Question 112 of 968
mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security analyst needs to write a script that…
A security analyst needs to write a script that detects changes to critical files across a fleet of Linux servers. Which approach is most efficient and secure?
⚠ Common exam trap
CompTIA CASP+ often tests the distinction between event logging (auditd/syslog) and cryptographic integrity verification (FIM tools like OSSEC), leading candidates to choose a logging-based solution that cannot detect subtle content changes like a rootkit replacing a binary with the same size and timestamp.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an agentless tool like OSSEC with a central manager to report file integrity changes.
OSSEC is a host-based intrusion detection system (HIDS) specifically designed for file integrity monitoring (FIM). Its agentless mode uses SSH to connect to remote servers, retrieve file hashes, and compare them against a known baseline stored on a central manager. This approach is both efficient (centralized reporting, no per-server cron jobs) and secure (encrypted communication, tamper-proof baseline storage).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a cron job on each server running a Python script that checks file hashes.
Why it's wrong here
Distributed scripts are harder to maintain and inconsistent.
- ✗
Enable Linux auditd on each server and forward logs to a SIEM for analysis.
Why it's wrong here
Linux auditd provides detailed, low-level event logs crucial for forensic analysis and compliance auditing, making it tempting for file change detection. However, its comprehensive logging generates a high volume of data. Relying on forwarding all raw auditd logs to a SIEM for efficient, real-time detection of *specific* critical file changes across an entire fleet is resource-intensive due to network bandwidth, SIEM ingestion costs, and the complexity of filtering noise for targeted alerts. It excels in providing an immutable audit trail for post-incident investigation, rather than efficient real-time fleet-wide change detection.
- ✗
Deploy a centralized log server and parse syslog for file modifications.
Why it's wrong here
Syslog may not reliably capture all file changes.
- ✓
Use an agentless tool like OSSEC with a central manager to report file integrity changes.
Why this is correct
OSSEC provides centralized, efficient monitoring.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.