The first action should be to reset access for John and Joe, who are corporate accounts belonging to the organization. Their credentials were exposed in recent leaks, including one from an initial access broker (Joe), which indicates an active exploitation risk. Immediate password resets and session invalidations prevent adversaries from using the compromised credentials to gain access.
Ann's account (@hotmail.com) is personal and not under corporate management, so while her exposure is concerning, it does not pose a direct risk to organizational systems. Contacting her can follow later steps but should not delay urgent remediation for John and Joe.
Option B delays remediation. Option C overreaches by including Ann in corporate resets. Option D includes contacting authorities prematurely, which is important but secondary to immediate containment.
CAS-005 emphasizes rapid containment of credential leaks affecting corporate identities, making access resets for John and Joe the first step.

Configuring device profiling for patch level and jailbreak status ensures that the mobile device is compliant with security requirements before granting access. Device attestation checks the integrity of the device (such as whether it is jailbroken or up to date with security patches) to ensure that only trusted devices are allowed to authenticate and access resources. This solution directly addresses the requirement to integrate device attestation into user authentication workflows.

Creating golden images with Terraform enables automated, consistent, and up-to-date deployment of microservices with a pre-patched base OS. This significantly reduces time spent on manual updates and accelerates production deployment in a microservices environment.

Comprehensive and Detailed
Best practice in CAS-005 network security design is to deploy:
NIDS passively via a port mirror (SPAN port) to avoid introducing latency or failure points.

Implementing the given commands in the Dockerfile ensures that the container runs with non-root user privileges. Running applications as a non-root user reduces the risk of privilege escalation attacks because even if an attacker compromises the application, they would have limited privileges and would not be able to perform actions that require root access.
* A. Implementing the following commands in the Dockerfile: This directly addresses the privilege escalation attack surface by ensuring the application does not run with elevated privileges.
* B. Installing an EDR on the container's host: While useful for detecting threats, this does not reduce the privilege escalation attack surface within the containerized application.
* C. Designing a multi-container solution: While beneficial for modularity and remediation, it does not specifically address privilege escalation.
* D. Running the container in an isolated network: This improves network security but does not directly reduce the privilege escalation attack surface.
References:
* CompTIA Security+ Study Guide
* Docker documentation on security best practices
* NIST SP 800-190, "Application Container Security Guide"