Comprehensive and Detailed Explanation From Exact Extract:
Establishing two Direct Connect (or equivalent private connectivity services such as Azure ExpressRoute) connections with two different providers ensures maximum redundancy and reliability. This setup complies with high availability (HA) and fault-tolerance design best practices for regulated industries, where minimal downtime and service continuity are critical.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Hybrid Connectivity and High Availability":
"Redundant connections to cloud providers should use physically separate paths and providers to ensure fault tolerance and meet reliability requirements in hybrid cloud environments."
"Direct connections provide higher availability and consistent performance than VPNs." Other options:
* A. Peering to two VPCs does not ensure link redundancy.
* B. Combining Direct Connect with VPN offers backup but less reliability than dual Direct Connects.
* D. VPNs over the internet are lower in reliability and do not meet high availability standards required for regulated industries.

Segregating management interfaces onto their own dedicated network ensures that administrative access is isolated from general user and server traffic, greatly reducing the attack surface and preventing lateral movement if the production network is compromised.

Comprehensive and Detailed Explanation From Exact Extract:
RADIUS (Remote Authentication Dial-In User Service) is the best-fit protocol for this requirement. It supports both authentication and authorization and is widely used in Wi-Fi network environments for client device authentication using credentials stored in centralized directories such as Active Directory.
RADIUS integrates seamlessly with enterprise authentication sources and supports EAP (Extensible Authentication Protocol), making it compatible with Wi-Fi-based client devices. It also allows for role-based access control, enabling policy enforcement specific to device types (e.g., inventory scanners).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - "Authentication and Authorization Technologies":
"RADIUS provides centralized authentication, authorization, and accounting (AAA) services and is commonly used for securing wireless access in conjunction with Active Directory."
"Organizations use RADIUS to manage Wi-Fi authentication for user devices and enforce security policies during access attempts." Using a RADIUS server with 802.1X on the Wi-Fi infrastructure allows the scanners (and their users) to be authenticated against Active Directory and mapped to the correct authorization policies. TACACS+ is geared toward device management, LDAP alone doesn't handle the Wi-Fi 802.1X handshake, and PKI by itself wouldn't provide the user-to-device authorization flow needed. RADIUS gives you both authentication and authorization tied into AD.

The attacker tricked the user into revealing credentials by impersonating the help desk over the phone-an archetypal social engineering tactic.

Comprehensive and Detailed Explanation From Exact Extract:
Traffic mirroring allows a copy of network traffic - including headers and payloads - to be sent to an analysis tool or appliance for deep packet inspection. This is essential for security analysis, network troubleshooting, and performance diagnostics in cloud environments.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Packet Capture and Network Flow Monitoring":
"Traffic mirroring enables the capture of full packet data, including payloads, for forensic or performance analysis within cloud networks." Other options:
* A. Application monitoring focuses on app-level metrics, not packet inspection.
* B. Syslog is log-based, not for inspecting packets.
* D. Network flows (e.g., NetFlow, VPC flow logs) provide metadata (source, destination, size) but not full packet content.