A site survey is the formal assessment used to determine the optimal number and placement of wireless access points (APs). According to Security+ SY0-701, wireless site surveys evaluate factors such as building layout, RF interference, wall material density, antenna propagation, and signal overlap. The goal is to ensure full wireless coverage while minimizing the number of APs needed, maximizing performance, and reducing dead zones.
During a site survey, technicians analyze:
Signal strength patterns
Interference sources (microwaves, metal shelving, wiring, etc.)
Required coverage zones
Capacity needs (number of users, devices)
Although heat maps (C) visually represent wireless signal distribution, they are a result of a site survey, not the process itself. WPA3 (B) is a security protocol unrelated to determining coverage. A signal locator (A) is not an enterprise-grade planning tool.
Therefore, the correct answer is D: Site survey.

The best technical defense is to deploy more secure email gateways and block emails from unknown or suspicious domains. The scenario specifically states that payroll fraud occurred because of phishing attacks, which commonly arrive through email and attempt to impersonate trusted parties, harvest credentials, or initiate fraudulent payment activity. Secure email gateways can inspect sender reputation, domains, attachments, links, headers, and suspicious message patterns before users receive the emails. Internal phishing campaigns and training are valuable, but they are administrative awareness controls, not technical defenses.
EDR is useful for endpoint detection, but it does not primarily stop phishing emails before delivery. Browser patching and DNS block lists help reduce web-based risk, but email gateway filtering is the most direct technical control for phishing-based payroll fraud.

Detailed Explanation:Mean Time to Repair (MTTR) is a key metric in risk management, reflecting the time required to repair a failed component, such as a generator, and restore operations. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Business Continuity Metrics".

To identify the exactcommand or input usedduring a SQL injection attack, theapplication log (B)is the most relevant. It records inputs, errors, and processing activities within the application layer.
UnderDomain 2.1, CompTIA emphasizes reviewingapplication logsto detect indicators of malicious activity, includingweb application attackslike SQL injection.
Reference: CompTIA Security+ SY0-701 Objectives, Domain 2.1 - "Indicators of malicious activity: SQL injection; review application logs."

The best answer is C. Execute the file in a sandbox.
Antivirus alone may miss new, obfuscated, or modified malware, including ransomware. A sandbox provides an isolated environment where the file can be safely executed and observed for malicious behavior such as:
file encryption activity
process spawning
registry changes
network callbacks
persistence attempts
Why the other options are incorrect:
A). Review the file in a code editor.Many malicious files are compiled, packed, or obfuscated, so this is not a reliable analysis method.
B). Monitor the file connections with netstat -ano.This only shows network connections and would not fully reveal ransomware behavior.
D). Retrieve the file hash and check with OSINT.This helps only if the malware is already known. New variants may not match existing threat intelligence.
From a SY0-701 perspective, dynamic analysis in a sandbox is the strongest step for safely identifying malicious file behavior.