CompTIA SY0-701 Bundle

A password and PIN are both knowledge-based secrets and do not add a separate possession or inherence factor. This observation is relevant when evaluating MFA but does not explain how to resolve excessive compulsory password changes. The scenario describes daily rotation causing predictable patterns; the correction is the password-change policy itself.

An origin-bound FIDO2 security key provides strong phishing-resistant authentication and may be useful to modernize the login system. It does not directly fix a policy that still demands changing a strong memorized password every day. Deploying a hardware key without revising arbitrary expiration rules would preserve the predictable-increment problem.

Periodic access certification asks responsible owners to attest that employees still need their roles, applications, and permissions. It can reduce stale privileges after staff transfers but is not a password-expiration control. The prompt addresses weak patterns caused by forcing users to change otherwise strong passwords every day, not unauthorized role membership.

Short-lived credentials are often preferable where supported, but the legacy tool is explicitly unable to authenticate them. This option cannot satisfy the stated integration constraint. Federated tokens become useful only after the target application can verify those tokens or a compatible broker translates them safely. The stem expressly excludes that ability, so deploying tokens by itself breaks authentication rather than fixing the copies of the static credential.

Disk encryption protects storage media but does not prevent approved users, builds, or leaked repositories from exposing a hardcoded script password. It does not coordinate rotation. A repository's encrypted disk does not remove credential values already committed into revision history, included in build artifacts, or printed by scripts. Someone with authorized repository access can still read them. The control does not give individual runtime access logs or coordinate password replacement.

Resetting human user passwords does nothing to remove a shared service secret from scripts. The risk originates in the stored legacy credential. Those daily changes concern human interactive logins, whereas the exposed secret belongs to an automated service identity used by several scripts. Nothing in this choice removes the machine password from files, enforces retrieval controls, or provides a reliable plan for revoking its copies.

FIDO2 can strongly authenticate an enrolled credential, but if it is bound to an impostor the assurance proves the wrong person controls it. Proofing must establish the human identity first. This reverses the assurance order: a hardware key proves possession of a credential, not that its initial recipient is the approved contractor. If enrollment happens before identity verification, future strong authentications faithfully authenticate an impostor who was mistakenly bound to the contractor's record.

Authorization approval determines what a named worker should access. It does not show that the person currently requesting credentials is the one the manager approved. The business owner has already approved the contractor's role. Repeating entitlement authorization cannot verify the remote caller's physical or organizational identity. The unresolved step is establishing that the individual asking for enrollment matches the applicant associated with the approved access request.

A forced password reset reduces exposure from a temporary secret, but cannot establish who received the secret. It may give a convincing impostor a fresh long-term credential. A first-login reset limits how long an initial password remains valid, but it does not establish the recipient's identity. A fraudulent caller could receive the temporary password, reset it themselves, and become the persistent holder of the approved contractor's privileged account.

Token lifetime controls how long a machine or user credential remains usable. It cannot discover or remove accumulated legacy group memberships. Expiring machine tokens is useful for reducing the replay window of a stolen credential, but the case describes accumulated *human authorization* from three former roles. The user would retain the old directory or application group memberships even if every service-account token were made shorter.

Identity proofing establishes the claimant’s identity, which is not in dispute. The problem is whether an authenticated employee still needs old permissions. The employer already knows which employee holds the identity; the disputed issue is which privileges they should still hold. Rechecking a government document does not evaluate payroll data exposure, orphaned group memberships, or whether the engineering role still requires particular resources.

A new password changes the login secret but leaves unauthorized group memberships intact. The review must examine authorization, not just authentication hygiene. Resetting passwords may reduce the usefulness of an old leaked secret but does not alter the effective access-control lists, security groups, or application entitlements. A newly authenticated employee would still inherit the obsolete permissions unless managers actually recertify and remove them.

Identity proofing verifies a claimant before enrollment in sensitive authentication methods. Issuing a secure key to the wrong person defeats the assurance chain. Proofing is appropriate when a *human* claimant must be linked to an approved identity before authenticator enrollment. These are automated build jobs, and the defect is a shared, reusable production credential in ephemeral files. Checking an applicant's identity would not change credential lifetime or permissions.

A secrets vault controls storage, retrieval, rotation and auditing of service credentials. Hardcoded shared passwords create persistent exposure. A vault is a useful improvement when a legacy API key cannot be removed, because it restricts storage and can rotate the value. Here the workflow can use native machine identities instead, allowing each build to obtain a separate short-lived credential without holding a reusable shared secret.

Periodic access certification asks accountable owners to attest continued need for permissions. It helps remove privilege accumulated through job changes. Periodic certification helps confirm that account owners still require access; it can retire stale entitlements at intervals. It does not stop a developer or attacker reading a long-lived key already embedded in build environments, nor does it confine stolen credentials to the lifetime of a single job.

Broad account administrator rights are unnecessary. Least privilege is valuable for restricting which resources an administrator can change, but it does not by itself record commands entered over SSH or tie terminal activity to a named approval. The stated requirement explicitly extends beyond authorization scope to verifiable session oversight.

Just-in-time access limits the *duration* for which administrator privileges are active, reducing standing exposure. It can complement a PAM session broker, but an elevation that expires after one hour still does not automatically capture the commands executed during that hour.

Static role membership alone is insufficient. Conditional access checks geography, device posture and sign-in risk before accepting a session. A legitimate high-risk administrative login could pass those checks and still run destructive commands without a session recording. The question seeks evidentiary oversight of activity after authentication.

PAM brokers can manage highly privileged interactive administrator sessions, but this is a noninteractive image-processing service. Brokering a human shell would not reduce the standing cloud-wide permissions granted to the service's resource identity for reading one bucket. Privileged-shell monitoring would not remove the image worker’s excessive cloud subscription role; this is a service authorization scope problem.

Time-limited elevation is appropriate for an administrator performing an approved exceptional task. This service needs persistent access for a narrow, repetitive operation; granting temporary subscription-wide privilege on each run remains excessive compared with a bucket-scoped read policy. Even a temporarily elevated role would let this image service administer unrelated subscriptions while it was active.

Rotating or shortening a credential reduces how long a copied token stays usable, but a valid token with administrator-wide permissions can still reach unrelated subscriptions during its lifetime. Permission scope, not token age alone, fixes this excessive-authorization issue. Rotating the worker token does not cure a token whose effective authorization still spans every cloud subscription.

PAM session recording is important for sensitive administrator activity, but no privileged command or session audit deficiency is described. The anomaly is two geographically inconsistent sign-ins, so the immediate question is whether the identity provider should challenge or block access based on risk.

FIDO2 uses origin-bound public-key authentication, preventing credentials from being replayed to a lookalike domain. Ordinary OTPs can be phished in real time. An origin-bound security key helps prevent a user from authenticating to a phishing lookalike, a real benefit. It does not automatically detect suspicious travel or determine whether previously obtained sessions originated from incompatible locations; risk-based session policy remains necessary.

Broad account administrator rights are unnecessary. Reducing a service identity's object-storage permissions enforces least privilege for cloud workloads. This case concerns a finance user's anomalous interactive sign-ins, so narrowing a storage API policy does not examine the location signal or challenge the suspicious authentication event.

Blind action on weak indicators risks outages. SOAR endpoint isolation responds to suspicious or confirmed workstation activity after detection, generally in operations. The defect here occurs before deployment when an infrastructure pull request would create a publicly reachable bucket, so incident containment is too late and the wrong control point.

The workflow still needs ownership and duplicate-event handling. Automatic alert-to-ticket creation improves ownership and triage, but merely opening a task does not prevent a flawed infrastructure-as-code change from being merged and provisioned. A gate that fails the build is required to eliminate that exposure before resources are created.

Secret scanners are valuable for catching hardcoded keys and other confidential strings before release. A public-storage endpoint can be created without any embedded secret, so this test does not examine the network and access-control configuration the scenario identifies as unsafe.

A configuration-as-code guardrail blocks insecure cloud resource definitions before merge. That policy check cannot transform an already generated EDR detection into a tracked incident, assign responders, or preserve host-level alert evidence in the case management system. A cloud-storage configuration gate cannot transfer the pending EDR alert details into the security incident queue.

Enrichment itself is not equivalent to blocking traffic. Enrichment can attach asset ownership, threat intelligence, and previous detections to an endpoint alert. By itself it does not create a case with a unique identifier, assign an on-call queue, or ensure the alert's lifecycle is tracked instead of remaining in a mailbox.

Blind action on weak indicators risks outages. Isolation is a containment action with potential availability consequences; a high-confidence alert can justify it only under an authorized playbook. The given pain point is delayed case creation, not verified need to disconnect workstations, so automating isolation would add unnecessary operational risk.

Not every automated notification needs the same gate. Human approval may be warranted for low-confidence or business-critical hosts, and the approved playbook should encode those exceptions. A universal manual gate for every independently verified ransomware signature would retain much of the delay the SOC is explicitly trying to reduce.

Enrichment itself is not equivalent to blocking traffic. Enriching a detection with reputation and contextual data can help confirm the ransomware hash. If the SOC already knows the indicator is malicious, enrichment without an enforcement step still allows active file encryption and lateral movement to continue.

The workflow still needs ownership and duplicate-event handling. Creating enriched incidents ensures analysts have records and ownership, but recording a ransomware alert does not stop the affected workstation from reaching network shares. The requested improvement is rapid, controlled containment, not only documentation of the detection.