SY0-701

Of the actors listed, organized crime groups are the ones that work for money and have the resources and skills to carry out sophisticated attacks, so a foreign government can hire them as proxies to attack critical systems in other countries. Hacktivists are motivated by ideology and choose their own targets rather than working for hire. Whistleblowers are insiders exposing wrongdoing, and unskilled attackers lack the capability needed against critical infrastructure.

Salting adds a random value to the input, such as a password, before it is hashed, so identical inputs produce different hashes and precomputed rainbow tables stop working. Key stretching runs the hash many times to slow brute-force attempts, but the extra random input itself is the salt. Data masking hides data from view, and steganography hides data inside other files; neither is used with hashing.

The employee received an email with a link to a fake site that collected their login credentials, then showed an error once the credentials were captured. That is phishing: a fraudulent email that tricks the recipient into revealing sensitive information. Brand impersonation and typosquatting can be techniques used inside a phishing campaign, but the question gives no detail about a look-alike domain, and pretexting relies on an invented scenario delivered through direct interaction.

Each rule lists the source first and the destination second, and the firewall evaluates rules from the top. Option D first permits DNS (port 53) from the single host 10.50.10.25/32 to any destination, then denies DNS from every other source. Options A and C permit all DNS traffic in their first rule, so the deny that follows never takes effect, and option B uses 10.50.10.25 as the destination instead of the source.

Single sign-on (SSO) lets employees use one set of credentials, here their domain credentials, to access many applications, including SaaS applications federated with the company's identity provider. MFA adds more authentication factors but does not reduce the number of credentials. LEAP and PEAP are EAP methods for wireless network authentication, not SaaS sign-in.

Business email compromise impersonates a trusted leader, such as an executive, to trick an employee into sending money or making purchases, and urgent requests for gift cards or wire transfers are its typical form. Putting the executive's name in the display field is a common spoofing technique in these attacks. Demanding payment to unlock files describes ransomware. A fake email portal used to harvest credentials is credential phishing, and a request for administrator credentials is likewise aimed at stealing credentials rather than the direct financial fraud that characterizes BEC.

A jump server (jump box) is a hardened host placed between network segments; administrators connect to it and then reach the restricted servers from there, so access can be controlled and monitored at one point. RADIUS provides centralized authentication but does not provide a path into the segment. An HSM stores and manages cryptographic keys, and a load balancer spreads traffic across servers.

A web application firewall inspects HTTP and HTTPS traffic to a web application and blocks exploit attempts aimed at the application, such as malformed or oversized input used to trigger a buffer overflow. An NGFW focuses on network and application identification across all traffic and is less specialized for web application exploits. TLS encrypts traffic but does nothing to stop malicious input, and SD-WAN manages WAN connectivity.

Multifactor authentication stops this attack because a stolen or guessed password alone is no longer enough to sign in; the attacker would also need the second factor. Resetting passwords only fixes the current compromise. Password complexity makes guessing harder but does not help once a password is phished or reused, and permissions assignment and access management control what an account can do after sign-in, not whether the attacker can sign in.

The attacker pretends to be the payroll department, which is impersonation, and delivers the lure by text message, which is smishing (SMS phishing). Smishing is the more specific term for phishing over text, so it is the better answer than generic phishing. Vishing uses voice calls, typosquatting relies on misspelled domains, and misinformation is spreading false information rather than requesting credentials.

This is a smishing attempt using CEO impersonation and a gift-card request. The best responses are to warn all employees now with a general email so nobody acts on the message, and to add smishing to security awareness training so staff recognize it in the future. Cancelling gift cards, changing the CEO's number or examining the CEO's phone do not help, because the attacker never used the CEO's real phone, and mobile device management does not control texts sent from outside numbers.

Counterfeit hardware enters through the supply chain, so a thorough supply chain analysis, verifying manufacturers, authorized distributors and the provenance of components, best addresses the risk before purchase. A right-to-audit clause lets the company inspect a vendor afterwards but does not by itself ensure genuine parts. An acquisition policy states intent without verifying sources, and penetration testing suppliers tests their networks, not the authenticity of the hardware they ship.

The rules of engagement define the terms of a penetration test: scope, targets, permitted techniques, timing, contacts and how findings are handled. A right-to-audit clause gives a customer the right to audit a vendor, supply chain analysis evaluates suppliers, and due diligence is the assessment of a party before entering an agreement.

Port and service scans send traffic directly to the target systems, which makes them active reconnaissance. Passive reconnaissance gathers information without interacting with the target, for example from public records or OSINT. Defensive and offensive are not reconnaissance types.

A disaster recovery plan (DRP) documents how an organization restores systems, data and services after a failure, including roles, priorities and restore procedures. An incident response plan (IRP) covers detecting and handling security incidents, the recovery point objective (RPO) is only a target for acceptable data loss used within the DRP, and the SDLC governs software development.

Side loading is installing applications from outside the manufacturer's approved app store or repository, which bypasses the vendor's vetting and can introduce malware. Jailbreaking removes operating system restrictions and often enables side loading, but it is not itself the act of installing outside the store. Memory injection and resource reuse are unrelated vulnerabilities.

The log shows one common password, Spring2023, being tried against many different usernames within a few seconds, which is the pattern of password spraying: a single likely password is tried across many accounts to avoid per-account lockout. A brute-force attack would instead try many passwords against the same account. Pass-the-hash reuses a captured password hash rather than submitting a plaintext password, and account forgery is not a login attack pattern shown here.

In the CompTIA Security+ Zero Trust model, the data plane covers the subject or system requesting access, the implicit trust zones it moves through, and the policy enforcement point, so evaluating the subject's role relates to the data plane. Adaptive identity and threat scope reduction are listed under the control plane, along with policy-driven access control, the policy engine and the policy administrator, which make the access decisions rather than carry the traffic.

A jump server is a hardened host that administrators must connect to first before they can reach internal systems, adding a controlled, monitored layer between users and internal resources. A proxy server mainly brokers and filters client web traffic rather than gating administrative access to internal hosts. An RDP server exposes remote desktop access itself, and a hypervisor hosts virtual machines; neither adds an access-control layer in front of internal resources.

Unencrypted websites are served over plain HTTP, so their URLs begin with the scheme http://, and blocking that string denies access to non-encrypted sites while leaving https:// URLs untouched. Port 443 is the HTTPS port, so blocking :443 would block encrypted traffic instead. encryption=off is not a standard URL component, and www.*.com would match encrypted and unencrypted sites alike.