smartphones to access internal applications through a reverse proxy. Recently, users report that they are frequently prompted to re-authenticate, causing workflow interruptions. The security team wants to maintain zero-trust principles while improving the user experience. Analysis shows that session tokens are being revoked after a short idle timeout. Which adjustment should the security team implement to balance security and usability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement short-lived access tokens with refresh tokens that are automatically rotated
Implementing short-lived access tokens with refresh tokens that are automatically rotated aligns with zero-trust principles by minimizing token exposure time while allowing seamless re-authentication without user intervention. The refresh token is used to obtain new access tokens transparently, reducing workflow interruptions. Option A is incorrect because extending token lifetime increases the risk of token theft and misuse. Option B is incorrect because certificate-based authentication does not inherently reduce re-authentication frequency and adds management complexity. Option C is incorrect because reducing authentication factors weakens security and violates zero-trust principles. Option D is correct as it balances security and usability by providing continuous authentication through automatic token rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Extend the session token expiration time to reduce the frequency of re-authentication
Why it's wrong here
Longer token lifetimes increase the window for token theft and misuse.
- ✗
Replace token-based authentication with certificate-based authentication and revoke certificates based on device posture
Why it's wrong here
Replacing token-based authentication with certificate-based authentication does not address the specific problem of session tokens being revoked after a short idle timeout, because certificates themselves do not manage session persistence—they are a credential for initial authentication, not a mechanism to extend token lifetime or adjust idle session policies. This option is tempting because certificate-based authentication can enforce device posture checks at each access request, which aligns with zero-trust continuous verification; it would be the correct choice if the goal were to tie access to real-time device health rather than to resolve frequent re-authentication caused by an overly aggressive idle timeout.
- ✗
Reduce the number of authentication factors required for re-authentication
Why it's wrong here
Reducing factors weakens security and violates zero-trust principles.
- ✓
Implement short-lived access tokens with refresh tokens that are automatically rotated
Why this is correct
Refresh tokens allow seamless renewal of access without user intervention, while maintaining short token lifetimes.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.