Authentic CompTIA Certification Exam CAS-005 Questions Answers

The output shows that multiple systems have outdated or vulnerable software versions (OpenSSL 1.01 and Java 11 runtime). This suggests that the systems are not being patched regularly or effectively.

A. Automating the patching system to update base images: Automating the patching process ensures that the latest security updates and patches are applied to all systems, including newly deployed ones. This addresses the root cause by ensuring that base images used for deployment are always up-to-date with the latest security patches.

B. Recompiling the affected programs with the most current patches: While this can fix the immediate vulnerabilities, it does not address the root cause of the problem, which is the lack of regular updates.

C. Disabling unused/unneeded ports on all servers: This improves security but does not address the specific issue of outdated software.

D. Deploying a WAF with virtual patching upstream of the affected systems: This can provide a temporary shield but does not resolve the underlying issue of outdated software.

Automating the patching system to update base images ensures that all deployed systems are using the latest, most secure versions of software, addressing the root cause of the vulnerability trend.

Code signing uses cryptographic digital signatures to prove that software or updates come from a trusted source and have not been altered. In the SecurityX CAS-005 objectives, this is covered under security engineering and cryptographic assurance mechanisms.

Envelope encryption protects confidentiality but does not authenticate the source.

File integrity monitoring detects file changes but does not confirm the origin of the update.

Application control manages which software can run but does not ensure authenticity of distributed files.Only code signing meets all three objectives: verifying the source, ensuring authorization, and proving integrity.

The best way to reduce liability and secure customer environments is to require that all employee-owned laptops have a corporate-licensed and managed Endpoint Detection and Response (EDR) solution installed. This ensures that devices accessing sensitive customer infrastructure are monitored for malware, unauthorized processes, and suspicious behaviors. EDR provides visibility into endpoint security posture and enforces corporate security baselines, which unmanaged personal devices typically lack.

Option A (MDM with attestation) works well for corporate-owned devices but is difficult to enforce reliably across personally owned laptops. Option C (VPN with certificate authentication) ensures encrypted access but does not validate whether the device is secure. Option D (host checking to jump boxes) reduces exposure but still allows unmanaged endpoints to connect indirectly.

CAS-005 emphasizes endpoint controls and assurance mechanisms for environments with third-party or bring-your-own-device (BYOD) risk. Deploying managed EDR ensures visibility, consistent policies, and rapid response across all devices, making this the most secure and practical option.