Managing telemetry and differentiating it by office requires a way to categorize data. Let's evaluate:
A . Sensor placement:Useful for data collection but doesn't inherently differentiate by office.
B . Data labeling:Assigns metadata (e.g., office location) to telemetry, enabling differentiation. This aligns with CAS-005's focus on data management for security operations.
C . Continuous monitoring:Ensures ongoing data collection but doesn't address differentiation.

Device attestationensures that only corporate-approved devices can perform privileged actions in SaaS applications.Continuous authorizationmonitors ongoing device compliance, dynamically adjusting permissions based onsecurity posture.
* Blocking connections (A)is too restrictive and does not accommodate BYOD.
* Machine certificates (B)help with authentication but do not provide continuous security assessment.
* MDM policies (D)secure mobile devices but do not apply real-time access controls for SaaS applications.
Reference:CompTIA SecurityX (CAS-005) Exam Objectives- Domain 2.0 (Security Architecture), Section onIdentity & Access Management (IAM)

The best answer is B. Extending an SD-WAN with specific policies because the question asks for a way to create a unified network while not weakening the acquiring company's security posture . In CompTIA SecurityX CAS-005, SD-WAN is explicitly part of Security Architecture , under "Deperimeterization: SASE, SD-WAN, and software-defined networking." The same official objective set also lists "Network architecture:
segmentation, microsegmentation, VPN..." and "Security boundaries... secure zones." Those objective areas support a policy-based integration approach in which the plant can be connected while maintaining segmentation, security zones, and centralized enforcement.
This is especially important because the manufacturing plant is old and has not followed an equipment refresh life cycle. That strongly suggests there may be legacy systems, operational technology, and devices that cannot be rapidly modernized or patched. A policy-driven SD-WAN design is more effective than simply connecting the site because it allows the acquiring company to preserve trust boundaries and apply differentiated controls to plant traffic. That aligns directly with CompTIA's official SecurityX emphasis on segmentation , secure zones , and deperimeterization technologies.
Why the other options are not the best choice:
A is not best because a WAF protects web applications, not an entire acquired manufacturing environment, and the scenario does not say the core issue is a web application stack. Also, "patching the legacy IT equipment" is unrealistic in a plant with decades-old infrastructure and does not answer the requirement for a unified but controlled network design. C is weaker because a site-to-site VPN provides connectivity and SIEM provides visibility, but neither by itself gives the same policy-based segmentation and architectural control as SD-WAN. D is too narrow because a proxy server does not solve full-site network integration or architecture-wide posture management.
References:
CompTIA SecurityX (CAS-005) official certification page and exam objectives summary, especially Security Architecture domains covering SD-WAN , segmentation , VPN , and secure zones .

To improve the quality of code scanning results and reduce false positives, the best solution is to limit the tool to a specific coding language and fine-tune the rule set. By configuring the code scanning tool to focus on the specific language used in the application, the tool can more accurately identify relevant issues and reduce the number of false positives. Additionally, tuning the rule set ensures that the tool's checks are appropriate for the application's context, further improving the accuracy of the scan results.
Reference:
CompTIA SecurityX Study Guide: Discusses best practices for configuring code scanning tools, including language-specific tuning and rule set adjustments.
"Secure Coding: Principles and Practices" by Mark G. Graff and Kenneth R. van Wyk: Highlights the importance of customizing code analysis tools to reduce false positives.
OWASP (Open Web Application Security Project): Provides guidelines for configuring and tuning code scanning tools to improve accuracy.

The output indicates that the software tool contains hard-coded credentials, which attackers can exploit to bypass user access controls and load the database. The mostlikely recommendation is to remove hard-coded credentials from the source code. Here's why:
Security Best Practices: Hard-coded credentials are a significant security risk because they can be easily discovered through reverse engineering or simple inspection of the code. Removing them reduces the risk of unauthorized access.
Credential Management: Credentials should be managed securely using environment variables, secure vaults, or configuration management tools that provide encryption and access controls.
Mitigation of Exploits: By eliminating hard-coded credentials, the organization can prevent attackers from easily bypassing authentication mechanisms and gaining unauthorized access to sensitive systems.
References:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
OWASP Top Ten: Insecure Design
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations