CompTIA SY0-701 Bundle

Behavior-based EDR analytics can detect suspicious process chains and misuse of trusted administrative utilities even when antivirus signatures do not fire. The scenario gives no evidence of living-off-the-land execution; it identifies unexplained configuration-file changes. FIM targets that specific observable difference more directly, while behavioral telemetry may help investigate its origin.

Centralized Group Policy can enforce Windows workstation settings such as screen-lock timeouts at fleet scale. It is not a general-purpose file-change detector for every payment server security configuration. Applying a screen-lock policy would not record unauthorized edits to the server's protected files or correlate them with the missing change ticket.

SELinux mandatory access control can confine Linux service domains even when ordinary discretionary file permissions would permit access. It is useful for restricting what a compromised daemon may read or modify. The current requirement is to detect unexpected changes already occurring in payment server configuration files, so file integrity monitoring is the more specific answer.

An HTTP-to-HTTPS 301 redirect asks a browser to make a second request on a secure URL after first contacting the server over HTTP. That initial plaintext connection may still be intercepted or altered by an active network attacker. The question asks for a persistent browser-side rule after a trusted HTTPS visit, which a redirect alone cannot establish.

Setting Secure on authentication cookies prevents compliant browsers from sending those cookies over plaintext HTTP. It is an essential session confidentiality control, but the browser could still request non-cookie content through an old HTTP bookmark and expose its initial navigation. The specified requirement is to upgrade the entire host connection policy after an HTTPS visit, not only protect cookie transport.

Content-Security-Policy can restrict which script sources a page may load, helping mitigate some injection and XSS impacts. A policy that only names allowed JavaScript origins does not tell the browser to reject plaintext HTTP navigation to the host. The scenario is about transport downgrade behavior, not untrusted script execution.

Signature-focused antivirus scanning compares files with known malicious signatures and may apply basic heuristics. Threat actors can abuse legitimate signed administrative tools whose binary hashes are not malicious. The stem explicitly says ordinary antivirus permits these tools, so relying on more of the same signature checks could miss the behavior that matters.

File integrity monitoring detects unauthorized changes to important files or security configurations by comparing their approved properties or hashes. Some signed-tool abuse may modify files, but attackers can also execute malicious commands without altering the monitored baseline. The specified failure is misuse of trusted binaries, better observed through process behavior and execution context than file-change alerts alone.

NAC quarantine limits network access for endpoints whose posture fails a policy, often directing them to a remediation segment. It is useful after a compromised or noncompliant device is identified. The stated problem is detection of suspicious use of signed administrative tools that signature checks miss, so NAC alone does not supply the requested behavioral visibility.

A narrowly scoped, time-limited web-filter exception allows an otherwise blocked legitimate hostname needed for a specific business operation. Here kiosks are visiting domains already classified as credential-harvesting destinations. Creating exceptions would weaken protection instead of preventing access, so the policy should enforce the malicious category block rather than bypass it.

Protective DNS can refuse name resolution for confirmed malicious hosts, which may provide a complementary control to proxy filtering. However, the case emphasizes web browsing through an available central proxy and category classifications; a URL reputation policy can evaluate the web destination at that existing enforcement point. DNS-only controls may also lack the same path- and category-level context.

Behavioral EDR analytics can identify malicious activity performed with signed administrative programs after execution. They may help find a kiosk that has been compromised but do not directly prevent web browsing to known phishing domains through a proxy. The requirement is outbound destination policy for public kiosk browsers, not local process lineage detection.

A restricted NAC remediation segment can isolate a noncompliant device from production until it meets policy. It does not grant a specific firmware updater access to one justified hostname while preserving the rest of the proxy restrictions. The administrator wants a precise web-filter policy exception, not wholesale network quarantine.

URL reputation blocking keeps users away from phishing and malware sites classified by a web security gateway. The required vendor update hostname is currently blocked despite a legitimate, verified purpose. Leaving the block in place prevents necessary firmware maintenance; the requested change is a narrowly documented exception, not expanding category blocking.

Protective DNS filtering prevents resolution of confirmed malicious hostnames. It is useful for disrupting command-and-control but cannot make one legitimate blocked web hostname available if a separate proxy web filter still denies it. The scenario explicitly targets the proxy exception workflow rather than malicious DNS resolution.

URL reputation and category blocking can prevent browsers from visiting malicious sites and disallowed web categories. A legal team's personal email attachment may use a reputable webmail provider, and the approved legal portal may be in an ordinary category. Web reputation alone cannot reliably classify which sensitive files are being sent through each channel.

Behavior-based EDR can detect abnormal endpoint process activity and living-off-the-land attacks. The legal team may be using completely legitimate email applications while violating a sensitive-file transfer policy. The problem is confidential content moving through the wrong destination, so DLP's content- and context-aware decision is more precise than process-malware analytics.

A temporary proxy exception could allow an approved web portal otherwise blocked by filtering policy. It does not decide whether protected legal files should be blocked when attached to personal emails. The scenario requires simultaneous content classification and channel-specific allow/block decisions rather than merely making one hostname reachable.

Identity federation lets services trust assertions from a common identity provider and can simplify central authentication. Federation does not guarantee immediate disabling when HR fails to notify the identity platform about a terminated employee. The existing weekly delay is a lifecycle-trigger problem, so federated login alone cannot remove still-valid sessions promptly.

OAuth delegated authorization allows an application to access a protected API using scoped tokens instead of collecting the user's password. It does not by itself trigger offboarding when HR records change. The scenario needs coordinated account and session revocation for a dismissed employee, not authorization delegation to another client application.

Time-limited privileged elevation reduces persistent administrator rights by granting them only for a justified interval. It may reduce exposure from overprivileged accounts, but the dismissed employee is retaining ordinary active cloud sessions because the termination signal arrives weekly. Just-in-time elevation does not replace event-driven identity deprovisioning and session invalidation.

SAML federation supports browser-based single sign-on through signed identity assertions between an identity provider and a service provider. It can simplify logging into a database administration portal but does not automatically limit a developer's privileged database role to an approved release window. Authentication federation is distinct from time-bounded privileged authorization.

Event-triggered deprovisioning disables identities promptly when a worker departs or loses eligibility. It is critical during offboarding but does not solve an active developer's unnecessarily permanent administrator role while still employed. The developer needs privilege for individual approved releases, so adjust elevation duration rather than remove the entire employee account.

A privileged access management broker can control credentials and record high-risk sessions, which improves auditability and may implement time limits. However, a monitored session does not necessarily remove the permanent database administrator role after release work. The scenario specifically asks to eliminate standing elevation, so just-in-time assignment and automatic expiry are the decisive mechanisms; PAM can enforce them as a supporting platform.

OAuth 2.0 delegation allows a client to call protected APIs on a resource owner's behalf using access tokens and scopes. OAuth by itself is an authorization framework, not a substitute for user authentication assertions at each third-party login. The prompt requires employees to sign into several SaaS applications using the company identity provider, which is a federation architecture problem.

OpenID Connect supplies an identity layer and ID token over OAuth 2.0, which can authenticate users to compatible applications. However, the scenario explicitly includes SAML-only vendors that do not accept OIDC tokens. Insisting those vendors produce an OIDC ID token would fail interoperability rather than establish a broader federation model.

SAML conveys signed XML-based assertions through federation between compatible identity providers and service providers. It supports some vendors in the case, but others explicitly accept only OpenID Connect. Requiring all integrations to speak SAML would exclude those applications, whereas a federation architecture can support each vendor's standard separately.

OAuth 2.0 access tokens authorize clients to use protected APIs within agreed scopes. The specified SaaS login expects signed XML assertions representing user identity, not an API access token. OAuth's delegated authorization purpose does not by itself satisfy the service provider's SAML assertion requirement.

OpenID Connect provides an identity layer over OAuth 2.0 and commonly returns a signed JSON Web Token ID token for user authentication. It is suitable where a service explicitly supports OIDC, but the partner requires signed XML assertions. An OIDC ID token has the wrong wire format and federation protocol for that endpoint.

SCIM can provision users, groups, and attributes between identity systems, streamlining account creation and disablement. It does not produce the browser single-sign-on assertion that the SaaS login endpoint consumes. Synchronizing an account may prepare access but cannot replace the required signed identity assertion during interactive authentication.

Identity federation allows one trusted identity provider to authenticate users for external applications. It may help a reporting client establish a user session, but federation alone does not grant the client narrowly scoped permission to call the employee's calendar API. The immediate requirement is constrained delegated API authorization without revealing the user's password.

SAML federation uses identity assertions for sign-on to compatible service providers. A SAML login may establish who the employee is, but it does not inherently issue calendar API access scopes to a separate reporting tool. The scenario is explicitly about delegated resource access rather than an interactive browser SSO assertion.

LDAP allows authorized clients to query directory entries and group memberships inside an enterprise environment. It is not designed to obtain a short-lived delegated token for a third-party calendar API with user consent. Querying the employee's directory account cannot replace OAuth's resource-owner authorization flow or secure API access scope.