Within an organization's Software Development Life Cycle (SDLC), an Information Security Policy is a vital component. It outlines the rules and procedures for ensuring that the organization's IT assets and data are protected throughout the development process. Ensuring secure coding practices, access controls, and regular security testing is fundamental in preventing vulnerabilities in applications.
Other options like service-level agreements and branch protection requirements are less likely to be integral to SDLC processes. Penetration testing methodology, while useful, is generally considered outside the scope of the SDLC.

Infrastructure as Code (IaC) enables organizations to automate the provisioning, configuration, and deployment of servers through machine-readable scripts rather than manual processes. SY0-701 emphasizes IaC as a key component of DevOps and secure deployment pipelines. By using IaC, server builds become repeatable, standardized, version-controlled, and much faster.
This directly addresses the company's goals:
Better control: IaC ensures predictable, consistent configuration across all servers.
Standardization: Scripts eliminate drift by applying identical configurations.
Lower build time: Automation significantly accelerates server creation and eliminates manual intervention.
IoT (A) refers to Internet-connected smart devices and is unrelated to server deployment. PaaS (C) offers development platforms but does not automate infrastructure builds. ICS (D) refers to industrial control systems, not IT server architecture.
Therefore, the only correct architecture that meets all objectives is IaC, a foundational technology for modern automated infrastructure.

Recovery Time Objective (RTO)defines themaximum acceptable downtimebefore business operationsmust be restored. It helps organizations set expectations for recovery speed and prioritize system restoration accordingly.
A (likelihood of an incident and cost)relates to risk assessment, not RTO.
B (roles and responsibilities)falls underincident response planning, not RTO.
C (state of restored systems)is covered byRecovery Point Objective (RPO), not RTO.
Reference:CompTIA Security+ SY0-701 Official Study Guide, Security Program Management and Oversight domain.