To limit the potential impact on the log-in database in case of a breach, the security team would most likely recommend hashing. Hashing converts passwords into fixed-length strings of characters, which cannot be easily reversed to reveal the original passwords. Even if the database is breached, attackers cannot easily retrieve the actual passwords if they are properly hashed (especially with techniques like salting).
* Tokenization is used to replace sensitive data with a token, but it is more common for protecting credit card data than passwords.
* Obfuscation is the process of making data harder to interpret but is weaker than hashing for password protection.
* Segmentation helps isolate data but doesn't directly protect the contents of the login database.

The most appropriate method is to use aGroup Policy Object (GPO) with time-of-day restrictions (A). This is a native capability in Windows environments that allows administrators to controlwhen users are allowed to log into domain-joined systems.
This aligns withDomain 3.1: Given a scenario, apply identity and access management (IAM) concepts, especially under"Access controls (e.g., time-based restrictions, GPOs, least privilege)." Reference: CompTIA Security+ SY0-701 Objectives, Domain 3.1 - "Access controls: Time-based restrictions, GPO."

Comprehensive and Detailed Explanation From Exact Extract:
End-of-life (EOL) systems no longer receive security patches, vendor support, or vulnerability updates.
Because of this, they are highly susceptible to exploitation, especially if attackers can reach them over a network. When the system is business-critical and cannot be decommissioned, the most effective strategy is isolation, also known as network segmentation, air-gapping, or restrictive network zoning. Isolation removes direct exposure to external and internal threats by limiting communication paths to only essential systems and users.
According to the Security+ SY0-701 guidance, isolating legacy systems helps reduce the attack surface when patching is no longer possible. Monitoring (A) is useful for detection but does not prevent exploitation.
Decommissioning (C) would be ideal but is not possible for business-critical systems, as stated in the question. Encryption (D) protects data confidentiality but does not stop an attacker from exploiting vulnerabilities in an unpatched OS or application.
Isolation is a recommended compensating control for legacy and unsupported systems in SY0-701's Security Architecture & Resilience domain, which emphasizes micro-segmentation, firewalls, and restricted access to minimize risk when systems cannot be replaced or patched.

The attacker used a denial-of-service attack and a vishing attack. The flood of thousands of VoIP requests causes legitimate calls to drop or fail, which is an availability attack and clearly maps to denial of service. The second behavior involves tricking users over voice communications into sharing sensitive information, which is vishing. Vishing is voice-based phishing and commonly abuses trust, urgency, caller ID manipulation, or internal-looking extensions. SIP spoofing may appear related because fake internal extensions are mentioned, but the question asks for two attack types that describe the overall incident: service disruption and voice-based social engineering. On-path attacks involve interception, packet sniffing captures traffic, and supply chain attacks compromise vendors or dependencies.

Updating wire transfer processes to include verification steps (such as requiring dual approval or verifying account changes via a secondary communication method) canprevent fraudulenttransactions. Attackers often use business email compromise (BEC) or pretexting to trick employees into transferring funds to fraudulent accounts.
Standardizing security incident reportingis useful for tracking security events but does not prevent fraud in real time.
Executing regular phishing campaignsimproves awareness but does not enforce a verification process for financial transactions.
Implementing insider threat detectionfocuses on internal risks but does not specifically prevent external fraud.
Amore secure wire transfer processwith additional verification steps is the most effective measure against fraudulent transactions.