Traffic analysis involves monitoring and inspecting network traffic flows to detect unusual patterns, such as a workstation sending large volumes of outbound SMTP (spam). This process enables identification of malware as the root cause.
B). Availability monitoring checks uptime but doesn't diagnose spam traffic.
C). Baseline metrics show normal usage but don't pinpoint infected hosts.
D). Network discovery identifies devices, not malicious traffic flows.
References (CompTIA Network+ N10-009):
Domain: Network Security - Traffic analysis, malware detection, identifying compromised hosts.

* Understanding Subnetting:
* Original Network: 192.168.1.0/24 has a subnet mask of 255.255.255.0, which allows for 256 IP addresses (including network and broadcast addresses).
* Objective: Divide this network into two equal subnets.
* Calculating Subnet Mask:
* New Subnet Mask: To divide 192.168.1.0/24 into two equal halves, we need to borrow one bit from the host portion of the address, changing the subnet mask to 255.255.255.128 (/25).
* Subnet Breakdown:
* First Subnet: 192.168.1.0/25 (192.168.1.0 - 192.168.1.127)
* Second Subnet: 192.168.1.128/25 (192.168.1.128 - 192.168.1.255)
* Verification:
* Each subnet now has 128 IP addresses (126 usable IP addresses, excluding the network and broadcast addresses).
* Comparison with Other Options:
* 255.255.0.0 (/16): Provides a much larger network, not dividing the original /24 network.
* 255.255.254.0 (/23): Also creates a larger subnet, encompassing more than the original /24 network.
* 255.255.255.0 (/24): Maintains the original subnet size, not dividing it.
References:
* CompTIA Network+ study materials on subnetting and IP addressing.

Smishing (SMS phishing) occurs when attackers send fraudulent text messages pretending to be a trusted source, tricking the victim into giving up sensitive credentials. Since this came via text message, it qualifies as smishing.
A). DNS poisoning corrupts name resolution.
B). ARP spoofing manipulates MAC-to-IP mappings.
C). Vishing is phishing via voice calls, not text.
References (CompTIA Network+ N10-009):
Domain: Network Security - Social engineering, phishing types (smishing, vishing, spear phishing).

Security Assertion Markup Language (SAML) is an XML-based standard used for exchanging authentication and authorization data between parties, particularly between an identity provider (IdP) and a service provider (SP). SAML is commonly used in Single Sign-On (SSO) solutions to pass sensitive user information, such as login credentials and attributes, securely between the identity provider and the service provider.
* SAML (Security Assertion Markup Language): Facilitates web-based authentication and authorization, allowing users to access multiple services with a single set of credentials.
* XML-based: Uses XML to encode the authentication and authorization data, ensuring secure transmission of user information.
* Identity Federation: Enables secure sharing of identity information across different security domains, making it ideal for enterprise SSO solutions.
Network References:
* CompTIA Network+ N10-007 Official Certification Guide: Covers authentication protocols, including SAML.
* Cisco Networking Academy: Provides training on identity management and federation technologies.
* Network+ Certification All-in-One Exam Guide: Explains SAML and its role in secure identity management and SSO.

A warm site is a compromise between a hot site and a cold site, providing a balance between cost and recovery time. It is partially equipped with the necessary hardware, software, and infrastructure, allowing for a quicker recovery compared to a cold site but at a lower cost than a hot site.
* Recovery Time: Warm sites can be operational within hours to a day, making them suitable for non- critical applications that can tolerate short downtimes.
* Cost-Effectiveness: Warm sites are more economical than hot sites as they do not require all systems to be fully operational at all times.
Network References:
* CompTIA Network+ N10-007 Official Certification Guide: Discusses disaster recovery strategies and the different types of recovery sites.
* Cisco Networking Academy: Provides training on disaster recovery planning and site selection.
* Network+ Certification All-in-One Exam Guide: Explains the characteristics of hot, warm, and cold sites and their use cases in disaster recovery planning.
Warm sites offer a practical solution for maintaining business continuity for non-critical applications, balancing the need for availability with cost considerations.