CompTIA SY0-701 Bundle

WPA3-Personal SAE authenticates clients using a shared passphrase, although each connection negotiates its own session keys. It is appropriate for small sites without a user directory, not for individual centrally revoked employee identities. Distributing one common secret cannot meet the stated requirement that access infrastructure consult a corporate authentication server for each employee.

MAC allowlisting compares a device's reported wireless address with an approved list. Addresses can be spoofed and are not user identities; a reused device can remain allowed after its original user leaves. It cannot authenticate each employee against the existing RADIUS server, making it insufficient for an enterprise identity requirement despite offering a basic inventory filter.

A guest captive portal can display acceptable-use terms or request a shared visitor code after joining a wireless network. It does not normally establish per-user enterprise authentication through 802.1X or consult an existing RADIUS identity server for each employee. Printing one code at reception also introduces shared-secret accountability problems, contradicting the stated individual identity requirement.

Per-command role-based access control limits what an administrator may execute after successfully reaching and authenticating to a switch. It is a useful least-privilege layer, but student laptops could still contact the exposed management listener and attempt attacks before role authorization. The present requirement is to remove client-subnet network reachability while preserving the operations subnet.

Forwarding failed administrator-login events to the SOC improves detection and investigation of password spraying or unauthorized management attempts. It does not prevent student laptops from opening TCP connections to the switch management interface. Logging may reveal misuse after contact occurs; the requested control must instead restrict the source networks permitted to reach that interface.

Strengthening SSH key-exchange algorithms protects the confidentiality and cryptographic security of authorized management sessions. It is advisable for older switch configurations, but it still leaves the TCP listener accessible to every student device. The scenario explicitly asks to block unauthorized client-subnet reachability, a network segmentation and filtering decision rather than a cipher-suite upgrade.

A protected management VLAN and ACLs restrict which network devices can contact switch administration interfaces. That reduces reachability, but a shared local password used by many engineers still prevents attributing a change to a particular person. The case describes missing administrator identity accountability rather than unauthorized network entry, so segmentation does not solve its central audit weakness.

A wireless RF survey reveals dead zones, interference, and access-point placement problems. It cannot distinguish which switch engineer changed an access rule or revoke one employee's administrative privilege. The scenario addresses network device management identity, not wireless client coverage, so this survey is unrelated to the shared-password accountability gap.

802.1X with RADIUS controls how endpoints or users authenticate to network access services, commonly enterprise Wi-Fi or controlled wired ports. It could be part of an enterprise identity strategy, but does not by itself replace the common administrator login on dozens of switches. Configure distinct administrative AAA accounts and logging for switch management specifically.

Server-side input validation and parameterized SQL queries protect applications against malformed client input and injection attacks. Those defenses are important for payment backends, but the problem on these terminals is operators installing unsigned games. Changing request parsing does not stop unauthorized local executables from launching on the device.

An isolated sandbox can safely open suspicious attachments or run untrusted documents for investigation. Payment terminals, however, should not execute games at all; putting an app in a sandbox may preserve its ability to run rather than block it. Allowlisting is the direct enforceable policy for a fixed-purpose device with a narrow software inventory.

A workstation-hardening baseline disables unnecessary services, secures accounts, and establishes approved operating-system defaults. It helps protect an endpoint fleet, but without execution restrictions operators might still install arbitrary games on payment terminals. Baselines can include allowlisting, yet the specifically requested preventive capability is control over which applications are allowed to start.

The HttpOnly cookie attribute prevents ordinary client-side JavaScript from reading a cookie through document.cookie, reducing token theft during some XSS attacks. It does not restrict whether the browser includes that cookie on an unencrypted HTTP request. The portal's issue is cookies traversing a legacy plaintext endpoint, not scripts reading them in the page.

SameSite influences when a cookie accompanies cross-site requests and can help reduce certain CSRF opportunities. It does not mean the cookie is encrypted or prohibit same-site HTTP delivery when Secure is absent. The scenario specifically reports authentication cookies travelling over a plaintext endpoint, so the Secure attribute is the relevant transport restriction.

Validating user input and using parameterized database queries prevents injection through untrusted request parameters. It is important for backend application security but does not govern when a browser sends session cookies. The reported behavior is transport of an existing authentication cookie to HTTP, not SQL syntax changing a query or malformed data entering the application.

A read-only viewer may discourage accidental editing, but its parser still processes attacker-controlled document content. If a malicious attachment exploits that parser, the production laptop could be compromised despite the read-only label. The analyst explicitly needs active detonation and isolation, so ordinary workstation viewing is not an acceptable substitute for a disposable analysis environment.

A signature-based antivirus scan can flag known malicious files before execution and may be part of intake triage. However, an unknown malicious document may use a novel exploit or harmless-looking script that evades signatures. Merely scanning the file on the analyst's production laptop does not meet the requirement to safely observe its behavior during intentional opening.

Application allowlisting on a normal desktop restricts executable launches but is not a safe document-detonation boundary. A viewer exploit may execute within the already allowed viewer process or abuse signed system components. The stem asks to avoid risking the analyst's main workstation and network, which requires an isolated disposable environment rather than execution policy alone.

The Secure cookie attribute restricts transmission of the cookie to secure transport so credentials are not inadvertently sent over HTTP. It does not prevent malicious JavaScript already executing within the protected origin from reading document.cookie. The problem is script access after stored XSS, so transport-only protections leave the described token-theft path open.

SameSite restricts whether a browser sends a cookie with cross-site requests, helping mitigate certain CSRF cases. The malicious JavaScript in this scenario runs inside the site's own origin because of stored XSS. Such in-origin code may access a non-HttpOnly cookie directly regardless of the SameSite policy, so this is not the targeted remedy.

An isolated analysis sandbox contains suspicious files while investigators execute them, limiting contact with production machines. It has no direct effect on JavaScript's ability to read session cookies inside a user's browser. The scenario already has a stored XSS vulnerability in the website; cookie attribute hardening and XSS remediation are the relevant controls.

Server-side validation and parameterized database access stop malformed fields or SQL injection from controlling query structure. CSRF instead tricks an already authenticated browser into issuing unwanted requests with its session credentials. Validation of input format alone cannot determine whether the user intentionally authorized a state-changing request originating from another site.

A disposable document sandbox protects analysts while opening suspicious attachments and observing malicious behavior. It does not change the browser's cross-site cookie-sending rules. The user's risk arises from authenticated state-changing web requests induced by another origin, not from executing a downloaded document in the endpoint environment.

A Secure cookie attribute prevents transmission over plaintext HTTP but still allows the cookie on cross-origin HTTPS requests when other cookie rules permit. Thus encrypted transport does not by itself stop a cross-site request forgery. The attack needs restrictions on cross-site session use and server-side CSRF validation, not just confidentiality in transit.

The Secure cookie flag prevents session cookies from travelling over plaintext HTTP when supported by the browser. It does not validate whether a numeric invoice ID contains SQL operators or unexpected characters. The API issue occurs when untrusted request values influence a server-side query, which requires input constraints and safe database parameter binding.

HttpOnly limits script access to a cookie but does not check API parameters or protect the SQL interpreter from forged request fields. A malicious client can send an arbitrary numeric-ID string regardless of cookie visibility in a browser. The required fix targets backend validation and prepared statements, not the browser's session-token storage behavior.

Signed firmware updates ensure an embedded device installs packages authorized by its vendor and unmodified in transit. That trust decision is unrelated to an API accepting raw SQL fragments in an invoice identifier. Updating embedded-device firmware would not prevent query manipulation in this application's backend database calls.

HTTPS encrypts and authenticates the network connection to the configured management server when its certificate is validated. It does not independently prove that every firmware image hosted there was authorized by the camera manufacturer; a compromised server could distribute altered binaries. The scenario explicitly requires image-level provenance and integrity checks before installation, beyond connection security.

Comparing firmware version numbers can identify older releases or prevent unsupported downgrades, but the header is attacker-controlled if a package can be replaced in distribution. A malicious image can claim a legitimate version while containing unauthorized code. The devices need cryptographic authentication of the firmware package, not merely a string comparison.

A cryptographic hash detects changes only if the expected digest comes from a trusted independent source. If an attacker can replace both the firmware image and its bundled hash, the malicious package can appear internally consistent. The scenario says the hash arrives within the same untrusted download, so it does not establish authorized publisher provenance.

Network discovery and inventory reconciliation can reveal devices that were deployed without registration or have unknown network addresses. It helps find shadow hardware and services, but the cloud buckets are already known: the missing information is which accountable team owns remediation. Another discovery scan cannot assign responsibility for fixing public access.

Recording sensitivity labels and data-handling rules is important for deciding how customer records or regulated files should be protected. The scenario does not say the buckets' sensitivity is unknown; security cannot identify who must act on an unsafe public access setting. Classification alone does not establish an accountable owner to accept and close a remediation ticket.

A SaaS service inventory tracks subscriptions and user accounts so offboarding teams can revoke access to unapproved external applications. These known cloud object-storage buckets instead lack assigned internal owner teams. Cataloguing SaaS accounts would not identify who is responsible for bucket access-policy configuration and the public exposure remediation.