CAS-005 — Frequently Asked Questions

A false negative occurs when a non-compliant device is incorrectly classified as compliant, allowing it to access the network.

A true positive means the system correctly identified a threat. Here, the system failed to identify the threat, so it is not a true positive.

Prompt injection manipulates the model at runtime to produce attacker-chosen or off-policy output; poisoning corrupts what the model learned, so its answers are inherently inaccurate.

Output handling covers how applications decode, validate and sanitize model output to block code execution or injection; it does not make the model's answer factually wrong.

It is a process framework, not a mechanism that inventories dependencies and matches them to disclosed CVEs. An SCA tool performs that detection automatically on every build.

IaC provisions and versions infrastructure resources; it does not analyze application libraries. SCA scans manifests and binaries to flag known vulnerable third-party components.

Centralized logging only aggregates logs into one platform; without labels or source metadata, records from different offices are indistinguishable and cannot be reliably segmented.

Labeling stamps each telemetry stream with attributes like office, region, or business unit at ingestion, allowing one unified system to filter, route, and retain data per office or jurisdiction.

Faster patching changes timing, not content. An attacker can still deliver a same-named altered binary through the normal update channel, so the differing hash goes undetected.

Source filtering trusts where a file came from, not what it contains. A compromised internal distribution point can serve a modified binary that signature verification would reject.

The AVC caches computed policy decisions so the kernel serves repeated access checks from memory rather than re-evaluating the full policy, boosting performance while keeping MAC enforcement intact.

PAM protects administrative credentials and sessions but does not enforce mandatory access control between processes and files, so it cannot deliver the four listed protections.

Credential stuffing targets login endpoints with stolen password lists; a decoded token header and payload exhibit concerns claim validation, not password guessing.

If signature or algorithm checks are weak, an attacker rewrites the role claim in the payload to inherit the service account's elevated permissions.

The intelligence report already contains the adversary's tactics, techniques, and procedures—such as commands run and mitigation actions. Building TTPs would duplicate the provided information instead of acting on it immediately.

An IR playbook is a reactive planning document typically prepared in advance or updated after incidents. With specific IOCs in hand, the priority is creating detection and prevention rules to mitigate the threat now.