The best approach is to use Terraform scripts while creating golden images (A). Terraform is an Infrastructure as Code (IaC) tool that allows organizations to automate infrastructure deployment consistently across environments. A golden image is a pre-configured, patched, and hardened system image used as a standard baseline. By creating golden images via Terraform scripts, the company ensures that every microservice instance is deployed on an already-updated and secure OS. This eliminates the need for repeatedly patching the base OS before code deployment.
Option B (cron job with apt-update) applies patches but introduces delays (every 30 days) and lacks consistency across new deployments. Option C (snapshots) saves deployment states but risks replicating outdated or unpatched images. Option D (centralized update server) is useful but still requires updates post-deployment, which slows the rollout of microservices.

The Subject Alternative Name (SAN) field in an X.509 certificate specifies additional hostnames, FQDNs, or IP addresses that the certificate will secure. To allow mutual TLS authentication for multiple hostnames and an IP address, these identities must be included in the SAN field.
* Organizational Unit (B) is an informational attribute, not related to TLS authentication.
* Extended Key Usage (C) defines purpose (e.g., serverAuth, clientAuth) but not hostnames.
* "Certificate extension" (D) is a generic term; SAN is the specific required extension.

For a distributed workforce needing access to compliance-bound on-premises systems, VPN access ensures encrypted, authenticated connectivity while limiting exposure. SecurityX CAS-005 emphasizes using VPNs for secure remote access when direct migration to cloud is not possible.
Moving legacy systems to cloud (B) violates the compliance constraints.
SDN security controls (C) are beneficial but do not inherently provide secure remote connectivity.
Microsegmentation (D) is useful for internal lateral movement control but does not solve remote access needs.

Malware that does not execute in a sandbox environment often contains anti-analysis techniques, such as anti-virtualization code. This code detects when the malware is running in a virtualized environment and alters its behavior to avoid detection. Checking for anti-virtualization code is a logical next step because:
It helps determine if the malware is designed to evade analysis tools.
Identifying such code can provide insights into the malware's behavior and intent.
This step can also inform further analysis methods, such as running the malware on physical hardware.
Reference:
CompTIA Security+ Study Guide
SANS Institute, "Malware Analysis Techniques"
"Practical Malware Analysis" by Michael Sikorski and Andrew Honig