CA1-005 — frequently asked questions

Token-based MFA verifies the user's authentication strength, but a personal device can still complete MFA and reach resources unless Conditional Access or NAC checks device identity and compliance.

Conditional Access binds identities to approved or managed devices at the application layer, while NAC evaluates device health and configuration on the network before allowing access.

SSO validates the normal user account; privileged systems use a separate administrator account whose password expired during the 90-day leave.

Internal vulnerability scans show no device issues, so patch gaps did not block access; the failure is isolated to privileged authentication.

RCE on an internet-facing host can be exploited remotely without valid CRM credentials and yields OS-level control, while CRM privilege escalation requires application access and has a narrower blast radius.

Only if the data leakage is broadly exposed and the RCE is heavily constrained; by default, externally reachable RCE gets first priority because it enables full host compromise.

Regression testing validates behavior after a build; it does not catch syntax errors in IaC templates or policy violations before the pipeline deploys them.

No. Branch protection controls who can merge code, but it does not lint the templates or scan them for security-control violations.

Regulation is a compliance driver, but the question asks for design considerations; segmentation and safety monitoring directly contain unmanaged IoT and protect OT processes.

Unmanaged IoT creates a reachable attack path into critical OT; segmentation limits lateral movement, while privacy controls alone do not protect the OT stack.

EDR telemetry can improve visibility, but it does not combine the separate events the SIEM already logged. The missed alert points to a correlation gap, not a missing source.

Improving parsing helps when fields are malformed, mislabeled, or dropped before rules can evaluate them. Here the report shows events were recorded, so the failure is alert correlation.

CASB focuses on SaaS application visibility, data policy, and shadow IT; it does not baseline identity behavior across independent identity providers or generate IAM anomaly alerts.

SASE converges network and cloud security controls such as ZTNA and CASB, but dedicated identity anomaly detection across independent IdPs is a UBA function.

Lateral movement needs evidence of remote logons or SMB/WMI/RDP execution across hosts; local abuse of signed utilities does not prove host-to-host movement.

Certutil can encode or download files, but the TTP is LOLBins when native utilities are abused; exfiltration requires outbound data-transfer evidence.

Hashes change whenever malware is rebuilt, packed, or modified, so a match proves only a sample match. Code style and TTPs persist across variants and support actor attribution.

No. Decompilation exposes code for review, but stylometry compares author fingerprints and TTP analysis compares behavior; neither is replaced by decompilation alone.

It puts a vendor-managed appliance on the internal network, where it may reach more than the HVAC system; outbound-only traffic does not by itself enforce least privilege.

Yes, when the tunnel and firewall rules are dedicated to the vendor and scope reachability to the HVAC system only, with credentials held only by the vendor.

Dashboards are generated from the same SIEM alert logic being investigated, so they show the misconfiguration rather than an independent view of actual activity.

Third-party logs provide external evidence, but a human must interpret context and confirm whether an alert or missed event is truly a false positive or negative.