The table shows that the user "SALES1" is consistently blocked despite having met the MFA requirements.
The common factor in these blocked attempts is the source IP address (8.11.4.16) being identified as from Germany while the user is assigned to France. This discrepancy suggests that the network geolocation is being misidentified by the authentication server, causing legitimate access attempts to be blocked.
Why Network Geolocation Misidentification?
Geolocation Accuracy: Authentication systems often use IP geolocation to verify the location of access attempts. Incorrect geolocation data can lead to legitimate requests being denied if they appear to come from unexpected locations.
Security Policies: Company security policies might block access attempts from certain locations to prevent unauthorized access. If the geolocation is wrong, legitimate users can be inadvertently blocked.
Consistent Pattern: The user "SALES1" from the IP address 8.11.4.16 is always blocked, indicating a consistent issue with geolocation.
Other options do not align with the pattern observed:
A). Bypass MFA requirements: MFA is satisfied, so bypassing MFA is not the issue.
C). Administrator access policy: This is about user access, not specific administrator access.
D). OTP codes: The user has satisfied MFA, so OTP code configuration is not the issue.
References:
CompTIA SecurityX Study Guide
"Geolocation and Authentication," NIST Special Publication 800-63B
"IP Geolocation Accuracy," Cisco Documentation

Collecting operating system logs and storage disk data provides historical records of file creation, modifications, user activity, and system events. These artifacts are essential for reconstructing a detailed timeline of the attack, including the source of malicious files, initial entry, and lateral movement.

The error message"NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM" indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which often use outdated or insecure algorithms.
Why Discontinue Self-Signed Certificates?
Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards.
Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance with security standards and is less likely to be flagged as insecure.
Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.
Other options do not address the specific cause of the certificate error:
A . Rewriting legacy web functions: Does not address the certificate issue.
B . Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.
C . Blocking non-essential ports: This is unrelated to the issue of certificate validation.
Reference:
CompTIA SecurityX Study Guide
"Managing SSL/TLS Certificates," OWASP
"Best Practices for Certificate Management," NIST Special Publication 800-57

Comprehensive and Detailed Step-by-Step
Option A: Data retention
Data retention refers to how long an organization retains its data to comply with legal, regulatory, or business requirements.
The CISO's action focuses on researching compliance regulations, not on retaining data.
Option B: Data classification
Data classification deals with organizing data based on sensitivity and importance. While important, this is unrelated to researching compliance regulations.
Option C: Due diligence
Correct Answer.
Due diligence involves investigating and verifying processes, regulations, or environments to ensure compliance with laws and standards.
The CISO researching compliance regulations aligns directly with the concept of due diligence.
This concept is foundational in the CASP+ syllabus under governance and legal compliance.
Option D: Reference framework
Reference frameworks provide templates for structuring security initiatives (e.g., ISO 27001 or NIST CSF).
While a framework may aid compliance, researching compliance regulations is a due diligence activity, not a reference framework application.
Reference:
CompTIA CASP+ Study Guide (Current Edition) - Chapters on GRC and Legal Compliance.
CASP+ Objective 3.2: Integrate enterprise resilience.