Pearson CAS-005 New Attempt

To improve the vulnerability management process in an environment where new devices/IPs are added and dropped regularly, the company should perform regular discovery scanning throughout the IT landscape using the vulnerability management tool. Here’s why:

Accurate Asset Inventory: Regular discovery scans help maintain an up-to-date inventory of all assets, ensuring that the vulnerability management process includes all relevant devices and IPs.

Consistency in Reporting: By continuously discovering and scanning new and existing assets, the company can generate consistent and comprehensive vulnerability reports that reflect the current state of the network.

Proactive Management: Regular scans enable the organization to proactively identify and address vulnerabilities on new and existing assets, reducing the window of exposure to potential threats.

The Subject Alternative Name (SAN) field in an X.509 certificate specifies additional hostnames, FQDNs, or IP addresses that the certificate will secure. To allow mutual TLS authentication for multiple hostnames and an IP address, these identities must be included in the SAN field.

Organizational Unit (B) is an informational attribute, not related to TLS authentication.

Extended Key Usage (C) defines purpose (e.g., serverAuth, clientAuth) but not hostnames.

“Certificate extension” (D) is a generic term; SAN is the specific required extension.

The log shows an AXFR (zone transfer) query, which exposed internal DNS records, aiding lateral movement. Let’s evaluate:

A. Disabling DNS zone transfers:AXFR allows full DNS zone data to be transferred. Disabling it externally prevents attackers from mapping internal networks, directly mitigating this issue per CAS-005’s security operations focus.

B. Restricting to UDP/53:AXFR uses TCP/53, so this wouldn’t stop it.

C. DNSmasking:Obscures records but isn’t a standard term for this fix.

To prevent sensitive corporate information from being exposed if a laptop is stolen, the solution must ensure that data is not stored locally and access is tightly controlled. According to the CompTIA SecurityX CAS-005 study guide (Domain 4: Governance, Risk, and Compliance, 4.3), Desktop as a Service (DaaS) hosts data and applications in the cloud, reducing the risk of data exposure on physical devices. Combining DaaS with multifactor authentication (MFA) ensures that even if a laptop is stolen, unauthorized access to the cloud environment is prevented.

Option B:IP allow lists and SSO do not address data stored locally on the laptop, which could be accessed offline.

Option C:MDM and stronger passwords help but do not prevent data exposure if the device is compromised (e.g., via offline attacks).

Option D:Updating policies and monitoring breaches are reactive measures that do not directly protect data on a stolen laptop.

Option A:DaaS ensures no sensitive data resides on the device, and MFA secures access, making it the best solution.