CompTIA SY0-701 Bundle

Least-privilege ACLs control who can read or modify files inside an approved repository or shared folder. They are useful, but the developer already has access to the proprietary code and can export copies to a personal account. Governance of repository integrations, managed endpoints and outbound synchronization is needed in addition to internal file permissions.

Data lineage and provenance records reveal how a dataset or artifact was created and transformed, supporting reproducibility and auditability. They do not prevent a developer from syncing an entire proprietary repository to an unmanaged personal service. Source control history may help investigate the export, but it is not the primary containment mechanism.

Mandatory label-based access controls could restrict use of classified source artifacts according to centrally enforced classifications. The case does not establish a formal classification-label regime; it describes an uncontrolled personal synchronization path. Enterprise repository governance and managed identity/device enforcement more directly address the observed behavior.

Data lineage tracks source records and transformation steps, helping teams understand where incorrect data originated. It does not provide historical valid database rows that can be restored after an accidental deletion was propagated to replicas. Provenance can support investigation, but recovery requires an independently retained point-in-time copy.

A retention policy defines how long approved records must be preserved and can affect backup lifecycle, but it is not itself a recovery artifact. If every replica already reflects a deletion, merely extending a schedule does not reconstruct the missing rows. Use actual point-in-time restore points with tested recovery procedures.

Least-privilege access controls can prevent some accidental deletion by limiting who may modify tables. They are an important preventive measure, especially for privileged databases, but do not reverse a deletion that has already propagated to the secondary copy. Recovery now depends on preserved earlier data states.

Ordinary user-folder permissions reduce accidental edits by nonadministrators but leave both application teams sharing a broad service-administrator identity. That administrator can still cross the marketing and confidential-prototype boundary. The scenario requires distinct administrative authority and storage policy, not just less permissive everyday user roles.

Encrypting all files under one shared key can protect stored bytes against some media disclosure, but both application teams can retrieve the same key. That leaves the essential trust boundary intact and fails to distinguish publicly distributable images from restricted prototypes. Separate key custody and administrator permissions are needed along with storage isolation.

Confidentiality labels help communicate handling requirements and can support automated policy, but labels are ineffective if every service and administrator keeps the same broad access. The question specifies separate administration and retention needs. Apply actual permission and storage boundaries rather than relying on labels without enforcement.

A data catalog storing only current schema and dataset ownership can help teams discover research assets. It cannot reconstruct which original observations were transformed, when jobs ran or who produced a particular published value. The requirement is a chain of derivation and responsibility, not a one-time inventory entry.

A checksum can establish whether the published dataset bytes differ from an expected value, assuming the reference is authenticated. It does not identify which partner observations contributed to a result or how analysis jobs transformed them. Integrity of a final file and provenance of its contents are complementary but distinct forms of evidence.

Platform login audit records can attribute users who accessed the analytics service, but do not describe the full derivation of scientific outputs. A user may have logged in without running a relevant transformation, and automated jobs may process sources under service identities. Data lineage needs explicit links among records, processes, versions and actors.

Storage encryption protects information against certain unauthorized media or platform access but does not identify which unstructured reports contain regulated customer identifiers. DLP cannot apply different rules reliably if the system has not discovered the sensitive content. Encrypting every disk is useful defense in depth, but classification is the missing prerequisite for content-aware policy.

Longer backups improve recovery opportunities after corruption or deletion, but can also preserve additional copies of sensitive reports without any classification. Retention alone does not tell the organization where regulated identifiers exist or which content needs stricter handling. The immediate need is discovery and labeling before rule enforcement.

A uniform access rule may be too permissive for regulated reports or excessively restrictive for harmless documents. Without classification, the organization cannot apply proportionate controls to the sensitive subset. Begin by identifying and labeling protected content, then map each label to least-privilege and DLP rules.

Least-privilege ACLs limit which users can access a live storage volume. Once an SSD leaves the company, those operating-system permissions may not protect residual flash data against someone with physical possession or low-level access. The requirement is irreversible access prevention for a returned device, requiring verified sanitization rather than live user authorization.

Region-constrained storage limits where cloud data resides or is replicated for jurisdictional compliance. It does not sanitize an SSD being returned to a vendor and has no bearing on data remnants across flash blocks. Physical asset disposal and geographic hosting policy address different risks.

Point-in-time backups preserve earlier versions for recovery after a failure or accidental change. They do not make discarded SSD contents unrecoverable, and may themselves hold additional protected copies requiring separate lifecycle controls. Backup validation is relevant before destruction but not a sanitization technique for the returned media.

Retention policies govern how long protected records remain available and when they should be securely deleted. The contract in this scenario is instead about where copies are stored geographically. A backup retained for an appropriate duration could still violate the agreement if replicas are placed outside the permitted legal jurisdiction.

Separating restricted records into an access-controlled storage segment can limit who reads them and reduce cross-tenant exposure. It does not guarantee that a cloud provider places every copy in the legally permitted jurisdiction. Isolation and geographic residency must be assessed independently; the latter is the explicit contractual problem.

Cryptographic erase can render media data infeasible to recover by securely destroying relevant encryption keys under validated conditions. It is used at disposal or sanitization time, not as a control for an ongoing backup provider replicating records worldwide. It does not prevent unauthorized geographic storage before the keys are erased.

Dynamic masking hides selected fields from a user's displayed view but often leaves identifiable source records intact in storage. The research consortium intends to release statistics publicly without practical re-identification, not merely hide visible digits in an internal dashboard. Masking is insufficient for that disclosure threat model.

Removing unnecessary personal fields is an important data-minimization technique and can reduce direct identifiers in the published dataset. It may not prevent re-identification through rare combinations, linkage to external data or small population groups. A broader anonymization and disclosure-risk evaluation is required before claiming no practical individual identification.

Pseudonymous identifiers replace direct identities with stable aliases while preserving the possibility of later linkage or re-identification through a protected mapping. That can be appropriate for controlled longitudinal research but conflicts with an unrestricted release claiming no practical re-identification. A leaked mapping or cross-dataset linkage could expose subjects.

Replacing each visit's identifier with an unrelated one-time token that has no stable cross-visit mapping would prevent the longitudinal joins that researchers require. Tokenization can be designed with stable tokens and may overlap with pseudonymization in other implementations, but the option here explicitly lacks persistent identity linkage. The scenario requires consistent pseudonyms with a protected identity map.

Full anonymization aims to eliminate practical identification, including linkability back to individuals, under the release threat model. A separately held re-identification mapping is expressly required by the scenario, so claiming the dataset is anonymous would be misleading. Use controlled pseudonymization rather than an irreversible disclosure transformation.

Removing unnecessary fields minimizes exposure and may be appropriate before analysis, but simply deleting names does not create consistent, governed aliases for matching records across visits. Analysts need a stable link that a separate custodian can resolve when authorized. That mapping and its controls, not minimization alone, define the intended design.

Recovery point objective specifies the maximum tolerable period of data loss measured backward from a disruption. A 15-minute RPO might be an additional database requirement, but the question describes two hours of service unavailability. That is a time-to-restoration limit, not the age of the most recent recoverable data.

A warm alternate site provides some installed capacity but commonly requires restoring data or activating additional services before production can resume. It may satisfy a two-hour RTO if measured activation procedures prove adequate, but its name alone does not specify the business recovery deadline. First establish the explicit RTO requirement.

A hot alternate recovery site is designed for rapid resumption using preprovisioned capacity and frequently synchronized data. It can support stringent RTOs, but might be unnecessarily expensive when the business tolerates two hours. The scenario asks which metric matches the tolerated outage, not to choose a specific site without cost or dependency analysis.

Offline or immutable backups protect recovery copies against deletion or tampering by an attacker with ordinary administrative access. They improve recoverability but do not by themselves define how much recent transaction history the business may lose. A nightly immutable copy could still be far older than the allowed 15-minute data-loss window.

Recovery time objective limits how long a service may be unavailable after disruption. Restoring operations in two hours could still lose yesterday's transactions if recoverable data copies are old. The statement here explicitly limits lost transaction history, so the correct metric is recovery point objective rather than elapsed downtime.

A hot site can provide quickly available infrastructure and reduce service restoration time. That does not guarantee that its data replica is current within 15 minutes or that a logical deletion was not replicated. The required maximum transaction loss must be quantified as RPO and validated independently of standby-site readiness.