Cloud Security Logic Flaw: False Negative in Device Compliance

CAS-005 By islever Editorial Last updated

Given a scenario, securely implement cloud capabilities in an enterprise environment.

Short answer

C The OS version was below 10, triggering a false negative due to a logic flaw in the compliance evaluation code.

Question

A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. Company policy allows all Windows 10 and 11 laptops to connect to the system as long as the MDM agent installed by IT is running. Only compliant devices can connect, and the logic in the system to evaluate compliant laptops is as follows:
Which of the following most likely occurred when the employee connected a personally owned Windows laptop and was allowed on the network?
Exhibit: Cloud Security Logic Flaw: False Negative in Device Compliance
  1. The agent was not running on the laptop, which triggered a false positive.
  2. The OS was a valid version, but the MDM agent was not installed, triggering a true positive.
  3. The OS was running a Windows version below 10 and triggered a false negative. Correct Answer
  4. The OS version was higher than 11, and the MDM agent was running, triggering a true negative.

Key Takeaways

The exam tests your ability to trace conditional logic in code; the trap is assuming any non-compliant device is blocked, while this specific logic allows older OS versions through.

This question analyzes a logical flaw in a cloud-based device compliance system where an OS version check below Windows 10 incorrectly returns COMPLIANT, resulting in a false negative.

Common mistake: Many learners choose B, assuming the MDM agent was missing, but they overlook the critical flaw in the 'Else' branch of the OS version check that bypasses the agent requirement for old OSs.

Expert Analysis

Why the Answer Is Correct

The provided pseudocode contains a logical vulnerability in its conditional structure. The first condition checks if OSVersion >= 10. If this evaluates to true, it proceeds to check if the agentRunning flag is true. However, if the OS version is less than 10 (e.g., Windows 7 or 8), the first condition is false, and the execution jumps directly to the else block, which returns COMPLIANT. Since the employee's personal laptop was allowed on the network despite being against policy, it must have triggered this else path. This represents a false negative because the system failed to identify a non-compliant device (an unauthorized OS version) as non-compliant.

Why the Other Options Are Wrong

Option A is incorrect because a false positive would mean the system flagged a compliant device as non-compliant, preventing connection, whereas the device connected successfully. Option B suggests the OS was valid but the agent was missing; however, if the OS were Windows 10/11 and the agent missing, the code would correctly return NON_COMPLIANT (a true positive), blocking the device. Option D describes a scenario where the device is clearly non-compliant (OS > 11 is invalid per policy, though technically high versions are usually fine, the prompt implies strict 10/11) and the agent is running, which would likely trigger a different error or be a true negative if the system worked correctly, but doesn't explain the unauthorized access via the logic flaw.

Community Comment Notes

Community consensus strongly favors C, with many users noting the 'flaw' in the code. As Wole_excel noted, the logic incorrectly returns COMPLIANT for OS < 10. Several commenters initially chose B but corrected themselves after tracing the if-else flow, realizing that the OS version check takes precedence and has a dangerous default outcome in its else branch.

Exam Strategy

Always trace the exact path of execution in pseudo-code questions. Pay close attention to the else branches of primary conditions, as they often contain the security gaps or logic errors tested in CAS-005 scenarios.

Frequently Asked Questions

What is a false negative in device compliance?

A false negative occurs when a non-compliant device is incorrectly classified as compliant, allowing it to access the network.

Why isn't this a true positive?

A true positive means the system correctly identified a threat. Here, the system failed to identify the threat, so it is not a true positive.

More CAS-005 FAQ →

Community Votes

C
91%
B
9%

91% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Wole_excel 👍 7 Answered C
    If OSVersion >= 10: If agentRunning: return COMPLIANT Else: return NON_COMPLIANT Else: return COMPLIANT # <-- flaw! If OS < 10 → the system still marks it compliant. This means Windows 7/8 devices (personal laptops, not allowed by policy) would slip through. Where the flaw is If the OS = Windows 7/8 (i.e., below 10) → the logic incorrectly returns COMPLIANT. That means a non-compliant device (old Windows OS, no agent) was wrongly marked compliant. That is the textbook definition of a false positive: Reality = non-compliant. System = says compliant.
  2. Learner213 👍 4 Answered C
    I'm changing my answer to C. MDM is not installed, so the personal laptop should not be able to connect. A false negative is the only thing that makes sense.
  3. Trini_007 👍 3 Answered C
    I change my answer to C. In the code, if the statement is not true, it goes to the else block. Because it's black and white, I couldn't see that 10 is red BUT I did research this output. If the statement is false, it will give you an else output.
  4. Trini_007 👍 3 Answered B
    The answer is B. The check only partially did the check. It allowed it through after just checking the OS version. It's supposed to the the OS Version and if the device has the MDM agent on it.
  5. Learner213 👍 2 Answered B
    The MDM is not running on the personal laptop. There is no indication of the version of Windows running on the laptop. Why would anyone assume the version is not 10 or 11? B is the correct answer.
Show 3 more comments
  1. BenBenBen3 👍 2 Answered C
    The flaw in the code indicated that is the OS version is less than 10, it will return as compliant, thus a false negative.
  2. Rickhrd 👍 1 Answered B
    A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. < This I fear gives it away. It was ALLOWED. to connect. therefor it was compliant. and the only compliant answer would be. B.
  3. arya_3365 👍 1 Answered C
    To clarify confusion from old comments, if the OS was lower than Windows 10 AND the agent is running the logic of the code would return COMPLIANT. B is incorrect since even if the OS wasn't a valid version if there is an agent installed the code would still return COMPLIANT.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Vendor Contract Risks: Missing NDAs for Device Support

A-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide