Hardening the engineering workstations using a consistent strategy would have the greatest impact on reducing the attack surface. The workstations are running outdated and unsupported operating systems, with no security controls, and inconsistent software installations, which significantly increases the risk of exploitation. Hardening involves applying patches, reducing unnecessary software, disabling unused services, and ensuring uniform security controls across all systems. By addressing these vulnerabilities and inconsistencies, the overall security posture improves significantly, which aligns with CASP+ best practices on reducing attack surfaces by standardizing and securing endpoint configurations.

The Chief Information Security Officer (CISO) should highlight social engineering as an area of increased vulnerability due to the lack of completion of security awareness training by employees. Social engineering attacks exploit human behavior, and employees who are not adequately trained are more likely to fall victim to phishing, pretexting, and other types of social engineering tactics. Increasing awareness and training helps employees recognize and respond appropriately to these threats.

Comprehensive and Detailed Step by Step Explanation:

The issue stems from Web Server C ' s new IP (10.2.0.92) not being included in thefirewall rules.

To resolve the issue,modify the firewall rules to include the new IP range(e.g., 10.2.0.0/26) rather than adding a specific host rule, ensuring scalability and simplicity.

Changing inbound or outbound security group rules would still miss the underlying issue of omitted IPs.

Reconfiguring the IP is unnecessary when updating firewall rules is sufficient.

Network segmentation is a method to isolate environments from one another, thus limiting the scope of a potential attack. For IoT systems that cannot be updated or patched, network segmentation is the best mitigation technique. It would contain any compromise to the segmented network and prevent it from affecting the rest of the network infrastructure.

Purchasing one wildcard certificate is the best solution to protect multiple websites hosted by an organization in a cloud-hosted WAF. A wildcard certificate is a type of SSL/TLS certificate thatcan secure a domain name and any number of its subdomains with a single certificate. For example, a wildcard certificate for *.mycompany.com can secure www.mycompany.com, campus.mycompany.com, and any other subdomain under mycompany.com. A wildcard certificate can save costs and simplify management compared to purchasing individual certificates for each website.

The source code in this scenario uses insecure functions like strcpy which are known for not checking buffer sizes, leading to buffer overflow vulnerabilities. The most effective solution is to update the company’s secure coding policy to prohibit the use of insecure functions and replace them with safer alternatives, such as strncpy, which enforces buffer length checks. Integrating this change into the Software Development Life Cycle (SDLC) ensures that future code adheres to secure practices, thereby reducing the risk of vulnerabilities being introduced into production systems. This approach aligns with CASP+ guidelines that emphasize secure coding practices and policies to prevent common security flaws in software development.

Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. This provides users with the assurance that the software is legitimate and safe to install.

ssdeep is a tool that computes and matches Context Triggered Piecewise Hashing (CTPH), also known as fuzzy hashing. It can be used to identify similar files or slight variations of the same file, which may point to the creator of the file if certain patterns or markers are consistently present. This method allows for integrity checking without altering the evidence, which is critical in forensic investigation.

The first step in reducing the attack surface of vulnerable, end-of-support systems is to apply hardening recommendations. Hardening involves applying security configurations, such as disabling unnecessary services, enforcing strong authentication, and tightening access controls to mitigate vulnerabilities on systems that can no longer receive patches or support. While patching and deploying security tools like IPS/IDS and antivirus are important, hardening addresses the fundamental weakness of these legacy systems by reducing their exposure to threats. CASP+ recommends hardening as a crucial measure in environments where patching or upgrading may not be feasible, particularly for unsupported systems.

“Geofencing capabilities in a mobile device management (MDM) solution allow administrators to define a virtual perimeter—based on GPS or network identifiers—around a physical location. Devices that exit the geofence can be automatically restricted or disabled, preventing them from functioning outside the approved area, and will automatically resume normal operation once they re-enter the perimeter. This approach deters unauthorized removal while allowing legitimate, temporary off-site use (for example, if a device is accidentally taken home and returned).”

— CompTIA CASP+ Official Study Guide, Third Edition, Chapter 5: Mobile Device Security, p. 278

“Implement geofencing as part of an enterprise MDM strategy to enforce location-based access controls. Unlike remote wipe— which is irreversible—geofencing ensures devices remain usable when returned, and unlike encryption or simple location monitoring, it enforces a policy that directly blocks functionality outside authorized zones.”

— CompTIA CASP+ CAS-004 Exam Objectives (v7.1), Section 4.3: Mobile Device Management, p. 26

By configuring a geofence around the warehouse, the company ensures that mobile devices become non-functional if removed beyond the defined boundary, yet automatically restore full functionality when brought back, effectively deterring theft without risking permanent data loss or requiring user intervention.

A spam campaign is a mass distribution of unsolicited or fraudulent emails that may contain malicious links, attachments, or requests. Spam campaigns are often used by attackers to deliver ransomware, which is a type of malware that encrypts the victim’s data and demands a ransom for its decryption.

Simulating a spam campaign would allow the Chief Security Officer (CSO) to evaluate whether the training has been successful in reducing the number of successful ransomware attacks that have hit the company, because it would:

Test the employees’ ability to recognize and avoid clicking on fake or malicious emails, which is one of the main vectors for ransomware infection.

Measure the effectiveness of the training by comparing the click-through rate and the infection rate before and after the training.

Provide feedback and reinforcement to the employees by informing them of their performance and reminding them of the best practices for email security.

Fuzz testing identifies vulnerabilities by providing unexpected or random input to the application, exposing edge cases and additional attack vectors. This aligns with CASP+ objective 1.5, emphasizing proactive vulnerability discovery techniques in application security.

To prevent similar issues from occurring again, the CISO should create an effective communication plan and ensure all employees are aware of it. A clear communication plan ensures that critical security information, such as breaches or vulnerabilities, is promptly communicated to the right stakeholders (e.g., the CEO) in a timely manner, preventing situations where the media reports on breaches before internal teams are fully informed. CASP+ emphasizes the importance of having structured communication protocols during security incidents to ensure accurate and timely responses.