Exam CAS-003 topic 1 question 215 discussion

Actual exam question from CompTIA's CAS-003

Question #: 215
Topic #: 1

A software company is releasing a new mobile application to a broad set of external customers. Because the software company is rapidly releasing new features, it has built in an over-the-air software update process that can automatically update the application at launch time. Which of the following security controls should be recommended by the company's security architect to protect the integrity of the update process? (Choose two.)

A. Validate cryptographic signatures applied to software updates
B. Perform certificate pinning of the associated code signing key
C. Require HTTPS connections for downloads of software updates
D. Ensure there are multiple download mirrors for availability
E. Enforce a click-through process with user opt-in for new features

Show Suggested Answer

Suggested Answer: AB 🗳️

by JamesMcD123 at Sept. 4, 2021, 5:57 p.m.

Comments

Submit Cancel

JamesMcD123

3 years, 9 months ago

C doesn't sound like a bad choice either. Are A/B just the BEST choices>?

upvoted 2 times

AB1938

3 years, 2 months ago

Yes, but keep in mind that enforcing HTTPS you're proposing "encryption" which is confidentiality in CIA triad and the question is purely focused on "integrity."

upvoted 1 times

...