Before deploying an application update broadly, best practice is to test it in an isolated environment to avoid breaking production systems. The All-in-One guide defines sandbox testing clearly: "a sandbox is a place where you can experiment without messing up the primary system," typically a virtualized environment, and it "entails checking out new and updated applications without putting the systems and data you depend on at risk." That directly aligns with rolling out a new application update across the organization.
Mike Meyers' Lab Manual repeats the same concept: sandbox testing uses an isolated environment and snapshots to test changes safely before production deployment. It's positioned as a documented business process within change-management best practices, reinforcing why it comes early-before impact spreads.
A backup/rollback plan is important too, but the question asks for the first step when applying a new update to everyone. Testing first helps identify compatibility issues, installation failures, and side effects early-so you don't deploy a bad update at scale. Therefore, Sandbox testing (C) is correct.

Image deployment is the fastest and most efficient method for installing operating systems on multiple machines. It involves creating a pre-configured image of an OS and deploying it across systems using tools like Windows Deployment Services (WDS) or third-party imaging solutions. This method saves time and ensures consistency across all devices.
A). Physical media is slow and not scalable.
B). Mountable ISOs are useful but still require manual installation.
C). Manual installation is time-consuming and not suitable for large-scale deployment.
Reference:
CompTIA A+ 220-1102 Objective 1.4: Given a scenario, use appropriate Microsoft operating system installation methods.
Study Guide Section: Deployment methods - image deployment, automation

Antivirus/antimalware detection depends heavily on its definitions/signatures. If those are outdated, new malware variants may not be recognized. Quentin Docter explains that the "definitions database" is a core antivirus component and that its effectiveness depends on "the frequency of updates and the comprehensiveness of the database signatures." He adds that new signatures are discovered frequently and added to the database, meaning stale definitions leave gaps.
Docter is also explicit that security software "is not perfect" and that malware may get around it, "especially a new threat (and especially if you haven't updated your definitions lately)." That statement directly matches this scenario: the software exists, but it failed to detect the infection-most likely because the detection data wasn't current.
The other answers don't fit as well: folder permissions and user permissions can limit what malware can change, but they don't explain why security software didn't detect it. Port security relates to network access control, not local signature detection. Therefore, Outdated definitions (B) is the best explanation.

The correct answer is B. Kerberos token, because Kerberos authentication relies heavily on precise system time synchronization between clients, servers, and the Key Distribution Center (KDC). Kerberos uses time- stamped tickets to prevent replay attacks, and even small time discrepancies can cause authentication failures.
According to the Quentin Docter - CompTIA A+ Complete Study Guide, Kerberos requires clocks on all participating systems to be synchronized within a narrow tolerance (typically five minutes). If system time is inaccurate, Kerberos will reject authentication requests, resulting in login failures and access denial.
The Travis Everett & Andrew Hutz - CompTIA A+ All-in-One Exam Guide explains that Kerberos tokens include timestamps to ensure tickets are valid only for a short time window. This security design protects against attackers reusing captured authentication data.
The Mike Meyers / Mark Soper Lab Manual reinforces that time synchronization issues are a common cause of Kerberos-related login problems in domain environments. Services like TACACS+, RADIUS, and WPA do not depend on strict system time synchronization in the same way Kerberos does.
Because Kerberos authentication cannot function correctly without accurate system time, B is the correct answer.

Carbon fiber filamentcan producefine particles or fumesduring printing, which may be harmful when inhaled.
Wearing anair filter maskis essential to protect the respiratory system.
FromQuentin Docter - CompTIA A+ Complete Study Guide:
"When working with advanced materials like carbon fiber, always use appropriate personal protective equipment such as air filter masks to prevent inhalation of dangerous particles."