CompTIA Security+ Domain 4: Security Operations

A security template or GPO derived from an established benchmark codifies the approved settings and enforces them uniformly across every joined host.

• AManual per-host configuration is error prone and does not guarantee consistency at scale, defeating the purpose of a uniform baseline.
• CScanning finds missing patches and flaws but does not define or push the approved configuration settings that a baseline requires.
• DDefault vendor settings are exactly what hardening replaces; firewalls alone do not enforce the registry and service baseline needed here.

Purging via a certified overwrite or cryptographic erase removes recoverable data while preserving the media for sanctioned internal reuse.

• AShredding destroys the media, contradicting the requirement to reuse the drives internally for the lower-sensitivity test lab.
• BReformatting and deleting partitions leaves recoverable data, an inadequate sanitization method for regulated information being repurposed.
• DEncrypting in place still leaves the original keys and protected data accessible, so it does not sanitize the asset before reuse.

Attack Vector specifies the proximity an attacker needs, ranging from remote network access down to physical access to the component.

• BThat definition matches the User Interaction metric, not Attack Vector, which describes the exploitation path rather than victim involvement.
• CThose are the separate impact sub-metrics; Attack Vector measures how the flaw is reached, not the resulting damage.
• DThat describes the Privileges Required metric; Attack Vector instead captures the network proximity of the exploitation path.

A SIEM centralizes, normalizes, and correlates logs from disparate sources, surfacing coordinated patterns like distributed failed logins in one place.

• ASNMP traps push individual device alerts but do not aggregate or correlate events from multiple sources into one investigative view.
• BMore verbose logs add data but still leave events scattered across separate consoles, worsening rather than solving the visibility gap.
• CNetFlow records traffic flows for bandwidth and connection analysis, not the cross-source authentication-event correlation the analyst actually needs.

DLP classifies content and enforces rules that detect and block sensitive data like SSNs from leaving through email, web, or endpoints.

• AEDR focuses on detecting and responding to malicious process behavior, not inspecting outbound content for sensitive data patterns being exfiltrated.
• CAn IPS blocks attack signatures and exploit traffic, but it does not understand or stop policy-violating transfers of sensitive business data.
• DWeb filtering governs which sites users may reach; it does not inspect message contents to prevent regulated data from being sent out.

Federation establishes trust between an identity provider and an external service provider so authentication assertions cross organizational boundaries, exactly as described.

• BPAM controls and audits elevated administrative access; it does not establish cross-organization identity assertions to an external SaaS provider.
• CMFA strengthens how a single login is verified, but it does not describe trust relationships between separate identity and service providers.
• DABAC decides authorization from attributes after login; it does not handle the cross-domain authentication assertion the scenario requires.

Orchestrated playbooks execute predefined steps the same way every time, cutting response time and the human mistakes that come from manual repetition.

• AAutomation augments analysts by handling routine work; skilled staff are still required to tune playbooks and handle complex judgment calls.
• BPlaybooks act on the alerts they receive; they cannot guarantee elimination of false positives, which stem from detection logic upstream.
• DAutomated actions should be logged for accountability and review; orchestration does not remove auditing needs and typically improves traceability.

Containment immediately follows analysis; isolating infected hosts halts lateral movement and limits damage before eradication and recovery begin.

• ALessons learned is the final phase and is premature while the incident is still actively spreading and causing damage to systems.
• BRecovery via restoration comes after containment and eradication; restoring now risks reinfection because the threat is still active in the environment.
• CEradication and rebuilding follow containment; rebuilding now wastes effort while lateral movement continues to compromise additional hosts.

A full packet capture preserves complete frames including headers and payload, letting the investigator reconstruct and examine the exact transmitted contents.

• AFirewall logs record connection metadata and verdicts but omit the actual payload bytes the investigator needs to inspect the contents.
• CNetFlow aggregates flow statistics like bytes and timing but discards payload, so it cannot reveal the byte-level contents being examined.
• DDNS logs show name-resolution requests, useful for context, yet they contain none of the actual data payload exchanged over the connection.

CIS Benchmarks are vendor-neutral, consensus hardening standards that Group Policy can enforce fleet-wide and that scanners can later measure for compliance, satisfying every stated requirement.

• AManufacturer images ship with broad compatibility settings, trial software, and open features that are not hardened, so they do not constitute a measured, compliance-ready secure baseline.
• BPatching closes known vulnerabilities but does not configure services, permissions, ciphers, or audit policy, so updates alone leave dozens of hardening controls unaddressed in the baseline.
• DTurning off the host firewall removes a core protective control and widens the attack surface, which is the opposite of hardening and weakens rather than establishes a secure baseline.

Cryptographic erase discards the drive encryption key so all stored ciphertext becomes unreadable instantly, which sanitizes self-encrypting SSDs reliably while keeping the hardware intact for reuse.

• ADegaussing erases magnetic platters but SSDs store data in flash cells, so a magnetic field does nothing useful and leaves the sensitive data fully recoverable on the chips.
• CWear-leveling and over-provisioning on SSDs remap blocks, so a single overwrite pass cannot reach every cell and leaves residual sensitive data in reserve areas.
• DPhysical destruction does sanitize media but it ruins the hardware, directly contradicting the requirement to preserve these specific drives for continued internal reuse.

The scanner flagged a present package, but validation confirmed the threat is not exploitable in this environment, so it is treated as a false positive after analyst confirmation.

• AA zero-day is an unpatched flaw with no fix available, whereas here the component is merely present and already neutralized by configuration, so the label does not apply at all.
• BValidation here proved the opposite: the service is disabled and the port blocked, so no working exploitation path exists in the current configuration despite the high base score.
• CResponsible disclosure applies when you discover a new flaw and notify a vendor privately, not when you triage a known catalog finding that scanned your own assets.

NetFlow summarizes source, destination, ports, bytes, and direction per conversation without payloads, making it the efficient choice to confirm steady beaconing volume and direction overnight.

• BFull capture stores entire payloads and consumes large amounts of storage, which directly violates the requirement to avoid capturing payload content while confirming connection patterns.
• CSNMP interface counters report aggregate throughput per port but cannot attribute traffic to a specific external IP or conversation, so they cannot confirm this particular beaconing pattern.
• DGeneric syslog may note service events but typically lacks per-flow byte and direction detail for outbound connections, so it cannot reliably confirm the volume of beaconing traffic.

DMARC builds on SPF and DKIM alignment, and a p=reject policy tells receivers to discard failing spoofed mail while the rua tag delivers the requested aggregate reports.

• AAdding another SPF include only lists more authorized senders; it does not tell receivers what to do with failures or provide any reporting back to the domain owner.
• BRotating the DKIM key is good hygiene but does not instruct receivers to reject failing mail, nor does it generate the aggregate reports the team specifically wants.
• DAn additional MX record only designates an alternate inbound mail server for delivery and has no effect on authenticating senders or rejecting spoofed outbound phishing.

OAuth 2.0 issues scoped access tokens so a third-party service can act on a user's behalf for limited resources without the user ever revealing their password.

• ASAML carries authentication assertions for browser-based single sign-on between identity and service providers, but it is not designed to delegate scoped resource access to a third-party app.
• CRADIUS centralizes authentication, authorization, and accounting for network access like VPN or wireless, which is unrelated to delegating application data access to a web third party.
• DKerberos grants tickets for authenticating to services inside a trusted domain and does not provide the scoped, user-consented delegation to external third-party services that OAuth offers.

A SOAR playbook orchestrates the reputation lookup, detonation, and quarantine into one automated, documented, repeatable workflow, directly reducing repetitive effort and accelerating consistent phishing response.

• AA correlation rule can raise or refine alerts, but it does not perform the lookup, detonation, and quarantine actions, so analysts still do the repetitive manual response work.
• BMore EDR coverage strengthens endpoint detection but does nothing to automate the recurring email triage workflow, leaving the manual, repetitive phishing response steps fully in place.
• CRotating more analysts through the same manual steps increases labor instead of reducing it and provides no automation or speed improvement, which is the stated goal here.

After containment stops the spread, eradication removes the malicious files, accounts, and persistence so the threat is fully eliminated before recovery restores systems to normal operation.

• BContainment is already complete because the hosts are isolated and the team verified the malware is no longer spreading, so repeating it is not the next process phase.
• CPreparation occurs before an incident to build tooling and playbooks, so it cannot be the next step in the middle of an active ransomware response after containment.
• DLessons learned is the final phase performed after recovery, so jumping to it now would skip the required eradication and recovery work still ahead in this incident.

Object access auditing on the file server records the account, the specific files opened, the action performed, and the timestamps, giving the most direct evidence of file activity.

• ANetFlow shows connection metadata like addresses, ports, and byte counts but cannot reveal which individual files a user account opened or the timestamps of those file operations.
• BFirewall logs record allowed and blocked connections at the network boundary, providing no visibility into specific file objects accessed by a user account on an internal server.
• DDNS logs capture name resolution requests and can hint at destinations, but they contain no information about which files a user opened on a server or when.

Corporate-owned, personally enabled devices are owned by the company yet permit personal use, letting security enforce encryption, push managed apps, and remotely wipe the entire device.

• ABring-your-own-device means the worker owns the hardware, so the company cannot mandate a full-device wipe or total control without overstepping onto personally owned property.
• CChoose-your-own-device centers on letting staff pick hardware from an approved catalog, which addresses selection rather than the ownership and personal-use balance this scenario specifically requires.
• DCorporate-owned, business-only locks the device strictly to work functions and forbids personal activity entirely, directly contradicting the requirement to allow employees limited personal use.

A certificate of destruction from the vendor lists the serial numbers destroyed and the method used, giving auditors documented proof that each specific drive was sanitized as required.

• AAn asset inventory list records which hardware the organization owns and its current status, but it does not certify that any specific drive was actually physically destroyed by the vendor.
• BA chain-of-custody form tracks who handled the media during each transfer, yet on its own it documents possession and movement rather than confirming the final destruction of each drive.
• DA records retention schedule defines how long data must be kept before disposal, but it provides no evidence that the physical destruction of these particular drives ever actually occurred.

Common Weakness Enumeration catalogs categories of software weakness types such as improper input validation, which apply broadly across many products rather than to one specific vulnerable instance.

• BCommon Vulnerabilities and Exposures assigns an identifier to a single confirmed flaw in a specific product version, not to a reusable class of weakness affecting many different products.
• CCVSS produces a numeric severity score for a vulnerability's characteristics, but it is a scoring system and does not catalog or name the underlying weakness type at all.
• DCommon Platform Enumeration provides a standardized naming scheme for hardware, operating systems, and applications, identifying products themselves rather than describing the class of weakness that affects them.

An installed agent collects configuration and telemetry locally on each endpoint even while disconnected, then reports its queued results once the device reconnects, providing the continuous compliance visibility required.

• AAgentless remote scanning depends on reaching each host over the network at scan time, so it cannot continuously assess laptops that frequently roam offline or sit unreachable for long periods.
• BSNMP trap polling gathers device health and interface metrics mainly from network gear, but it does not collect the detailed operating-system configuration compliance data this scenario requires from endpoints.
• CPort mirroring copies network traffic passing an interface for inspection, which reveals communications in transit rather than the on-host configuration state the team needs to monitor continuously.

Network Access Control authenticates each connecting device and evaluates its security posture, admitting compliant systems while redirecting noncompliant ones into a remediation VLAN exactly as the scenario describes.

• AA next-generation firewall inspects and filters traffic at network boundaries using application awareness, but it does not authenticate endpoints or evaluate their health posture before granting LAN access.
• CA web application firewall filters HTTP requests to protect web applications from attacks like injection, which is unrelated to admitting, checking, or quarantining devices joining the wired network.
• DA SIEM aggregates and correlates log events for detection and investigation, but it analyzes data after the fact and cannot enforce admission decisions at the moment a device connects.

A memorized password is a knowledge factor and a hardware token the user physically carries is a possession factor, so the login now combines something-you-know with something-you-have.

• ATreating both the password and the hardware token as knowledge factors is wrong, because a token the user physically possesses is a possession factor, not something merely memorized and recalled.
• BLabeling these as inherence and location factors is incorrect, since neither a typed password nor a one-time hardware token measures a biometric trait or the user's geographic position.
• DCalling this possession plus location is wrong because, although the token is indeed a possession factor, the password is knowledge and no geographic or location signal is being evaluated here.

Embedding automated security gates in the CI/CD pipeline runs dependency and code scans on each commit and fails the build automatically, blocking vulnerable merges without any manual gatekeeping.

• BA quarterly manual code review happens only periodically and relies on human reviewers, so it cannot automatically inspect every individual commit or block merges at the moment they are proposed.
• CProduction hotfix patching addresses flaws reactively after code is already deployed, which does the opposite of preventing vulnerable dependencies from entering the codebase before the merge happens.
• DA static firewall ruleset filters network traffic and has no awareness of source-code commits or software dependencies, so it cannot evaluate or block insecure merges within the build process.

Memory and cache contents are the most volatile evidence because they vanish the moment the system loses power, so the order of volatility requires capturing RAM before any persistent storage.

• AOffline backup tapes are among the least volatile evidence and persist for long periods, so the order of volatility says they should be collected last, not first, during a live acquisition.
• BFiles on the local disk remain after power loss and are far more persistent than memory, so volatility ordering places disk acquisition after the most fragile in-memory data is captured.
• CLogs stored on a remote server are written to persistent storage and survive a reboot, making them a lower priority than volatile memory under the order-of-volatility principle for collection.

Firewall logs record each connection attempt along with the allow or deny action the device took, directly confirming whether the host reached the blocked command-and-control IP address.

• ANetFlow records summarize connection metadata like addresses, ports, and byte counts, but they do not record whether a perimeter device actually permitted or denied each individual connection attempt.
• CA vulnerability scan report enumerates missing patches and misconfigurations on hosts, but it captures no record of actual connection attempts or the perimeter device's allow and deny decisions.
• DDNS resolver logs show which domain names a host attempted to resolve, providing useful context, yet they do not contain the firewall's allow or deny verdicts for those connections.

Network segmentation with allowlist firewall rules is the standard compensating control for resource-constrained RTOS devices that cannot be hardened using host-based agents.

• AEmbedded controllers with limited memory cannot host an EDR agent; assuming every device can run endpoint software ignores the stated RTOS resource constraints.
• CAuthenticated scanning can crash fragile RTOS stacks and only finds issues; it does not harden the device, misreading scanning as a hardening control here.
• DManual daily password rotation is operationally impractical for plant-floor controllers and ignores the memory limit, mistaking password churn for meaningful embedded-device hardening.

Enumerating the devices and recording an accountable owner directly closes the inventory and ownership gap that the audit identified for the untracked laptops.

• ASanitizing drives addresses disposal, not the missing inventory record; this confuses end-of-life data destruction with establishing ownership and tracking of active assets.
• BApplying a baseline image hardens configuration but does not record who owns each device, mistaking hardening for the asset enumeration and accountability that is missing.
• DPushing a remote-wipe policy is a control action, not inventory; it ignores that the core gap is the absent ownership and tracking record itself.

Static application security testing inspects source code without executing it, detecting insecure patterns like SQL injection exactly as the requirement specifies before the build.

• ADAST tests a running application from the outside and cannot inspect source code, so it does not meet the requirement to analyze code before execution.
• BFuzzing exercises a live endpoint with malformed input at runtime, which conflicts with the stated need to inspect source before the build is executed.
• CSoftware composition analysis flags known vulnerabilities in third-party packages, not custom insecure coding patterns, so it misses the in-house SQL injection logic described.

Tuning the correlation rule to exclude the known backup window suppresses the predictable benign alerts so genuine alerts surface, which is precisely alert tuning.

• BIncreasing retention archives more events but does nothing to stop the benign backup job from generating alerts, confusing storage capacity with alert noise reduction.
• CDeploying more agents increases telemetry and likely more alerts; adding collection where the issue is rule sensitivity worsens noise rather than tuning it out.
• DForwarding every alert to a provider outsources triage without fixing the noisy rule, so the underlying false-positive condition and analyst fatigue persist unaddressed.

An SPF record lists hosts authorized to send for the domain, letting receivers reject messages from unlisted servers, a core sender-authentication mechanism in this scenario.

DKIM signs outbound messages with a domain key so receivers can cryptographically verify message origin and integrity, directly supporting the sender authentication requested.

A DMARC policy tells receiving servers how to handle SPF and DKIM failures and provides reporting, completing the authentication and failure-handling requirement described.

• DOpening an SMTP port 25 relay to external hosts creates an open relay abused for spam; it weakens security and provides no sender authentication whatsoever.

Just-in-time access through a privileged access manager grants elevation only for the active window and revokes it automatically, eliminating always-on administrator accounts as required.

• ADiscretionary access control lets resource owners grant rights but does not automatically time-box or revoke elevation, leaving the standing administrator privilege the design seeks to remove.
• CSingle sign-on federates authentication for convenience but does not constrain how long elevated rights persist, confusing streamlined login with reducing standing privilege.
• DRole-based access control assigns persistent roles by job title, which keeps standing administrative privilege in place rather than granting temporary elevation on demand.

Routing all critical workflows through one non-redundant platform makes it a single point of failure whose outage would halt provisioning and service operations across the organization.

• AReduced reaction time is a benefit of automation, not the risk this centralized design raises, so it misreads an advantage as the relevant consideration.
• BCentralizing every workflow through one platform tends to raise, not lower, complexity, and framing it as reduced complexity ignores the redundancy concern entirely.
• CAutomation does not by itself eliminate technical debt and can accumulate it; treating debt removal as the outcome misses the availability risk of one platform.

Maintaining a documented chain of custody records every handler and preserves integrity, which is what proves the disk images were unaltered and admissible in court.

• BA legal hold preserves data from deletion but does not track who handled evidence or prove it was unaltered, addressing retention rather than the integrity proof required.
• CA lessons-learned review improves future response after recovery and has nothing to do with proving evidence integrity or documenting handlers for court proceedings.
• DThreat hunting proactively searches for undetected adversary activity and does not document evidence handling, so it fails to provide the admissibility proof this scenario needs.

A full packet capture preserves the complete payloads of the session, letting the analyst inspect the actual content that left the network to confirm exfiltration.

• ANetFlow records summarize connection metadata and volume but contain no payload, so they cannot confirm exactly what data content left the network during exfiltration.
• BFirewall connection logs show allowed and denied tuples without payload content, so they reveal that traffic occurred but not the actual data that was transferred.
• DThe endpoint authentication log records logins and logoffs, not transferred data, so it cannot reveal the content of the suspected exfiltration the analyst must confirm.