SVR02 has a CVSS score of 7.1 and is exploitable, making itthe highest priority for remediation.
* SVR01 (CVSS 8.9) is not exploitable, so it is a lower risk.
* SVR03 (CVSS 3.5) is exploitablebut has alower severitythan SVR02.
* SVR04 (CVSS 6.7) is not exploitable, reducing its urgency.
Thus,B (SVR02) is the correct answer, as it presentsthe highest immediate risk.

To identify existing vulnerabilities in the web application, the best options are to contract a penetration test and create a bug bounty program. A penetration test simulates attacks against the application to uncover security flaws proactively. A bug bounty program incentivizes external security researchers to find and report vulnerabilities, expanding the testing scope without overburdening internal resources. According to CompTIA CySA+, both methods are highly effective in identifying vulnerabilities from an external perspective, particularly when internal resources are limited. Options like a WAF (A) focus more on prevention than detection, while threat modeling (F) and tabletop exercises (D) are generally proactive measures not focused on active flaw identification.

Wiresharkis apacket capture and analysis toolthat allows analysts to inspect network traffic and detectcleartext credentialssent over protocols like HTTP, FTP, and Telnet.
* Option A (OpenVAS)is avulnerability scanner, not a network analysis tool.
* Option B (Angry IP Scanner)identifiesactive hosts, but does not analyze packet contents.
* Option D (Maltego)is used forOSINT and network reconnaissance, not packet inspection.
Thus,C (Wireshark) is the correct answer, as itcaptures and analyzes network packets to identify unencrypted passwords.

APIs are designed for standardized, well-defined communication between systems. Compared to one-off scripts (which can break when outputs, formats, versions, or endpoints change), API-based integrations are typically more stable and maintainable because they use vendor-supported interfaces intended for integration and automation across tools.
Secbay Press explicitly describes why APIs are used for tool integration: they enable "seamless data sharing, workflow automation, and orchestration across the security stack," which reduces the overhead of maintaining brittle, custom script-based connections.
Exact extract (Secbay Press): "Integrate security tools and systems using APIs to enable seamless data sharing, workflow automation, and orchestration across the security stack." The Sybex Practice Tests reinforce the idea that API integration is the best choice when you need real-time or up-to-date integration between tools (another maintenance and reliability advantage over scripts/flat files):
Exact extract (Sybex Practice Tests): A SOAR integration question where real-time query capability is needed selects "API" as the best integration type.
Why the other options are not the most important reason here:
* B is unrelated to vendor-to-vendor communication.
* C can be true sometimes, but customization isn't the primary driver versus standardization and maintainability.
* D is about pipeline security; APIs can be used in CI/CD contexts, but that's not the core reason for choosing APIs over scripts for vendor tool communication.
References (CompTIA CySA+ CS0-003 documents / study guides used):
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): APIs enable seamless cross-tool integration and orchestration
* Chapple/Seidl, CompTIA CySA+ Practice Tests (CS0-003): API is the best integration type for real- time tool integration

The correct answer is D. Disconnect the access point from the network.
A rogue access point is a wireless access point that has been installed on a network without the authorization or knowledge of the network administrator. A rogue access point can pose a serious security risk, as it can allow unauthorized users to access the network, intercept network traffic, or launch attacks against the network or its devices1234.
The first action that should be taken to protect the network while preserving evidence is to disconnect the rogue access point from the network. This will prevent any further damage or compromise of the network by blocking the access point from communicating with other devices or users. Disconnecting the rogue access point will also preserve its state and configuration, which can be useful for forensic analysis and investigation.
Disconnecting the rogue access point can be done physically by unplugging it from the network port or wirelessly by disabling its radio frequency5.
The other options are not the best actions to take first, as they may not protect the network or preserve evidence effectively.
Option A is not the best action to take first, as running a packet sniffer to monitor traffic to and from the access point may not stop the rogue access point from causing harm to the network. A packet sniffer is a tool that captures and analyzes network packets, which are units of data that travel across a network. A packet sniffer can be useful for identifying and troubleshooting network problems, but it may not be able to prevent or block malicious traffic from a rogue access point. Moreover, running a packet sniffer may require additional time and resources, which could delay the response and mitigation of the incident5.
Option B is not the best action to take first, as connecting to the access point and examining its log files may not protect the network or preserve evidence. Connecting to the access point may expose the analyst's device or credentials to potential attacks or compromise by the rogue access point. Examining its log files may provide some information about the origin and activity of the rogue access point, but it may also alter or delete some evidence that could be useful for forensic analysis and investigation. Furthermore, connecting to the access point and examining its log files may not prevent or stop the rogue access point from continuing to harm the network5.
Option C is not the best action to take first, as identifying who is connected to the access point and attempting to find the attacker may not protect the network or preserve evidence. Identifying who is connected to the access point may require additional tools or techniques, such as scanning for wireless devices or analyzing network traffic, which could take time and resources away from responding and mitigating the incident.
Attempting to find the attacker may also be difficult or impossible, as the attacker may use various methods to hide their identity or location, such as encryption, spoofing, or proxy servers. Moreover, identifying who is connected to the access point and attempting to find the attacker may not prevent or stop the rogue access point from causing further damage or compromise to the network5.
References:
1 CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives
2 Cybersecurity Analyst+ - CompTIA
3 CompTIA CySA+ CS0-002 Certification Study Guide
4 CertMaster Learn for CySA+ Training - CompTIA
5 How to Protect Against Rogue Access Points on Wi-Fi - Byos
6 Wireless Access Point Protection: 5 Steps to Find Rogue Wi-Fi Networks ...
7 Rogue Access Point - Techopedia
8 Rogue access point - Wikipedia
9 What is a Rogue Access Point (Rogue AP)? - Contextual Security