CAS-005 — frequently asked questions

A false negative occurs when a non-compliant device is incorrectly classified as compliant, allowing it to access the network.

A true positive means the system correctly identified a threat. Here, the system failed to identify the threat, so it is not a true positive.

Prompt injection manipulates the model at runtime to produce attacker-chosen or off-policy output; poisoning corrupts what the model learned, so its answers are inherently inaccurate.

Output handling covers how applications decode, validate and sanitize model output to block code execution or injection; it does not make the model's answer factually wrong.

It is a process framework, not a mechanism that inventories dependencies and matches them to disclosed CVEs. An SCA tool performs that detection automatically on every build.

IaC provisions and versions infrastructure resources; it does not analyze application libraries. SCA scans manifests and binaries to flag known vulnerable third-party components.

Centralized logging only aggregates logs into one platform; without labels or source metadata, records from different offices are indistinguishable and cannot be reliably segmented.

Labeling stamps each telemetry stream with attributes like office, region, or business unit at ingestion, allowing one unified system to filter, route, and retain data per office or jurisdiction.

Faster patching changes timing, not content. An attacker can still deliver a same-named altered binary through the normal update channel, so the differing hash goes undetected.

Source filtering trusts where a file came from, not what it contains. A compromised internal distribution point can serve a modified binary that signature verification would reject.

The AVC caches computed policy decisions so the kernel serves repeated access checks from memory rather than re-evaluating the full policy, boosting performance while keeping MAC enforcement intact.

PAM protects administrative credentials and sessions but does not enforce mandatory access control between processes and files, so it cannot deliver the four listed protections.

Credential stuffing targets login endpoints with stolen password lists; a decoded token header and payload exhibit concerns claim validation, not password guessing.

If signature or algorithm checks are weak, an attacker rewrites the role claim in the payload to inherit the service account's elevated permissions.

The intelligence report already contains the adversary's tactics, techniques, and procedures—such as commands run and mitigation actions. Building TTPs would duplicate the provided information instead of acting on it immediately.

An IR playbook is a reactive planning document typically prepared in advance or updated after incidents. With specific IOCs in hand, the priority is creating detection and prevention rules to mitigate the threat now.

Firewalls struggle because cloud services use encrypted HTTPS (port 443) and have dynamic IP ranges. Blocking all cloud traffic would disrupt legitimate business operations.

A CASB acts as a gatekeeper between users and cloud providers, enforcing security policies like authentication, authorization, and data loss prevention (DLP).

An MSA sets general business terms, but an NDA specifically legally binds the vendor to keep your proprietary data secret. Without it, they can legally share or mishandle sensitive info found on devices.

Yes. Modern multifunction devices often have hard drives or flash storage that cache printed/copied/scanned documents. This data must be secured and accessed only by authorized personnel.

Permit listing (allowlisting) blocks everything by default except explicitly approved items. Block listing (denylisting) allows everything by default except explicitly banned items. Permit listing is more secure against zero-day threats.

Signing verifies the authenticity and integrity of an app but does not prevent an unapproved, yet validly signed, app from running. Permit listing actively restricts execution based on authorization status.

UBA provides continuous verification by analyzing behavior patterns, whereas MFA is typically a one-time check. For travelers, context changes constantly, requiring ongoing validation.

No. Hardware tokens strengthen initial authentication but do not provide continuous monitoring. Zero Trust requires both strong initial access and ongoing contextual verification.

While Option D keeps MFA, it lowers password complexity. Weakening the first factor increases the risk of brute-force attacks, which is a more fundamental security degradation than applying contextual policies to the second factor.

Strictly speaking, yes. However, in many enterprise implementations and exam scenarios, the corporate network is treated as a controlled environment where additional controls (EDR, NAC) mitigate risks, making it a pragmatic choice for reducing user friction.