CompTIA SY0-701 Bundle

Restoring the endpoints without fixing the accessible entry point leaves attackers able to compromise them again. Endpoint cleanup alone does not remove the infrastructure vulnerability described in the scenario. Endpoint restores may appear successful until the attacker uses the same exposed application vulnerability again. Reconnecting the machines without closing that attack path repeats the documented failure pattern and wastes recovery effort while leaving users exposed.

Lessons learned can improve incident-response procedures after containment, but it cannot replace remediation of the known exploited service while reinfection is still occurring. Lessons learned help improve governance after the urgent threat is stopped, but meetings do not patch the exploitable service or remove the attacker’s current ingress path. Here root-cause remediation cannot wait for postmortem documentation.

Monitoring may help confirm attack patterns and measure residual compromise, but it does not close a known vulnerability that repeatedly admits the intruder. An active mitigation is required. Monitoring is essential for detecting reinfection and confirming remediation, but observation without limiting access or applying a fix leaves a known reachable vulnerability exploitable. The scenario asks how to *prevent* another cycle, not how to count recurrences.

They are appropriate for rehearsing executive notification judgment. Tabletop simulations are useful for practicing responses to fictional incidents, but the SOC suspects actual stealthy activity may exist in its production estate. Rehearsing personnel decisions does not search real endpoints and logs for artifacts the detections missed.

Detecting one signal alone is not final attribution. Routine alert triage starts with a specific surfaced signal whose legitimacy or severity is unknown. The situation explicitly has no triggering alert for the suspected technique, so waiting for such an event leaves a blind spot rather than testing the hypothesis.

Merely deleting the payload leaves the opening exploitable. Root-cause analysis is appropriate after an intrusion is identified and a mechanism needs remediation. The SOC has only a plausible technique hypothesis, not a verified incident or known exploited control to repair; evidence-led hunting must precede root-cause claims.

Capturing RAM protects volatile state from disappearing at shutdown, but these are stored logs threatened by routine retention turnover. Taking a memory image will not suspend deletion or prove the preserved records are complete for civil discovery. The threatened loss concerns stored rotating logs, not transient RAM artifacts that would be lost if a live computer were powered off.

Unlogged handoffs weaken admissibility. Transfer logs and integrity checks matter after evidence is collected, but chain-of-custody paperwork alone does not stop the automatic storage rotation scheduled in three days. Establishing preservation under the hold is the prerequisite for meaningful subsequent transfers.

Unsupported certainty weakens investigative conclusions. A factual forensic report can describe preserved evidence and articulate uncertainty, yet reporting does not prevent imminent deletion. A thorough narrative prepared after logs expire cannot replace the underlying records that litigation or independent analysis may require.

Chain-of-custody and controlled copies are still needed. A preservation hold prevents destruction of relevant evidence but does not automatically improve the accuracy of an attribution conclusion. Here binaries have already been recovered, and the immediate ethical obligation is describing what the artifacts actually establish rather than naming an unsupported actor.

Live memory collection may reveal additional processes or network connections, but the request focuses on how to communicate conclusions from recovered binaries. Additional acquisition does not justify declaring an actor when corroborating attribution evidence is absent. Taking a memory image would not resolve who authored the recovered binaries unless the additional volatile artifacts contained corroborating attribution evidence.

Merely deleting the payload leaves the opening exploitable. Root-cause work can identify the entry mechanism and broken controls. Even a confirmed exploit path does not necessarily identify who operated the malicious code; do not convert technical explanation into unsupported geopolitical or personal attribution in a forensic report.

DNS lookups indicate which hostnames a client resolved, but they say nothing about local interactive logon failures if no network query was involved. A failed Windows sign-in can occur entirely on the laptop without generating relevant resolver evidence. Even a DNS trace showing a hostname cannot establish the error code and username associated with failed interactive laptop logons.

A web proxy can tie outbound HTTP requests to users, but a login attempt at the device console is not necessarily an HTTP transaction. The scenario's silent firewall logs and local failures point to host security events instead of browsing activity.

EDR process lineage is excellent for reconstructing malicious script launches, but a process tree without authentication event details does not establish failed logon reasons or whether a user submitted credentials at the console. Host security auditing targets that evidence. A PowerShell parent-process tree would address script execution but cannot directly reconstruct the failures in the laptop account’s authentication log.

A web proxy can show URL requests made by clients passing through it, but the problem states no proxy history remains. A domain may also be resolved without producing an HTTP request, so absent proxy evidence cannot establish which endpoint issued the lookup.

Firewall logs identify allowed and denied connections, usually by IP address and port. They rarely preserve the exact hostname the client resolved, particularly with shared hosting, changing addresses or DNS-over-HTTPS; mapping a reported domain needs resolver evidence. A firewall connection record may show attempted network flows but usually cannot tie a specific DNS query for the reported domain to the originating client.

Firewall flow data cannot prove interactive account success. Operating-system authentication events concern account logon activity, not name resolution. An infected device may query a malicious domain under a service context without any unusual user sign-in, so account events would not answer which host asked DNS for the indicator.

Firewall flow data cannot prove interactive account success. Local authentication logs may explain which account signed in, but the download's URL, proxy response and transfer timing are separate HTTP events. A successful login is not evidence that this particular executable was requested or delivered.

DNS queries may reveal which domain the employee's device resolved, but not the exact executable path, response status or whether a download occurred. Many distinct files share one hostname, so resolver logs are weaker than retained web gateway transaction records.

Packet capture can provide detailed transfer evidence when lawfully collected and decrypted, but there is no indication that complete payload captures were retained for the suspected event. The enterprise web gateway is the specific historical data source most likely to show the request.

DNS resolver telemetry can link destination domain names to clients, but the suspected egress attempt may be recorded by IP and port even without a DNS query. Lookup data does not prove that firewall policy allowed or denied an actual connection.

EDR telemetry can show the local process initiating network activity and can complement investigation. However, a process tree by itself cannot prove whether the perimeter or host firewall rejected the outbound traffic; the question asks about connection disposition. Endpoint process telemetry may identify a local executable but cannot establish whether the perimeter firewall allowed or blocked the suspicious egress attempt.

Firewall flow data cannot prove interactive account success. Authentication event logs describe identities and sign-ins, not packet-filter rule decisions. A server can initiate an automated outbound session without a new interactive login, so an auth failure or success log would not establish the requested exfiltration attempt.

A proxy log may identify an unusual web download that led to PowerShell execution, but it usually cannot show which local process spawned PowerShell. The distinction between a management agent and an Office attachment requires process ancestry from the endpoint.

Network packet inspection can reveal commands sent over an unencrypted channel or suspicious destinations, yet encrypted traffic and off-host observation obscure Windows process parentage. It is not the primary way to distinguish the launching application of a local interpreter. Network packet analysis would not show whether a particular PowerShell child process was launched by the approved agent or an Office document.

Firewall flow data cannot prove interactive account success. Security logon events can attribute which user session existed at the time, but multiple processes under that session may start PowerShell for different reasons. The parent-child relationship is process telemetry, not an authentication fact, and provides the decisive distinction.

Firewall flow data cannot prove interactive account success. OS authentication events can show if an account attempted or completed a sign-in, but they do not display HTTP Basic Authorization headers crossing a legacy link. A user logon is therefore insufficient to prove network transport carried the credential without encryption.

DNS logs explain name resolution and client-to-domain relationships, not application payload contents. An attacker or analyst can observe a DNS lookup even when the subsequent connection uses TLS, so resolver data cannot establish plaintext credential transfer. The resolver could reveal a hostname lookup, not whether the subsequent application session transmitted a basic-authentication password without TLS.

EDR can show that the legacy application started and made connections, which helps host attribution, but process ancestry does not reveal the bytes placed on the wire. Proof of Basic credentials appearing in cleartext requires authorized application-layer network evidence. A process tree could establish which binary ran but not whether its legacy authentication exchange exposed password bytes on the wire.

Firewall session logs show network reachability and communications, which can corroborate an attack timeline. They generally do not establish the application version or vulnerability finding that existed on the server before the incident. An egress firewall log can identify network attempts but not whether a specific flaw was known and present on this application server before intrusion.

Packet captures may show an exploit request if complete traffic from the incident was recorded, but the scenario asks whether the asset was *previously exposed*. Historical scan evidence preserves that earlier assessment state more directly than traffic-only observations. A packet trace may capture exploit traffic but does not provide the server’s prior vulnerability inventory and remediation status at the relevant date.

Firewall flow data cannot prove interactive account success. OS login events can identify accounts used around the intrusion, but compromise through an exposed application flaw may not create interactive failed logins. Without vulnerability/version details, those events cannot answer whether a known finding had already been detected on that host.