CompTIA SY0-701 Bundle

Privilege escalation means an identity or process acquires permissions beyond its authorized level, as shown by unexpected administrative group changes or newly privileged commands. The badge system here logs one credential opening geographically separated physical doors within seconds. No digital account privileges or roles changed. This is a physical-access credential anomaly, not evidence of operating-system or directory privilege escalation. The distinction matters because physical reader logs and credential issuance records are the relevant investigation sources.

Concurrent-session indicators involve simultaneous use of a digital account or token from separate login contexts. Although two badge presentations happen close together, they are physical door-unlock events, not authenticated computer sessions. The same credential number at distant readers may suggest cloning, sharing, or a logging issue, but calling it a concurrent user session hides the more specific physical-access symptom. Investigators need reader timestamps and badge enrollment records.

Impossible-travel alerts commonly correlate two successful interactive account logins whose time and geographic separation make legitimate movement improbable. This case has an analogous timing concern but is explicitly about an RFID badge unlocking physical doors. The more specific result is possible physical credential cloning or sharing, not a cloud identity-provider's login geolocation alert. The terminology matters because badge-reader security and location records differ from VPN or public-IP geolocation systems.

A hash collision occurs when two different inputs produce the same hash digest, possibly by chance or through a chosen-input attack against a weak hash. The proxy here manipulates protocol negotiation to force an obsolete cipher suite despite modern capabilities on both sides. No digest comparison or two crafted documents are described. The flaw concerns negotiated cryptographic strength rather than identical hash outputs. Hash algorithms may be used during handshakes, but that does not make every handshake weakness a collision.

On-path modification is a broad category in which an intermediary changes traffic while it crosses the network. A malicious proxy forcing weaker handshake negotiation is indeed an on-path manipulation, making this option related but less specific. The question supplies the precise objective: reducing the negotiated cipher suite below what both endpoints can support. Naming the downgrade mechanism is more informative than only saying the proxy altered traffic. A different on-path attack might change HTTP content without weakening cryptographic negotiation.

Cross-site request forgery causes an authenticated browser to submit an unwanted request to an application without properly verifying that the user intended it. The proxy here does not induce a payment or settings change through a third-party page; it manipulates a protocol handshake. Although both can be security attacks using requests, CSRF concerns browser origin and application action authorization. Cipher-suite negotiation is a separate transport security boundary.

A missing-log investigation lead arises when expected audit data disappears or is incomplete, requiring validation of sensor health or tampering. The scenario instead shows two distinct crafted documents producing one identical weak hash digest in a verifier. No missing log records or telemetry gaps are described. The supplied condition directly concerns a cryptographic hash property, not the integrity or availability of event collection. Audit logs may be useful during investigation but are not the described weakness.

A protocol downgrade attack induces endpoints to agree to a weaker encryption version or suite than they normally would. Here there is no handshake negotiation, proxy, or protocol version change. The attacker crafts distinct document inputs and obtains the same hash output, which is a collision property of a hash function. Both involve cryptography, but they violate different assurances and require different remedies. Stronger transport negotiation would not automatically correct a weak document-digest algorithm.

Cross-site request forgery causes a victim's authenticated browser to perform an unintended action on an application, commonly through a request initiated by an external page. The scenario describes a verifier comparing hash digests for two crafted documents. No browser session, cross-origin request, or unauthorized web transaction is mentioned. A document hash collision may undermine integrity checks, but it does not imply that a logged-in user's browser was tricked into submitting an action.

An impossible-travel alert needs paired account logins with geographically inconsistent timestamps, such as successful sign-ins from distant countries minutes apart. The incident here concerns missing host security events during an interval in which neighboring systems remain active. No login geography or travel timing is given. Both can be investigated as suspicious signals, but the relevant evidence is event-record absence, which may indicate sensor failure, misconfiguration, or tampering and cannot be converted into a travel correlation.

Privilege escalation indicators arise when a principal unexpectedly gains or uses more powerful permissions, such as an unauthorized administrative group modification. The question reports an event-log gap but no permission changes, privileged commands, or role transitions. An attacker might suppress logs after escalation, yet that sequence is not demonstrated. The evidence supports investigating telemetry integrity rather than assigning a specific authorization breach without supporting audit or configuration changes.

DNS tunneling uses unusual query patterns or encoded DNS labels to carry command-and-control or exfiltrated information. The observed irregularity is a host's missing security logs, while nearby systems still report normal activity. No suspicious DNS names or resolver traffic appear in the statement. Tunneling and log suppression could coexist in an incident, but the analyst should not infer the communication mechanism from a gap in endpoint events alone.

Stored XSS requires attacker-supplied script to be saved on an application page and later executed by visitors when that page renders. The payment action here is submitted from an untrusted external page, with no script stored in the payment site's own content. A CSRF payload can trigger an authenticated action even when no hostile JavaScript executes within the victim application's origin. The important trust boundary is request authorization, not unsafe rendering of persistent HTML content.

Reflected XSS occurs when an application echoes untrusted request input into its immediate response and a browser executes it as script in that site's origin. The scenario does not say the payment application reflected content or ran injected JavaScript. Instead an unrelated page causes an authenticated browser to make an unwanted payment request. These attacks can overlap in complex exploits, but nothing in the case establishes an XSS sink or malicious reflected response.

SQL injection uses malicious syntax inserted into database query construction to alter the server's SQL execution. The payment action in this question is a valid-looking HTTP request submitted without sufficient cross-site intent validation. The backend might use safe parameterized SQL and still process the unauthorized transaction if CSRF controls are absent. There is no query-text manipulation, so diagnosing SQL injection would misidentify the application's missing security boundary.

Risk-prioritized patching applies updates to close exploitable software vulnerabilities, weighing severity, exposure, and observed exploitation. The problem is a published application token that attackers are actively using for unauthorized API calls. Patching unrelated code does not invalidate that token or stop a server from honoring it. A later software fix may prevent the next disclosure, but revocation is the action that directly cuts off current credential misuse. The response must follow the observed exposure rather than a generic security schedule.

Replacing credentials before future deployment is good preventive hygiene when preparing new workloads, but the exposed token is already in a public repository and has already been abused. Merely planning a different token for a subsequent release leaves the current one usable. The decisive timing is immediate revocation of the existing credential, followed by provisioning and secure distribution of a replacement. Credential replacement without disabling the compromised value is insufficient for active abuse.

Endpoint isolation disconnects a compromised device from production networks while maintaining investigatory access, which is effective when an infected host is beaconing. The incident describes unauthorized API calls using a secret published in a repository, not any specific compromised workstation. A stolen token can be used from numerous external systems, so isolating one endpoint may not invalidate it. The security boundary that has failed is credential secrecy, and the correct containment action is to revoke the credential at its issuer.

Outbound traffic monitoring and DLP can detect suspicious data transfers or block the export of protected information. They do not remove a database-owner privilege from a reporting service that only needs a particular read-only view. Excess permissions still allow database changes if the account is compromised, even if alerts identify abuse. Monitoring is a valuable detective layer, but the immediate risk is unauthorized capability granted to a service identity. Enforcing least privilege at the database is the direct mitigation.

Leaving the service account as database owner while adding a client-side or application-interface restriction on writes does not remove its server-side authority. An attacker using the account directly could bypass the reporting application's interface and still execute privileged database operations. This fails the precise requirement to reduce the credential's effective permissions. A read-only view grant enforced by the database eliminates unnecessary owner rights regardless of how the client issues queries.

Centrally enforced secure baselines can require authentication, approved settings, audit policies, and consistent security configuration across a fleet. They are useful systemic controls but do not specify the exact database permission this reporting service needs. A generic baseline cannot substitute for removing a database-owner role from an identity that should only SELECT from one view. Least-privilege role assignment at the data layer is the direct treatment; a baseline can help keep that assignment from drifting later.

Host intrusion prevention detects or blocks some malicious process behaviors on the endpoint, such as suspicious memory execution or unauthorized file changes. It may reduce damage after a macro starts, but the described entry path is untrusted external spreadsheets executing active macros. A policy preventing those macros from starting addresses the technique earlier in the chain and is more targeted. Prevention products are useful defense in depth, yet their detections may not catch every malicious Office script.

Driver-signature enforcement helps prevent untrusted kernel drivers from being loaded or executed, protecting privileged operating-system boundaries. The incident involves active content inside Office spreadsheets, which normally executes within a user application and does not require installing a kernel driver. A malicious macro could attempt to deploy a driver later, but no such payload is described. Enforcing driver trust does not reliably stop an unsigned spreadsheet macro from beginning its execution chain.

A restrictive host firewall can limit network connections to or from a workstation and reduce some post-compromise communication paths. It cannot by itself prevent a macro embedded in an external spreadsheet from executing when the document is opened. The scenario asks to address the initial document execution risk, not a listening remote-management port or an observed command-and-control connection. Firewall restrictions are a useful secondary containment control, whereas macro trust policy is the direct intervention.

Risk-prioritized patch deployment closes known software weaknesses, especially where exploitation is observed. The workstation problem here is that unnecessary management ports accept inbound connections, a network policy and service exposure issue rather than a stated unpatched flaw. Even a fully patched remote desktop daemon should not be publicly reachable without authorization. Patching is important maintenance but does not replace restricting which sources may connect to local services.

Host intrusion prevention may detect exploit behavior or unauthorized changes after a remote-management service is contacted. The threat in this case is avoidable network reachability on unnecessary inbound ports. A firewall rule blocks that traffic before it reaches the listener, reducing the exposed boundary more directly than relying on behavior detection. An intrusion-prevention agent is complementary but should not be the only protection when the service itself is not supposed to accept those connections.

Blocking unsigned macros controls execution of untrusted active content in document applications, particularly Office files received from the Internet. No spreadsheet, embedded script, or document delivery is involved in the developer workstation's exposed remote-management listener. Restricting macros will not close TCP ports or block remote sessions to a separate service. The correct mitigation changes inbound network reachability rather than document execution policy.

A centrally enforced secure baseline can ensure services use approved settings and may require timely update management. However, a generic baseline is less direct than deploying the specific tested patch for a vulnerability already listed as exploited by CISA. The immediate gap is an existing exploitable server flaw, not simply configuration drift. Baselines can support long-term compliance, but they do not automatically remediate an identified software vulnerability unless the relevant fix is installed.

Endpoint isolation is urgent when a host is actively compromised, beaconing, or posing an immediate spread risk. The question reports a vulnerability known to be exploited in the wild and a tested vendor update, but does not say this specific server has been compromised. Isolating all exposed servers without assessing business impact may be unnecessary and could interrupt service. The most directly supported action is accelerated risk-based patching, with isolation reserved for confirmed incidents or unpatchable exposure needing containment.

Revoking a published API token stops use of a known compromised credential, and it is appropriate when unauthorized calls are occurring with that secret. The incident here concerns a software vulnerability listed as exploited and a vendor patch ready for deployment. No stolen token or credential-exposure incident is stated. Token rotation would not correct a vulnerable service's code path, so the remedy should target the exploited flaw rather than an unrelated authentication secret.

Revoking a leaked token is the direct response when a specific machine credential is exposed and unauthorized API requests use it. A laptop that is already beaconing to command-and-control has an active host compromise; the stem provides no particular secret that revocation alone would neutralize. Stolen credentials may need rotation later, but immediate network isolation prevents the host from continuing to contact the attacker or attack other devices while forensic triage begins.

Risk-prioritized patching closes known software vulnerabilities and reduces the likelihood of future exploitation. The laptop in the case is already compromised and communicating with a command-and-control endpoint, so patching alone cannot establish that malicious processes have stopped or that the attacker has lost access. The first containment decision is to disconnect or restrict the host while preserving evidence. Patching or rebuilding can follow after the incident-response team understands the intrusion.

Protected centralized append-only log retention makes security events harder for attackers to delete or alter and supports reliable forensic reconstruction. It is important during response to a compromised laptop, but it does not stop that laptop from reaching a command-and-control server or attacking nearby systems. The question asks for the most direct immediate mitigation of ongoing beaconing. Network containment is required first; durable logs are a supporting evidence-preservation control, not a replacement for isolation.