The correct answer is A. Hashes.

A hash is a fixed-length value generated from data using a hashing algorithm. Developers often publish cryptographic hashes, such as SHA-256 hashes, so users can compare the published hash with the hash of the downloaded file. If the values match, the user has assurance that the file was not altered or corrupted after the hash was generated.

This aligns with CompTIA Security+ SY0-701 topics related to integrity, cryptographic concepts, and secure software distribution.

Why the other options are incorrect:

B. Certificates

Certificates are used to verify identity, support encryption, and enable trust in public key infrastructure. They may support code signing, but simply posting a certificate is not the standard method for users to manually verify file integrity.

C. Algorithms

Algorithms define the mathematical process used for hashing or encryption, but posting an algorithm alone does not allow users to verify a specific file’s integrity.

D. Salting

Salting is commonly used with password hashing to defend against precomputed hash attacks, such as rainbow table attacks. It is not used for verifying downloaded file integrity.

Therefore, the developer should post hashes for the downloadable files.

The correct answer is A. SD-WAN.

SD-WAN, or Software-Defined Wide Area Network, allows organizations with multiple locations to manage and optimize WAN connections across different circuit types, such as MPLS, broadband, cellular, and other internet links. It can dynamically route traffic based on business rules, performance, link quality, cost, latency, or application requirements.

This aligns with CompTIA Security+ SY0-701 security architecture concepts related to network infrastructure, availability, resilience, and secure connectivity between locations.

Why the other options are incorrect:

B. UTM

Unified Threat Management provides multiple security features, such as firewalling, intrusion prevention, antivirus, and web filtering, but it does not primarily manage multiple WAN circuits based on routing criteria.

C. VPN

A VPN provides encrypted connectivity over an untrusted network, but it does not inherently optimize traffic across MPLS, broadband, 4G/5G, and dial-up links.

D. SASE

Secure Access Service Edge combines networking and cloud-delivered security services, but the best answer for leveraging multiple circuit types across locations based on specific criteria is SD-WAN.

Therefore, the best solution is SD-WAN.

A Service Level Agreement (SLA) defines the expectations between service providers and customers, including response times, escalation procedures, and performance metrics. It ensures accountability and measurable service quality.

BPA (Blanket Purchase Agreement) relates to purchasing terms, MOA (Memorandum of Agreement) outlines responsibilities but is less specific on performance, NDA (Non-Disclosure Agreement) covers confidentiality.

SLAs are key in Security Program Management for managing vendor and internal service expectations【6:Chapter 16†CompTIA Security+ Study Guide】.

An acceptable use policy, or AUP, defines how users are permitted to use organizational systems, networks, applications, internet access, email, and data. Its purpose is to establish acceptable and unacceptable behavior so employees understand what operations are allowed and what activities violate company policy. This may include rules for personal use, prohibited websites, software installation, data handling, credential sharing, and unauthorized access. A security assessment framework is related to audit or risk assessment methodology, not an AUP. Procedures for restoring resources belong to disaster recovery or incident response documentation. An agreement between a vendor and service provider is more closely related to contracts, SLAs, MOUs, or SOWs. Therefore, the AUP’s main reason is permitted system use guidance.

================

A training curriculum plan for a security awareness program should address the following factors:

The threat vectors based on the industry in which the organization operates. This will help the employees to understand the specific risks and challenges that their organization faces, and how to protect themselves and the organization from cyberattacks. For example, a healthcareorganization may face different threat vectors than a financial organization, such as ransomware, data breaches, or medical device hacking1.

The cadence and duration of training events. This will help the employees to retain the information and skills they learn, and to keep up with the changing security landscape. The training events should be frequent enough to reinforce the key concepts and behaviors, but not too long or too short to lose the attention or interest of the employees. For example, a security awareness program may include monthly newsletters, quarterly webinars, annual workshops, or periodic quizzes2.

Host isolation ensures that a device cannot communicate with other systems on the network. Isolation is typically applied through EDR/XDR tools, quarantine mechanisms, or endpoint firewalls. Security+ SY0-701 identifies host isolation as a containment technique used when:

A device is suspected of compromise

Lateral movement must be prevented

Sensitive systems must be protected

A system must be completely cut off except for administrative access

Isolation enforces an immediate block on all inbound and outbound communications, effectively making the device inaccessible to any network-based resource.

Disablement of unused services (A) reduces attack surface but does not isolate the device.

A WAF (B) protects web applications, not device access.

A network IDS (D) only monitors traffic and does not block access.

Thus, C: Host isolation is the correct answer.

The correct answer is D. NetFlow.

NetFlow records network traffic metadata, such as source IP address, destination IP address, source port, destination port, protocol, timestamps, and traffic volume. This makes it especially useful for detecting port scan activity, because port scans often show a pattern of one system attempting connections to many ports or many hosts in a short period of time.

This aligns with CompTIA Security+ SY0-701 security operations topics related to log analysis, network monitoring, and detection of suspicious traffic patterns.

Why the other options are incorrect:

A. Firewall

Firewall logs can detect some port scan activity, especially if the firewall blocks and logs connection attempts. However, NetFlow is generally better for identifying scan patterns across network traffic because it provides broader flow visibility.

B. Proxy

Proxy logs are mainly useful for web traffic analysis, URL filtering, and HTTP/HTTPS activity. They are not the best source for detecting port scans across many ports.

C. Endpoint

Endpoint logs may show local connection attempts or suspicious activity on a host, but they do not provide the same network-wide visibility as NetFlow.

Therefore, the best log source for detecting port scan activity is NetFlow.

A buffer overflow is a vulnerability that occurs when an application writes more data to a memory buffer than it can hold, causing the excess data to overwrite adjacent memory locations. A register is a small storage area in the CPU that holds temporary data or instructions. An attacker can exploit a buffer overflow to overwrite a register with a malicious address that points to a shellcode, which is a piece of code that gives the attacker control over the system. By doing so, the attacker can bypass the normal execution flow of the application and execute arbitrary commands.

A legal hold is the correct answer because the organization is preserving potentially relevant evidence after a suspected breach involving sensitive client information. In incident response and governance, legal hold prevents deletion, alteration, or routine retention-policy destruction of data that may be required for litigation, regulatory investigation, discovery, or internal investigation. Logs, server images, and email communications are exactly the kinds of records that may become evidence. Chain of custody is related but narrower: it documents who handled evidence, when, and how integrity was maintained. Root cause analysis happens later to determine why the breach occurred. Containment focuses on stopping spread or limiting damage. Here, the key action is preservation of records.

===============

Code repositories are a common source of unintentional corporate credential leakage, especially in cloud environments. Developers may accidentally commit and push sensitive information, such as API keys, passwords, and other credentials, to public or poorly secured repositories. These credentials can then be accessed by unauthorized users, leading to security breaches. Ensuring that repositories are properly secured and that sensitive data is never committed is critical for protecting against this type of leakage.

References =

CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture​.

CompTIA Security+ SY0-601 Study Guide: Chapter on Threats and Vulnerability Management​.

Detailed Explanation:

A software development life cycle (SDLC) policy outlines responsibilities, best practices, and standards for developing, deploying, and maintaining secure systems and software. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: " Policies and Standards " ​​.

Installing a host-based content filtering solution on the endpoints ensures that web traffic is filtered locally even when the VPN connection to the on-premises proxy fails, maintaining protection for remote users.

Network access control (A) manages device network access, local gateway configuration (B) does not solve protection if VPN fails, and public NAT (C) exposes internal resources and increases risk.

Endpoint filtering complements VPN for resilient web security, covered in Security Architecture and Operations【6:Chapter 11†CompTIA Security+ Study Guide】.

The best answer is A. MTBF.

MTBF (Mean Time Between Failures) is a reliability metric that measures the average time a system or component operates before failing. Since the question specifically mentions past availability incidents and asks for a value that helps choose technology while considering reliability, MTBF is the most relevant metric.

A higher MTBF generally indicates more reliable technology and helps justify investment decisions when selecting systems intended to reduce outages and improve availability.

Why the other options are incorrect:

B. RTORecovery Time Objective is the target amount of time to restore service after an outage. It is important for disaster recovery planning, but it does not directly measure reliability.

C. ALEAnnualized Loss Expectancy estimates expected yearly financial loss from a risk. It is useful for risk-based investment decisions, but the question specifically emphasizes availability incidents and reliability, which points more directly to MTBF.

D. RPORecovery Point Objective measures acceptable data loss in time. It applies to backup and recovery strategy, not system reliability.

From a Security+ standpoint, when evaluating technologies for availability and reliability, MTBF is the strongest metric among these options.

Secure Shell (SSH) is a protocol used for secure command-line access to remote systems, while Secure File Transfer Protocol (SFTP) is an extension of SSH used specifically for securely transferring files. Both SSH and SFTP ensure that data is encrypted during transmission, protecting it from interception or tampering.

References =

CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture​.

CompTIA Security+ SY0-601 Study Guide: Chapter on Secure Protocols and Encryption​.

Using a Privileged Access Management (PAM) vault to secure domain administrator credentials and enforcing role-based access control (RBAC) is the most comprehensive solution. PAM systems help manage and control access to privileged accounts, ensuring that only authorized personnel can access sensitive credentials. This approach also facilitates password rotation, auditing, and ensures that credentials are not misused or left unchanged. Integrating PAM with RBAC ensures that access is granted based on the user ' s role, further enhancing security.

References =

CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight​.

CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management​.

Input validation is most directly used to reduce prompt injection attacks against AI chatbots. Prompt injection occurs when a user enters crafted instructions designed to override, bypass, or manipulate the chatbot’s intended system instructions. By validating, filtering, constraining, and sanitizing user input, an organization can prevent malicious instructions from being interpreted as trusted commands. Model manipulation is broader and may include poisoning or adversarial techniques beyond simple input validation. Bias is mainly addressed through training data governance, testing, and model evaluation. Hallucinations are inaccurate or fabricated AI outputs, usually reduced through grounding, retrieval controls, and output verification. Therefore, for a chatbot, input validation best maps to preventing prompt injection.

================

The correct answer is Acquisition process because supply chain compromise risks originate before systems ever enter the organization’s environment. Within the Security+ SY0-701 objectives, supply chain risk management is a core element of security governance and third-party risk oversight. Reviewing the acquisition process allows an organization to evaluate how vendors are selected, how hardware integrity is validated, and what security assurances are required before purchase and delivery.

The acquisition process includes vendor due diligence, contract requirements, sourcing controls, and verification steps that ensure hardware has not been tampered with, preloaded with malicious firmware, or altered during manufacturing or transit. The SY0-701 study guide emphasizes that organizations must assess supplier trustworthiness, require secure delivery practices, and define security expectations in contracts to reduce the risk of compromised components entering the environment. If the acquisition process is weak, downstream controls become reactive rather than preventive.

Option A, sanitization procedure, applies to data destruction and system disposal, not newly acquired servers. Option C, change management, governs how modifications are introduced into existing systems and does not address risks introduced during procurement. Option D, asset tracking, helps maintain inventory visibility once assets are received but does not prevent compromised hardware from being introduced in the first place.

By reviewing and strengthening the acquisition process first, the company can implement preventive controls such as approved vendor lists, chain-of-custody requirements, hardware integrity checks, and acceptance testing. These measures align with SY0-701 principles of reducing risk at the earliest possible stage and enforcing accountability across third-party relationships.

In summary, supply chain compromise is best mitigated by addressing risks at procurement. The acquisition process is the foundational control point where organizations can limit exposure before servers are deployed into production environments.