CompTIA SY0-701 Bundle

An explicit cross-zone ACL deny can block traffic between networks, such as engineering clients and finance databases. It does not selectively inspect or reject injection payloads while maintaining public web portal availability. Blocking all customers might eliminate reachability but violates the implied need to keep the vendor portal operating until the patch arrives.

Disabling Telnet and enforcing SSH protects administrative CLI sessions against plaintext credential exposure. The identified vulnerability is a public injection flaw in a web application, not unencrypted management access. Changing the remote shell protocol does not validate web inputs or block malicious HTTP requests directed at the portal.

Restricting permitted sources, destinations, and ports is good least-privilege network design. The portal must remain publicly reachable on its web service, so a TCP 443 allow rule alone does not identify or reject injection payloads within HTTPS requests. Use a targeted web-layer mitigation in front of the vulnerable application while its code fix is pending.

Replacing Telnet with SSH encrypts interactive remote administration sessions and prevents network observers from reading CLI credentials. Payroll exports instead use FTP, a different protocol with plaintext authentication and data connections. Hardening switch remote login would not protect the exported payroll files as they cross the untrusted network.

Enforced SMTP TLS secures mail transfer between appropriately configured servers and may protect confidential email transport. The workflow described is an FTP-based payroll export, not SMTP messaging. Enabling TLS for outbound mail would leave the existing FTP username, password, and file payloads readable on their network path.

An SPF TXT record lists authorized mail senders for an envelope domain and helps recipients evaluate spoofed SMTP sources. It does not encrypt files or credentials, and it is not used to authenticate an SFTP or FTP transfer. The case requires confidentiality for payroll exports, not sender authorization for email domains.

Password authentication protects user access to SSH after the connection is established, but blindly trusting any presented host key allows an impersonating server to become the apparent target. Even with encrypted packets, the client could establish its session to an attacker-controlled endpoint. The question identifies missing server identity validation and weak algorithms, so accepting unknown host keys is unsafe.

SNMPv2c uses shared community strings for network-management queries and generally does not provide cryptographic confidentiality or strong message authentication. Enabling it would not repair SSH host-key verification or deprecated key exchange. The requirement is to harden the already deployed administrative SSH path, not add a weaker monitoring protocol.

Re-enabling Telnet would send management commands and credentials without SSH's normal cryptographic protection and would create another exposed administrative path. This directly reverses the completed migration to SSH and does nothing to fix unverified SSH host keys. Older clients should be upgraded or retired rather than introducing plaintext remote management.

Disabling Telnet and using SSH protects interactive network administration, not necessarily SMTP message transfer between email relays. Even if both systems support SSH, the described workflow sends files through SMTP. The required control must make the mail transport refuse plaintext fallback when the destination cannot negotiate authenticated TLS.

SFTP provides encrypted file transfer over SSH when both parties choose that protocol. It could be an alternate architectural solution for exports, but the case explicitly states that the system must relay confidential files by SMTP. Replacing the business mail flow is not the requested SMTP downgrade-prevention policy.

DKIM signs selected mail headers and a body hash so recipients can validate message integrity and the signing domain. It does not encrypt SMTP hops or prohibit a sender from falling back to plaintext when TLS negotiation fails. The specific risk is intercepted confidential content during transport, which requires enforced authenticated TLS rather than email signature verification alone.

A DKIM DNS record publishes a cryptographic verification key used to validate mail signatures made by a domain's signer. DKIM helps detect certain forms of tampering and supports domain authentication, but it does not list the source IP addresses permitted to send with an envelope MAIL FROM domain. That distinction is central to this question.

DMARC combines aligned SPF or DKIM authentication with a domain policy such as none, quarantine, or reject and provides optional reporting. It guides handling of messages that fail aligned authentication but does not itself enumerate every authorized sending IP. The domain first needs an SPF sender list for the particular MAIL FROM authorization described here.

Mandatory STARTTLS encryption protects mail transport when a peer can validate the required TLS connection, and can prevent downgrade under the selected policy. It does not declare which SMTP source IPs may send for an envelope domain. Encryption of the connection and SPF sender authorization solve different threats; the question explicitly asks for the latter.

DMARC quarantine policy tells participating receivers how to treat messages that fail aligned authentication and may supply aggregate reports. It is valuable for domain spoofing policy but relies on SPF or DKIM results; it does not itself create a cryptographic signature on the mail. The scenario specifically asks recipients to verify a signed enterprise message.

Switching administrative devices from Telnet to SSH encrypts remote management commands and credentials. It has no bearing on cryptographic verification of SMTP message headers or body content. Mail recipients cannot authenticate a claimed enterprise signing domain through a switch's SSH transport settings.

SPF lists hosts permitted to send mail on behalf of an envelope MAIL FROM domain and is evaluated from the connecting server's IP. It helps authenticate sending infrastructure but does not cryptographically sign a message body or selected headers. Recipients seeking signature verification need DKIM rather than an SPF list alone.

A DKIM signer and public DNS key let receivers validate signatures and may contribute to DMARC alignment. The scenario states authentication is already functioning and aligned, however; the new requirement is receiver handling of mail that impersonates the domain. DKIM by itself does not instruct receivers to quarantine failures.

SFTP encrypts file transfer over SSH but has no role in domain-based SMTP authentication policy or receiver handling of spoofed mail. It can protect payroll exports if a file-transfer application uses it, yet the scenario is about messages claiming to be from a domain. An SFTP endpoint cannot publish a quarantine instruction to recipient mail servers.

SPF authorizes SMTP source IP addresses for an envelope domain and can contribute to DMARC when alignment conditions are met. It does not itself tell receivers to quarantine messages that fail aligned authentication; a negative SPF result may be handled under various local policies. Configure DMARC for the requested receiver disposition.

DNSSEC validates that signed DNS responses have not been modified relative to a trusted DNSSEC chain. A malicious operator can legitimately sign records for a domain they control, so authentic DNS data can still direct users to malware. The task is deliberately to block resolution of a confirmed malicious hostname, not merely verify data integrity.

Encrypted DNS protocols such as DoT or DoH protect DNS queries against passive intermediaries on the path. They do not automatically prevent a resolver from returning a valid address for a malicious domain. A private but successful lookup would still let an infected endpoint contact the command-and-control infrastructure, violating the required block.

Data loss prevention detects protected files moving through unauthorized uploads or removable-media paths. It may alert on exfiltration later, but it does not control which DNS addresses the enterprise recursive service returns. The specific requirement is to prevent resolution of a confirmed command-and-control hostname, requiring protective DNS filtering instead.

Windows Group Policy can centrally enforce workstation controls such as idle screen locking, password policy, and various configuration settings. The affected host is a Linux server with a compromised service process that can read directories permitted by ordinary Unix ownership. Domain screen-lock policies do not provide the required confinement for a Linux daemon.

A NAC remediation VLAN restricts network connectivity for endpoints failing posture requirements. It can contain an unhealthy laptop but does not directly prevent a local Linux service process from reading files on the same machine. The exploit is a host-level privilege boundary problem, so mandatory access controls are the appropriate mechanism.

File integrity monitoring detects changes to protected file contents or configuration baselines and can alert investigators after unauthorized edits. It does not necessarily stop a compromised service from opening and reading unrelated home directories. The scenario requires enforcing a restriction on the process's read capability, which an SELinux policy can provide.

Protective DNS filtering blocks known malicious hostnames and can prevent endpoint connections to some command-and-control domains. It has no effect on whether Windows workstations lock their screens when left idle. The risk involves unauthorized people using already authenticated local sessions, not resolution of external domains.

SELinux mandatory access control enforces process confinement on supported Linux systems. This fleet consists of domain-joined Windows PCs and needs consistent idle-session locking. SELinux rules cannot be deployed to Windows Group Policy to enforce workstation screen timeouts; use native centralized endpoint policy instead.

File integrity monitoring reports changes to selected files or configurations and helps detect tampering. It would not enforce an idle-timeout setting merely by noticing that some machine values differ. The enterprise needs the screen lock actually configured and maintained on hundreds of clients, with compliance verification following enforcement.

Behavior-based EDR analytics can detect suspicious process chains and misuse of trusted administrative utilities even when antivirus signatures do not fire. The scenario gives no evidence of living-off-the-land execution; it identifies unexplained configuration-file changes. FIM targets that specific observable difference more directly, while behavioral telemetry may help investigate its origin.

Centralized Group Policy can enforce Windows workstation settings such as screen-lock timeouts at fleet scale. It is not a general-purpose file-change detector for every payment server security configuration. Applying a screen-lock policy would not record unauthorized edits to the server's protected files or correlate them with the missing change ticket.

SELinux mandatory access control can confine Linux service domains even when ordinary discretionary file permissions would permit access. It is useful for restricting what a compromised daemon may read or modify. The current requirement is to detect unexpected changes already occurring in payment server configuration files, so file integrity monitoring is the more specific answer.