Comprehensive and Detailed Explanation From Exact Extract:
Infrastructure as Code (IaC) is the technology required for automating infrastructure deployment. IaC allows organizations to define and deploy servers, networks, containers, and cloud resources using machine-readable configuration files rather than manual configuration. This leads to faster deployment, consistent environments, repeatability, version control, and lower human error.
CompTIA Security+ SY0-701 highlights IaC as a foundational component of DevOps and modern cloud operations. It supports automated provisioning through tools such as Terraform, Ansible, CloudFormation, and Puppet. IaC also enhances security by enabling automated compliance checks and standardized hardened configurations.
IaaS (B) is a cloud service model, not an automation mechanism. IoC (C) refers to Indicators of Compromise used in threat intelligence. IoT (D) refers to Internet-connected devices and is unrelated to infrastructure deployment.
Therefore, IaC is the required technology for automated, repeatable, secure infrastructure deployments.

Restricting access to a router's web management interface is apreventive control (C). This type of control is implementedbefore a threat occursto reduce the likelihood of exploitation.
CompTIA Security+ SY0-701listspreventive controlssuch asIP whitelisting, ACLs, and firewallsunderDomain 1.4: Security controls.
Reference: CompTIA Security+ SY0-701 Objectives, Domain 1.4 - "Security control types: Preventive (e.g., access control)."

Detailed Explanation:Quarantining a potentially infected system by placing it into an air-gapped environment physically disconnects it from the network. This prevents the spread of malware while maintaining the integrity of forensic evidence. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Incident Response and Containment".

Cross-site scripting (XSS) occurs when a web application fails to properly validate or sanitize user input, allowing attackers to inject malicious scripts into web pages viewed by other users. The most effective remediation is input validation, which ensures that only safe, expected data is accepted by the application.
Security+ SY0-701 highlights input validation as a primary defense against:
* XSS
* SQL injection
* Command injection
* Path traversal attacks
By validating and sanitizing input at both the client and server layers, organizations can strip harmful characters, block script tags, enforce strict data types, and ensure proper encoding.
A NGFW (B) or WAF (D) can mitigate attacks by blocking malicious payloads, but they do not fix the root cause within the web application. A vulnerability scan (C) identifies the issue but does not remediate it.
Therefore, only input validation (A) directly resolves the underlying coding flaw responsible for XSS.

Least privilege and application allow listing best support a cloud services policy designed to reduce user- introduced vulnerabilities and shadow IT. Least privilege ensures users only have the permissions required for their duties, reducing the chance that they can deploy unauthorized cloud resources, connect unapproved services, or expose sensitive data. Application allow listing restricts usage to approved applications and services, which directly reduces shadow IT and prevents users from adopting unvetted cloud tools. A trusted platform module protects cryptographic keys on hardware, not cloud service usage. Jailbreaking is a vulnerability or unsafe device modification, not a control. Access control lists are useful but narrower. File integrity monitoring tracks file changes and does not govern cloud service adoption.