First Step in Security Infrastructure Design: Gap Assessment

CAS-005 By islever Editorial Last updated

Given a scenario, integrate appropriate controls in the design of a secure architecture. Given a scenario, perform risk management activities.

Short answer

D Perform a gap assessment of the security controls to identify deficiencies against the target framework before implementing specific technical or governance measures.

Question

A security analyst must design a system infrastructure that aligns to industry best practices and established frameworks. Which of the following should the analyst do first?
  1. Establish a centralized logging tier.
  2. Assign data labeling and data classification models.
  3. Implement a vulnerability management program.
  4. Perform a gap assessment of the security controls. Correct Answer

Key Takeaways

Assessment always precedes implementation in security frameworks; you must identify gaps against a standard before applying specific controls or classifications.

When designing security infrastructure aligned with frameworks, the first step is performing a gap assessment. This identifies control deficiencies before implementing logging, classification, or vulnerability management.

Common mistake: Candidates often choose Data Classification (B) because it feels foundational. However, classification is driven by the risk profile and compliance requirements identified during the initial gap assessment, making it a secondary step.

Expert Analysis

The question asks for the first step in designing a system infrastructure aligned with industry best practices and frameworks. This is a classic governance and architecture sequencing question.

Why D is Correct: Before implementing any specific technical control (like logging or vulnerability management) or even classifying data, an organization must understand its current state relative to the desired standard. A gap assessment identifies where existing controls fall short of the target framework (e.g., NIST, ISO). Without this baseline, subsequent actions are blind; you cannot prioritize fixes or design resilient systems if you don't know what is missing or weak. This aligns with risk management and security architecture principles where assessment precedes implementation.

Why B is Attractive but Wrong: Assigning data labeling and classification (Option B) is critical for securing data and is often a foundational activity. However, classification is typically part of the broader governance strategy that emerges after understanding the regulatory and operational gaps. You classify data based on its value and risk, which is determined by the gap analysis against compliance requirements. Doing B before D risks misclassifying assets because the full scope of required protections isn't yet known.

Why A and C are Late-Stage: Centralized logging (A) and vulnerability management (C) are operational security controls. They are implemented to monitor and maintain the security posture defined by the architecture. Implementing them first without a design baseline leads to fragmented, inefficient security operations.

Exam Strategy

In 'first step' questions involving frameworks, look for the option that establishes a baseline or identifies current status (assessment, audit, review). Implementation options (logging, patching, configuration) are never the first step unless the scenario explicitly states the environment is already assessed and ready for deployment.

Frequently Asked Questions

Why isn't data classification the first step?

Data classification is important but depends on knowing what data exists and its risk level. A gap assessment reveals the regulatory and operational requirements that dictate how data should be classified.

Does gap assessment apply to new builds?

Yes. Even for new builds, you assess the 'as-is' or proposed design against the target framework to ensure all required controls are included from the start, preventing costly rework.

More CAS-005 FAQ →

Community Votes

D
67%
A
33%

67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. jamestkd 👍 1 Answered D
    The correct answer is D. Perform a gap assessment of the security controls. Explanation: The First Step: According to risk management frameworks (such as NIST SP 800-53 or the NIST Cybersecurity Framework), before designing, implementing, or prioritizing new technical controls (like logging, data classification, or vulnerability scanning), an organization must first assess its current security posture against baseline standards or established frameworks to identify existing deficiencies and needs. Why others are subsequent steps: Establishing centralized logging, data classification, and vulnerability management are crucial implementation phases, but they cannot be effectively designed or targeted without first knowing where the security gaps currently lie.
  2. c289594 👍 1 Answered D
    AI Overview A security controls gap assessment measures your current security posture against a desired baseline or framework (such as NIST, CIS, or ISO 27001). This process identifies where your protections are lacking, clarifies your security priorities, and highlights missing policies, tools, or procedures.
  3. Skri113xX 👍 1 Answered A
    Absolutely A. The other options are factually incorrect.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cloud Security Logic Flaw: False Negative in Device Compliance

S-grade

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide