CompTIA SY0-701 Bundle

Endpoint network isolation is a containment response that blocks or limits an affected host's connectivity after suspicious behavior is identified. It may be triggered by a malware alert but does not itself inspect executable files for known malicious signatures before execution. The fleet needs baseline malware detection, not merely the ability to quarantine a machine.

Endpoint data loss prevention detects sensitive information being copied to removable media, uploaded, or sent through unauthorized channels. It is useful for protecting regulated records but does not identify known malicious binaries merely because their code matches malware signatures. The scenario describes executable threat detection rather than a confidential-data transfer policy breach.

Endpoint process telemetry records execution events, parent-child chains, and related activity for investigation. Such data can feed behavioral detection rules, but collecting process events alone is not the same as actively scanning files for known malicious binary signatures before launch. The stated baseline need is anti-malware prevention and detection, with telemetry serving as a complementary layer.

Anti-malware telemetry looks for malicious files, signatures, and suspicious execution behavior on an endpoint. It may alert if an executable on the kiosk is infected, but the scenario explicitly says the copied spreadsheets contain no malware. Authorized programs can still leak confidential records, so malware scanning would not identify the policy violation by itself.

SCAP-compatible compliance checks compare endpoint configuration with machine-readable hardening rules such as service state or password policy. They can detect security settings that diverge from a baseline, but the documents here are ordinary files being copied to USB while configuration remains stable. File movement and sensitivity need DLP, not a baseline compliance score.

SNMP infrastructure health traps report events such as switch interface failures, fan faults, or device alarms. They are useful for detecting network equipment issues but do not classify files or record a kiosk user copying confidential spreadsheets to USB. The affected activity occurs on a managed endpoint and requires endpoint content-aware monitoring.

Network vulnerability scanning discovers exposed services, missing patches, and potential CVEs and may include configuration checks on some platforms. The stated requirement, however, is rule-by-rule comparison against a standardized machine-readable hardening checklist on hundreds of hosts. Generic CVE scanning alone does not guarantee the defined configuration rule evaluations or consistent cross-platform compliance reporting.

A SIEM correlation rule can identify suspicious authentication failures and service restarts by analyzing collected events. It is useful for security monitoring but does not systematically evaluate whether every host matches a comprehensive weekly configuration checklist. The compliance team needs explicit rule pass/fail evidence rather than a set of operational alerts.

Asset inventory reconciliation identifies registered hardware and software and detects devices missing from official records. That helps determine which hosts should be assessed, but a serial-number or software-name listing cannot prove whether detailed security baseline settings pass the desired rules. Inventory completeness is supporting context, not the required configuration assessment capability.

Quarterly SCAP assessment reports can provide evidence of baseline compliance at a scheduled point in time. The scenario requires an immediate alert when a server's mandatory audit service is disabled, rather than waiting until the end of the quarter. A periodic report could document the gap later but does not meet the timeliness requirement for active configuration drift.

A scanner restricted to known software CVE signatures can identify products with disclosed vulnerabilities. It would not necessarily detect an audit service disabled at a particular time, especially if no vulnerable software version is present. The case concerns violation of a required local configuration control rather than a published CVE.

Endpoint DLP watches sensitive documents copied or transmitted to prohibited destinations such as removable media. It is valuable for detecting data leakage but would not ordinarily notify the SOC when a server's audit logging service is disabled. This case needs baseline state-change monitoring of an operating-system control.

Paging the on-call team is useful for incident coordination and accountability, but it does not stop a malware process that EDR already identified as malicious. The workstation must continue its approved clinical network session, so responders need a surgical host action. A notification-only response leaves the malicious executable running and provides no immediate containment of the known threat.

Post-remediation verification confirms whether a containment or removal action succeeded and whether suspicious behavior returns. It is a necessary follow-up, but here the malicious helper process is still active and the team already knows which executable is responsible. Waiting for another scan before taking an approved precise action prolongs the exposure without preserving any additional clinical availability.

Antivirus signature scanning may identify known malicious files and can help check other endpoints for related indicators. However, the EDR has already identified this executable and can terminate it. Repeating detection without removing or quarantining the file leaves a confirmed process able to act; the immediate requirement is targeted malicious execution containment rather than additional signature collection.

Endpoint isolation disconnects a compromised workstation from most network paths and can be an emergency incident containment step. The case describes a firewall rule already pushed but still bypassed via another route; it needs verification of the network control's effectiveness and remaining path. Isolating one host might reduce exposure without validating the policy for all affected traffic.

On-call routing ensures a responder receives and acknowledges important alarms. It helps when a firewall containment failure is found but does not establish whether the block actually took effect. The key observation is continuing connections after a change, so compare before-and-after telemetry and routing rather than simply notifying another analyst.

SIEM ingestion monitoring can reveal gaps in collection queues, missing log sources, and delayed events. It is useful when an absence of logs might mislead investigators. Here connection records are available and show traffic continuing through another route; the missing activity is verification of remediation effectiveness, not collection reliability.

Ingestion-health monitoring can verify that logs reach the SIEM without being dropped. The overnight incident alarm is already present in a dashboard, so log delivery is not the failure. The issue is that no one sees or acknowledges an urgent alert until morning, requiring responder routing and escalation.

Contextual tuning can reduce repetitive maintenance alerts and emphasize deviations from a known-good pattern. That improves signal quality, but the incident described is already serious and has generated an alarm. Tuning alone does not deliver that alarm to a staffed responder overnight, leaving the same response delay.

SIEM correlation combines multiple log sources to detect suspicious patterns. It may strengthen detection of an intrusion, but the scenario says an incident alert has already been written to dashboards. Detection without paging or acknowledgment still leaves an unattended overnight incident. Actionable routing is the missing operational capability.

On-call alert routing can notify analysts after a detection occurs, but it cannot repair silent loss of logs inside an overloaded ingestion queue. Important events may never reach the rules that would generate alerts. The scenario requires health checks for log collection capacity and completeness, not only a responder paging schedule.

Event correlation depends on having input records from relevant sources. When ingestion queues silently drop logs, correlation rules operate on incomplete data and may fail to detect active intrusion chains. More elaborate detection logic cannot reconstruct missing records without restoring pipeline reliability. Monitor and protect data collection first.

Protected central archives preserve raw telemetry already received by the logging system and help investigations reconstruct historical events. They do not guarantee delivery if upstream queues overflow and discard messages before archival. The case identifies silent ingestion loss, so storage retention is insufficient without queue and transport health monitoring.

An explicit deny rule for a cross-zone flow is appropriate when engineering networks should not reach sensitive finance systems. The HR application instead needs a specifically permitted HTTPS connection from corporate clients. Denying the requested path would break the legitimate service; the task is to replace an overly broad allow-all ticket with a narrow allowlist.

Network access control can assign unhealthy endpoints to a restricted remediation network until they meet security posture checks. That concerns device admission and quarantine, not the firewall port range for an approved HR application's HTTPS service. NAC segmentation alone does not precisely permit only TCP 443 between the identified source and destination.

A web application firewall can inspect HTTP payloads and temporarily block known injection patterns while a patch is prepared. The problem here is excessive network ports requested for an otherwise legitimate HTTPS service, not a reported application injection flaw. WAF filtering does not replace a source/destination/protocol-restricted firewall rule.

A narrow allow rule for corporate clients to reach one HTTPS server on TCP 443 is useful when an application legitimately needs that access. Here the engineer test VLANs already have unwanted connectivity to production finance database ports. Adding an unrelated HTTPS allow rule does not block the prohibited cross-zone database traffic.

A targeted WAF rule can reduce exploit attempts against a vulnerable public web endpoint. It generally inspects web application requests rather than enforcing segmentation between an engineering VLAN and finance database ports. The scenario is about unwanted layer-three/layer-four access across trust zones, so a cross-zone deny is more appropriate.

SFTP over SSH protects file transfers across untrusted networks using an authenticated encrypted session. It can replace plaintext FTP for payroll exports, but it does not prevent engineering workstations from initiating network connections to a production finance database. The required control is traffic policy between segments, not changing a file-transfer protocol.

An explicit cross-zone ACL deny can block traffic between networks, such as engineering clients and finance databases. It does not selectively inspect or reject injection payloads while maintaining public web portal availability. Blocking all customers might eliminate reachability but violates the implied need to keep the vendor portal operating until the patch arrives.

Disabling Telnet and enforcing SSH protects administrative CLI sessions against plaintext credential exposure. The identified vulnerability is a public injection flaw in a web application, not unencrypted management access. Changing the remote shell protocol does not validate web inputs or block malicious HTTP requests directed at the portal.

Restricting permitted sources, destinations, and ports is good least-privilege network design. The portal must remain publicly reachable on its web service, so a TCP 443 allow rule alone does not identify or reject injection payloads within HTTPS requests. Use a targeted web-layer mitigation in front of the vulnerable application while its code fix is pending.