User awareness training is essential in preventing security incidents caused by human error, such as clicking on malicious links. Employees need to be educated on recognizing phishing attempts, verifying email senders, and avoiding suspicious downloads.
Network monitoringdetects and alerts on malicious activity but does not prevent employees from clicking on harmful links.
Endpoint protectioncan mitigate malware infections but is not foolproof, especially if users continue to fall for phishing attacks.
Data loss prevention (DLP)can prevent data exfiltration but does not stop malware from being introduced into the system.
By training employees to recognize and avoid phishing scams, organizations canreduce the risk of malware infections and data breaches.

The requirement is to prevent the accidental disclosure of national identity information-highly sensitive personal data. The best solution is DLP (Data Loss Prevention). DLP tools monitor, detect, and block unauthorized transmission or exposure of sensitive data across:
* Email
* Cloud storage
* Endpoints
* Networks
* Databases
In Security+ SY0-701, DLP is specifically recommended for ensuring compliance with privacy regulations, including those related to national identifiers (e.g., Social Security numbers, national ID numbers).
A SIEM (A) aggregates logs but does not prevent data leakage. SCAP (B) provides standardized security configuration assessments, unrelated to data protection. A WAF (D) helps protect web applications but does not prevent sensitive data exfiltration.
Since the requirement focuses on preventing accidental disclosure, DLP is the only technology capable of detecting, labeling, blocking, and reporting attempts to move or expose sensitive national identity data.
Therefore, the correct answer is C.

Baseline enforcement involves establishing standard configurations and operational baselines that allow a service provider to scale services efficiently while ensuring consistent performance and security. By enforcing baselines, automation can be applied, reducing manual intervention and variability, which supports rapid, cost- effective expansion.
Increasing workforce (B) adds operational cost and may introduce inconsistency. Escalation support (A) is reactive and does not inherently support scaling. Technical debt (D) refers to accumulated suboptimal design or quick fixes that hamper future scalability and is a negative factor.
Baseline enforcement is recognized as a best practice in the Security Program Management domain for scaling services reliably#6:Chapter 16 CompTIA Security+ Study Guide#.

Severity describes how serious a risk event would be if it occurred and is commonly used to prioritize remediation. In practical risk management, severity reflects the operational consequence of an event, such as service disruption, data loss, regulatory exposure, financial damage, or safety concerns.
Likelihood and probability both describe the chance that the event will occur, not the seriousness of the result. Impact is closely related, but severity is the scoring label often used to express the overall seriousness of the risk in a risk register, vulnerability report, or risk matrix. For Security+, severity helps determine which risks require immediate treatment and which can be accepted, monitored, or deferred.

The best answer is D. Lock the employee ' s account to prevent further unauthorized access.
If credentials have been exposed in a phishing incident, the most urgent priority is to contain the threat by preventing attackers from using those credentials. Locking or disabling the affected account is an immediate response step that reduces the risk of unauthorized access, lateral movement, privilege abuse, or data theft.
Why the other options are incorrect:
A). Notify all employees about the phishing attack and instruct them to avoid suspicious emails.Awareness messaging may be useful later, but it does not immediately contain the compromised account.
B). Wait for confirmation from the employee before making any changes to the account.Waiting introduces unnecessary risk if the credentials are already exposed.
C). Reimage the employee ' s workstation to ensure no malware is present.Reimaging may be appropriate if malware was delivered, but the question specifically says the employee exposed credentials. The first priority is account containment.
From a Security+ incident response perspective, the immediate action after credential compromise is to disable or lock the account, making D the best answer.