hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Is automating cloud security group management…
An organization is automating cloud security group management across AWS, Azure, and GCP. Which TWO approaches provide centralized, auditable control? (Select TWO.)
⚠ Common exam trap
Candidates often mistakenly believe that only Infrastructure as Code tools (Option A) provide centralized, auditable control, while dismissing CLI scripting (Option D) as insufficient. However, CLI scripts executed via automation pipelines with version control and logging can also achieve the same goal, as long as credentials are not hard-coded (Option E is a trap). The key is that both IaC and properly orchestrated CLI scripts offer repeatability and auditability; manual approvals (B) are slow and not centralized, and disabling logs (C) defeats auditability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Leverage infrastructure as code tools (e.g., Terraform) to define and enforce security group rules.
Infrastructure as Code (IaC) tools like Terraform provide a declarative, version-controlled, and repeatable method to define and enforce security group rules across AWS, Azure, and GCP. This approach ensures that all changes are auditable through code repositories (e.g., Git), and can be automatically validated and applied via CI/CD pipelines, eliminating manual drift and providing centralized control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Leverage infrastructure as code tools (e.g., Terraform) to define and enforce security group rules.
Why this is correct
IaC provides a single source of truth and automates enforcement across multiple clouds.
- ✗
Require manual approval for every security group change through a ticketing system.
Why it's wrong here
Manual approval slows automation; the goal is to automate security group management.
- ✗
Disable logging on security group changes to reduce performance impact.
Why it's wrong here
Logging is crucial for auditing; disabling it violates security best practices.
- ✓
Use cloud provider CLI commands (e.g., AWS CLI, Azure CLI) in scripts to update security groups.
Why this is correct
CLI scripts can be version-controlled and scheduled for automated changes across accounts.
- ✗
Store service account credentials directly in automation scripts for simplicity.
Why it's wrong here
Credentials in scripts pose a security risk; use secrets management instead.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.