SCAP (Security Content Automation Protocol) is designed to automate vulnerability management, configuration assessment, and compliance checking. According to CompTIA Security+ SY0-701, SCAP standardizes how vulnerability information is expressed, measured, and shared, allowing security tools to automatically scan systems, identify weaknesses, and assess compliance against predefined baselines.
SCAP integrates multiple standards such as CVE, CVSS, CPE, and XCCDF, enabling automated vulnerability scanning, scoring, and reporting across large environments. This makes it a core technology for continuous vulnerability management and compliance automation.
CVE (A) is a catalog of known vulnerabilities, not an automation framework. OSINT (C) provides publicly available intelligence but does not automate remediation or assessment. CVSS (D) provides severity scoring but does not automate vulnerability management.
Because SCAP enables automated identification, assessment, and reporting of vulnerabilities, the correct answer is B: SCAP.

The correct answer is A. Generator.
A generator can provide long-term backup power during an extended power outage, as long as sufficient fuel is available. For a multiday outage, a generator is the appropriate solution to keep a data center operational.
This aligns with CompTIA Security+ SY0-701 availability and resilience concepts. Data centers often use generators, redundant power feeds, UPS systems, and environmental controls to maintain uptime.
Why the other options are incorrect:
B . Uninterruptible power supply
A UPS provides short-term backup power and protects against brief outages, power fluctuations, and brownouts. It is usually designed to keep systems running until generator power starts or until systems can be shut down safely.
C . Replication
Replication copies data or systems to another location or system. It supports disaster recovery and availability, but it does not keep the same data center powered during an outage.
D . Parallel processing
Parallel processing distributes computing tasks across multiple processors or systems. It does not provide backup power.
Therefore, a generator is the best answer for a multiday power outage.

A partially known environment is a type of penetration test where the tester has some information about the target, such as the IP address, the operating system, or the devicetype. This can help the tester focus on specific vulnerabilities and reduce the scope of the test. A partially known environment is also called a gray box test1.
References: CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 10, page 543.

Containment (C)is thefirst critical stepduring a security incident tostop the spreadof the attack. This could include isolating affected systems, disabling accounts, or blocking malicious traffic.
According to theIncident Response Lifecycle, the order is typically:Identification # Containment # Eradication # Recovery # Lessons Learned.
Reference: CompTIA Security+ SY0-701 Objectives, Domain 5.4 - "Incident response process: Containment as the immediate action."

The logs show impossible travel because the same employee account is successfully authenticating from Atlanta and Beijing within minutes. A legitimate user cannot physically travel between those locations in that short period of time. In Security+ operations, impossible travel is an identity and access anomaly often detected by SIEM, IAM, CASB, or UEBA tools. It may indicate credential theft, session hijacking, VPN abuse, or malicious login activity. SMTP replay relates to email transmission or abuse and does not explain geographically impossible logins. Directory traversal is a web attack that attempts to access unauthorized file paths. Cross-site request forgery tricks an authenticated browser into submitting unwanted requests. The location and timing pattern clearly indicates impossible travel.