CompTIA SY0-701 Bundle

A general-purpose shared virtual-machine scheduler may delay control threads unpredictably as unrelated workloads compete for resources. It can be suitable for office applications but does not guarantee the bounded interlock response measured in milliseconds. Running the PLC workload on that scheduler would preserve the timing failure already demonstrated by the tests.

Serverless functions are invoked through provider-managed runtimes and network services, and cold starts or service contention can add variable delays. They are well suited to asynchronous event processing but unsuitable as the sole millisecond-bounded controller for a safety interlock. Cloud invocation latency cannot provide the deterministic local deadline stated in the question.

Containers normally share a host kernel and are governed by the underlying operating system’s scheduler. Without real-time scheduling guarantees, multi-tenant resource pressure can delay critical control processes just as it does in general-purpose VMs. Packaging software in a container does not itself make control-loop timing deterministic.

A geographic data-residency policy constrains where information is stored or processed, which matters for regulated cloud tenants. It does not supply a secure network path between two offices. The case concerns transporting internal address-space traffic across an untrusted network without purchasing a leased private circuit.

A DMZ separates Internet-facing servers from protected internal networks and limits how external traffic crosses trust boundaries. The offices need private intersite connectivity, not a screened segment for publishing public applications. A DMZ might be part of either office’s local architecture but does not create the encrypted link.

Microsegmentation enforces fine-grained traffic rules among internal workloads to limit lateral movement. It can be deployed after intersite connectivity exists, but it does not itself encrypt packets across a third-party WAN or authenticate the remote network gateway. Site-to-site VPN supplies the missing trusted transport.

Hybrid integration combines an on-premises environment with cloud resources. It does not inherently ensure that all copies of data remain within a particular country; traffic, replicas and managed service dependencies may cross borders. The residency requirement needs explicit region and data-location governance regardless of whether the deployment is hybrid.

A private cloud is used exclusively by one organization, offering isolation and control over tenant allocation. A private deployment hosted abroad can still violate country-specific storage obligations. Tenancy type is therefore not sufficient; geographic placement, backups and operator access require independent evaluation.

An authenticated encrypted VPN protects information traversing an untrusted network and verifies the endpoint gateway. It cannot determine where a cloud provider persists databases or backup copies. Encrypted transit is useful for cross-site communication, but data residency involves geographic storage and processing choices outside a VPN tunnel.

Noisy-neighbor contention results from shared resource competition when one workload consumes a disproportionate share of a host. The issue in the question is a nonredundant identity provider on which many applications depend, not CPU or storage contention among tenants. Resource reservations would not provide an alternate authentication service during its outage.

Broad forwarding-policy manipulation is a risk when an attacker gains administrative authority over a central networking controller. A single identity service may also need access protection, but the prompt identifies a reliability dependency rather than stolen SDN credentials or widespread routing changes. The primary architectural concern is identity availability.

Configuration drift means that live settings differ from the approved desired configuration. No mismatch of deployed and planned identity policies is described here. The service may be correctly configured but still fail because there is only one instance, so redundancy and dependency resilience are the relevant decisions.

Shared-kernel exposure arises when isolated applications rely on one host operating-system kernel and can be affected by compromise of that kernel. The scenario instead describes virtual machines slowing under a tenant’s heavy CPU load. It provides evidence of resource scheduling contention, not exploitation of shared kernel privileges.

An identity single point of failure can disrupt many dependent services if their sole authentication component stops responding. The shared-VM slowdown is correlated with CPU consumption by one tenant, not an identity outage. Adding identity redundancy would not correct poor CPU scheduling limits on the virtualization platform.

Isolated network security zones restrict which tenants or departments can initiate traffic across network boundaries. They can limit lateral movement but do not allocate processor time among virtual machines. Network segmentation therefore does not directly address degradation caused by a shared physical host running out of available CPU capacity.

A WAF at the web listener can filter malicious HTTP requests but does not create a network isolation boundary between a compromised front end and the database. Keeping both on one flat subnet gives the public tier unnecessary reachability. The scenario explicitly requires nonpublic internal networks and controlled inter-tier flows, so subnet placement remains essential.

Publishing the database on an Internet-routable segment unnecessarily expands its attack surface and violates the requirement that application and data tiers remain internal. Even strong database passwords would not justify exposing its network endpoint broadly. Place database listeners behind internal access rules serving only approved application identities.

The employee LAN is a separate trust context from a public web service and should not become an unrestricted bridge to application or database resources. Placing the front end there mixes public ingress with internal user traffic. A screened DMZ offers a clearer boundary and more limited intertier policy.

A DMZ provides a screened segment for public-facing services such as web servers. The question concerns internal employee devices reaching payment database ports directly, not Internet ingress to a public listener. A DMZ alone would not enforce the required trust boundary between ordinary corporate users and the card-data environment.

A reverse proxy accepts application requests and forwards them to protected web origins, potentially adding TLS termination and routing. Payment database clients connect using database protocols, and ordinary employee LAN traffic should not reach those ports. An HTTP reverse proxy does not automatically restrict direct database network connectivity.

A web application firewall inspects HTTP requests for patterns associated with application-layer attacks such as injection. The unrestricted path described is from employee hosts to database service ports, not malformed web requests passing an HTTP gateway. WAF rules are complementary, but cannot replace network-level least-privilege filtering.

A basic stateful network firewall can allow TCP 443 based on source, destination and connection state. It does not normally parse the HTTP parameters that carry the malformed injection payload described, especially without appropriate TLS inspection. It is useful network filtering but not an application-layer request control for this specific vulnerability.

A passive IDS connected to mirrored traffic can alert analysts when it recognizes attack signatures. Because it is not in the request path, it cannot reliably block the malicious HTTP payload before vulnerable code processes it. The requirement explicitly asks for an inline preventive mechanism, not after-the-fact detection.

A screened DMZ limits network reachability between the public web service and protected internal systems. It helps contain compromise, but does not inspect or reject malformed application parameters entering the web listener. A DMZ is good architectural layering but cannot directly stop the targeted injection request before it reaches vulnerable code.

An interzone firewall enforces allowed communications across internal trust boundaries, frequently using addresses and ports. That is valuable for segmentation but does not specifically add exploit-signature blocking to an existing alert-only edge sensor. Stateful packet filtering alone may not recognize the attack patterns the device already detects.

A WAF can block suspicious HTTP application requests, including known injection patterns, when traffic is web-based and routed through it. The question does not restrict the alert signatures to HTTP; it asks to turn network exploit detection into dropping behavior. An inline IPS is the broader matching prevention component.

A reverse proxy forwards client web requests to origin services, often terminating TLS and hiding origin addresses. It need not identify or drop exploit signatures and typically applies only to proxied protocols. The existing security sensor needs in-path intrusion prevention, not merely an application ingress intermediary.

A passive WAF sensor can inspect mirrored HTTP traffic and alert about suspicious request patterns. In that placement it does not receive and forward live client connections to origins or conceal origin addressing as the required gateway. An inline WAF could include reverse-proxy functions, but this option explicitly describes alert-only operation.

An intrusion detection sensor receiving packet copies analyzes traffic without acting as the client-facing HTTP endpoint. It cannot independently accept sessions, terminate TLS for legitimate clients, or relay requests to approved origin servers. IDS supports detection, not the application gateway functionality requested in the scenario.

A DMZ is a network zone or screened segment for Internet-facing services and provides a useful trust boundary. It does not by itself create a running HTTP proxy or forwarding service. Placing the origin in a DMZ may limit exposure, but clients would still need an actual intermediary gateway to hide its address.

DHCP snooping rejects unauthorized DHCP server replies on untrusted switch ports and can build bindings used by other security features. It does not authenticate the laptop's user or evaluate endpoint posture before granting the normal VLAN. An attacker can acquire an address from the legitimate DHCP server while remaining unmanaged.

MAC-address allowlisting may filter devices by layer-2 addresses, but those identifiers can often be spoofed and do not prove user identity or device health. The policy explicitly requires authentication and posture-based VLAN placement. MAC controls alone cannot meet either requirement reliably for guest laptops.

Permanently disabling all campus access ports would prevent normal managed devices from connecting as well as guests. It eliminates the service rather than selectively admitting authorized endpoints based on trust level. Network admission should differentiate compliant users and devices from unknown or noncompliant ones without removing legitimate connectivity.