CompTIA SY0-701 Bundle

A honeypot is an instrumented decoy system or service that resembles a legitimate target and attracts unauthorized connections. The scenario contains no standalone decoy server or running service; it plants a fabricated access key in a repository. An intruder's attempt to use the key is the monitored event, so the deception artifact is a credential, not an entire host.

A honeynet is a collection of connected decoy assets or services intended to let defenders observe attacks across a simulated environment, including lateral movement. The planted access key is a single inert artifact and does not establish linked hosts or a network of decoys. Network-level deception would fit only if multiple instrumented systems had actually been deployed.

A honeyfile is a planted document containing fictitious but plausible information, often configured to alert when it is opened, moved or copied. A repository entry may look like a file, but the deception mechanism in this question is a fake cloud credential whose attempted use triggers monitoring. The meaningful distinction is credential-use telemetry rather than access to a fake document.

A single high-interaction honeypot can imitate one production-like host and let defenders observe commands and exploitation against its simulated or isolated environment. The scenario explicitly deploys three connected decoy servers with fake web, directory and database roles, allowing intruder movement between them. The multi-system relationship makes the deployment more than a solitary decoy host.

A honeytoken is an intentionally invalid or decoy item such as an API credential that generates an alert when accessed or used. Such a token might appear inside a honeynet, but one alerting access key cannot by itself emulate interconnected web, directory and database services. Here the defender wants to observe movement between multiple instrumented hosts, not simply detect access to one fake value.

A honeyfile is a fictitious document placed where unauthorized readers may encounter it, with logging or alerts on access. It is useful for spotting suspicious file exploration or exfiltration. This deployment simulates multiple communicating servers and studies how an intruder pivots between them, which is a network-of-decoys architecture rather than a single planted document.

A honeytoken API key is a decoy credential whose unexpected use generates an alert. It can be embedded in a document, but the selected artifact here is itself a fictitious payroll spreadsheet that alarms when opened or copied. The event of interest is unauthorized document access, not an authentication attempt using an invalid cloud or application key.

A honeypot host provides a decoy computing environment or service for observing suspicious connections and commands. A single spreadsheet does not accept network sessions or emulate a server. Although it may live on a shared directory, the intentional detection point is opening or copying the document; the existence of normal file storage does not convert the planted file into a honeypot machine.

A honeynet connects several monitored decoy systems to support observation of discovery and lateral movement across fake services. The scenario names only one instrumented document and does not describe multiple related decoy hosts. The distinction matters because file-deception alerts can be deployed without building or defending a separate attacker-facing network.

A tested backout procedure documents how to restore a known-good configuration when a change causes disruption. It is essential for controlled deployments and should be prepared before execution. However, it addresses recovery after a failed route modification, while the architect's immediate question concerns discovering whether payroll-to-database connectivity will break in the first place. A rollback plan cannot substitute for mapping dependencies and forecasting the change impact.

Version-controlled configuration history preserves earlier route-policy settings, records changes, and helps teams compare or restore configuration versions. It may support later troubleshooting or rollback and provides accountability when routes drift. Yet merely storing the last configuration does not demonstrate which payroll database path depends on a proposed route; the architect must first analyze the connectivity consequences of the unimplemented change.

Formal change approval is the recorded authorization to proceed once responsible stakeholders understand risks, impacts, test results, and required safeguards. The owner cannot responsibly approve an unknown impact simply because the request exists. This stem explicitly calls for investigating dependencies before approval and deployment, so authorization is a later governance decision rather than the immediate analytical activity being tested.

Formal change approval authorizes a proposed change after appropriate risk and business review. It should have been secured before the rule was deployed, but gaining approval now does not restore customer connectivity or undo the erroneous deny condition. Authorization is an essential governance control, not a technical response to the unexpected outage already caused by the deployed rule.

A low-impact maintenance window schedules potentially disruptive work when fewer customers are expected to be affected. This could have reduced exposure before the firewall update, but the change is already blocking legitimate production traffic. Moving future changes into a better window will not fix the current bad rule. Incident recovery calls for the tested backout step first.

Dependency and impact assessment identifies which services, flows and users might be affected by a proposed policy change. It is valuable before deployment and during post-incident learning, especially where unexpected application traffic was blocked. However, the scenario asks for a response to an observed production outage; analysis alone does not restore permitted connectivity, whereas the preapproved rollback directly can.

A rollback is the planned reversal of a change if the new configuration causes a production failure. It would be used after an unsuccessful privilege deployment, not to authorize an already assessed request that has not yet been installed. The blocking fact here is missing service-owner approval, so invoking a backout process at this stage would address the wrong point in the change lifecycle.

Risk assessment evaluates exposure, possible consequences, and safeguards, but it does not automatically grant someone authority to expand privileged-group membership. The responsible service owner may have accountability for the resources affected by that expansion. Bypassing the required owner decision because technical risks were assessed would violate the stated governance rule and separation of responsibility.

Updated topology diagrams document a changed network layout and may help future troubleshooting, but they do not decide whether a contractor should receive additional privileged roles. Producing diagrams after deployment would also miss the explicit pre-deployment approval requirement. The requested security decision concerns access authorization, so documentation is supplementary and not the missing gating control.

Stakeholder communication informs affected application owners and customers about a planned restart, expected impact, and escalation contacts. It is important for smooth certificate maintenance but, by itself, it does not determine when to perform the disruption. The primary scheduling control is selecting an approved window with acceptably low customer demand, then notifying those affected so the outage is planned rather than unexpected.

A pilot or functional test checks whether the new certificate chain, private key and TLS settings work before broad deployment. It can catch certificate mismatch or incompatible client behavior, but even a technically correct certificate replacement will restart the customer-facing proxy. The question is specifically about reducing planned downtime impact, which requires choosing an appropriate deployment time rather than only testing functionality.

Formal change approval makes sure the proposed maintenance is authorized, risk-assessed and accountable. Approval is necessary for controlled changes, yet it does not automatically specify a business-appropriate execution time. An approved restart during peak customer traffic may still be harmful, so the most direct response to this stated interruption risk is to schedule the restart in a low-impact window.

Dependency and impact analysis examines which systems rely on shared DNS resolvers or zones and what breaks if they are changed. It can identify the owners who should be involved, but the stated risk is uncoordinated effects across three departments. The change process also needs direct communication with those stakeholders before and during deployment; an inventory of dependencies without engagement will not establish shared readiness.

A low-impact maintenance window could reduce the number of users affected by a DNS service change, particularly if resolver restarts or zone transitions are required. However, the question emphasizes separate application and network ownership across departments. Scheduling alone does not communicate dependencies, required testing or response contacts to those stakeholders. The most direct governance action is cross-team coordination.

Updating architecture documentation preserves accurate DNS service diagrams and configuration records after a change. That is important for ongoing operations, but a completed diagram cannot substitute for talking to teams whose services might fail when DNS behavior changes. Documentation should accompany the coordinated rollout, not be mistaken for the primary stakeholder-management control.

Pilot testing proves how a proposed configuration behaves in a controlled setting before it is widely deployed. It does not reconstruct the exact network policies that were present before an undocumented emergency modification. When the question calls for recovering earlier settings, a maintained configuration history is the direct evidence, while new tests can validate a recovered configuration later.

Architecture documentation records topology, zones, major routing relationships and design intentions. It can show how networks were supposed to connect, but it may not preserve the full ordered rules and exact previous settings needed to reconstruct undocumented policy changes. A configuration version history is more precise for restoring earlier network behavior; diagrams are supporting context rather than a change-by-change source of truth.

Operational procedures explain how administrators are expected to manage or recover a network system. They can guide restoration steps, but they are not automatically a record of which rules existed before an undocumented update. Without a versioned configuration, a procedure may leave engineers guessing parameter values and rule order. The question asks for reconstruction evidence rather than instructions alone.

Coordinating stakeholders is important when payment and corporate network owners are affected by segmentation changes. They may need to adjust applications, monitoring or firewall policies. However, the stated defect is that topology diagrams remain obsolete after the zones were split. Communication does not by itself update the authoritative network design documentation required for future maintenance.

Pilot testing would have evaluated whether the subnet split preserves legitimate connectivity and enforces intended isolation before production rollout. Such testing is a good change-management safeguard, but it cannot make old diagrams reflect the new payment and corporate subnets. The change has already occurred and the present problem is inaccurate documentation, which should be corrected as part of change closure.

Version-controlled configuration history preserves individual changes to device or policy settings and can support rollback or reconstruction of prior firewall and routing state. It may help determine when the subnet split happened. But the question is about stale topology diagrams that must describe the current architecture, not simply maintaining historical diffs. The needed update is to the network architecture documentation itself.

Formal change approval establishes that an authorized owner has accepted the proposed risk and timing. It is necessary for controlled access-policy changes, but authorization alone does not tell the team whether a service principal, workload identity or break-glass account will be unexpectedly denied. The scenario's concrete failure mode is functional compatibility, which controlled pilot evidence addresses before the rule is enabled broadly.

Dependency and impact assessment identifies identities and applications that rely on current conditional-access behavior, and it helps select a representative test set. It is useful preparation, but the question asks which response most directly addresses whether service identities will actually be locked out. A pilot that executes real sign-in and policy outcomes provides more decisive evidence than a dependency list alone.

An emergency change procedure permits urgent modifications outside normal approval windows while retaining defined accountability and retrospective review. Nothing describes an emergency requiring immediate action. Instead the policy is proposed and there is time to validate its effects. Applying the emergency path would not test whether service identities survive the change and could increase the chance of preventable access loss.