CAS-004 Security Architecture Practice Question
A company is migrating to immutable infrastructure for its production environment. The security architect needs to ensure that any changes to the infrastructure are made by replacing instances, not by modifying existing ones. Which security advantage does immutable infrastructure provide?
⚠ Common exam trap
CAS-005 often tests the misconception that immutability 'eliminates vulnerabilities' or 'removes patching,' when it actually changes the patching model to image rebuilds and still requires scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It prevents attackers from establishing persistence by modifying system files
Immutable infrastructure means servers are never patched or modified in place; instead, a new image is built and instances are replaced. This prevents attackers from establishing persistence via modified system files, backdoors, or rootkits, because any tampering is discarded when the instance is recycled. It also makes the deployed state deterministic and auditable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It eliminates all security vulnerabilities in the infrastructure
Why it's wrong here
Immutability removes the drift and unauthorised configuration changes that persistent modification allows, but vulnerabilities in base images, dependencies and application code remain and must still be scanned and patched by rebuilding. It is tempting because it sounds like a complete control; it would be correct to claim it eliminates configuration drift.
- ✗
It removes the need for vulnerability scanning of base images
Why it's wrong here
Replacing instances does not remove the need to scan base images, because a vulnerable image is simply redeployed with every replacement, propagating the flaw at scale. It is tempting because scanning shifts left into the build pipeline; scanning would be unnecessary only if images were provably built from trusted, verified components.
- ✗
It simplifies compliance by eliminating the need for patching
Why it's wrong here
Immutability changes how patching happens, replacing in-place updates with rebuild-and-redeploy, but compliance still requires evidence that running images contain patched components. It is tempting because the rebuild pipeline automates remediation; it would be correct to say immutability makes patching more auditable and repeatable, not unnecessary.
- ✓
It prevents attackers from establishing persistence by modifying system files
Why this is correct
Immutable infrastructure replaces instances rather than patching them, so any attacker modification to system files is discarded when the instance is rebuilt. This removes the persistence mechanism attackers rely on to survive reboots and remediation.
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.