Last Attempt SY0-701 Questions

The best answer is D. Lock the employee ' s account to prevent further unauthorized access.

If credentials have been exposed in a phishing incident, the most urgent priority is to contain the threat by preventing attackers from using those credentials. Locking or disabling the affected account is an immediate response step that reduces the risk of unauthorized access, lateral movement, privilege abuse, or data theft.

Why the other options are incorrect:

A. Notify all employees about the phishing attack and instruct them to avoid suspicious emails.Awareness messaging may be useful later, but it does not immediately contain the compromised account.

B. Wait for confirmation from the employee before making any changes to the account.Waiting introduces unnecessary risk if the credentials are already exposed.

C. Reimage the employee ' s workstation to ensure no malware is present.Reimaging may be appropriate if malware was delivered, but the question specifically says the employee exposed credentials. The first priority is account containment.

From a Security+ incident response perspective, the immediate action after credential compromise is to disable or lock the account, making D the best answer.

ARP cache poisoning is the best answer because the affected endpoint’s traceroute shows an unexpected first hop, 10.20.10.10, with high latency before reaching the normal gateway path. The unaffected device connected to the same port reaches 10.20.10.1 as the first hop, which strongly suggests the issue is specific to the affected endpoint’s local ARP mapping rather than the switch port, router, or destination resource. ARP poisoning manipulates a host’s ARP cache so traffic is sent to the wrong MAC address, often enabling traffic interception or redirection. An on-path attack is possible as a result, but ARP cache poisoning is the specific mechanism. Resource exhaustion and DNS spoofing do not match the traceroute evidence.

Ransomware-as-a-service is a type of cybercrime where hackers sell or rent ransomware tools or services to other criminals who use them to launch attacks and extort money from victims. This is a typical example of organized crime, which is a group of criminals who work together to conduct illegal activities for profit. Organized crime is different from other types of threat actors, such as insider threats, hacktivists, or nation-states, who may have different motives, methods, or targets. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 17 1