SY0-701 — frequently asked questions

Hacktivists act on personal ideology rather than for pay, so a state cannot contract them; they select targets they object to instead of accepting money to hit critical infrastructure.

Nation-states are government-sponsored by definition, so when a state outsources an attack abroad it typically uses proxies such as organized crime groups, which provide skill and plausible deniability.

Smishing is already a phishing subtype, so pairing B with E would give two overlapping delivery answers and ignore the payroll masquerade. CompTIA reserves phishing for the traditional email vector; the identity deception here is impersonation.

Vishing is voice phishing conducted over a phone call, while smishing uses SMS or text messaging. The stem specifies a text message, so the channel is smishing (E), and vishing (D) is the wrong vector.

Compensating controls apply when a real, confirmed vulnerability is offset by another control; here the analyst's Nmap test shows the reported cleartext condition does not match the host, so the report itself is wrong.

No. The Nmap script only proves the server offers encryption, not that clients must negotiate it, so most exam and real-world guidance still prefers replacing Telnet with SSH.

The firewall may isolate traffic, but the scenario's intent is to compensate for the legacy system's unpatched weaknesses with alternative controls, not to create network segments (B).

On a legacy system that cannot be patched or upgraded, disabling services is an alternative safeguard that reduces attack surface where the primary control—vendor-supported hardening—is not feasible.

Whaling targets the executive themselves, usually via a tailored email. Here the CFO's name was only a pretext used against a regular employee, so the broader social engineering label fits.

It is vishing, a voice-based social engineering attack. Since vishing is not offered as an option, the correct umbrella choice is social engineering (C), not email phishing (B).

DLP can only block what it can identify. Without classification labels or matching patterns, an email attachment rule blocks legitimate traffic and still misses sensitive data sent over other channels.

It covers only one exfiltration channel, ignores email, USB, and encrypted uploads, and does not tell the DLP engine what data is sensitive in the first place.

The sender's number was not spoofed and nothing in the scenario says the CEO's device was compromised, so imaging the phone investigates a threat that was never indicated.

Cancelling legitimate recognition gift cards does nothing to stop the scam, while a company-wide warning helps staff recognize the fraudulent texts already in circulation.

Fencing is a deterrent and delay control that blocks or slows intrusion, but it does not verify identity. Anyone who climbs over or breaches the fence can enter, so it cannot ensure only authorized personnel gain access.

An access control vestibule (mantrap) uses interlocking doors to allow only one person at a time into a small space, often requiring badge authentication before the next door opens. This physical design stops unauthorized individuals from following an authorized person through.

Isolation means a fully standalone or air-gapped network with no connectivity, but the scenario keeps the data on a separate part of the same network, so segmentation is correct.

No. Encryption protects data confidentiality but does not block network access; users on the main corporate network could still reach the storage unless network segmentation enforces access control.

Isolating a device on a separate segment is a containment control that limits exposure while the device is still in use; decommissioning permanently removes the asset, so only unresolvable security failures justify it.

A related build of this question listed a choice about a device unable to receive authorized updates; that option is not offered here, so the security-driven picks among A-E are B and E.

Legacy IoT devices usually no longer receive vendor OS updates, and constrained hardware can make patch deployment impractical, so patching is not a quick mitigation.

Replacement fixes the root cause permanently but requires procurement, compatibility testing, and operational downtime, so it is slower than isolating the devices with segmentation.

A right to audit clause is a contract provision permitting an organization to inspect a vendor's controls and records. It does not set the scope, timing, or authorized actions of the penetration test.

Scope and target systems or IP ranges, testing window, permitted and prohibited techniques, escalation and emergency contacts, and explicit legal authorization to test.

Hashing is a one-way function used for integrity checks and password verification, so the original value can never be recovered. Encryption hides the data while still allowing authorized decryption.

No. Tokenization swaps the real value for a surrogate token, but the original sensitive data still resides in a token vault that must be separately protected, so the stored data itself is not enciphered.

Because end of life means the vendor no longer sells the product, but it may still provide security patches; the scenario's lack of updates and patches defines end of support (C).

EOS is when vendor support, updates, and patches stop; EOL is when the product is no longer sold, though limited support may continue.

CompTIA's official study guide advises isolating unsupported systems as much as possible; segmentation still leaves the server reachable on the network. Isolation reduces the attack surface more completely.

Hardening helps but cannot fix an unsupported OS that no longer receives security updates. CompTIA recommends isolation plus compensating controls like monitoring and strict firewall rules.

RPO is only a metric for the maximum tolerable data loss, used to set backup and replication frequency. It informs the DRP but does not contain the procedures that restore systems and data.

An IRP is correct when the scenario is about detecting, containing, and eradicating a security incident. The DRP takes over when critical systems and data must be restored after disruption.

It removes shared accounts, but the appliance's built-in local admin account still exists with its factory password. Only changing that password or disabling the account stops a known-credential login.

It limits what the session can do afterwards, but it does not stop the authentication itself — and a local admin account usually has full control of the appliance anyway.

Key stretching iterates the hash to slow brute-force attacks, but the scenario explicitly adds a 36-character random string to the password, which is the definition of salting.

No, the salt is stored alongside the hash and is not part of the user's password; it makes each stored hash unique and defeats precomputed hash attacks.

A site survey addresses physical placement and coverage, but the security-focused action is to segment the IoT camera on a dedicated VLAN to prevent lateral movement.

Disabling unused ports is a valid hardening step, but VLAN segmentation is the primary deployment control for isolating an IoT device like a camera on the network.

DHCP logs only map IP addresses to MAC addresses; they do not show the C2 communication, so you first need network or firewall logs to find the suspicious IP.

Application logs record events within applications, not network traffic to external C2 servers, so they won't reveal which host is communicating with the attacker.

Asymmetric encryption requires a key pair, not one shared key — the sender encrypts with a public key and the receiver decrypts with the matching private key, which the question never describes.

Hashing is a one-way integrity function and salting just adds random data before hashing, so neither produces a reversible ciphertext that the peer could decrypt back into the original message.

A WAF inspects HTTP(S) traffic to protect web applications and has no ability to block a device from connecting to a physical switch port.

No, port security is a Layer 2 switch feature that limits MAC addresses per port; 802.1X/NAC adds identity-based authentication and can be layered with it.

Retention is a policy for keeping data over time, not a device-handling action; the question asks for activities on the laptop being reissued, so sanitization plus certification is the right pair.

Certification verifies that sanitization was performed correctly, and destruction would make the laptop unusable for the next employee, which contradicts reissuing.

Segmentation contains lateral movement and shrinks blast radius, but it does not make stolen credential records unreadable. Only one-way hashing removes the value of the data after a breach.

Tokenization suits data that must stay retrievable, like card numbers, using a stored vault mapping. Authentication requires comparing a verifier, which hashing provides and tokenization does not.

Secured zones sit in the control plane of CompTIA's Zero Trust model. The data plane contains the subject/system plus the policy engine, policy administrator, and policy enforcement point.

Subject/system, policy engine, policy administrator, and policy enforcement point. The analyst evaluates the subject's role because that is what the policy is enforced against.

DMARC authenticates the sending domain but does not inspect message content or block sensitive data; DLP enforces data-content policies to stop exfiltration.

Classification identifies which data is sensitive and where it resides, so DLP policies can monitor, alert on, or block unauthorized transfers of that specific data across endpoints, network, and cloud.

Confidential focuses on harm from unauthorized disclosure, but the question asks about impact of loss, and data essential to core operations (critical) causes the greatest disruption when unavailable.

Yes. CompTIA's privacy and data classification material lists public, private, sensitive, confidential, and critical, with critical carrying the highest impact if lost.

Business email is an attack surface, and business email compromise requires the attacker to control a legitimate mailbox. The scenario shows spoofed HR links, not a hijacked corporate account.

Hover to read the true destination, then verify the message through a known HR contact or the corporate portal instead of clicking the link or replying.

An MOU documents non-binding intent, but the question also requires specific deliverables and an accepted delivery time, which are SLA characteristics.

A BPA governs business partner relationships such as profit sharing and decision-making, not the service deliverables and timelines between a provider and a client.

It does block access, but CompTIA treats it as compensating because the legacy server cannot be patched or upgraded, so segmentation substitutes for the primary controls that are not feasible.

When it is the planned, primary defense for a supported system — for example, normal network zoning — rather than a workaround for an un-patchable legacy host.

Proxies manage web traffic and caching for internet access. They do not provide the dedicated, hardened isolation required for secure administrative access to internal infrastructure.

A bastion host is another term for a jump server. It is a specialized computer designed to withstand attacks and serve as a secure gateway to a private network.

It is crucial, but it is an operational procedure. You must first know if you are the controller (who fulfills the request) or processor (who assists) to implement the process correctly.

Yes, it affects jurisdiction (e.g., GDPR applies to EU residents), but the role (controller/processor) defines the actual duties regardless of where the company is headquartered.

Encryption protects data content, but virtualization ensures that the data resides in a secure, separate environment. Without isolation, an attacker could potentially bypass encryption by compromising the host.

No. Network segmentation divides traffic within a network, but virtualization creates the individual network and compute boundaries in the first place. You need both, but isolation is the foundational step.

No. Scanning implies using automated tools or software to analyze content. Hovering is a manual, human-based verification technique taught through training.

Policy review is an administrative activity to ensure compliance with rules. It does not describe the active identification of a specific malicious link by a user.

Decommissioning removes the asset, but if it is 'critical' for operations, immediate shutdown causes business disruption. Containment is the required interim step.

HIDS detects activity but does not prevent exploitation of known unpatched vulnerabilities. It is a detective control, not a sufficient preventive one for EOL systems.

External examinations are typically mandated by regulators or performed by independent third parties. An internal audit is used by the organization to self-assess and prepare for such events.

Yes. Attestation is a formal statement or certification of compliance, whereas an audit is the process of reviewing and evaluating the controls to determine if those statements are true.

Data exfiltration requires evidence of data being moved out of the organization. Not using a VPN is a policy violation (Shadow IT) but doesn't prove theft occurred.

Yes, Shadow IT creates security gaps that can be exploited for espionage, but the scenario only describes the unauthorized usage, not the malicious outcome.

Salting adds random data to the input to ensure unique hashes. Key stretching iterates the hash process to increase the time required to crack it.

Steganography hides data within other files. It does not add complexity to the input of a one-way hash function like SHA-256.

Tokenization replaces the card number with a random token. You cannot view the original last four digits from the token itself; a lookup is required.

Yes, masking is explicitly recommended by PCI DSS to protect cardholder data when full PAN visibility is not required.

While significant, reputational damage is often harder to quantify immediately than direct regulatory fines, making it less effective for urgent budget justification.

Fines are monetary penalties levied by regulators for legal non-compliance, whereas sanctions usually refer to broader restrictive measures often in geopolitical or employment contexts.

Memory injection modifies the running process in RAM without changing files on disk. Side loading involves executing unauthorized binaries or libraries that exist as files on the storage system.

SQL injection targets databases via web inputs. It does not typically cause a local batch job process to suddenly generate random high-port outbound network traffic.

While CCTV does detect activity by recording it, 'Detective' is not provided as an option. The question forces a choice between the remaining valid classifications: Deterrent (discouragement) and Directive (policy communication).

Deterrent controls aim to discourage malicious acts through fear of consequence (e.g., cameras, guards). Directive controls aim to influence behavior through instructions or warnings (e.g., 'No Entry' signs, privacy notices).

Whaling targets high-profile individuals. Since the victim here is an employee, not the executive, it is impersonation, not whaling.

Impersonating involves actively pretending to be a specific person to manipulate a victim. Disinformation is the general spread of false information without necessarily assuming a specific identity.

Yes, they are often used interchangeably. Both refer to a hardened system used as a gateway to access internal resources securely.

A WAF protects web applications from HTTP-based attacks. It does not secure non-web administrative protocols like SSH or RDP used for general system administration.

Side loading installs apps from unofficial sources, while jailbreaking modifies the OS to remove restrictions and enable new features.

Not always; some devices allow limited sideloading without full jailbreak, but jailbreaking is needed for deep system modifications.

Virtualization reduces physical servers but still requires a full guest OS for each VM. Containerization shares the host OS, resulting in fewer total OS instances.

No. Microservices is a design pattern. You can deploy microservices using containers or VMs. It doesn't inherently dictate the OS footprint.

Application logs track software usage and errors but lack low-level forensic data like process hashes, parent-child relationships, and file paths found in endpoint logs.

No, network logs capture traffic metadata (IPs, ports, protocols) but cannot see inside encrypted payloads or identify specific processes running on the host.

The Blue team identifies vulnerabilities through scanning and monitoring but focuses on defense. Active exploitation to prove exploitability is the Red team's offensive mandate.

The Red team performs the attack/exploitation. The Purple team coordinates the exercise between Red and Blue teams to ensure findings are communicated effectively.

FDE protects data at rest, but once the user logs in with valid credentials, the data is decrypted and accessible to any application running on the device.

Remote Wipe is a reactive incident response action. The question asks for a solution to 'increase security,' which implies a proactive control like containerization.

No. Mitigation involves implementing controls to reduce risk likelihood or impact. Insurance only transfers the financial consequence after the event occurs.

Transfer keeps the activity running but pays a third party for losses. Avoid means stopping the activity entirely so the risk no longer exists.

While TLS is common, many IoT devices lack the resources to run full TLS stacks. If the hardware cannot support the computation, the version compatibility is moot.

Not necessarily, but standard block ciphers may be too heavy. Lightweight alternatives or stream ciphers are often chosen specifically to mitigate resource constraints.

DRP focuses on restoring IT systems. BCP focuses on keeping essential services running, which may involve non-IT processes or manual workarounds if IT is down.

Yes, DRP is typically a subset of BCP. BCP covers the entire organization's ability to function, while DRP covers the IT infrastructure recovery.

A DNS sinkhole only resolves known bad domains. Since the domain is already dead, it provides no active protection. The real risk is the shortener pointing to new malicious sites later.

It could, but in a targeted attack scenario, preventing potential malware/phishing takes priority. Legitimate use can be whitelisted if necessary, whereas the current campaign is an active threat.

Insecure protocols are a vulnerability, but they can sometimes be mitigated via network controls. Lack of vendor support means you cannot patch the system itself, making the risk permanent.

Yes, typically. It implies the vendor has ended lifecycle support, so no new security updates or hotfixes will be released for identified threats.

While some frameworks call AUPs 'directive,' SY0-701 often groups them under preventive when 'directive' isn't an option, as they aim to stop violations by setting rules.

No. A compensating control replaces a failed primary control. An AUP is a primary administrative control that directly governs user behavior.

Self-signed certs are not trusted by clients/browsers by default, causing security warnings. They require manual trust installation on every device, which is unscalable for large enterprises.

If multiple distinct root domains are needed, a Single Wildcard won't work. You would need either multiple wildcard certificates or a Subject Alternative Name (SAN) certificate.

FIMs check for changes to file contents or permissions but don't typically try to read the raw content of highly restricted files like /etc/shadow in a way that triggers immediate permission denied errors during setup.

No, if run as root it succeeds. The error indicates the specific tool instance lacked privileges, which is common in unprivileged audit or attack scenarios.

Patching the CA is part of the Eradication phase, as it removes the vulnerability source. Cleanup focuses on handling the immediate consequences, such as revoking compromised certificates via the CRL.

No, updating the CRL only revokes trust in the compromised certificates. The underlying vulnerability in the CA must still be fixed through patching (Eradication) to prevent new malicious certificates from being issued.

Stewards manage data quality and ensure policies are followed, but the Owner defines those policies and authorizes access.

Owners define security requirements and access rules; Custodians implement technical controls and maintain the data daily.

SAST reviews source code for potential flaws but doesn't test the running application's reaction to actual malformed inputs, which is what fuzzing does.

Fuzzing proactively finds vulnerabilities by crashing the system with bad data during testing, allowing developers to patch those weaknesses before attackers exploit them.

Design Review is typically a pre-release validation step. Once the design is released, any fix becomes a change request governed by Change Control.

No. While risk is assessed during change control, the primary procedural requirement for altering a released asset is the Change Control Process itself.

CVE catalogs specific vulnerabilities (the 'what'), whereas OWASP categorizes and explains the exploitation methods and risks (the 'how') relevant to application development.

STIX is a format for sharing threat intelligence reports, while OWASP is a non-profit foundation providing guidelines and lists of security risks for software applications.

NIDS is a detection tool, not a mitigation/prevention tool. It alerts on malicious activity but does not block or stop the attack from succeeding.

A WAF is essential for Layer 7 protection, but adding HIPS ensures the underlying server is also monitored and protected if the WAF is bypassed.

Brand Impersonation is a technique used within the attack. The question asks for the 'type of attack,' and Phishing is the broader, standard classification for email-based credential harvesting.

No. The error likely means the malicious site failed to load properly after submission, but the initial lure and intent (stealing credentials via email) remain Phishing.

SCAP (Security Content Automation Protocol) is for automating security vulnerability and compliance checks on IT systems, not for mapping supply chain relationships or assessing logistical risks.

It provides end-to-end visibility, mapping dependencies, identifying bottlenecks, and assessing risks across the entire supply chain spectrum, including non-technical factors.

Penetration testing is part of the Testing phase, but branch protection is a continuous control embedded throughout the development workflow, making it more representative of daily SDLC operations.

No, the policy governs the SDLC but is not a step or control executed within the lifecycle itself; it is the framework rather than the execution.

No, it is required, but it is not the technical control that prevents the specific outage described. Testing validates the configuration.

It defeats the security purpose of the firewall by permitting all traffic, leaving the enterprise exposed to external threats.

$30,000 is the total expected loss across the whole three-year period ($15,000 × 2 events). ALE is an annualized figure, so that total must be divided by three years to give about $10,000.

ARO is the expected number of occurrences per year: 2 ÷ 3 ≈ 0.67. Multiply that by the $15,000 SLE and you get roughly $10,000, which is option B.

Counting records or observes activity as it occurs, which is the role of a detective control such as badge logs or cameras. Preventive controls block or deny access before it happens.

No. The immediate requirement is to determine the daily count; that data may inform preventive controls, but the counting mechanism itself is detective.

Unauthorized patching risks an unplanned production outage with no rollback plan and creates a change management and audit violation, even when the vulnerability is urgent.

No. Emergency change procedures may shorten the timeline or allow verbal authorization, but the change must still be documented, approved, and reviewed afterward.

The only attacker-influenced content the user touched was the resume received in a message; the company website visit and OS update were routine actions with no sign the site was compromised.

Typosquatting requires the user to mistype a URL and land on a look-alike domain, but no browsing mistake is described — the malicious content arrived unsolicited in a message.

IoCs are collected during detection and analysis to characterize the attack; RCA instead looks past the indicators to find why the control failed so the incident cannot recur.

Eradication removes the malware currently present, while RCA identifies the entry path and weakness that let it in, preventing the same intrusion from returning later.

Wiping uses low-cost or free software to overwrite data, while shredding requires specialized equipment, labor, and destroys the drive's resale value.

Yes—simple deletion removes only file references, so recovery tools can restore client data; wiping overwrites the actual data to prevent recovery.

Vulnerability scan records are smaller and structured, and they support remediation tracking and compliance, while full packet capture consumes far more storage for the same period.

Yes, endpoint and OS security logs are far less voluminous and provide critical host and authentication evidence for investigations, so they usually justify longer retention.

Disabling the script is a containment action. CompTIA incident response requires identifying whether the attack succeeded first, so you don't destroy evidence or miss unauthorized accounts.

An INSERT INTO users statement embedded in a web request to query.php indicates an attempt to add unauthorized accounts to the database.

RPO measures the maximum acceptable data loss in time, which drives how often backups run. It does not state how long systems may stay down, so it cannot answer how quickly services must return.

No. Risk tolerance is the acceptable deviation from the organization's risk appetite, a governance concept rather than a downtime target. The restoration-speed target is set by the recovery time objective (RTO).

Replication copies data to another server for redundancy or read scaling, but it does not automatically redistribute incoming traffic when a server is added or replaced.

Most load balancers automatically detect new healthy nodes and include them in the pool, so adding or replacing a server usually needs minimal reconfiguration.

Brute-force generates its own password guesses against the authentication service; it never positions the attacker between user and server to capture a credential that already works.

ARP poisoning, DNS spoofing, evil twin Wi-Fi, session hijacking and SSL stripping all put the attacker in the traffic path or downgrade TLS so logins can be read.

Redundancy duplicates resources or personnel, but it does not calculate how many staff are required to sustain essential functions during a disruption. Capacity planning is the sizing step.

Capacity planning calculates resource and staffing needs for disruption, while a tabletop exercise tests the plan through discussion. That makes tabletop exercise incorrect here.

Impersonation is only the mechanism; SY0-701 wants the named attack that matches the finance-fraud outcome, and BEC is the specific label for bank or executive spoofing that drives wire transfers.

Spear phishing is the delivery method aimed at specific users, while BEC is the goal-oriented fraud — convincing accounting to send funds to an attacker-controlled account.

A zero-day is exploited before a vendor fix or detection signature exists, so there is nothing for the engineer to deploy on day zero.

EOL is a vendor lifecycle milestone; updates reduce known vulnerabilities but do not obligate the vendor to keep supporting the hardware or software.

Encryption protects data if intercepted or stolen, but a user in a high-risk country with valid credentials and keys can still open the document; you need an access control that enforces location.

Yes, a VPN or proxy can hide the user's true origin IP, so geolocation should be combined with MFA, device compliance, and risk-based signals.

Country of origin is a supply-chain and vendor due-diligence factor that applies to any product, not a technical exposure created by installing and running a cheap IoT device in your infrastructure.

Many ship with weak defaults and no encryption for data at rest, and they often forward telemetry to vendor cloud services, exposing sensitive readings to unauthorized access or misuse.

An allow list filters by trusted source or service but does not inspect packet content, so malicious payloads from permitted hosts or protocols can still reach internal systems.

A host-based firewall protects only the host it runs on and does not provide inline, network-wide packet inspection at the perimeter, so it is less comprehensive than an IPS.

Buffer overflow is a software coding weakness in how an application handles memory, so it can affect many hardware platforms and is not tied to a specific firmware or device version.

Attackers can target known flaws in the firmware that controls a device's basic operations, and remediation usually requires applying a vendor firmware update.

Fingerprinting identifies the device type, OS, or browser, but it does not verify that patches, antivirus, or firewall settings meet corporate policy. Compliance attestation performs that policy check before access is granted.

Yes. A quarantine subnet is a pre-access holding area, so the security team should attest that each guest device satisfies minimum security requirements before allowing it to reach corporate resources.

Red team doctrine in SY0-701 is purely offensive adversary emulation. The question requires defensive work performed with developers during application building, which describes the yellow team instead.

Green team focuses on improving security through automation, scripting and orchestration. Yellow team instead works hands-on with developers to embed security into the build of key applications and software.

Federation allows users to use one set of credentials to access multiple systems (SSO). It does not automate the backend process of assigning or updating specific permissions within those systems.

No. Security Groups are containers that hold users. While you can assign permissions to a group, the group itself does not trigger or automate the change of those permissions based on events or roles.

MFA adds security steps but doesn't reduce the number of credentials. The question asks to 'reduce the number of credentials,' which SSO achieves by centralizing authentication.

No. PEAP is an authentication protocol primarily used for securing Wi-Fi connections (802.1X). It does not aggregate identities across different web-based SaaS platforms.

Least privilege is a security principle or goal, not a specific technical object or list. You use an ACL to ENFORCE least privilege, but you don't 'tune' the principle itself on a file.

Patching fixes software vulnerabilities by updating code. ACLs manage access rights (permissions) for users and processes to read or write files. They serve completely different functions.

Logging in completes Authentication. The question asks about granting access rights after this step, which is the function of Authorization.

Identification is claiming an identity (username), while Authentication is proving it (password/biometrics). Authorization comes next.

Degaussing is a form of sanitization. It destroys the magnetic field, making data unrecoverable, but does not physically destroy the platter.

Physical destruction involves breaking the hardware (shredding/burning). Wiping leaves the hardware intact, allowing it to be recycled or reused.

While OSINT can support threat hunting, 'collecting evidence' is a broad term often involving internal forensics. Social engineering testing is explicitly defined by its reliance on public data gathering.

Common sources include LinkedIn for professional connections, company websites for org charts, and public social media posts for personal interests.

'Critical' typically refers to data whose unavailability causes immediate business failure. Patient data is primarily about confidentiality (privacy), making it 'Sensitive'.

In most enterprise frameworks (like NIST or CIS), 'Private' is not a standard tier. Standard tiers are usually Public, Internal, Confidential, and Restricted/Top Secret.

Hacktivists are driven by their own political or social ideology and volunteer their efforts; they cannot be hired or directed by a foreign government, so the "hired" wording rules them out.

No. Nation-state or APT actors are the sponsor here, not the hired party. Among the listed choices, organized crime is the group a government contracts for such operations.

Financial gain and power, which makes them willing to take paid work from outside sponsors while supplying the funding, tools, and cross-border experience a critical-systems attack requires.

Key stretching repeats the one-way transformation many times to slow guessing; it does not add unique random data to each input before hashing, which is the stem's "before" condition.

No. Salting ensures identical passwords produce different hashes and defeats precomputed rainbow tables, but hashing remains one-way; an attacker can still guess and hash candidate passwords.

Yes. A password-storage scheme often combines a unique salt with an adaptive/key-stretching function such as PBKDF2, bcrypt or Argon2 to make each guess slow.

Phishing is a broad term for deceptive messages aiming to steal data or install malware. BEC is a specific subtype of phishing focused on financial fraud through impersonation of trusted figures like executives or vendors.

Option C describes credential harvesting via social engineering. While related, BEC specifically emphasizes fraudulent financial transactions or changes to payment details, which Option C does not include.

The Control Plane defines policies, manages identity, and makes access decisions (e.g., Adaptive Identity). The Data Plane enforces these policies on actual traffic using the Subject and Policy Enforcement Points.

While segmentation happens in the network, the definition and management of Secured Zones as part of the ZTA reference model are handled by the Control Plane to establish the trust boundaries before traffic flows.

An internal assessment is performed by the organization's staff or internal auditors to identify gaps before an official review. An external assessment is conducted by a third-party Qualified Security Assessor (QSA) and is required for formal compliance validation.

No, payment card brands do not directly fine organizations based on internal assessments. Fines are levied when a bank is found non-compliant through external audits, transaction monitoring, or after a data breach occurs.

The bank must create a remediation plan to address the audit findings. These issues must be resolved before the next external QSA audit to ensure the bank achieves and maintains full PCI DSS compliance.

A false positive means the reported weakness does not exist after validation — the Telnet service negotiates encryption, so credentials are not cleartext. A compensating control would mean the cleartext Telnet remains and something else (segmentation, IPS, MFA at a jump host) offsets the risk.

A rescan verifies remediation after you patch, reconfigure or remove a service. The analyst made no change — he tested the live service with Nmap's telnet-encryption script, so the validation result itself closes the finding.

No. Telnet encryption is optional and negotiated per session, and Telnet still lacks modern session protections such as strong integrity checks and Kerberos/MFA support. In practice you would still plan migration to SSH and correct the scanner rule that assumes all Telnet is cleartext.

Sanitization removes data so it cannot be recovered but keeps the storage media intact. Destruction physically destroys the media, making recovery impossible but rendering the device unusable.

Certification provides documented proof that the sanitization process was completed successfully. It creates an audit trail for compliance and legal requirements.

A hot site is fully operational and can take over immediately, while a warm site has some equipment and connectivity but still needs configuration or data restoration before production resumes.

A cold site offers only space, power, and basic infrastructure, so the company must install hardware and restore data, which cannot satisfy an immediate-continuity requirement.

No. A hot site must be maintained and tested through failover exercises; otherwise replication, capacity, or configuration gaps can turn it into an unusable standby facility.

No. A wildcard such as *.example.com covers hostnames under example.com, not example.net or deeper names such as a.b.example.com; multiple base domains may need separate wildcard or SAN certificates.

It avoids CA fees, but public clients do not trust it by default and will show warnings unless every client imports it; that operational burden and trust gap make it unsuitable for company domains unless internal-only.

Client certificates authenticate users or devices, while code-signing certificates verify software publisher integrity; neither is designed to cover many web domains and subdomains.

Patching closes the PKI flaw and prevents recurrence, but it does not revoke the specially crafted certificates already trusted. Before or alongside that eradication fix, update the CRL or OCSP so those certificates fail validation.

Revoke or delete certificates created during the test, remove any accounts, scheduled tasks, or persistence, and restore changed configurations to their pre-test state.

It may be part of credential rotation, but it does not invalidate the certificate-based authentication path. Revoke the certificates and patch the CA as separate cleanup and eradication actions.

The owner holds accountability for the data set and approves risk tolerance and access. The steward supports governance and data quality but does not own those decisions.

The custodian implements and maintains the controls the owner approves, such as permissions, backups, encryption, and storage safeguards.

No. Controller is a privacy-law role that determines the purpose and means of processing personal data, commonly under GDPR; owner is the internal accountable role for a data set.

Branch protection is a version-control gate during development that can require reviews and passing status checks before code is merged. That directly enforces SDLC quality and security controls in the code review and integration workflow.

Penetration testing is a security assessment often performed after development or as a separate engagement. It can support SDLC testing, but it is not the embedded development workflow control that branch protection provides.

An information security policy is enterprise-wide governance that may require secure development practices. The SDLC is the structured process for building, testing, deploying, and maintaining software, so the policy sits above it rather than inside it.

Production failover exercises the actual power path and switchover from primary to backup in the live environment. Simulation can validate assumptions without confirming real transfer switches, UPS/generator behavior, and application dependencies.

A tabletop exercise validates plans, roles, communication, and decision-making through discussion. It does not perform a technical failover, so it is not the best test of power-failure resiliency.

No. In this context it is a planned, controlled test of failover to backup systems; the stem asks for the best test without a no-impact constraint.

Weak hashing algorithms such as unsalted MD5 or SHA-1 make stored password hashes quicker to brute-force or match with rainbow tables. An on-path attack can be helped by weak transport encryption, but the attack begins with intercepting traffic, not with cracking a hash.

Choose on-path when the scenario describes an attacker intercepting or relaying traffic, especially with missing TLS, a downgrade to weak ciphers, or no certificate validation. The weak crypto explains why intercepted data is readable, but interception is still the core attack.

Not primarily. Side-channel attacks exploit leaked timing, power, electromagnetic or cache information from an implementation; strong algorithms can be vulnerable if implemented insecurely. Only choose side-channel if the stem mentions those leakage signals.

A stateful firewall tracks connection state and enforces IP, port, and session policies, but it usually does not classify URLs or domains or inspect email content; an allowed HTTPS session to a harmful site can pass.

DLP inspects email bodies and attachments against policies for PII, financial data, or classification labels, then blocks, quarantines, encrypts, or alerts before the message leaves the organization.

No. Antivirus signatures detect known malicious files or code, not the reputation or category of a website, so they do not enforce a domain-level web access policy.

Symmetric encryption is faster for bulk data, but secure communications need a key establishment step. ECC provides that on constrained devices with smaller keys, then a symmetric session key encrypts the data.

ECC provides strong security with much smaller key sizes than RSA, reducing processing, memory, and bandwidth requirements. That is why it fits limited-resource communications.

PKI is a framework for certificates and key management that can use ECC or RSA. It is not itself the efficient cipher, and RSA-based PKI is heavier than ECC for constrained devices.

The injected code runs inside a legitimate process, so process-name and file-path checks may see trusted software; behavior monitoring and EDR are needed to spot the anomalous memory operations.

When the scenario stresses pre-boot execution, persistence after an OS reinstall, or activity in device firmware below the OS, firmware is the intended layer; this stem stresses an exploit running undetected through memory.

No. Encryption can defeat network or content inspection, but once code executes on the endpoint the OS still handles the process and memory; encryption alone does not provide in-memory stealth.

Permission restrictions block the write or transfer action before it happens by checking the user's authorization. Hashing only produces a new checksum after data changes, so it can detect tampering but not prevent it.

An ACL can implement object-level permissions, but it is a narrower mechanism and may not enforce role separation across financial records and fund-transfer functions. The broader control is least-privilege permission restriction.

Restrict financial-system write, approval, and transfer permissions to specific roles, and separate duties so the person who alters records cannot also approve or execute the transfer.

Valid Accounts explains attackers using legitimate credentials to access systems, which could be part of the intrusion. The question asks what redirected the database traffic; credentials alone do not alter a running process's outbound connections, while Process Injection can.

Process Injection (T1055) lets adversaries inject code into a legitimate process, which can hook or patch that process's network calls. That makes it the best fit among the four options for outbound database traffic being sent to an attacker-controlled server.

CVE is only a unique identifier for a known vulnerability and carries no severity. CVSS provides a standardized severity score and vector that lets an organization rank findings for remediation.

When the question asks for business-specific loss or quantitative risk, such as SLE or ALE. Exposure factor estimates the percentage of an asset lost in a successful exploit, not a standardized vulnerability severity score.

No. CVSS is the baseline, but asset criticality, internet exposure, active exploitation via KEV or EPSS, and compensating controls can reorder remediation. For this exam question, however, CVSS is the primary prioritization metric among the listed options.

Patching is necessary, but CompTIA frames it as a task within host hardening. The broader first action is to harden the virtual host—remove unnecessary services, tighten permissions, and establish a secure baseline—before adding WAF or NIDS layers.

They are layered controls that filter or monitor traffic after the host has a secure baseline. Creating WAF rules (B) or enabling NIDS (C) before hardening would leave the server itself unnecessarily exposed.

It includes disabling unused services and default accounts, closing unnecessary ports, applying secure configuration settings, enforcing least privilege, and validating file and directory permissions. Patching is one part of this baseline, not a replacement for it.

Low-cost devices often cut corners on encryption and access controls, so the data they collect in infrastructure environments can be exposed at rest or in transit. Country of origin is a supply-chain risk but is less directly tied to the device's operational handling of sensitive data.

No. Country of origin remains a supply-chain and third-party risk concern, especially for critical infrastructure, but it is not the most likely operational security issue emphasized for low-cost IoT devices in this SY0-701 scenario.

Watch for weak default credentials, unpatched firmware, lack of secure update mechanisms, and unencrypted data transmission, all of which compound the data-storage risk in infrastructure environments.

User provisioning is the IAM lifecycle process that automates account creation, modification, permission assignment, and removal across many identities. Security groups centralize permissions, but they still rely on membership management or another automation layer to update a large account population.

No. Federation establishes a trust relationship that enables single sign-on and cross-domain authentication; it does not perform bulk permission updates for user accounts.

It automates account lifecycle tasks such as creating accounts, applying role-based permissions, modifying access, and deprovisioning users when they change roles or leave.

A keylogger on the host can capture the replacement password, so the credential remains at risk until the endpoint is remediated. The user should change the Gmail password afterward from a clean device and check for reuse.

The bracketed [ENT], [RTN], [BACKSPACE], [CTRL]c, and [CTRL]v tokens are keystroke events, not ordinary prose. They show the file recorded the user's typing, including the Gmail address and password.

No. Firewall logs can help scoping after the active infection is handled, but they do not remove the keylogger or stop ongoing credential capture. Reimaging the endpoint is the first effective action among the options.

They are stronger authenticators, but the question asks for password-policy content following an audit. A and B directly remediate weak password construction, while E and F describe authentication methods or factors.

No. Least privilege is an authorization and access-control principle limiting what an authenticated account can do; it does not define password length or complexity.

NIST emphasizes length, blocklists, and avoiding composition rules, but SY0-701 password-policy questions commonly pair minimum length with complexity as standard policy settings. Answer the exam doctrine unless the stem explicitly cites modern guidance.

Branch protection is a strong code-change control, but the question asks for a treatment of a continuous risk like phishing. CI/CD is a process, not the risk being treated in this stem.

It is mitigation: it reduces the likelihood that phishing reaches users rather than transferring, avoiding, or accepting the risk.

Continuous controls operate whenever the risk is present, while one-time controls such as pre-employment background checks address only a point-in-time exposure.

A data inventory catalogues where data lives, and retention defines how long it is kept. Both are supporting evidence for a scope decision, but neither is the formal acknowledgement and attestation that confirms the application is out of external reporting scope.

It is documented confirmation by the application owner, management, or auditor that a scope statement is accurate. Here it records that the application is no longer applicable to external reporting requirements.

Choose right to be forgotten when a data subject asks the organization to delete personal data under a privacy regulation, not when an internal audit changes an application's reporting scope.

Unneeded ports expose services that do not need to be reachable, so disabling them immediately reduces the attack surface. Patching remains essential, but it should follow removal of unnecessary functionality so you do not maintain or expose services the server does not require.

No. An ACL controls who can reach the server but does not remove vulnerable or unnecessary services on the host. Host hardening—closing unused ports and disabling unneeded services—must secure the server itself before network access rules are relied on.

No. Upgrading changes the OS release and can introduce compatibility or support issues; updating current software applies fixes within the deployed version. Neither replaces the initial attack-surface reduction step in this scenario.

Application logs generally contain messages the application chooses to emit, not a complete host-level record of process creation, command line, path, hash, or parent process. Endpoint logs provide that broader executable context.

Look for process creation events, executable path, command line, file hash, user context, parent-child process relationships, and execution timestamps. These details help correlate the binary with the original network alert.

They can show traffic patterns and detections, but they usually cannot reliably map a flow to a specific local binary. Use them to establish network context, then pivot to endpoint telemetry for process-level evidence.

The provider secures the physical facilities, network, storage, and virtualization layer. The customer secures the guest OS, database engine, configuration, identities, and data it deploys in IaaS.

DBA is an organizational job role, not a party in the shared responsibility model. A DBA may perform client-side database hardening, but accountability remains with the client/customer.

The provider may manage the database engine, patching, and platform, shifting more responsibility upward. The customer still typically owns data classification, access governance, and configuration choices.

Authentication confirms identity at sign-in, but it does not create per-message evidence or prevent a sender from denying authorship. Non-repudiation adds digital signatures and PKI so a specific message can be tied to an individual.

The sender signs the message with a private key; a verifier uses the corresponding public key to confirm origin and integrity, so the sender cannot credibly deny sending it.

Access logs can show account activity, but they are not cryptographic proof of authorship and can be incomplete or altered, so they do not provide non-repudiation by themselves.

Printing centers produce paper and other media that can contain sensitive data. If those items are thrown away without shredding or locked disposal, an attacker can retrieve them from the trash.

Credential harvesting is a digital theft technique that captures usernames and passwords, typically through phishing, keylogging, or fake login pages. It does not describe recovering discarded printed documents.

Use cross-cut shredders, locked waste bins, secure print release, clean-desk policies, and awareness training so employees never place sensitive printouts in ordinary trash.

Scanning identifies missing patches or coding flaws for remediation, but it does not block a malicious request. Patching and a web-application firewall actively prevent exploitation.

No. Encryption protects confidentiality at rest or in transit if data is exposed, but injected script can still execute or manipulate requests; it addresses impact rather than the vulnerability.

Removing cardholder data is valuable data minimization and reduces PCI scope and breach impact, but it does not stop attackers from injecting JavaScript into the web application. It is not a prevention control for the server attack.