CompTIA SY0-701 Bundle

Formal change approval establishes that an authorized owner has accepted the proposed risk and timing. It is necessary for controlled access-policy changes, but authorization alone does not tell the team whether a service principal, workload identity or break-glass account will be unexpectedly denied. The scenario's concrete failure mode is functional compatibility, which controlled pilot evidence addresses before the rule is enabled broadly.

Dependency and impact assessment identifies identities and applications that rely on current conditional-access behavior, and it helps select a representative test set. It is useful preparation, but the question asks which response most directly addresses whether service identities will actually be locked out. A pilot that executes real sign-in and policy outcomes provides more decisive evidence than a dependency list alone.

An emergency change procedure permits urgent modifications outside normal approval windows while retaining defined accountability and retrospective review. Nothing describes an emergency requiring immediate action. Instead the policy is proposed and there is time to validate its effects. Applying the emergency path would not test whether service identities survive the change and could increase the chance of preventable access loss.

Formal approval documents the authority to perform a production modification and its risk acceptance. An emergency patch still needs appropriate authorization, but waiting for the entire ordinary weekly approval cycle could leave a critical exposure untreated. An emergency change procedure specifies the expedited approval and accountability measures needed; bypassing all governance is not the same as accelerating it safely.

A low-impact maintenance window can reduce service interruption during patch installation, but a critical vulnerability might require treatment before the next normal scheduled window. The question is about a sanctioned exception to the usual change calendar, not merely choosing the hour with fewest users. Emergency handling can include a shorter maintenance window where practicable while preserving expedited authorization.

Separating the approving and implementing roles helps reduce fraud or error during sensitive production changes, including critical patches. However, role separation alone is not a complete mechanism for an out-of-window urgent deployment. The organization needs a documented emergency route covering expedited authorization, risk testing, notification, rollback and retrospective review; separation of duties should operate within that route where feasible.

Rolling back after production traffic fails can restore a service once a harmful TLS change has already occurred. However, the engineer knows before deployment that the reporting client cannot negotiate the proposed minimum version. The question explicitly requires identifying compatibility breakage in advance, so relying on a future rollback would permit a foreseeable outage instead of analyzing the dependency first.

Updating topology diagrams is appropriate when a change alters network routes, trust boundaries or service locations. Raising a TLS minimum version may affect client compatibility without changing network topology at all. Because an indispensable reporting client uses an obsolete handshake, the missing work is testing and documenting protocol support across dependencies, not drawing the same endpoint in a different network diagram.

Post-incident lessons-learned meetings analyze causes, response effectiveness and preventive improvements after an actual event. They could be warranted if a TLS rollout had already caused an outage, but there is no incident yet. The engineer has identified incompatibility before deployment, and the best controlled-change step is to assess dependencies and plan a viable migration before changing the server.

Revising an operations procedure can document how engineers request or deploy firewall exceptions, including the correct approval workflow. It does not itself ensure that the requester is prevented from authorizing the same risky change. The observed weakness is one person controlling request, approval and deployment, which needs separation of decision authority rather than a purely textual update.

Coordinating affected stakeholders helps align security, application and network teams on expected traffic effects before a high-risk firewall exception. That communication is valuable but does not guarantee independent approval: the engineer could still approve their own change. The distinguishing concern is concentration of incompatible duties, so stakeholder notification alone leaves the authorization conflict intact.

Formal change approval is necessary before implementing a significant firewall exception, but the mere presence of an approval field does not guarantee independence. If the requesting engineer can approve their own ticket, the same conflict remains. The control improvement must specifically assign authorization to another accountable role and prevent self-approval rather than simply requiring that some approval exists.

Version-controlled configuration history can reveal which SIEM collection endpoint was configured before and after a change, and it helps reconstruct errors if forwarding fails. But the stated operational gap is that responders are still following obsolete instructions. Historical versions will not automatically tell those users the current procedure; the active runbook must be updated to match the deployed pipeline.

Stakeholder coordination can notify responders about the new log collection endpoint and associated changes, which is valuable for a safe handover. Yet a one-time message does not fix the persistent, written instructions they consult during incidents. The question specifically describes an outdated operational process, so documentation that governs routine response steps must be revised and disseminated.

Network architecture documentation records major services, data flows and system boundaries; it may need an update if the SIEM design changes. The immediate problem, however, is that responders follow outdated step-by-step instructions about a current collection endpoint. A diagram can show the new location without telling analysts how to validate ingestion or handle alerts, so the procedural runbook is the more direct remedy.

A digital signature proves origin or helps detect unauthorized changes to data when the signer’s key and certificate are trusted. It does not make the archive content secret, because a valid signature can be checked on readable data. Signatures may protect an archive manifest or software package integrity, but they are not the encryption process that hides several terabytes from unauthorized readers.

Public-key encryption or hybrid key encapsulation can solve the problem of distributing a symmetric session key to parties who lack a shared secret. Modern hybrid schemes still rely on symmetric encryption for the high-volume payload. The scenario already supplies managed secret keys and emphasizes efficient bulk protection, so using asymmetric operations as the primary data-encryption mechanism adds complexity without meeting that efficiency requirement more directly.

An HMAC authenticates data to parties sharing a secret and helps detect modification, often protecting the integrity of an API message or file manifest. It does not encrypt the input or prevent observers from reading the archive. It can complement encrypted backups through integrity protection, but a standalone MAC would leave the terabytes of sensitive content visible and therefore fail the confidentiality goal.

Symmetric encryption is efficient for messages and archives, but the participating services must already share or securely exchange the same secret decryption key. The scenario explicitly says the sender has no shared symmetric secret. Simply choosing a symmetric cipher does not solve initial key distribution; a trustworthy public-key or hybrid key-establishment step is what enables the sender to communicate securely.

A digital signature can authenticate the sender and expose alterations to the message, assuming proper key validation. It does not itself encrypt the message for the recipient, so an observer could still read the content. If both confidentiality and sender origin are required, signing may accompany public-key or hybrid encryption, but it is not the solution to obtaining secrecy without a pre-shared key.

A password salt is unique, nonsecret data mixed into password hashing to reduce identical verifier values and hinder reuse of precomputed attack tables. It does not establish a session key with a partner or protect an arbitrary message for a recipient. Password-storage controls are important elsewhere, but the given challenge is key establishment for two parties who do not share a secret.

Public-key encryption can keep a released update package confidential to a particular recipient, but the confidentiality operation does not prove the publisher authorized that exact binary. Anyone with the recipient's public key can encrypt data, including a malicious replacement. Software update verification needs an authenticated publisher signature over the released content and reliable trust information, not merely encrypted delivery.

Symmetric encryption hides content from parties lacking the secret key and is efficient for large files. However, customers need to verify origin and detect unauthorized modification of software, and a shared encryption key does not necessarily give them evidence of which publisher produced a particular file. Encryption may be useful for confidential deployments, but signed release artifacts address the stated authenticity and integrity requirements.

A costly password-hashing or key-derivation function slows attempts to guess stored credentials or derive keys from weak passphrases. That protects user authentication secrets rather than letting customers verify who created a downloadable software update. Even if the publisher used a strong password-derived key somewhere, the release needs a trusted digital signature so independent recipients can check its integrity and provenance.

Symmetric encryption provides confidentiality by making a message unintelligible without a secret key; depending on the mode, it may also authenticate ciphertext. The option as stated is only data encryption and does not identify a keyed integrity tag to reject forged API records. The question specifically calls for message authentication between parties that already share a secret, which an HMAC provides explicitly.

Public-key encryption or hybrid key encapsulation protects information for a recipient that possesses the corresponding private key, and it can help establish symmetric keys without a pre-shared secret. The trusted services already share the key needed for HMAC. Encryption alone does not clearly supply the required origin-and-integrity check on each API record, and asymmetric key exchange would be unnecessary complexity for this specific requirement.

A unique password salt prevents identical passwords from yielding predictable identical stored verification records when appropriately hashed. It has no role as a secret authenticity key for API messages, since salts are normally stored alongside verifier hashes and can be public. An API integrity check must combine the message with a protected authentication key, not with per-password salt values.

Encrypting every password record with one organization-wide key may help keep a database private while that key remains secret, but it does not inherently prevent two identical passwords from producing the same deterministic stored output. Key compromise could also expose the entire protected set. The specific equality-leakage problem is resolved by a distinct per-record random salt incorporated into appropriate password hashing.

A plain file checksum detects changes to a particular byte sequence, but it is not a secure password verifier and generally has no per-password salt or deliberately expensive work factor. Using it would preserve predictable equality and enable extremely fast offline guesses after a database theft. A standard file-integrity digest therefore does not address password-specific verifier storage requirements.

Account lockout or rate limiting constrains how many guesses a remote user can submit to the live sign-in service. Once attackers steal the verifier database, however, they can test candidate passwords offline without sending requests to the application. The requested weakness is identical stored hashes, so online lockouts would not conceal equal passwords or change the existing verifier values.

One unsalted SHA-256 operation is deliberately fast and deterministic, which would let attackers use GPUs to evaluate enormous candidate lists quickly. Removing the existing salts also reintroduces equal-hash leakage for equal passwords. SHA-256 is a useful general-purpose digest, but password storage requires a suitable intentionally expensive password-hashing or KDF scheme, not a single inexpensive digest computation.

Failed-login lockouts limit online attempts made through an application's authentication endpoint and can help against remote guessing. The attacker described here does not submit login requests; it already has salted verifier hashes and computes candidate matches locally. No server-side failed-login counter is incremented during those offline guesses, so increasing lockout severity will not materially raise the cost of each guessed password.

TLS encrypts a network connection and protects data in transit between an application and database service when correctly configured. That reduces interception risks but does not affect the cost of cracking verification hashes already stolen from storage. The question states the database has been exfiltrated, so changing transport protection while keeping a fast password hash leaves the attacker’s offline GPU advantage intact.