CompTIA SY0-701 Bundle

A protocol downgrade attack coerces endpoints into using an older or weaker protocol or cipher than they otherwise could negotiate. The rogue gateway here intercepts and modifies HTTP requests, but the question does not say any transport negotiation or encryption version was forced down. A downgrade can be performed by an on-path attacker, yet it is a narrower behavior that needs specific negotiation evidence. The demonstrated activity is interception and alteration of application traffic.

DNS cache poisoning changes the IP address a resolver returns for a hostname, potentially sending users to an attacker-controlled endpoint. This case specifies a rogue gateway that directly intercepts and changes HTTP requests between a user and internal application. No DNS record or name-resolution answer has been manipulated. Both might facilitate redirection, but the relevant security boundary here is in-transit request integrity at the gateway rather than the resolver cache.

Credential replay reuses captured passwords, tokens, or session artifacts to authenticate without obtaining the legitimate user's secret again. The rogue gateway is observed changing HTTP requests while they travel between endpoints, not presenting a stolen session token to impersonate a user. A gateway could potentially steal credentials, but the question does not say that happened. Selecting replay would invent a later authentication step and miss the actual tampering technique.

Password spraying tests one or a few common passwords across many accounts, usually to avoid lockout thresholds applied per user. This scenario describes a stolen reusable session token used from a second device without the attacker knowing any password. No new guesses across accounts appear. Spraying and replay can both result in account access, but spraying abuses password verification while this case abuses possession of an authentication artifact already accepted as proof of a session.

On-path modification means intercepting or changing traffic between the legitimate endpoints. The attacker may have acquired the token from such an interception, but that origin is not specified. The observed attack is submission of a captured reusable token from another device and acceptance of the session. The relevant security failure is improper protection or replay resistance of an authentication artifact, not evidence that messages were modified in transit during this login attempt.

Targeted password brute force sends many password guesses against one specific account until a matching secret is found. In this case the attacker never performs password guessing; they already possess a session token. Authentication can be bypassed if the server treats that artifact as sufficient, but the mechanism is reuse rather than discovery of a password. Rate-limiting login attempts would not necessarily stop an attacker who submits a valid stolen token through an existing session interface.

Targeted brute force concentrates a large number of distinct guesses on one account, trying to discover that account's secret through repeated attempts. Here only a few attempts are made per identity and the same common password is tested against many users. The distribution is the opposite of focused brute force. Both are password attacks, but defenses and monitoring should recognize the cross-account correlation instead of focusing solely on one noisy account.

Credential replay presents a previously captured password hash, token, or valid session artifact as authentication evidence instead of enumerating guesses. The scenario describes actively testing a common password across many accounts, not reusing an already valid token from an earlier session. The observed mechanism is broad guessing, not replay of an accepted session credential. The difference is whether the attacker is searching for a working password or reusing an authentication artifact.

Impossible-travel alerts correlate apparently successful logins from geographic locations too far apart to be physically plausible over the elapsed time. The scenario reports failed or attempted common-password use across hundreds of accounts, not two distant successful sessions for one identity. Geographic source information could help analysts investigate a spray campaign, but it does not establish impossible travel without the requisite paired successful-login evidence. The specific pattern is cross-account spraying.

Password spraying tries a small set of passwords against many user identities, spreading attempts to reduce per-account lockout risk. The question instead describes thousands of sequential guesses focused on one account within a short time. Both are online password guessing, but the account distribution is the crucial discriminator. A spraying alert needs broad identity coverage, whereas the observed single-target volume indicates a concentrated brute-force attempt.

A concurrent-session indicator arises when the same identity has overlapping logins from endpoints or contexts that may be inconsistent with normal behavior. The case provides thousands of password guesses against one account, with no successful logins or simultaneously active sessions described. An intruder might eventually gain access, but that later outcome is not demonstrated. The immediate evidence is authentication trial volume, not conflicting session usage.

Credential replay uses a valid previously issued artifact, such as a stolen session token, rather than discovering the password through repeated guesses. The repeated authentication attempts here each test another candidate secret on the same account. No captured token or authenticated session is described. A replay attack can be one request if the artifact remains valid; it does not require thousands of guessed passwords. The described behavior is targeted brute force.

An account-lockout indicator occurs when repeated failed authentication attempts cause the identity provider to deny further login attempts temporarily. The stem instead describes two apparently successful interactive logins from distant locations within minutes. It provides no failed-password surge or lockout event. A compromised account might eventually be locked, but that would be a later or separate symptom. The specific signal is location/time inconsistency in the access logs.

Abnormal outbound volume indicates unexpected data uploads or network transfers, often used as a lead in possible data-exfiltration investigations. The evidence here consists of geographic locations and timestamps of interactive logins, not large outgoing transfers. A stolen session could later be used for exfiltration, but such activity is not described. The tested indicator concerns whether one user could physically travel between login locations in the observed interval.

Concurrent-session anomalies involve simultaneous active sessions or overlapping privileged use from unrelated endpoints. Two logins separated by minutes could produce overlapping sessions, but the question provides no session-end timestamps or evidence both were active at once. The critical specified condition is the improbable geographic travel time between successful interactive logins. A concurrent-session conclusion would depend on an additional fact that the records do not establish.

An account-lockout indicator usually reflects many failed sign-in attempts reaching a password-attack threshold. The account in this scenario is already running simultaneous privileged sessions from unrelated endpoints while its owner is away. No failed-password burst or lockout is described. Both can arise during account compromise, but the primary evidence here is conflicting session activity, not the identity platform denying further logins. Review token usage and session origins rather than assume a password lockout.

A privilege-escalation indicator would show a principal obtaining or exercising rights beyond its authorized level, often after an exploit or unexpected role change. The scenario says privileged sessions are active, but it does not say the account lacked those privileges before. The suspicious condition is that the same identity is active concurrently on unrelated machines during leave. Escalation may have occurred, yet that cannot be concluded without a baseline permission comparison.

Impossible travel requires two login locations separated by an impractical distance for the elapsed time. The question mentions unrelated endpoints and simultaneous privileged sessions but does not establish their geographic coordinates. Two machines can be unrelated and yet located in the same building, so a location-based alert is not automatically supported. Concurrent use is the direct anomaly described; geographic impossibility would require independent location and time evidence.

Password spraying can cause widespread failed logins or lockouts when one or a few guesses are attempted across many users. That makes it a plausible cause of the incident, but the question asks for the directly observed security indicator. It reports sudden lockouts after a failed-login spike, without identifying whether the same guessed password was used across accounts. The safe conclusion is an account-lockout anomaly; a spraying diagnosis would need credential-guess correlation evidence not supplied.

Impossible-travel alerts compare successful interactive logins from geographically inconsistent locations within a short interval. These events involve failed authentication and locked accounts across departments rather than rapid movement between successful sessions. The account activity may be malicious, but no geographic mismatch is described. The correct investigation should focus on the failed-attempt source patterns and lockout thresholds before applying travel-based heuristics.

Concurrent-session alerts arise from overlapping access by the same identity, sometimes from unrelated devices. A sudden wave of account lockouts following failed logins does not establish any active sessions, much less simultaneous ones. Password attacks can create authentication noise without successful compromise. This option presumes a session-state symptom not in the evidence, while account lockouts are explicitly reported by the help desk.

A concurrent-session indicator involves one identity being used in overlapping sessions from inconsistent endpoints or contexts. The workstation in this scenario transmits an unusually large amount of data to an unfamiliar external destination at midnight; no account session overlap is stated. The suspicious behavior is a transfer-volume anomaly that may indicate exfiltration. Session correlation could aid investigation, but it does not replace examination of the outbound bytes and destination.

DNS tunneling can conceal payloads in DNS labels and queries, producing anomalous names or frequent requests to a controlled domain. The case describes tens of gigabytes of uploads to an unknown external destination, without showing those bytes traveled as DNS queries or used encoded subdomains. Some tunneling could produce substantial traffic, but the record lacks distinctive DNS evidence. The supported indicator is the unexpectedly high outbound transfer volume rather than a particular covert protocol.

Privilege escalation involves an account or process gaining more authority than it previously possessed, such as modifying administrator group membership without permission. The question reports unexpected network uploads but says nothing about changed roles, successful elevation, or new capabilities. Data theft can occur with existing user privileges or after escalation; those are separate facts. The observed signal is data movement, so selecting privilege escalation would assume a credential or permission event not established by the logs.

An abnormal outbound-volume alert flags unexpectedly large amounts of data leaving a device or network over some period. The case describes an unusual pattern of frequent DNS queries with long encoded labels, while ordinary web-upload volume remains low. The stronger signal is the structure and cadence of name-resolution traffic rather than a general high-throughput transfer. DNS tunneling can carry comparatively small covert payloads without registering as a large generic upload event.

DNS cache poisoning causes a resolver to return false address records for legitimate domain names, redirecting clients toward attacker-selected destinations. The described symptom is unusually frequent, long encoded queries generated by an infected host, not incorrect answers returned to users for a banking hostname. Poisoning changes the integrity of DNS responses, whereas tunneling abuses DNS queries and replies as a data channel. The observed label pattern fits the latter investigation lead.

Privilege escalation means a process or identity crosses a permission boundary to gain rights it did not already have. The case reports suspicious DNS traffic but no administrator group change, local exploit, or privileged command. Malware can communicate through DNS without ever obtaining elevated rights. The traffic may warrant investigation, but a role-transition conclusion would require evidence of changed privileges, not merely a novel network protocol pattern.

Concurrent-session indicators involve overlapping use of one identity on different devices or in inconsistent contexts. The case instead reports that a previously nonprivileged service account is able to change membership in a privileged group. No competing sessions or unusual simultaneous logins are described. A stolen session could contribute to the incident, but session concurrency would require separate log evidence. The direct concern is a change in effective authority or abuse of another privileged mechanism.

DNS tunneling may be indicated by long encoded domain labels, anomalous DNS query frequency, or unexpected resolver destinations. The service account here performs a privileged membership change despite lacking administrative rights. There is no DNS activity described or indication that information moved through name-resolution queries. A compromised host could use DNS tunneling after gaining privileges, but this question concerns an authorization boundary crossed before any such network technique is established.

Account-lockout indicators appear when authentication systems deny further logins following too many failed attempts or policy-triggered blocks. The scenario instead shows a service account performing a membership change in a privileged group; it does not report failed passwords or locked identities. Authentication and authorization are different controls. A locked account could be part of another incident, but it does not explain the unexpected privilege-management operation described here.

Privilege escalation means an identity or process acquires permissions beyond its authorized level, as shown by unexpected administrative group changes or newly privileged commands. The badge system here logs one credential opening geographically separated physical doors within seconds. No digital account privileges or roles changed. This is a physical-access credential anomaly, not evidence of operating-system or directory privilege escalation. The distinction matters because physical reader logs and credential issuance records are the relevant investigation sources.

Concurrent-session indicators involve simultaneous use of a digital account or token from separate login contexts. Although two badge presentations happen close together, they are physical door-unlock events, not authenticated computer sessions. The same credential number at distant readers may suggest cloning, sharing, or a logging issue, but calling it a concurrent user session hides the more specific physical-access symptom. Investigators need reader timestamps and badge enrollment records.

Impossible-travel alerts commonly correlate two successful interactive account logins whose time and geographic separation make legitimate movement improbable. This case has an analogous timing concern but is explicitly about an RFID badge unlocking physical doors. The more specific result is possible physical credential cloning or sharing, not a cloud identity-provider's login geolocation alert. The terminology matters because badge-reader security and location records differ from VPN or public-IP geolocation systems.