CompTIA SY0-701 Bundle

Per-branch scripts and manual screenshot reviews preserve the duplication and variation that caused the drift. They do not consistently enforce a common approved configuration state. Separate manual scripts for each branch permit command-order differences, unreviewed local edits and drift between routers. Screenshots after the fact are weak evidence of effective policy because they may omit hidden defaults or never prove every device uses the same tested settings.

Centralized detection of drift is useful, but alerting alone does not standardize the configuration change process. The requested design must also apply and verify a consistent security baseline. A dashboard can flag drift after the fact but does not prevent staff from pasting a different policy at each branch. The requirement is consistent deployment of a reviewed baseline, not merely centralized visibility into manual errors.

Reboot orchestration may restore services after maintenance, but it cannot establish whether access control, logging and other security settings match the approved baseline. Reboots may load the wrong configuration again or interrupt stores unnecessarily; they do not establish correctness. Without a common source of truth and post-change state verification, every device can restart successfully while continuing to enforce an inconsistent security posture.

Reimaging can be part of eradication and clean restoration for the first compromised machine, but that machine is already isolated and no longer explains the ongoing writes. The server audit trail instead identifies a service account being used from a second host to encrypt more files. Focusing only on the original endpoint would leave the active share-writing identity untouched and permit continuing damage. Rebuild planning must follow, not replace, targeted containment of the identified account.

Additional file-server logging can improve the incident timeline, show which paths were encrypted and preserve evidence for investigators. It is not a containment action if the compromised account retains permission to create or overwrite files on the share. Because the logs already identify the unauthorized writer and incident command has approved urgent action, passive monitoring leaves users’ data exposed to further encryption. Preserve logs while promptly cutting the specific write channel.

Restoring clean files is a recovery activity undertaken after the continuing attack path has been restricted and backups have been checked for integrity. If the compromised service account remains enabled with write access, restored files may be encrypted again as soon as they appear on the SMB share. The organization should first revoke that identity’s access, then scope affected files and coordinate tested recovery. Restoring immediately without containment risks wasting recovery effort and losing new changes.

Restoring without addressing the entry mechanism invites reinfection. Eradication addresses malicious files and persistence after the incident has been scoped, but deleting or rebuilding the server now could overwrite the memory evidence investigators explicitly require. Correct removal timing cannot compensate for already lost volatile credentials or process details.

Eradication and rebuilding can follow once scoped. Network isolation may stop external communications while preserving power and RAM, which can complement forensic preservation. The option alone does not specify acquisition of the memory and process evidence that may disappear when the system is later shut down.

Unlogged handoffs weaken admissibility. Chain-of-custody records the handling and integrity of collected evidence, but it does not create a memory image. Without acquiring volatile artifacts first, meticulous handling of a disk image still leaves the requested session and process evidence unavailable.

Collecting live memory addresses volatile credentials and running processes, but a seized USB drive is nonvolatile physical evidence. The requirement is continuous accountability for the drive's origin, possession, seals and authorized transfers, not a transient memory snapshot of an unrelated device.

Restoring without addressing the entry mechanism invites reinfection. Removing malware persistence can be part of remediation after proper acquisition; modifying a potential evidence USB before establishing an image and custody record risks altering timestamps or content. The investigation needs defensible preservation rather than immediate repair of the seized media.

Chain-of-custody and controlled copies are still needed. A legal hold protects records from routine disposal and might apply to this investigation, but it does not alone record which person picked up the USB, who accessed it, or whether evidence was tampered with in transit.

Restoring an infected image can reintroduce malicious persistence immediately. The system requires remediation and verified clean recovery media, not an unchanged infected state. Restoring an image that still includes the malicious task and service recreates the persistence mechanism. Even if the original intrusion connection is closed, those scheduled components can restart execution on the recovered server and jeopardize the next connection to production.

Ending a network session limits activity temporarily but does not eliminate the locally installed service and scheduled task, which could execute after reconnection. Terminating an open connection is containment, not eradication of local persistence. The identified service and task remain able to execute after reboot, so the responder has not removed the mechanism that would relaunch the payload.

Isolation is a containment milestone, not proof that the attack has been eradicated. Persistent artifacts remain and would endanger restoration. Isolation limits communication but does not make the compromised host trustworthy; malicious code can remain on disk for the next maintenance window or network reconnection. Closing an incident on isolation alone would skip eradication and validation of the discovered persistence.

Restoring without addressing the entry mechanism invites reinfection. Root-cause remediation should be completed before returning systems to service, but the stated question concerns an already rebuilt laptop lacking post-restore verification. Selecting an eradication label alone does not demonstrate that the installed recovery image is clean or behaving normally.

Eradication and rebuilding can follow once scoped. Isolation is useful during active compromise, and the laptop may stay segmented until checks pass. It is not sufficient proof that malware, scheduled tasks or unauthorized credentials were removed from the restored device before it resumes production activity.

Completing containment without follow-through misses systemic weaknesses. A lessons-learned review should follow the incident, but it cannot substitute for validating that the recovered laptop is trustworthy right now. Process improvements after an incident will not prevent an untested restored endpoint from immediately reintroducing the same infection.

Merely deleting the payload leaves the opening exploitable. Root-cause remediation asks how the initial intrusion happened and how the exploited weakness should be closed. Missing after-hours contacts are a response coordination gap discovered *after* restoration, so an exclusive technical root-cause task would leave that process deficiency unassigned.

Restoration validation confirms normal service and monitoring without malware persistence. The case explicitly says recovery is complete and describes a missing escalation roster, which cannot be fixed by another system-health check unless procedural owners are also assigned. The stated problem is an outdated escalation roster discovered after restoration, not an unverified clean state on a rebuilt host.

Inventing roles during an emergency wastes response time. Preparation should include current on-call contacts and escalation authorities before the next event. But simply naming the planning phase does not capture the need to examine a completed incident, document the discovered weakness, and track concrete improvements from the review.

Eradication and rebuilding can follow once scoped. Network isolation would be premature when the suspicious logins may be authorized travel and no compromise has been established. Disruptive containment should be based on assessed evidence or a protective rule, not mere receipt of several correlated-but-unverified alerts.

Inventing roles during an emergency wastes response time. A contact plan ensures the right personnel can be reached, but the immediate task is determining what the four alerts actually mean. Scheduling responders without reviewing devices, timezones, authentication factors and session origins cannot distinguish legitimate business activity from account takeover.

Proactive hunting starts with a hypothesis about hidden attacker activity without relying on a specific alert. The SOC already has four concrete login detections to classify, so incident triage and analysis is the more directly applicable response activity at this decision point.

Eradication and rebuilding can follow once scoped. Endpoint isolation is a containment action during a suspected or confirmed active compromise. The company lacks organizational roles and reporting thresholds *before* an event, so disconnecting a hypothetical workstation cannot establish who may communicate with law enforcement or approve escalation.

Detecting one signal alone is not final attribution. Analysis of suspicious indicators helps classify a real incident after signals appear. It is not an adequate substitute for predefined contact ownership, backup contacts, authorized communication channels or criteria for reporting serious ransomware activity.

They are appropriate for rehearsing executive notification judgment. A tabletop can exercise the planned contacts and test communication assumptions, but a simulation without an agreed roster or escalation authority has no dependable baseline to evaluate. First establish roles and decision rights, then use exercises to expose gaps.

Completing containment without follow-through misses systemic weaknesses. Lessons learned examine actual events after recovery to improve the process. The leadership group needs to practice hypothetical notification decisions and uncertainty *before* any production response, so a retrospective meeting does not provide the desired scenario-based rehearsal.

Memory acquisition involves preserving live system artifacts such as RAM, connections and processes. Legal and communications leaders are not investigating a compromised server in this scenario; collecting forensic evidence would not exercise their notification timelines or stakeholder decisions. Capturing live server memory is irrelevant to the leaders’ request to rehearse legal and communications decisions without collecting production evidence.

Inventing roles during an emergency wastes response time. Preparation plans define who should act and how incidents escalate. The group already wants to *rehearse* those plans under uncertain facts; distributing a contact directory alone does not test decision speed, communication consistency or the consequences of incomplete evidence.

Restoring the endpoints without fixing the accessible entry point leaves attackers able to compromise them again. Endpoint cleanup alone does not remove the infrastructure vulnerability described in the scenario. Endpoint restores may appear successful until the attacker uses the same exposed application vulnerability again. Reconnecting the machines without closing that attack path repeats the documented failure pattern and wastes recovery effort while leaving users exposed.

Lessons learned can improve incident-response procedures after containment, but it cannot replace remediation of the known exploited service while reinfection is still occurring. Lessons learned help improve governance after the urgent threat is stopped, but meetings do not patch the exploitable service or remove the attacker’s current ingress path. Here root-cause remediation cannot wait for postmortem documentation.

Monitoring may help confirm attack patterns and measure residual compromise, but it does not close a known vulnerability that repeatedly admits the intruder. An active mitigation is required. Monitoring is essential for detecting reinfection and confirming remediation, but observation without limiting access or applying a fix leaves a known reachable vulnerability exploitable. The scenario asks how to *prevent* another cycle, not how to count recurrences.