CompTIA Updated SY0-701 Exam Questions and Answers by herbie

Containment (C)is thefirst critical stepduring a security incident tostop the spreadof the attack. This could include isolating affected systems, disabling accounts, or blocking malicious traffic.

According to theIncident Response Lifecycle, the order is typically:Identification → Containment → Eradication → Recovery → Lessons Learned.

The company should implement a certificate revocation list, or CRL. Smart-card authentication commonly relies on certificates issued to users. When employees leave, their certificates must be revoked so those credentials can no longer be trusted. A CRL is published by a certificate authority and lists certificates that should no longer be accepted before their normal expiration date. A CA issues and manages certificates, but the specific missing control is revocation checking. A TPM stores cryptographic material on a device and does not revoke user certificates. A CSR is used to request a certificate, not disable one. An HSM protects cryptographic keys, but it does not prevent former employees from using still-valid smart-card certificates.

================

The best answer is C. Use an MDM platform to manage the devices and force security configurations.

The question asks for a scalable solution to protect data on company laptops if they are stolen or lost. An MDM (Mobile Device Management) platform is the best choice because it allows centralized administration of many endpoints and can enforce security controls across all laptops, such as:

full-disk encryption requirements

screen lock policies

remote wipe capabilities

compliance checks

device configuration enforcement

This makes MDM the most scalable and manageable approach for protecting a fleet of laptops.

Why the other options are incorrect:

A. Configure the HSM for each device and store recovery keys centrally.This is not the most practical or scalable answer for standard laptops, and HSMs are not typically configured individually this way for endpoint theft prevention.

B. Implement LAPS to ensure secure password rotation for administrative accounts.LAPS helps secure local administrator passwords, but it does not directly protect data at rest on a stolen laptop.

D. Ensure that each laptop has the secure enclave properly initialized in the BIOS.Hardware-based protections can help, but this is not the best broad, centrally managed, scalable control compared with MDM-enforced policies.

From a Security+ perspective, the main protection against data loss from stolen laptops is usually centralized device management with enforced encryption and security controls, making C the best answer.

Application allow listing is the most effective technique to prevent bloatware, unauthorized software, or unnecessary applications from running on devices. Allow lists work by permitting only pre-approved, trusted applications to execute, blocking everything else by default. This is a recommended best practice in Security+ SY0-701 for reducing attack surface, preventing malware, and maintaining lean, hardened system images.

Bloatware often comes pre-installed on devices or is unintentionally installed by users. An allow list ensures only authorized applications required for business functions can run, thereby eliminating bloatware risks.

Disabling ports/protocols (A) hardens network access but does not prevent software installation. Default password changes (C) improve authentication security but are unrelated to software control. Access control permissions (D) restrict who can access what but do not prevent installation of unnecessary apps.

Thus, the correct answer is B: Application allow list.