CAS-004 Security Architecture Practice Question
A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It prevents attackers from establishing persistence by modifying system files
Immutable infrastructure ensures that servers are never modified after deployment. This prevents configuration drift and makes it harder for attackers to persist. It also facilitates rapid recovery. It does not eliminate vulnerabilities or remove the need for patching; instead, patching is done by replacing instances. It simplifies forensics because instances are ephemeral and can be analyzed post-incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It eliminates all security vulnerabilities in the infrastructure
Why it's wrong here
Vulnerabilities still exist in the base images; immutable infrastructure does not eliminate vulnerabilities, but it helps ensure consistency.
- ✗
It removes the need for vulnerability scanning of base images
Why it's wrong here
Base images must still be scanned for vulnerabilities before deployment.
- ✗
It simplifies compliance by eliminating the need for patching
Why it's wrong here
Patching is still required, but it is done by building new images; the process changes but is not eliminated.
- ✓
It prevents attackers from establishing persistence by modifying system files
Why this is correct
Since instances are replaced rather than updated, any unauthorized changes are lost when the instance is replaced.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.