Federation is an access management concept that allows users to authenticate once and access multiple resources or services across different domains or organizations. Federation relies on a trusted third party that stores the user's credentials and provides them to the requested resources or services without exposing them.
Password complexity is a security measure that requires users to create passwords that meet certain criteria, such as length, character types, and uniqueness. Password complexity can help prevent brute-force attacks, password guessing, and credential stuffing by making passwords harder to crack or guess. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 308-309 and 312-
313 1

The vulnerability should be documented in the risk register because it represents an identified risk that cannot be immediately remediated. A risk register tracks risk details such as description, owner, likelihood, impact, severity, mitigation strategy, acceptance status, review dates, and residual risk.
Since the developers cannot patch the issue for six months, the organization needs formal visibility and accountability until remediation is possible. A patching schedule may track when updates are planned, but it does not fully document risk ownership and business impact. A vulnerability matrix may help prioritize technical findings, but it is not the central governance record. Change management procedures control changes, not long-term risk tracking.

A full inventory of all hardware and software is essential for measuring the overall risk to an organization when a new vulnerability is disclosed, because it allows the security analyst to identify which systems are affected by the vulnerability and prioritize the remediation efforts. Without a full inventory, the security analyst may miss some vulnerable systems or waste time and resources on irrelevant ones. Documentation of system classifications, a list of system owners and their departments, and third-party risk assessment documentation are all useful for risk management, but they are not sufficient to measure the impact of a new vulnerability. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 1221; Risk Assessment and Analysis Methods: Qualitative and Quantitative3

To analyze malware behavior in detail, the best approach is toexecute the malware in a sandbox (D) andcapture its network activity. This providesreal-time analysisof how the malware behaves, spreads, and communicates.
This method is highlighted inDomain 2.1under"Analyzing indicators of compromise"and usingsandboxing and packet captureto study malware.
Reference: CompTIA Security+ SY0-701 Objectives, Domain 2.1 - "Indicators of malicious activity: Perform packet captures; sandboxing for malware analysis."

Salting is a technique used to enhance the security of hashed passwords by adding a unique, random value (salt) to each password before hashing it. This prevents attackers from easily decrypting passwords using rainbow tables, which are precomputed tables for reversing cryptographic hash functions. Since each password has a unique salt, the same password will produce different hash values, making rainbow table attacks ineffective.
References =
* CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations.
* CompTIA Security+ SY0-601 Study Guide: Chapter on Cryptography and Hashing Techniques.