CompTIA CAS-005 Exam Dumps

To prevent unauthorized applications from running, the company needs a mechanism to explicitly define and enforce which applications are allowed to execute. 'Permit listing' (often referred to as 'whitelisting' in security contexts) is the most effective solution here. It involves creating a list of approved applications, and only those on the list are permitted to run, blocking all others by default. This directly addresses the root cause---users installing unapproved software---by restricting execution to only authorized programs.

Option A (Signing):Code signing ensures the authenticity and integrity of software by verifying it comes from a trusted source and hasn't been tampered with. While useful, it doesn't inherently prevent unauthorized applications from running unless combined with a policy like whitelisting.

Option B (Access control):Access control governs who can access systems or resources but doesn't specifically restrict which applications can execute. It's too broad for this scenario.

Option C (HIPS):A Host-based Intrusion Prevention System (HIPS) can detect and block malicious behavior, but it's reactive and relies on signatures or heuristics, not a proactive allow-only approach.

Option D (Permit listing):This is the best fit, as it proactively enforces a policy where only explicitly authorized applications can run, preventing malware introduced by unauthorized software.

Understanding the Security Event:

Unauthorized usersgained access from non-production to production.

IAM policies were weak, allowingbulk user creation.

Vulnerability assessments were disabled, andpatching was delayed.

Logs were unavailable, making incident response difficult.

Why Options A, D, and E areCorrect:

A (Disable bulk user creation by IAM team) Prevents unauthorized mass user account creation, which could beexploited by attackers.

D (Routine updates for endpoints & network devices) Patch management ensuresvulnerabilities are not left open for attackers.

E (Ensure all security/network devices send logs to SIEM) Helps withreal-time monitoring and detection of unauthorized activities.

Why Other Options Are Incorrect:

B (180-day log retention) While log retention is good,real-time monitoring is the priority.

C (Review application allow list daily) Reviewing itdaily is impractical. Regular audits are better.

F (Restrict production-to-non-production traffic) The issue isunauthorized access, not traffic routing.

CompTIA SecurityX CAS-005 Official Study Guide:IAM, Patch Management & SIEM Logging Best Practices

NIST 800-53 (AC-2, AU-12):Audit Logging & Access Control

The question states that security scanning and quality assurance (QA) in the CI/CD pipeline have been completed with no issues, indicating that the code in the test branch is ready for production. According to the CompTIA SecurityX CAS-005 study guide (Domain 2: Security Operations, 2.3), in a secure CI/CD pipeline, once code passes automated security scans, QA, and other checks (e.g., unit testing, peer reviews), the next step is to merge the tested branch into the main branch for deployment to production.

Option B:Threat modeling is typically performed earlier, during design or development, not after passing CI/CD checks.

Option C:Unit testing is part of the CI/CD pipeline and should already be completed.

Option D:Peer reviews are conducted before or during the test phase, not after QAand security scans are clear.

Option A:Merging the test branch to the main branch is the logical next step to prepare for production deployment.

CompTIA SecurityX CAS-005 Official Study Guide, Domain 2: Security Operations, Section 2.3: 'Manage secure software development lifecycles, including CI/CD pipelines.'

CAS-005 Exam Objectives, 2.3: 'Analyze secure deployment processes in CI/CD environments.'

The organization is most concerned about Generative AI improving phishing and social engineering attacks. Tools like ChatGPT can generate highly convincing phishing emails, fake websites, and human-like interactions that bypass traditional detection methods. Employees who were trained to spot poor grammar or obvious scams may now struggle to detect AI-crafted exploits.

Option A relates to compliance but not AI-driven threats. Option B (overreliance on AI bots) is operational risk, not phishing. Option D (differential analysis) applies to AI privacy issues, not phishing.

CAS-005 emphasizes adapting training to emerging threats, including AI-enabled social engineering. This ensures users remain resilient against modern attacks, making C the correct answer.