OSINT stands for open source intelligence and is commonly used to gather information from publicly available sources to support security activities such as reconnaissance, threat intelligence, and identifying exposures (for example, leaked credentials, exposed infrastructure details, or public references to vulnerabilities). The Practice Tests book defines OSINT directly: "OSINT, or open source intelligence, is intelligence information obtained from public sources like search engines, websites, domain name registrars, and a host of other locations." That definition aligns precisely with option C's "collecting information from public platforms." The Study Guide similarly explains OSINT in the threat intelligence context: "Open source threat intelligence is threat intelligence that is acquired from publicly available sources." This supports the idea that OSINT is used to discover relevant information that may affect security posture-such as indicators, exposed assets, or details useful for defensive planning. The other options describe different operational activities: A is internal monitoring (SIEM/IDS/EDR style), B is patch management, and D is encryption/storage strategy-none are "open source intelligence."

A hot site is a fully operational offsite facility that is equipped with hardware, software, and up-to-date data, and is ready to take over operations immediately if the primary site fails. This allows for minimal downtime and quick failover, meeting the requirement for rapid recovery.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 4.4: "Hot sites are ready to take over operations instantly with minimal downtime." Exam Objectives 4.4: "Summarize business continuity and disaster recovery concepts."

The correct answer is D. Gamification.Gamification uses game-like elements, rewards, points, competitions, badges, leaderboards, or incentives to encourage positive security behavior. In this scenario, employees are being incentivized not to click phishing links, which is a security awareness technique based on motivation and participation.Why the other options are incorrect: Computer-based trainingComputer-based training is a structured online training method. The question focuses on incentives, not simply online instruction.
Insider threat awarenessInsider threat awareness trains employees to recognize and report insider risks. The scenario is about phishing behavior and incentive-based awareness.SOAR playbookA SOAR playbook automates or standardizes security response actions.

A hot site is a fully operational data center equipped with hardware, software, and network connectivity, ready for immediate use after a disaster. It allows near-zero downtime, making it ideal for critical systems needing continuous operations.
Warm sites (B) have some infrastructure but require additional setup time. Cold sites (D) provide space and power but no equipment, leading to longer recovery. Geolocation (C) is unrelated.
Hot sites are a key disaster recovery solution discussed in SY0-701's Resilience and Recovery domain [6:Chapter 9 CompTIA Security+ Study Guide].

AWeb Application Firewall (WAF)is designed toprotect web applications from attackssuch asCross-Site Scripting (XSS)by filtering and monitoring HTTP traffic between the internet and a web application.
Next-Generation Firewalls (NGFW) (A)provide advanced network security but are not specifically designed to protect web applications from XSS attacks.
Unified Threat Management (UTM) (B)provides multiple security functions but lacks the specialized application-layer protection needed to mitigate XSS.
Network Access Control (NAC) (D)controls device access to the network but does not prevent web-based attacks.
AWAF is the best solutionfor protecting web servers fromXSS, SQL injection, and other web-based threats.