hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A large healthcare organization has implemented a…
A large healthcare organization has implemented a zero-trust network architecture (ZTNA) to secure access to its electronic health record (EHR) system. The architecture uses a software-defined perimeter (SDP) where all users must authenticate and be authorized before accessing the EHR. The EHR system is hosted in a private cloud and communicates with a legacy billing system that cannot support modern authentication protocols. The billing system is accessed by a small number of finance employees via a dedicated VPN. Recently, an auditor discovered that a finance employee's credentials were compromised, and the attacker used the VPN to access the billing system and exfiltrate patient billing data. The security architect must prevent such lateral movement while maintaining access for legitimate users. Which of the following is the BEST course of action?
⚠ Common exam trap
Test-takers frequently choose micro-segmentation (Option A) thinking it prevents lateral movement, but they overlook that the compromised VPN credentials already provide authenticated access to the network segment, so micro-segmentation alone does not stop the attacker from reaching the billing system within the same VLAN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a jump server with multi-factor authentication (MFA) and session recording, and restrict the VPN to only allow access to the jump server
A jump server with MFA and session recording creates a controlled, auditable choke point that prevents lateral movement from the VPN to the billing system. By restricting the VPN to only allow access to the jump server, the attacker cannot directly reach the billing system even with compromised VPN credentials, and MFA adds an additional layer of authentication. Session recording provides forensic evidence for post-incident analysis, addressing the auditor's concern without requiring the legacy billing system to support modern protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply micro-segmentation to isolate the billing system and allow only finance VLAN traffic
Why it's wrong here
Micro-segmentation reduces lateral movement but does not address the compromised credentials issue; the attacker could still authenticate from the finance VLAN.
- ✗
Remove the VPN and allow finance employees to access the billing system directly via RDP over the internet
Why it's wrong here
Direct RDP exposure is highly insecure and would increase the attack surface.
- ✓
Implement a jump server with multi-factor authentication (MFA) and session recording, and restrict the VPN to only allow access to the jump server
Why this is correct
This adds an extra layer of security and auditability, preventing direct access to the billing system.
- ✗
Upgrade the billing system to support OAuth 2.0 and integrate it with the ZTNA SDP
Why it's wrong here
The legacy system may not be upgradeable, and this is a longer-term solution that may not be immediately feasible.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.