Exam CAS-005 Topic 3 Question 97 Discussion

The output shows that multiple systems have outdated or vulnerable software versions (OpenSSL 1.01 and Java 11 runtime). This suggests that the systems are not being patched regularly or effectively.
* A. Automating the patching system to update base images: Automating the patching process ensures that the latest security updates and patches are applied to all systems, including newly deployed ones.
This addresses the root cause by ensuring that base images used for deployment are always up-to-date with the latest security patches.
* B. Recompiling the affected programs with the most current patches: While this can fix the immediate vulnerabilities, it does not address the root cause of the problem, which is the lack of regular updates.
* C. Disabling unused/unneeded ports on all servers: This improves security but does not address the specific issue of outdated software.
* D. Deploying a WAF with virtual patching upstream of the affected systems: This can provide a temporary shield but does not resolve the underlying issue of outdated software.
Automating the patching system to update base images ensures that all deployed systems are using the latest, most secure versions of software, addressing the root cause of the vulnerability trend.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-40 Rev. 3, "Guide to Enterprise Patch Management Technologies"
* CIS Controls, "Control 7: Continuous Vulnerability Management"