CompTIA CAS-005 Exam Dumps

The best answer is B. An attacker viewed password hashes on the device. The decisive event is sudo cat /etc/shadow SUCCESS. On Linux systems, /etc/shadow stores password hashes and related account password data. The log therefore indicates successful privileged access to that file and successful viewing of its contents. CompTIA's SecurityX Security Operations domain includes analysis of indicators of malicious activity and investigation of suspicious system behavior; this command sequence is consistent with credential-access activity.

Why the other options are not best:

A is incorrect because there is no evidence of file injection. C is not supported because the logs show file access, not confirmed data transfer or exfiltration. D is tempting because of cd ../../, but that is only navigation. The key security-relevant action is the successful reading of /etc/shadow, which means password hashes were viewed.

CompTIA SecurityX official exam objectives summary, Security Operations domain.

===========

The best answer is B. Implementing Conditional Access with device certifications and compliance requirements. The CISO's concerns are not only about patch latency; they also include missing security agents and a rise in unapproved BYOD endpoints. Conditional Access tied to device identity, compliance posture, and certificates can block or limit access from unmanaged or noncompliant devices. That directly addresses all three concerns at once: only compliant devices with required controls can access enterprise resources, which pressures patching hygiene, ensures agent presence, and reduces unauthorized BYOD access. CompTIA's SecurityX objectives include IAM controls and enterprise enforcement of access decisions based on trust and security posture.

Why the other options are weaker:

A helps remote connectivity for patch delivery, but it does not solve missing agents or rogue BYOD. C is governance-oriented and too slow and indirect compared with an enforceable technical control. D helps with managed devices, but it does not adequately stop unapproved BYOD devices unless access control is tied to device compliance. Conditional Access is the strongest enterprise control because it can enforce both identity and endpoint posture before access is granted.

CompTIA SecurityX official exam objectives summary, especially IAM and enterprise access-control enforcement themes.

===========