Which SELinux Feature Meets Email Server Baseline Requirements?
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control, and protecting against: • Unauthorized reading and modification of data and programs • Bypassing application security mechanisms • Privilege escalation • Interference with other processes Which of the following is the most appropriate for the engineer to deploy?
Community Insight
The phrase 'access vector cache' is a SELinux-specific term, and the four listed threats map directly to the protections SELinux MAC provides in a system baseline.
This question asks which technology delivers an access vector cache, mandatory access control, and protections against data tampering, application security bypass, privilege escalation, and process interference for email servers. The answer is SELinux, whose kernel MAC implementation uses an Access Vector Cache (AVC) to speed policy decisions while enforcing confinement.
Learners often pick privileged access management because it addresses privilege escalation, but PAM tools do not provide an access vector cache or MAC enforcement for processes.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
SELinux is a Linux kernel security module implementing Mandatory Access Control (MAC) with policy rules covering all subjects and objects. Its Access Vector Cache (AVC) stores recently computed access decisions so the kernel avoids re-evaluating policy on every request, which directly matches the stated performance goal. SELinux documentation explicitly lists protection against unauthorized reading and modification of data and programs, bypassing application security mechanisms, privilege escalation, and interference with other processes — the exact four bullets in the question. Deploying SELinux in enforcing mode as part of a server system baseline therefore satisfies every stated requirement at once.Why the Other Options Are Wrong
Privileged access management (B) governs administrative credential vaulting and session recording, but it provides no access vector cache and does not confine ordinary processes or block data-file tampering by compromised services. Self-encrypting disks (C) protect data at rest through hardware encryption and say nothing about MAC, process isolation, or application security bypass. A network intrusion prevention system (D) inspects traffic at the network layer; it cannot enforce in-kernel access decisions between local subjects and objects, so it addresses none of the four listed protections in the local baseline sense.Community Comment Notes
A single comment from jamestkd argues for A, explaining that SELinux "explicitly utilizes an Access Vector Cache (AVC) to improve performance by caching access decisions" and covers the four listed protections. That reasoning matches the official SELinux architecture description, and no dissenting comment was posted, so the community position aligns with the technical analysis.Official Reference
Exam Strategy
On CAS-005 scenario items, treat unique vendor-specific nouns like 'access vector cache' as identifiers — they point unambiguously to one technology and let you eliminate the rest without deep debate.
Frequently Asked Questions
Why does SELinux use an access vector cache?
The AVC caches computed policy decisions so the kernel serves repeated access checks from memory rather than re-evaluating the full policy, boosting performance while keeping MAC enforcement intact.
Why is privileged access management not the right choice here?
PAM protects administrative credentials and sessions but does not enforce mandatory access control between processes and files, so it cannot deliver the four listed protections.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →