nerdexam
CompTIA

CAS-003 · Question #361

The government is concerned with remote military missions being negatively being impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number…

The correct answer is A. Malicious actors intercepting inbound and outbound communication to determine the scope of the. Despite layered controls, adversaries can still intercept communications and use traffic analysis to infer mission scope and operational patterns even without decrypting content.

Enterprise Security Operations

Question

The government is concerned with remote military missions being negatively being impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number of solutions have been implemented, including the following:

End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow soldiers to securely communicate with families. Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP port 80 and 443 and approved applications A host-based whitelist of approved websites and applications that only allow mission-related tools and sites The use of satellite communication to include multiple proxy servers to scramble the source IP address Which of the following is of MOST concern in this scenario?

Options

  • AMalicious actors intercepting inbound and outbound communication to determine the scope of the
  • BFamily members posting geotagged images on social media that were received via email from
  • CThe effect of communication latency that may negatively impact real-time communication with
  • DThe use of centrally managed military network and computers by soldiers when communicating

How the community answered

(52 responses)
  • A
    50% (26)
  • B
    29% (15)
  • C
    13% (7)
  • D
    8% (4)

Why each option

Despite layered controls, adversaries can still intercept communications and use traffic analysis to infer mission scope and operational patterns even without decrypting content.

AMalicious actors intercepting inbound and outbound communication to determine the scope of theCorrect

End-to-end encryption protects message content but does not prevent metadata and traffic analysis, which allows sophisticated actors to correlate communication frequency, timing, and volume to deduce operational activity or mission scope. Additionally, nation-state adversaries may store intercepted ciphertext for retroactive decryption if implementation flaws or future cryptographic weaknesses are discovered. This threat targets the communications infrastructure directly and represents the most operationally damaging residual risk because it can expose active mission details even through the implemented controls.

BFamily members posting geotagged images on social media that were received via email from

Family members posting geotagged images occurs outside the controlled military network perimeter and represents a secondary OPSEC risk that does not directly compromise the secured communication channel or expose real-time mission activity.

CThe effect of communication latency that may negatively impact real-time communication with

Communication latency caused by satellite links and proxy servers is an operational performance concern, not a security or OPSEC threat, and does not create a path for information compromise.

DThe use of centrally managed military network and computers by soldiers when communicating

Centrally managed military networks and computers are a security control that increases visibility, enforces policy, and reduces risk rather than introducing a new vulnerability or concern.

Concept tested: Traffic analysis and OPSEC risk against encrypted military communications

Source: https://csrc.nist.gov/publications/detail/sp/800-77/rev-1/final

Topics

#operational security#geolocation data#social media risk#information leakage

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice