CompTIA SY0-701 Bundle

A technical detective control identifies events or artifacts that indicate suspicious behavior, such as signaling that an executable matches a malicious signature. Detection is an essential input to this case, so the category appears relevant. But the action being classified goes beyond observing the file: it isolates the process and removes the malware to restore the endpoint, which is corrective behavior.

An operational corrective action is performed by personnel following an operating procedure, such as a technician manually revoking a mistakenly assigned administrator role. The objective can resemble automated remediation, so the word corrective alone is not enough to decide. In this scenario, a software agent performs the isolation and deletion without the described human procedure, making the control technical rather than operational.

A technical preventive control blocks unauthorized activity before it succeeds, such as an application-control policy refusing to launch an untrusted executable. Endpoint software can provide both prevention and remediation capabilities, which may be confusing. Here the executable is already on the host and the requested action is cleanup following detection. Classifying that removal as the original prevention would ignore the time ordering stated in the stem.

An operational directive tells personnel how to perform recurring work, such as how service-desk employees should validate and process access requests. A risk assessment can eventually lead to new operating procedures, which creates a possible connection. In this question executives are deciding whether a network architecture change is warranted; there is no staff instruction governing daily execution, so the activity is managerial rather than operational.

A technical detective control collects and analyzes events to reveal suspicious activity, such as a network intrusion-detection system raising alerts about unusual traffic patterns. Monitoring results may feed a risk assessment, which can make detective technology relevant to the broader program. Yet leadership has commissioned a study, and the stem excludes any newly deployed sensor or event-based detection function; detection is not the implemented control.

A technical preventive control would enforce segmentation through mechanisms such as inter-zone firewall rules or access-control lists that stop disallowed network flows. The risk assessment could recommend exactly those defenses, so the term sounds familiar. However, a recommendation or cost-benefit evaluation is not the same as configuring the prevention mechanism, and the question explicitly says the technical deployment has not happened.

A permanent technical detective control would automatically sense entry attempts and produce events without relying on guards. The failed sensor is precisely the technology being temporarily replaced, and the substitute plan relies on human credential checking and written logs. Manual recordkeeping may provide later evidence, but it does not make the stopgap a new permanent automated detector or repair the failed sensor itself.

Security awareness messages can discourage accidental or casual trespassing by reminding personnel about required badges and restricted areas. This plan goes further: vetted guards actively inspect credentials and record entries at the physical boundary. It supplies a functional substitute for a broken detection or access-verification mechanism, not merely information intended to change visitor behavior or create a deterrent impression.

An automatic physical barrier can prevent passage through a door or turnstile until a hardware or electronic condition is met, without a guard independently deciding who enters. The scenario identifies no newly installed barrier and explicitly describes manually operated credential checks. That distinction matters: the temporary protection depends on staff procedures, training, and supervision, not autonomous mechanical enforcement.

Integrity means that data remains accurate and free from unauthorized alteration, with changes traceable to appropriate actors. A malicious user could compromise integrity by modifying diagnoses or payment details, but this evidence says the patient files were downloaded without being changed. An unauthorized reader is a confidentiality problem even when the read-only activity leaves every stored byte intact.

Availability requires that legitimate users can obtain a service and its data when needed. A denial-of-service attack or outage could violate availability, but the portal remains reachable throughout this incident. The key fact is that an unauthorized former contractor obtains patient information, not that patients or clinical staff lose access to the functioning records system.

Non-repudiation concerns evidence that binds a particular party to an action, often through appropriate signatures, identities, and auditable records. Signed transaction receipts might help prove who approved a clinical update, but the facts do not say receipt evidence is absent or disputed. The observed security violation is the unauthorized reading of confidential patient data, not a contested digital signature.

Availability is the ability of legitimate finance personnel to use the system and retrieve the payment file when needed. The scenario explicitly says the file remains readable and does not describe any outage or denial of service. The problem is that a beneficiary account number has been changed without approval, so the primary impact concerns correctness of the data rather than its accessibility.

Confidentiality is violated when payment data reaches an unauthorized reader or is disclosed outside an authorized audience. Investigators specifically found no distribution beyond the finance group, so there is no evidence of a disclosure. The unauthorized edit is dangerous because funds might be redirected, but that loss mechanism stems from altered instructions, not from someone learning confidential information.

Authenticity is evidence that a claimed identity or message origin is genuine, including whether an accountant logged in with valid credentials. An authentic prior login does not guarantee that the approved file was never changed afterward, and no login-spoofing evidence is stated. The failure described is unauthorized alteration of an existing record; it directly tests data integrity rather than the user's initial identity claim.

Confidentiality governs whether protected data can be viewed or disclosed to unauthorized parties. A traffic flood could sometimes be paired with data theft, but this investigation explicitly found no evidence of disclosure. Here packets overwhelm service capacity and prevent legitimate requests from succeeding, which affects a different dimension of the confidentiality-integrity-availability model.

Integrity requires that data and processes remain accurate and are not modified without authorization. An attacker might tamper with records or inject fraudulent transactions while disrupting a service, but investigators found stored data unchanged. The loss described is an inability to reach the online service during a flood, not corruption of the information that it stores.

Non-repudiation provides evidence connecting a party to an action so that the action cannot credibly be denied later, commonly through signed transactions and reliable identity records. The question concerns failed access to a service, not a dispute about a signed operation or the accountability of a transaction. It would therefore misclassify the customer outage to choose non-repudiation.

Authentication verifies that a claimant can demonstrate control of an acceptable credential and establishes an identity assertion for a session. The staff member has already passed that check using a phishing-resistant authenticator, so authentication has not failed. The subsequent refusal occurs when the system evaluates that identified user's permissions for one protected payroll folder.

Identity proofing is the enrollment process that validates an applicant's claimed real-world identity before appropriate credentials are issued. It may be important when onboarding a new employee, but the scenario begins with a staff member who already has a trusted authenticator and a functioning account. The denial is made after sign-in against resource privileges, not during the person's initial identity verification.

Password-expiry policies may require changing a credential or completing a new sign-in when an account's memorized secret is no longer acceptable. Nothing says the person's password expired; instead, a phishing-resistant credential was accepted and the user proceeded to a resource request. The explicit reason for denial is absence of payroll authorization, which password rotation would not automatically resolve.

MFA can strengthen the authentication of a shared account by making possession of the password insufficient for login. However, if all administrators still operate under the same root identity and no individual authentication-to-session binding is kept, the command log continues to attribute actions only to root. That does not establish which human performed a deletion, so MFA alone is inadequate for the specific accountability gap.

Granting additional permissions to a shared root identity expands what anyone using that account can change and may increase the impact of misuse. It does not create per-person attribution because all commands still run under the same collective identity. Privileged access should instead be limited, tied to an individual operator, and supported by reliable activity records, especially for emergency changes.

Disabling command logs eliminates important records of what happened during privileged emergency fixes. Investigators would have even less evidence of the deleted records and no basis to distinguish individual actions. Reducing logging volume may sometimes be necessary for performance or privacy, but that should be done with carefully scoped retention and auditing, not by removing the records needed for accountability.

A plain checksum can detect that a file differs from a known reference value, but anyone who can modify the order can calculate and substitute a new checksum. It therefore does not bind the contents to the business partner's private key or establish who authorized them. Checksums are appropriate for accidental corruption detection, not for the specified non-repudiation and origin-verification evidence.

A message authentication code proves that someone possessing a shared secret generated or validated a message and helps detect tampering in transit. Because both trading partners know the same MAC key, either could produce a valid tag, making it weak evidence in a dispute about which party signed. Shared-key authentication can be suitable for service-to-service integrity, but not exclusive attribution to the partner's signing key.

Encrypting the order to the recipient's public key helps keep its contents confidential during delivery because the recipient can decrypt it. That operation does not prove the sender owns the trading partner's signing private key or that the partner authorized the transaction. Anyone with the recipient's public key could encrypt a forged order, so encryption is not a substitute for a sender signature.

Penetration testing attempts to exercise security weaknesses and demonstrate exploitability within an authorized scope, potentially using controlled attacks against the servers. The auditor is instead comparing a list of currently deployed safeguards with an approved target baseline, without describing any exploit attempts. A penetration test can produce findings that feed a gap assessment, but it is not the comparison activity itself.

A business impact analysis identifies critical business functions and estimates disruption consequences, dependencies, recovery priorities and tolerable downtime. That is useful when deciding which servers deserve stronger protections, but the stated deliverable is the difference between installed safeguards and a preapproved target configuration. Its unit of analysis is control implementation versus a benchmark, not revenue loss or recovery impact.

Root-cause analysis investigates how and why an observed security or operational incident occurred, tracing contributing events and failed controls. The question does not identify a compromise or ask for an incident timeline. The auditor is performing a forward-looking baseline comparison across eighty servers, so the results are missing or misaligned controls rather than causes of a particular past event.

A policy enforcement point is the gateway or agent that allows, blocks, monitors, or terminates an actual subject-to-resource connection. It applies the result of a policy decision but need not calculate that decision itself. Because the scenario expressly states the gateway is already enforcing and asks for the separate component that evaluates context, selecting the enforcement point would confuse execution with decision-making.

The policy administrator arranges or tears down communication paths in response to a policy engine's decision, often instructing enforcement points to establish the authorized session. It can be mistaken for the engine because it participates in the control plane, but the question identifies a separate session-establishment component. The contextual allow-or-deny evaluation belongs to the engine, not to the administrator coordinating connectivity.

A network access switch forwards Ethernet frames and may implement port-level admission rules, VLANs, or access-control lists based on commands from other components. That network function does not by itself describe the logical policy engine assessing identity claims, posture and per-resource rules. Even if a switch acts as an enforcement location, the requested role is the distinct component that makes the access decision.