CompTIA SY0-701 Bundle

Assigning due dates without identifying a responsible remediation owner creates deadlines no team is accountable to meet. A generic target date may help reporting but cannot route a request to the group that manages the obsolete instance. First resolve the missing service-to-asset ownership relationship, then assign priority and due dates.

Repeating the same vulnerability scan may rediscover the obsolete server instances, but it does not determine which business application they support or who can safely change them. The facts already establish that the assets are visible. The problem is ownership metadata, not detection frequency, so an additional identical scan would add noise rather than actionable accountability.

Blocking every unidentified server could isolate legitimate services or interrupt contractual workloads without understanding their dependencies. It might also violate the organization's change process. The scenario requests the first asset-management step needed for remediation routing; establish service owners and risk context before choosing containment actions for particular instances.

Asset-to-service ownership mapping ensures vulnerability tickets reach the responsible team. The device already has a previously approved exception, so the immediate issue is expiry without renewed authorization or remediation, not an unknown service owner. Mapping alone would not restore the required security control or stop unjustified exposure.

Risk-ranked issue tracking is important for keeping owners and deadlines visible, but maintaining an open ticket does not legitimize a lapsed exception. The question specifically identifies an unapproved extension of a vulnerable remote-login service. Escalate and enforce the prescribed restriction rather than merely rescheduling a known overdue vulnerability.

A time-bound, documented exception with isolation may be appropriate when a validated patch cannot yet be deployed safely. That option describes a potential future approval, not a renewal that has actually occurred. Once the previous thirty-day exception expires, continued use cannot be treated as authorized until an accountable decision and required compensating control are established.

Protected central storage preserves endpoint and firewall events so investigations can reconstruct activity after the fact. It is important for evidentiary integrity, but separately archived logs do not automatically connect unusual script execution on a host with rare outbound destinations. The stem specifically asks for cross-source alerting based on two distinct observations.

SIEM ingestion-health monitoring detects dropped sources, queues, parser failures, or gaps in incoming records. The scenario describes both endpoint and firewall events already being produced, but they need to be interpreted together. Monitoring collection reliability cannot, by itself, correlate those signals into a suspicious process-to-destination event.

Context-aware alert tuning can suppress known maintenance noise and adjust thresholds for specific hosts or windows. Here the task is not excessive alerts or false positives; it is recognizing a joint pattern from an endpoint and a firewall. Correlation logic must first join the two event types by host, time, and network indicators.

Permanently disabling all alerts from the backup program would hide genuine abuse of its signed executable or unusual behavior occurring outside maintenance windows. A trusted binary can be hijacked or misused after a legitimate approval period. The SOC needs selective noise reduction, not unconditional immunity for everything bearing that program name.

Sending alerts to an unmonitored mailbox suppresses attention without improving signal quality or preserving timely investigation. Important detections from other sources could still be buried, and no accountable responder would see deviations from the backup agent's authorized behavior. This violates the stated requirement to retain detection of anomalous process actions.

Deleting raw maintenance telemetry may reduce storage expenses but destroys the evidence needed to investigate whether an event was actually routine or malicious. The question explicitly requires continued detection of unusual behavior by the same process. Keep raw records and use context-aware alerting rules rather than eliminating the data foundation.

Endpoint DLP telemetry can record sensitive-data copy and upload attempts and help reconstruct information movement. It is valuable for leakage investigations, but the missing capability here is retained historical event detail across the SOC, not a particular content-control sensor. Dashboards alone cannot substitute for centrally archived raw logs.

Ingestion health monitoring detects when log collectors drop events, parsers fail, or source feeds stop. It is an important supporting reliability control, but a healthy pipeline that retains only summary dashboards still cannot reconstruct detailed prior activity. The case needs long-term protected raw events, not solely assurance that recent summaries were received.

SIEM event correlation connects multiple security signals to raise a higher-fidelity alert and can aid active detection. It may still operate on events that are later discarded. If only aggregate dashboards remain, investigators cannot verify old incident chains. Preserve raw historical telemetry before expecting correlation dashboards to serve as durable forensic evidence.

SNMP traps deliver asynchronous health events from infrastructure devices, such as interface outages or fan failures. They are useful for network availability monitoring but do not normally capture operating-system process creation and parent-child lineage on an employee laptop. The missing information is host execution telemetry, not router state.

Agentless monitoring queries supported management APIs or remote protocols without installing an endpoint component. It helps hosted appliances that cannot support agents, but may not expose detailed process parentage and command lines from a modern workstation. The required source is local process event capture, usually provided by an endpoint agent or equivalent native telemetry.

Network flow records show connections, peers, protocols, durations, and byte counts without inspecting packet payloads. They can identify suspicious destinations but generally cannot identify which workstation process spawned another process. The SOC already has router flows and needs the host-level execution chain, which must be collected at the endpoint.

Endpoint process telemetry agents run on or instrument supported operating systems to capture process starts, scripts, and activity chains. They offer rich visibility but cannot be installed on these short-lived hosted appliances. Choosing them would conflict with the explicit platform limitation, even if the same tool is excellent for conventional desktops.

SNMP traps provide unsolicited device events for supported routers and network hardware. The case instead describes hosted appliances with read-only management APIs, without stating they provide or can send SNMP notifications. Agentless API polling uses the interface actually documented, rather than assuming a protocol unsupported by the hosted service.

Protected raw-event archives preserve logs after collection for historical investigations, but they do not create a way to obtain measurements from an appliance that cannot install agents. The immediate missing capability is a compatible monitoring integration. Once collected over the read-only API, relevant records can also be archived for future reconstruction.

Agentless monitoring through read-only management APIs is suitable for hosted systems that cannot run agents. It can check device health but is not the most precise description of the already-emitted asynchronous router notification. The router provides a specific event mechanism, so receive its trap rather than assuming the issue is an agent installation limitation.

Endpoint agent process telemetry captures workstation application launches, command lines, and parent-child relationships. It addresses malicious execution investigations, not a network router's physical fan failure. A core router generally will not run a user-workstation EDR agent; existing infrastructure notification protocols are more appropriate for this hardware health event.

Certificate expiry monitoring identifies impending expiration and failed automatic renewals that could break HTTPS services. No certificate is involved here; a router is signaling an immediate hardware failure. Certificate alerting would not report an SNMP fan alarm unless an unrelated correlation were added, so it does not provide the requested infrastructure health visibility.

Certificate-renewal alerts can prevent a portal outage when public TLS credentials expire, but they reveal nothing about WAN traffic pairs or byte counts. The investigation is about network communication patterns, not PKI lifecycle. Select telemetry that summarizes flows rather than a certificate inventory or renewal alarm.

Endpoint process telemetry identifies which binary launched a connection and may collect command lines on instrumented hosts. It can complement WAN flow investigation, but it is not the natural fleetwide answer for ranking communicating endpoints and traffic volumes at the network boundary. The question explicitly wants metadata without payloads, which is the central use of flow export.

SNMP traps can announce router interface or hardware failures and other asynchronous status events. They do not normally supply a continuous list of source-destination conversations and byte volumes for each flow. The WAN investigation needs exported flow metadata rather than occasional device alarm messages.

SNMP traps can deliver hardware health and availability warnings from capable routers. A public portal's certificate may expire while network devices remain healthy, so SNMP fan or interface alerts do not monitor this application-specific credential lifecycle. The stated outage mechanism is silent renewal failure, not physical infrastructure fault.

Actionable on-call routing ensures critical alerts reach a responder and can trigger escalation when not acknowledged. That mechanism is valuable after an impending certificate expiry has been detected. It does not itself inspect the certificate validity period or verify that automated renewal succeeded; those detections must first be implemented.

SIEM correlation can combine logs from certificate authorities, load balancers, and deployment systems into useful security alerts. However, relying only on generic event correlation without expiry checks may miss an approaching validity deadline. The question calls for a specific preventive monitoring rule for certificates and automated renewal failures.

Endpoint network isolation is a containment response that blocks or limits an affected host's connectivity after suspicious behavior is identified. It may be triggered by a malware alert but does not itself inspect executable files for known malicious signatures before execution. The fleet needs baseline malware detection, not merely the ability to quarantine a machine.

Endpoint data loss prevention detects sensitive information being copied to removable media, uploaded, or sent through unauthorized channels. It is useful for protecting regulated records but does not identify known malicious binaries merely because their code matches malware signatures. The scenario describes executable threat detection rather than a confidential-data transfer policy breach.

Endpoint process telemetry records execution events, parent-child chains, and related activity for investigation. Such data can feed behavioral detection rules, but collecting process events alone is not the same as actively scanning files for known malicious binary signatures before launch. The stated baseline need is anti-malware prevention and detection, with telemetry serving as a complementary layer.