CAS-005 Question #322: Real Exam Question with Answer & Explanation

Question

A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. Company policy allows all Windows 10 and 11 laptops to connect to the system as long as the MDM agent installed by IT is running. Only compliant devices can connect, and the logic in the system to evaluate compliant laptops is as follows: Which of the following most likely occurred when the employee connected a personally owned Windows laptop and was allowed on the network?

Options

• AThe agent was not running on the laptop, which triggered a false positive.
• BThe OS was a valid version, but the MDM agent was not installed, triggering a true positive.
• CThe OS was running a Windows version below 10 and triggered a false negative.
• DThe OS version was higher than 11, and the MDM agent was running, triggering a true negative.

Explanation

The provided logic checks for compliance based on the OsVersion and whether the agentRunning is true. Here's how the logic works: 1. If OsVersion >= 10: - If agentRunning is true, the device is compliant. - If agentRunning is false, the device is non-compliant. 2. Else (if < 10): - The device is marked as compliant. This logic means that laptops with an OS version below 10 are mistakenly considered compliant, which is a false negative because they do not meet the policy requirement. This is likely how the employee's laptop, running a version of Windows below 10, was able to connect to the network

No community discussion yet for this question.