CompTIA SY0-701 Bundle

Naming an accountable service owner makes a business group responsible for an asset's security configuration and lifecycle decisions. A missing tablet, however, also requires knowing which individual held it and what management profile was installed. A generic owner entry could still leave incident responders unable to identify the last custodian or assess the exposed data.

Security requirements in acquisition can specify encryption, management enrollment, support, and warranty controls for tablets. Those safeguards are useful before purchase, but the reported failure is an inventory that cannot connect one missing device to its assigned holder and installed profile. Procurement standards alone do not reconstruct its custody or current management state.

Network discovery can find a tablet while it is attached to an observed subnet and reveal an otherwise unregistered endpoint. Once the tablet is missing, it may be offline or outside the organization entirely. Discovery also does not reliably establish the assigned human custodian or work profile. Asset assignment integrated with management inventory addresses the actual loss-investigation gap.

Chain-of-custody and destruction documentation prove which physical media was transferred and sanitized. They are useful when equipment is retired, but they do not preserve the project records that still fall within a legal retention period. If media were destroyed now without a compliant retained copy, the organization could lose records it is obligated to maintain.

Physically destroying the media could eliminate data when a device cannot be safely erased or must be disposed of. The hardware in this scenario needs to be repurposed, and required project records have not yet reached their retention date. Destruction would both prevent reuse and risk violating record-preservation duties unless compliant copies already exist.

Data classification defines sensitivity and associated handling requirements, which can guide encryption, access controls, and retention policy. The scenario already provides the decisive requirement: records are subject to an active retention period despite hardware reuse. A new classification label alone neither retains the records in another repository nor sanitizes the outgoing device.

Passive vulnerability discovery uses observed network traffic and system metadata without sending active probes to fragile targets. It helps identify communicating industrial endpoints and may infer versions. However, a library installed on a server with closed inbound ports might never appear in network traffic, so passive observation cannot reliably enumerate its local packages.

Static application security testing examines source code or compiled artifacts for insecure constructs before or during development. It may detect unsafe APIs but does not necessarily inventory the installed library versions on a production server whose externally exposed ports are closed. Authenticated host inspection is more direct for that deployed component.

Dynamic application security testing sends inputs to a running web or application service to observe exploitation and runtime behavior. If all inbound service ports are closed from the scanner's viewpoint, DAST cannot reach the target. The missing evidence is a local library inventory, which requires credentialed or agent-assisted assessment instead of another external web test.

Static source-code analysis finds insecure patterns in code at build time without running the production system. It helps software developers but provides limited visibility into many compiled vendor controllers on an active packaging line. The requirement specifically prohibits aggressive probes and asks to observe endpoints currently operating; reviewing source repositories does not discover all active plant devices.

Software composition analysis tracks third-party libraries and their vulnerability advisories in software builds. It is appropriate for owned development pipelines, but the packaging line may include proprietary industrial controllers without available dependency manifests. It cannot replace passive identification of active operational equipment when live network scanning poses an availability risk.

Credentialed scanning can inspect installed applications and configurations deeply using authorized host access. It is useful in normal maintenance windows when vendors approve the load. On a fragile production line, however, login and probing activity may disrupt deterministic equipment behavior. The stem explicitly prohibits aggressive checks while the process is running, making passive discovery safer initially.

Dynamic application testing exercises a running service to find weaknesses observable through HTTP requests and responses. It may discover injection or authorization errors after deployment, but secret literals in source code can remain hidden from the application's external interface. The requested checkpoint is a pull request before the app is built, so static scanning fits better.

Passive vulnerability discovery observes network communication to infer services and potential exposures without disruptive probes. That is useful for running networks, especially industrial systems. A pull request containing a hard-coded password has no network behavior yet, so passive traffic analysis cannot inspect the relevant source-code change.

Software composition analysis enumerates first- and third-party dependencies, checks their versions, and matches them with known vulnerability advisories. It supports supply-chain risk management but generally does not detect a developer directly embedding a credential in an application source file. A dedicated static or secret-scanning rule examines that exact mistake before merge.

Software composition analysis identifies packages and indirect dependencies with known advisories. It can uncover library risk in an application but cannot by itself reproduce suspicious responses from the running test service when malformed HTTP payloads are sent. The problem concerns observable execution behavior, not merely whether a dependent package has a vulnerability entry.

Prioritizing an actively exploited, internet-facing vulnerability is a remediation decision based on exposure and threat intelligence. It does not answer which test method can verify whether a deployed service actually mishandles malicious HTTP inputs. No competing patch tickets or known exploitation indicators are supplied here.

SAST examines code without executing the application, which can expose unsafe source patterns. The question states the running service responds differently to crafted requests than source inspection predicts. A runtime test is needed to validate the actual deployment path, web framework behavior, and configuration under attacker-like input.

Dynamic testing probes a running application for weaknesses exposed by its inputs, responses, and state transitions. It does not reliably enumerate every transitive package selected by a build tool, especially libraries that never receive attacker-controlled web inputs. The question asks to continuously track indirect dependencies as new advisories appear, which is a composition-management task.

Environment-specific risk assessment adjusts remediation priorities based on exposure, sensitive data, privileges, and potential business impact. It becomes important after a vulnerable package is identified but does not itself generate an accurate inventory of the project's indirect dependencies. The scenario first needs sustained dependency visibility and advisory matching.

Static source-code testing can find insecure programming constructs, hard-coded credentials, and unsafe data handling in first-party code. It usually does not provide the complete transitive package inventory and ongoing external vulnerability advisory correlation required here. Use SAST alongside SCA, not as a replacement for third-party dependency governance.

A high CVSS base score indicates standardized technical severity, but it does not establish that a vulnerable asset is internet reachable or currently being exploited. The lab endpoint is isolated with no known exploitation, so treating its numeric score as the only priority signal ignores the exposed VPN's immediate threat context. Defer the lower-risk item only under a documented risk-based queue.

Annual risk assessment cycles are too coarse to handle an actively exploited internet-facing vulnerability already listed by CISA. The organization can perform normal periodic reviews, but vulnerability management needs timely updates when attack activity and exposure change. Waiting for next year's business impact review would leave a known reachable entry point unaddressed.

Ease of patching is a useful scheduling consideration but should not outrank credible evidence of exploitation against a high-value exposed network edge. The lab machine might be quick to update, yet leaving a remotely accessible VPN flaw exploitable during that work creates disproportionate risk. Prioritize containment and remediation according to exploit status and exposure, then handle lower-risk tickets.

A CISA KEV listing indicates credible observed exploitation of an identified vulnerability, while a CVE identifies the vulnerability record itself. Neither is inherently a severity metric measured on the same numerical scale as CVSS. The statement collapses distinct data sources into identical scores, so it would perpetuate the report's error.

A false-positive scanner finding requires validation of the observed software, version, configuration, or exploit condition. Renaming or editing the CVE identifier does not make a scanner's technical evidence accurate. The question is about the difference between a vulnerability record and a severity score, not whether a detected exposure can be reproduced.

The same CVE can create very different business risks in an exposed payment gateway and a disconnected lab device. CVSS technical severity is only one input; reachability, business impact, controls, and known exploitation also matter. Assuming every deployment has identical risk would conceal context and is unrelated to correcting a CVE-versus-CVSS terminology error.

CVE identifiers and CVSS scores describe what vulnerability is involved and aspects of technical severity, respectively. Those labels cannot fully rank the danger posed to different deployed assets. The same flaw may be reachable from the internet on a payment system but effectively inaccessible on a disconnected lab endpoint, so context must shape action.

False-negative vulnerability coverage occurs when scanners cannot access hosts or lack credentials, leaving gaps in discovery. Both assets in the stem are already known to share the same flaw; the problem is deciding which environment needs earlier attention. Improving scanner coverage is valuable but does not perform that comparative risk assessment.

Prompt remediation of an actively exploited publicly reachable issue is appropriate when evidence of exploitation exists. Here the scenario describes exposure differences, but provides no indication that either asset's particular flaw is in CISA KEV or being actively exploited. Prioritizing the exposed payment system may still be sensible, yet the general method tested is context-based risk assessment rather than assuming a KEV status.

A false-negative coverage issue occurs when scanning misses vulnerable systems, often due to absent credentials or unreachable networks. This case instead reports a positive TLS finding that manual negotiation appears to contradict. The risk is unnecessarily changing a safe configuration based on an inaccurate detection result, so the team should validate a possible false positive.

Credentialed scanning can inspect host configuration and installed software that remote probing cannot enumerate. It may help confirm whether an obsolete TLS library is installed, but the disputed finding claims that a service currently accepts an old protocol. The most precise immediate action is reproducing and validating the reported handshake behavior, not simply selecting a deeper scan category.

Static application security testing reviews code for unsafe constructs before or during development. A live TLS support claim depends on server and intermediary configuration, protocol negotiation, and deployed endpoints. Examining application source files alone cannot prove whether the running listener accepts an obsolete TLS version. Verify the service's actual network behavior instead.