Web-filtering effectiveness heavily relies on content categorization to correctly identify and block access to malicious or inappropriate websites. If users are still visiting malicious links, it is likely that the categorization database or configuration needs updating or correction.
Intrusion prevention systems (A) protect against network attacks but do not filter web content by category.
Encryption (C) is unrelated to web filtering, and DNS services (D) assist with domain resolution but do not directly categorize content.
Proper configuration and maintenance of content categorization are essential to effective web filtering, as emphasized in the Security Operations domain of SY0-701#6:Chapter 12†CompTIA Security+ Study Guide#.

An air gap is the practice of physically isolating a secure network from any external or unsecured networks, effectively preventing any external communication or data leakage. It is the strongest method to prevent data exfiltration in sensitive environments.
Containerization (B) and virtualization (C) are technologies for isolating applications or systems logically but do not guarantee physical separation. Decentralization (D) distributes resources but doesn't prevent data leakage.
Air gaps are critical in highly secure environments and covered under Resilience and Physical Security in SY0-701#6:Chapter 9†CompTIA Security+ Study Guide#.

A tabletop exercise is a simulation-based activity where incident response team members and relevant stakeholders walk through a hypothetical security incident in a discussion-based format. This exercise helps validate response plans, roles, and communication channels without actual system disruption.
Lessons learned (A) is a post-incident review, digital forensics (B) is evidence collection after an incident, and root cause analysis (D) investigates the underlying cause after an event.
Tabletop exercises are standard practices within the Security Operations domain to prepare teams for real incidents#6:Chapter 14†CompTIA Security+ Study Guide#.

Comprehensive and Detailed In-Depth Explanation:
User awareness training is essential in preventing security incidents caused by human error, such as clicking on malicious links. Employees need to be educated on recognizing phishing attempts, verifying email senders, and avoiding suspicious downloads.
* Network monitoringdetects and alerts on malicious activity but does not prevent employees from clicking on harmful links.
* Endpoint protectioncan mitigate malware infections but is not foolproof, especially if users continue to fall for phishing attacks.
* Data loss prevention (DLP)can prevent data exfiltration but does not stop malware from being introduced into the system.
By training employees to recognize and avoid phishing scams, organizations canreduce the risk of malware infections and data breaches.

Cryptojacking is the likely cause in this scenario. It involves malware that hijacks the resources of infected computers to mine cryptocurrency, usually without the user's knowledge. This type of attack doesn't typically degrade performance significantly or result in obvious system failures, which matches the situation described, where the machines showed no signs of degraded performance or excessive failed logins.
References =
* CompTIA Security+ SY0-701 Course Content: Cryptojacking is covered under types of malware attacks, highlighting its stealthy nature and impact on infected systems.