Exam CAS-005 topic 1 question 63 discussion

❌ Why not the others? B. Send camera logs to the SIEM Useful for monitoring, but does not fix the vulnerabilities on the device itself. C. Encrypt the camera's video stream Important for data confidentiality, but doesn't address device compromise risks (e.g., via default credentials or insecure services). D. Place the camera on an isolated segment It's already on a dedicated IoT subnet (as mentioned), and isolation alone doesn't fix the existing security misconfigurations.

✅ Explanation: The vulnerability scan revealed that the camera has open ports, insecure protocols, and default credentials, which are all classic signs of a poorly configured and vulnerable device. Hardening the configuration typically includes: Changing default usernames and passwords. Disabling unused services and insecure protocols (e.g., Telnet, HTTP). Enabling secure communication protocols (e.g., HTTPS, RTSP over TLS). Limiting access via IP whitelisting or firewall rules. Ensuring firmware is updated to patch known vulnerabilities. All of these directly address the security issues identified in the scan and are essential first steps before considering more advanced options.