Cloud Security Logic Flaw: False Negative in Device Compliance

Q: What is a false negative in device compliance?

A false negative occurs when a non-compliant device is incorrectly classified as compliant, allowing it to access the network.

Q: Why isn't this a true positive?

A true positive means the system correctly identified a threat. Here, the system failed to identify the threat, so it is not a true positive.

Given a scenario, securely implement cloud capabilities in an enterprise environment.

A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. Company policy allows all Windows 10 and 11 laptops to connect to the system as long as the MDM agent installed by IT is running. Only compliant devices can connect, and the logic in the system to evaluate compliant laptops is as follows: Which of the following most likely occurred when the employee connected a personally owned Windows laptop and was allowed on the network? exhibit

The agent was not running on the laptop, which triggered a false positive.
The OS was a valid version, but the MDM agent was not installed, triggering a true positive.
The OS was running a Windows version below 10 and triggered a false negative. Correct Answer
The OS version was higher than 11, and the MDM agent was running, triggering a true negative.

Answer Correct answer: C — The OS version was below 10, triggering a false negative due to a logic flaw in the compliance evaluation code.

Community Votes

91%

91% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your ability to trace conditional logic in code; the trap is assuming any non-compliant device is blocked, while this specific logic allows older OS versions through.

This question analyzes a logical flaw in a cloud-based device compliance system where an OS version check below Windows 10 incorrectly returns COMPLIANT, resulting in a false negative.

Many learners choose B, assuming the MDM agent was missing, but they overlook the critical flaw in the 'Else' branch of the OS version check that bypasses the agent requirement for old OSs.

Community Discussion (8 comments)

arya_3365 👍 1 Selected: C

To clarify confusion from old comments, if the OS was lower than Windows 10 AND the agent is running the logic of the code would return COMPLIANT. B is incorrect since even if the OS wasn't a valid version if there is an agent installed the code would still return COMPLIANT.

Rickhrd 👍 1 Selected: B

A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. < This I fear gives it away. It was ALLOWED. to connect. therefor it was compliant. and the only compliant answer would be. B.

Wole_excel 👍 7 Selected: C

If OSVersion >= 10: If agentRunning: return COMPLIANT Else: return NON_COMPLIANT Else: return COMPLIANT # <-- flaw! If OS < 10 → the system still marks it compliant. This means Windows 7/8 devices (personal laptops, not allowed by policy) would slip through. Where the flaw is If the OS = Windows 7/8 (i.e., below 10) → the logic incorrectly returns COMPLIANT. That means a non-compliant device (old Windows OS, no agent) was wrongly marked compliant. That is the textbook definition of a false positive: Reality = non-compliant. System = says compliant.

BenBenBen3 👍 2 Selected: C

The flaw in the code indicated that is the OS version is less than 10, it will return as compliant, thus a false negative.

Trini_007 👍 3 Selected: C

I change my answer to C. In the code, if the statement is not true, it goes to the else block. Because it's black and white, I couldn't see that 10 is red BUT I did research this output. If the statement is false, it will give you an else output.

Trini_007 👍 3 Selected: B

The answer is B. The check only partially did the check. It allowed it through after just checking the OS version. It's supposed to the the OS Version and if the device has the MDM agent on it.

Learner213 👍 4 Selected: C

I'm changing my answer to C. MDM is not installed, so the personal laptop should not be able to connect. A false negative is the only thing that makes sense.

Learner213 👍 2 Selected: B

The MDM is not running on the personal laptop. There is no indication of the version of Windows running on the laptop. Why would anyone assume the version is not 10 or 11? B is the correct answer.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The provided pseudocode contains a logical vulnerability in its conditional structure. The first condition checks if OSVersion >= 10. If this evaluates to true, it proceeds to check if the agentRunning flag is true. However, if the OS version is less than 10 (e.g., Windows 7 or 8), the first condition is false, and the execution jumps directly to the else block, which returns COMPLIANT. Since the employee's personal laptop was allowed on the network despite being against policy, it must have triggered this else path. This represents a false negative because the system failed to identify a non-compliant device (an unauthorized OS version) as non-compliant.

Why the Other Options Are Wrong

Option A is incorrect because a false positive would mean the system flagged a compliant device as non-compliant, preventing connection, whereas the device connected successfully. Option B suggests the OS was valid but the agent was missing; however, if the OS were Windows 10/11 and the agent missing, the code would correctly return NON_COMPLIANT (a true positive), blocking the device. Option D describes a scenario where the device is clearly non-compliant (OS > 11 is invalid per policy, though technically high versions are usually fine, the prompt implies strict 10/11) and the agent is running, which would likely trigger a different error or be a true negative if the system worked correctly, but doesn't explain the unauthorized access via the logic flaw.

Community Comment Notes

Community consensus strongly favors C, with many users noting the 'flaw' in the code. As Wole_excel noted, the logic incorrectly returns COMPLIANT for OS < 10. Several commenters initially chose B but corrected themselves after tracing the if-else flow, realizing that the OS version check takes precedence and has a dangerous default outcome in its else branch.

Exam Strategy

Always trace the exact path of execution in pseudo-code questions. Pay close attention to the else branches of primary conditions, as they often contain the security gaps or logic errors tested in CAS-005 scenarios.

Frequently Asked Questions

What is a false negative in device compliance?

A false negative occurs when a non-compliant device is incorrectly classified as compliant, allowing it to access the network.

Why isn't this a true positive?

A true positive means the system correctly identified a threat. Here, the system failed to identify the threat, so it is not a true positive.

More CAS-005 FAQ →

Related Analysis

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide