CompTIA SY0-701 Bundle

Versioned backup retention preserves earlier recovery points and prevents replicated mistakes from replacing all clean copies. The operations team instead depends on a live external alerting provider, and no backup version will generate real-time alerts when that service is unavailable. Recovery-point design addresses stored data, not the outsourced detection dependency.

Resilient DNS and identity services are important when authentication and name resolution must survive an outage. The question does not identify either as the shared weak point; both SOC offices rely on the same alerting provider. Adding identity redundancy would not necessarily preserve incoming third-party alerts.

An out-of-band communications plan provides alternate channels for responder coordination when normal enterprise messaging fails. It is useful during an alerting outage but does not independently detect events or deliver substitute alert feeds from another platform. Supplier continuity and a tested alternative detection path address the actual dependency.

Application allowlisting permits only trusted executables or approved software publishers to run, limiting the damage from unauthorized applications. It is valuable on managed laptops and could be part of a broader security baseline. However, it does not by itself remove an enabled guest account or disable unnecessary network-sharing protocols. Selecting this alone would miss the exact insecure settings identified during initial device provisioning.

A managed work profile or container separates organizational applications and data from personal applications, especially on mobile or personally owned devices. That isolation could be appropriate for a BYOD program, but these are contractor laptops with insecure operating-system services. Work-profile separation does not replace baseline hardening of guest-account status and network protocols on a freshly deployed desktop operating system.

Comparing deployed settings against a baseline and remediating drift detects unauthorized changes after a known-good configuration has already been established. This is an important ongoing control once endpoints are enrolled and configured. The stem instead describes never-provisioned laptops lacking an approved initial build, so establishing the baseline first is more direct than treating the initial insecure defaults as subsequent configuration drift.

Restricting switch management access to a dedicated VLAN with ACLs limits who can contact administrative interfaces. It helps contain network device compromise, but it does not compare registry settings on already hardened servers with their security baseline. The audit found host configuration drift, not a reachability problem on a switch management plane.

Applying an approved workstation image establishes secure defaults before a newly deployed laptop is put into service. These are servers whose initial hardening was completed, and the evidence is that registry values changed after deployment. Reinstalling workstation settings would be poorly targeted and could disrupt production. Measure and restore the specific server baseline instead.

MDM-enforced device locking protects unattended tablets and phones against casual unauthorized use, often with a PIN or biometric unlock. The scenario concerns server registry settings changing after a weekly configuration audit, not mobile screen exposure. Deploying a tablet lock policy would not identify the altered registry values or restore the approved server configuration.

A managed work profile isolates corporate applications and data from personal apps on a shared mobile device. It is useful when an employee owns a phone or when an organization needs selective work-data wiping. Here the danger is an enrolled tablet left unlocked on a public counter; a work container that remains open would still expose confidential inventory.

Configuration-baseline scanning can find devices whose security settings differ from approved policy, including weak timeout values. It is an auditing and drift-remediation technique rather than the direct runtime safeguard requested. For tablets exposed to customers while unattended, the primary requirement is automatic device locking and strong authentication when the user returns.

A corporate-owned, personally enabled deployment model describes who owns a device and whether limited personal use is permitted. That ownership model does not automatically secure an unattended session. These enrolled tablets need an enforceable idle-lock and unlock policy regardless of whether they permit personal apps or belong to an employee.

Choose-your-own-device is a procurement approach in which employees select from an organization-approved catalog of supported models. The defining condition is a bounded device choice, not whether a company-owned phone permits personal applications. The scenario specifies employer-owned phones and their permitted use, but does not mention an employee choosing among approved hardware models.

MDM automatic locking protects mobile sessions when phones are unattended and can require a strong passcode after idle time. It is an important control that a COPE deployment may enforce. However, it describes a security setting rather than the requested ownership-and-personal-use model. It does not explain why the organization buys the phones and permits limited private applications.

Managed work profiles partition company apps and data from personal information, supporting selective work-data removal and policy separation. They can be used on BYOD and COPE devices, so selecting this describes a possible technical implementation. It does not itself answer which deployment model is defined by company ownership plus limited personal use, which is the question's key distinction.

Application allowlisting controls which programs or signed publishers may execute on an endpoint. It can be part of a secure laptop build, but it does not govern which physical laptop models employees may order. The stem describes a hardware procurement constraint and supportability requirement, not untrusted games or executables installed on already issued devices.

COPE is a device-ownership and personal-use arrangement: the company owns a device but permits controlled nonwork activity. The described program instead asks employees to select a laptop model from a curated supported set. CYOD is compatible with several ownership policies, so employer ownership and personal use cannot be inferred solely from the restricted hardware-choice list.

A managed work profile or container separates employer apps, credentials, and data from personal data. It is helpful for selective management on mixed-use devices. It does not narrow laptop procurement to supported hardware models; a fully containerized application could run on unsupported equipment. The question concerns model selection before deployment, not data separation after enrollment.

CYOD gives staff a choice among approved equipment models and can reduce incompatible hardware in managed fleets. It does not automatically distinguish personal photographs from corporate mail on a personally owned phone. The scenario explicitly assumes employees already use their own devices, and asks for data separation and selective removal rather than an approved procurement catalog.

COPE identifies phones owned by the company with some allowed personal usage. Those devices may still benefit from a managed work profile, but a COPE ownership model is inconsistent with employees' personally owned BYOD phones. It does not provide the selective corporate-data wipe requested without a complementary work-container management mechanism.

Disabling an unnecessary Bluetooth radio removes a short-range wireless attack surface and may be sensible for devices without Bluetooth business needs. It cannot distinguish corporate email from personal photographs, nor does it enable selective removal of business data. The privacy requirement is about management boundaries inside the phone, not discovery or pairing exposure.

A segregated management network with ACLs can limit Ethernet access to a sensor's administrative interface. It is valuable for constraining trusted management traffic, but it does not disable Bluetooth discovery or pairing on the device. A nearby adversary might still reach the wireless interface despite carefully configured wired VLAN rules. The direct remedy is to switch off that unused radio.

Automatic idle screen locking protects handheld devices with an interactive display from unauthorized local use. These industrial sensors communicate only over Ethernet, and the stated weakness is an enabled Bluetooth radio. A mobile screen timeout neither removes Bluetooth services nor addresses a radio on a headless sensor.

Application allowlisting restricts the executables or approved publishers permitted to run, which can impede malware on supported endpoints. The problem is firmware exposing an unnecessary Bluetooth interface, not an unapproved application installed by an operator. An IoT sensor may not even support an allowlisting agent. Disable the unused wireless feature through supported device management.

A wireless survey measures RF propagation, interference, and access-point placement to improve coverage and reliability. It is useful before deployment in a warehouse or multiroom office. However, it does not select the authentication and key-establishment protocol for a branch that explicitly cannot use an identity server. Signal strength cannot replace SAE authentication.

Isolating management interfaces with VLANs and ACLs protects access-point administration from unauthorized client networks. This addresses the management plane, not how users authenticate for normal Wi-Fi access. The branch needs a stronger password-based wireless security mode without RADIUS, so segmentation alone does not deliver the required SAE handshake.

802.1X with a RADIUS authentication server can support distinct enterprise identities, centralized revocation, and auditable access decisions. It is an excellent choice where the organization operates an appropriate server and supplicant configuration. The question explicitly excludes a supporting identity server, so recommending RADIUS contradicts the deployment constraint rather than answering the password-based branch requirement.

Centrally authenticated named administrator accounts make network-management changes attributable and allow revocation when engineers leave. They do not reveal RF dead spots or signal reflections near metal racks. This warehouse problem concerns the physical radio environment, so changing switch administrator credentials would not help decide where to place wireless access points.

802.1X/RADIUS authenticates users or devices to enterprise wireless access using centrally managed identities. It controls who may join but does not measure signal propagation, interference, or client roaming quality. A warehouse with dead zones can remain poorly covered even when each user authenticates securely; site surveying addresses the placement problem first.

WPA3-Personal with SAE improves password-based Wi-Fi authentication and key agreement, not physical coverage. A branch may need it for secure wireless access without an identity server, but the warehouse's metal shelving and guessed access-point placement require measurement of RF conditions. Encryption choices cannot eliminate dead spots caused by antenna orientation or signal attenuation.

WPA3-Personal SAE authenticates clients using a shared passphrase, although each connection negotiates its own session keys. It is appropriate for small sites without a user directory, not for individual centrally revoked employee identities. Distributing one common secret cannot meet the stated requirement that access infrastructure consult a corporate authentication server for each employee.

MAC allowlisting compares a device's reported wireless address with an approved list. Addresses can be spoofed and are not user identities; a reused device can remain allowed after its original user leaves. It cannot authenticate each employee against the existing RADIUS server, making it insufficient for an enterprise identity requirement despite offering a basic inventory filter.

A guest captive portal can display acceptable-use terms or request a shared visitor code after joining a wireless network. It does not normally establish per-user enterprise authentication through 802.1X or consult an existing RADIUS identity server for each employee. Printing one code at reception also introduces shared-secret accountability problems, contradicting the stated individual identity requirement.