CompTIA SY0-701 Bundle

Revoking a leaked token is the direct response when a specific machine credential is exposed and unauthorized API requests use it. A laptop that is already beaconing to command-and-control has an active host compromise; the stem provides no particular secret that revocation alone would neutralize. Stolen credentials may need rotation later, but immediate network isolation prevents the host from continuing to contact the attacker or attack other devices while forensic triage begins.

Risk-prioritized patching closes known software vulnerabilities and reduces the likelihood of future exploitation. The laptop in the case is already compromised and communicating with a command-and-control endpoint, so patching alone cannot establish that malicious processes have stopped or that the attacker has lost access. The first containment decision is to disconnect or restrict the host while preserving evidence. Patching or rebuilding can follow after the incident-response team understands the intrusion.

Protected centralized append-only log retention makes security events harder for attackers to delete or alter and supports reliable forensic reconstruction. It is important during response to a compromised laptop, but it does not stop that laptop from reaching a command-and-control server or attacking nearby systems. The question asks for the most direct immediate mitigation of ongoing beaconing. Network containment is required first; durable logs are a supporting evidence-preservation control, not a replacement for isolation.

Host intrusion prevention inspects or intercepts suspicious activity on an operating system where a compatible agent can run. A production PLC may not support such an agent, and inserting one into its firmware could violate the very safety restrictions described. It can protect an engineering workstation instead, but it is not the best direct mitigation for a controller that cannot be modified.

Risk-prioritized patch deployment is sound when a vendor provides a validated fix and the operator can schedule safe installation. However, patching the PLC threatens safety certification, so prioritization alone does not create an executable fix. Defer firmware modification until the manufacturer and plant safety process approve it, while limiting reachable attack paths now.

A restrictive host firewall is a useful local control on operating systems that support managed rules. The question provides no evidence that the certified PLC can run or change an onboard firewall safely. External segmentation and protocol-aware filtering can restrict access without modifying the controller, making them more appropriate for this stated constraint.

Egress monitoring and DLP can alert on unusual transfers or attempts to send protected information to unauthorized destinations. Neither feature automatically makes the authorized telemetry payload confidential while it travels through the provider WAN. Monitoring could complement an encrypted channel by spotting exfiltration, but a passive observer could still read the plaintext measurements in this scenario.

Changing compromised or default credentials is important when an attacker might authenticate as a service or administrator. The described weakness is not a disclosed password; it is sensitive telemetry crossing an untrusted network in cleartext. Even perfectly unique endpoint passwords do not encrypt application payloads. Credential rotation would address a different incident and leave this interception risk unresolved.

A host firewall can restrict source addresses, ports, and connection directions for a telemetry endpoint. It does not turn an allowed plaintext data stream into an encrypted one, so a network intermediary on the third-party WAN can still observe the measurements. Use host filtering as defense in depth, alongside transport encryption, rather than treating access rules as data confidentiality.

Rotating a separate cloud API token revokes that token and may be necessary after its disclosure. It does not change the industrial sensors’ identical factory administrator passwords, which remain accepted for device management. The question asks for the provisioning action that removes a known, shared credential across physical devices; work on an unrelated cloud identity does not satisfy it.

Network monitoring could detect unexpected logins or management sessions and is useful for observing an industrial sensor fleet. Detection is not the same as eliminating authentication with a public factory password. An adversary who knows that password may still log into any reachable sensor before an alarm is investigated. Credential replacement is the immediate preventive change.

Recording the common password in a centrally managed document may improve inventory practices but does not reduce the attack surface of factory-default credentials. Every device would still accept the same published value. Worse, wider distribution of the list creates another exposure path. Securely recording unique replacement credentials is useful only after the default values have been removed.

Immediate token revocation can stop continued use of a known-compromised application credential and belongs in containment. It cannot recover audit events already deleted under that credential or prevent the account from erasing local logs before revocation completes. This scenario specifically asks to preserve evidence against an attacker with log-deletion rights, which requires an independent protected destination.

Outbound traffic monitoring and DLP inspect transfers to identify suspicious exfiltration or policy breaches. They may generate separate alerts, but they do not guarantee that the application’s own administrative activity records survive an attacker deleting the local log directory. Evidence durability needs independent append-only collection and access controls, not merely another traffic-detection rule.

Isolating an affected endpoint can interrupt attacker connectivity and limit further spread after compromise. If application logging is stored only on that endpoint under the compromised account’s permissions, isolation does not make the evidence tamper-resistant. An attacker who already controls the application identity may erase local files regardless of network containment; centralized protected logging addresses that specific failure.

Outbound flow telemetry paired with data loss prevention analysis can identify unexpected file-sharing destinations, volume spikes, and attempts to transmit protected finance data. Because the SOC needs rapid visibility into transfers leaving finance systems, monitoring at approved egress points and correlating alerts with endpoint identities directly matches the requirement. Proper tuning distinguishes business-approved transfers from exfiltration, and DLP inspection may require endpoint integration or policy-compatible handling of encrypted traffic.

An authenticated encrypted channel safeguards confidentiality and peer identity while data traverse a network. It does not, by itself, tell the SOC whether finance files are being sent to an unauthorized sharing service. Encryption may even hide content from network-only inspection. Use secure transport for legitimate traffic, but deploy egress telemetry and DLP to gain the requested transfer visibility.

Protected append-only logs preserve existing audit records after they have been collected and can strengthen investigations. Retaining logs is not sufficient if finance-to-file-sharing traffic is never captured or classified in the first place. The SOC needs an active egress monitoring and DLP capability to detect such movement promptly; protected retention can then safeguard its alert evidence.

Risk-prioritized patching reduces exposure to known software vulnerabilities according to severity, exploitation and business impact. The symptom here is an antivirus configuration repeatedly switching to disabled, not a missing software security update. Patching an agent may help if a verified bug causes the drift, but the main requirement is continuous policy enforcement of the protected configuration.

Append-only audit records can help investigators determine when and by whom antivirus protection was disabled. They do not actively restore the configuration after a workstation drifts from policy. Preserving evidence is useful if tampering is suspected, but the operational requirement is to maintain a consistent enabled state through a managed baseline.

Revoking a stolen access token stops that token from being used for authentication and may help after an account compromise. No compromised token is identified in the scenario. Rotating credentials does not automatically stop local antivirus settings from reverting, whereas managed desired-state enforcement checks and reapplies the security setting continuously.

Securely retire the obsolete server: confirm no production dependencies, remove network and identity access, preserve required records, sanitize storage appropriately, and dispose of assets under the approved process. The payroll workload is no longer needed, so eliminating the system removes an unsupported attack surface rather than accepting indefinite maintenance risk. Verify data-retention obligations and backups before destruction. Decommissioning is the cleanest control when the business no longer needs the service.

Applying a secure baseline can disable unnecessary services and reduce privileges on a machine that must remain in operation. Here there is no business justification to keep the unsupported server. Hardening an obsolete host may be an interim action before disposal, but it leaves an unnecessary asset and any unfixable software vulnerabilities in place.

Network isolation and monitoring are useful compensating controls for a legacy device that must keep serving a required function. The payroll host in this question has no such operational dependency. Segmentation would reduce exposure while the device remained installed, but approved decommissioning removes that risk and the cost of monitoring an unneeded server.

Remove general staff write or modify permissions on the approved policy folder while retaining read access for the people who need the PDFs. The scenario identifies an authorization error: viewers can overwrite authoritative documents. Read-only role permissions prevent ordinary viewers from changing them and preserve legitimate viewing. Reserve updates for designated publishers using a controlled approval workflow, and test inherited permissions so another group membership does not restore write access.

Retiring the entire folder would eliminate access to the approved policy documents as well as the ability to change them. That conflicts with the explicit requirement that staff continue reading current PDFs. Decommissioning is suitable for content that is no longer needed, not for an active reference repository requiring a narrower permission model.

Longer audit retention would help determine who viewed or changed a policy file after an incident, assuming modification events are logged. It does not prevent the unauthorized edit in the first place. Keep useful file-integrity and access logs as supplementary detective controls, but remove unnecessary write privileges to protect the authoritative copies.

Enforce a platform-supported kernel driver signing and trust policy so the system refuses to load unsigned or unapproved driver images. The attacker is specifically attempting to insert unsigned kernel code, where operating-system trust checks can block the load before a malicious module gains kernel privileges. Secure boot, driver blocklists and controlled exception procedures can strengthen this approach. Signing is not absolute proof of harmlessness: signed malicious drivers also require additional defenses.

Restricting write access to files or shares protects data integrity and reduces what a user may change. A driver installation is governed by kernel loading and device trust decisions, not just ordinary document permissions. File ACLs may support hardening, but they cannot by themselves verify the authenticity and approval of a kernel driver being loaded.

A host firewall filters inbound and outbound network connections according to local policy. It cannot reliably distinguish a signed driver from an unsigned driver when that file is loaded by the operating system. Network restrictions reduce exposure, but the explicit attack uses an untrusted local kernel module, so driver trust enforcement is the direct preventive control.

A compatible host intrusion prevention system can examine locally observed exploit behaviors and block suspicious execution or memory-abuse patterns before they complete. The server faces exploitation that network filtering cannot stop, and no usable vendor patch exists yet, so inline host protection can provide a temporary compensating control. Deploy prevention signatures or behavior policies in a tested mode to avoid service disruption; HIPS supplements, rather than replaces, eventual software remediation.

Driver-signature enforcement blocks unsigned or untrusted kernel drivers from loading. The described threat is memory exploitation of an exposed server process, not a malicious kernel-module installation. A trusted or signed process can still contain memory-corruption vulnerabilities. Driver policies are useful hardening, but host-level exploit prevention is more directly targeted.

Untrusted-macro blocking prevents office document automation from triggering malicious code in common phishing workflows. It does not intercept arbitrary memory exploitation in the server application described. If the vulnerable process were launched by a malicious document this might be one useful defense layer, but no such document path is part of this case.