CAS-004 Security Engineering Practice Question
A security engineer is implementing an integrity-monitoring solution for a fleet of Linux servers that must detect unauthorized changes to critical binaries and configuration files. The solution must provide a cryptographic baseline, resist tampering by an attacker with root privileges, and support automated verification. Which approach BEST meets these requirements?
⚠ Common exam trap
The trap here is equating preventive controls such as SELinux or audit logging with integrity monitoring, when the requirement is cryptographic baseline comparison against tamper-resistant storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a file integrity monitoring agent that stores SHA-256 baselines in a remote, append-only repository and alerts on deviations
The strongest approach combines a cryptographic baseline using SHA-256, remote append-only storage of that baseline to resist tampering by a local root attacker, and automated deviation alerting. MD5 is collision-prone, auditd logs lack baseline comparison and automation, and SELinux is preventive rather than detective. Only the agent with remote append-only baseline storage meets all three requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a file integrity monitoring agent that stores SHA-256 baselines in a remote, append-only repository and alerts on deviations
Why this is correct
A file integrity monitoring agent using SHA-256 provides a strong cryptographic baseline, and storing it in a remote, append-only repository prevents a local root attacker from silently rewriting the reference data. Automated comparison against that trusted baseline detects unauthorized changes and generates alerts. This combination satisfies the cryptographic, tamper-resistance, and automation requirements.
- ✗
Schedule a nightly script that computes MD5 hashes of files under /etc and /usr/bin and emails the output to the security team
Why it's wrong here
MD5 is cryptographically broken for collision resistance, so an attacker could craft a modified file with the same digest. Storing the baseline on the same host also means a root-level attacker can alter both the files and the recorded hashes. Emailing output provides no automated verification against a trusted baseline, so this approach fails the tamper-resistance requirement.
- ✗
Enable the Linux auditd subsystem to log all file writes and review the audit log manually each week
Why it's wrong here
auditd records file access events but does not compute or compare cryptographic baselines, so it cannot detect a change that was made before monitoring began or that matches an authorized-looking write. Manual weekly review is not automated verification and gives an attacker time to cover tracks by editing the logs. It does not provide the required cryptographic integrity guarantee.
- ✗
Configure SELinux in enforcing mode with a strict policy that prevents writes to system directories
Why it's wrong here
SELinux mandatory access control restricts which processes may write to system paths and is a valuable preventive control, but it does not create a cryptographic baseline or detect changes that occur through permitted paths. An attacker with root and a policy that allows the write, or one who disables enforcement, can still modify files undetected. It does not satisfy the detection and verification requirements.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.