CompTIA SY0-701 Bundle

Out-of-band management can provide a separate, resilient path to a switch when production interfaces or VLANs fail. It does not automatically encrypt Telnet if operators continue using plaintext on the shared network. For this stated credential-disclosure risk, disable Telnet and move to SSH; out-of-band separation can be an additional resilience control.

A private administration network and source allowlist reduce who can establish sessions to switches. They do not necessarily protect login credentials and commands against an observer with access to the shared link if Telnet remains enabled. Network separation complements, but cannot replace, encrypted remote management.

Load balancing distributes web or application traffic across healthy backends and may remove failed servers from service. It does not protect administrative credentials carried in Telnet sessions. The question concerns transport confidentiality for switch management, not availability of a multi-node web service.

A DMZ separates Internet-facing services from internal application and data networks and helps contain compromise. It does not inherently distribute requests across two frontends or stop sending traffic to an unhealthy backend. A DMZ could host a load balancer, but the required function is active request distribution and health checks.

An inline IPS can block traffic matching exploit signatures, protecting the frontends against some attacks. Prevention signatures do not perform weighted application request distribution or remove a failed backend from a traffic pool as the question requires. IPS and load balancing solve different security and availability concerns.

Dedicated out-of-band management keeps an administrative path accessible during faults in the production data network. That assists incident recovery but does not balance customer HTTP sessions or monitor frontend health for request routing. This option concerns management connectivity, not application traffic availability.

SSH over the normal secured management VLAN encrypts credentials and administrative commands, but that VLAN is unreachable after the faulty core-switch configuration. Encryption does not create an alternate physical path around the broken network. Operators need management connectivity that remains independent of the failed production forwarding configuration.

DNS-layer policy can block malicious domain resolutions from endpoints and enforce an approved browsing policy. It cannot recover a switch whose management VLAN was broken by its own configuration. The problem is independent device access, not malicious DNS responses or risky domain names.

A private administration path with an IP allowlist improves security when management traffic still has a working route to the target. If that path traverses the same misconfigured core management VLAN, allowlisting will not restore connectivity. The case calls for a physically or logically independent out-of-band access channel.

A private administrative network and source allowlist restrict which locations can reach production systems, providing a useful first boundary. The scenario also involves engineers initiating many direct privileged sessions from unmanaged home devices. Without a controlled intermediary, consistent session recording, policy enforcement and credential exposure remain difficult to manage.

DNS-layer domain blocking protects users against known malicious domains and can reduce phishing or malware callbacks. It does not mediate privileged remote sessions to production hosts, enforce engineer roles or record administrative activity. The stated architecture problem is direct administrator reachability, not domain-resolution policy.

SSH provides encrypted remote command sessions and is appropriate for Unix-like server administration. If every home machine connects directly to hundreds of hosts, using SSH alone still leaves many exposed management endpoints and inconsistent audit paths. A controlled bastion can use SSH internally while centralizing the required privileged gateway function.

A default-deny firewall or proxy allowlist can restrict network destinations broadly, but it may be too coarse to respond to domain intelligence when endpoints legitimately browse many websites. The question specifically identifies newly registered malicious domains before payload execution. DNS-layer filtering can act at the domain-resolution decision directly.

DNSSEC validates signatures for DNS records in signed zones and protects against some forged data. A malicious domain can be correctly registered and validly signed. DNSSEC therefore cannot determine whether a domain is dangerous or stop it based on a threat-intelligence classification.

Encrypted DNS transport prevents on-path parties from reading or modifying the client-to-resolver DNS conversation. It does not decide whether a legitimately registered domain is malicious. Using an encrypted resolver with no domain-blocking policy would still return addresses for newly registered attacker domains.

BGP prefix filtering restricts which network routes neighbors advertise or accept. It does not specify which SaaS applications or egress destinations the proxy may access at the application policy layer. Route control can reduce accidental reachability, but it is not the required default-deny service allowlist.

Symmetric traffic routing through a stateful firewall helps ensure session return packets traverse the same state-tracking device. This solves asymmetric-flow failures, not a proxy policy that grants outbound access to every destination except blocked ones. Correcting flow symmetry would not convert the proxy to an allowlist.

An interzone firewall with least-privilege rules controls connections between internal trust zones. The described policy sits at a SaaS proxy's Internet egress decision, and default-deny with specific approved flows is the requirement itself. Interzone restrictions may complement it, but do not inherently change the proxy's allow-by-default behavior.

Stateful VM security groups record connection state for permitted flows and often allow responses to established connections automatically. That property is useful for cloud host filtering but cannot correct return packets that bypass a separate stateful inspection device on an asymmetric network path. The issue is route symmetry at the firewall boundary, not VM policy cardinality.

A default-deny policy limits connections to explicitly approved services, reducing unnecessary exposure. Even correctly allowed sessions may fail if the stateful firewall sees only one direction of the conversation. More restrictive allow rules do not restore the missing connection-state observations caused by asymmetric routing.

Workload-level zero-trust policies use identity and context to restrict connections between services. They do not guarantee that both directions of a particular network flow pass through the same stateful inspection point. Authorization may be correct while TCP return packets are still rejected due to missing firewall session state.

Workload-level zero-trust policies can enforce least privilege between applications and services based on identity and context. They do not themselves optimize traffic for distributed remote users who connect to many external SaaS services. The bottleneck described is central backhaul of remote users’ web traffic rather than uncontrolled east-west data-center flows.

Stateful VM security groups govern permitted cloud instance connections and often recognize established return traffic. They are not a remote-user Internet access architecture and do not remove latency caused by sending global SaaS traffic through a central datacenter. Host filtering complements, but does not replace, distributed secure access.

Health-checked load balancing distributes requests over healthy application backends and can improve availability of a service the enterprise operates. Remote staff are visiting external SaaS platforms through an inefficient corporate backhaul path. Backend load balancing does not directly move security enforcement closer to those users.

Cloud-delivered converged controls secure remote user access to SaaS and other services, often using identity-aware policy near the user. They do not explain whether an IaaS VM firewall automatically permits a return packet to an established HTTPS session. The case asks about connection-state semantics at the instance access-control layer.

Default-deny with approved flows is a policy model controlling what traffic can begin. It does not tell administrators whether established return packets are automatically recognized as part of an allowed session. The question specifically asks which control layer tracks sessions, so the stateful security group is the appropriate concept.

Workload-level zero-trust policies can restrict service communications using identities and authorization rather than only addresses. Such policies may be enforced with many different network mechanisms, some stateful and some not. They do not directly describe automatic return-traffic handling in a VM security group.

Encrypting salary fields protects sensitive compensation data when it must remain confidential in a storage system. The document in the question is an earnings announcement that has already been approved for unrestricted public release and contains no private salary information. Treating it as a salary-encryption case would assign unnecessary protection to the wrong data type.

Dynamic masking hides sensitive data fields from viewers who do not need their full values, for example concealing account numbers in an employee dashboard. The approved announcement contains no sensitive fields and is intended for unrestrained external readership. Masking would interfere with the publication goal rather than represent its classification.

Tokenization substitutes a sensitive value with an alternate token while retaining a protected mapping for authorized recovery or joins. It is useful for confidential identifiers, not a public earnings release cleared for unrestricted publication. There is no original secret value to replace, so tokenization is not the appropriate classification.

True anonymization aims to prevent practical re-identification, including linkage through auxiliary datasets, and is appropriate when identifying the same customer over time is unnecessary. This dashboard explicitly needs identifiers that remain joinable across records. Full anonymization can destroy that association; a controlled token scheme preserves joins while restricting access to the original payment values.

Application-level encryption protects values such as salary fields at rest or in selected database columns. It may be useful for financial confidentiality, but encrypting an unrelated salary field does not address card-number identifiers in this dashboard. Even encrypted card numbers may be unsuitable join keys depending on keying and encryption mode; tokenization targets the stated need.

Dynamic masking hides portions of sensitive values when presented to users, for instance showing only the last four digits of a card. The original card number may still be stored in the underlying database, and a masked display may not provide a stable, non-sensitive join key. The requirement is to avoid storing card numbers in dashboard records.