CAS-004 Security Engineering Practice Question
A security administrator is configuring a Linux server to enforce mandatory access control (MAC) for a web application. The administrator wants to confine the web server process to only access its own files and network ports, even if the process is compromised. Which of the following should the administrator implement?
⚠ Common exam trap
Many exam-takers confuse AppArmor's complain mode with enforce mode, or thinking that DAC or chroot provides mandatory access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SELinux in enforcing mode with a targeted policy.
SELinux in enforcing mode applies mandatory access control, restricting processes to only the resources defined in the policy. A targeted policy confines specific services like the web server, limiting the impact of a compromise. This meets the requirement to confine the web server process even if exploited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A chroot jail for the web server process.
Why it's wrong here
A chroot jail changes the root directory for a process, limiting file system access, but it does not restrict network ports or provide comprehensive MAC. A determined attacker can escape a chroot jail. It is not as robust as SELinux for confining a process.
- ✗
AppArmor in complain mode.
Why it's wrong here
AppArmor in complain mode only logs policy violations but does not enforce restrictions. It would not prevent a compromised web server from accessing unauthorized resources. To enforce MAC, AppArmor must be in enforce mode, not complain mode.
- ✓
SELinux in enforcing mode with a targeted policy.
Why this is correct
SELinux in enforcing mode applies mandatory access control, restricting processes to only the resources defined in the policy. A targeted policy confines specific services like the web server, limiting the impact of a compromise. This meets the requirement to confine the web server process even if exploited.
- ✗
Standard Linux discretionary access control (DAC) with file permissions.
Why it's wrong here
DAC relies on user and group permissions, which can be bypassed if the process runs with elevated privileges. It does not provide mandatory confinement of the process. A compromised web server running as root could access any file, so DAC is insufficient for this requirement.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.