Preparation is the phase in the incident response process when a security analyst reviews roles and responsibilities, as well as the policies and procedures for handling incidents. Preparation also involves gathering and maintaining the necessary tools, resources, and contacts for responding to incidents. Preparation can help a security analyst to be ready and proactive when an incident occurs, as well as to reduce the impact and duration of the incident.
Some of the activities that a security analyst performs during the preparation phase are:
Defining the roles and responsibilities of the incident response team members, such as the incident manager, the incident coordinator, the technical lead, the communications lead, and the legal advisor.
Establishing the incident response plan, which outlines the objectives, scope, authority, and procedures for responding to incidents, as well as the escalation and reporting mechanisms.
Developing the incident response policy, which defines the types and categories of incidents, the severity levels, the notification and reporting requirements, and the roles and responsibilities of the stakeholders.
Creating the incident response playbook, which provides the step-by-step guidance and checklists for handling specific types of incidents, such as denial-of-service, ransomware, phishing, or data breach.
Acquiring and testing the incident response tools, such as network and host-based scanners, malware analysis tools, forensic tools, backup and recovery tools, and communication and collaboration tools.
Identifying and securing the incident response resources, such as the incident response team, the incident response location, the evidence storage, and the external support.
Building and maintaining the incident response contacts, such as the internal and external stakeholders, the law enforcement agencies, the regulatory bodies, and the media.
References:
CompTIA Security+ SY0-701 Certification Study Guide, Chapter 6: Architecture and Design, Section 6.4:
Secure Systems Design, p. 279-280
CompTIA Security+ SY0-701 Certification Exam Objectives, Domain 3: Architecture and Design, Objective
3.5: Given a scenario, implement secure network architecture concepts, Sub-objective: Incident response, p. 16

The best answer is C. WAF.
XSS (Cross-Site Scripting) is a web application attack that injects malicious scripts into web content. A WAF (Web Application Firewall) is specifically designed to inspect, filter, and block malicious HTTP and HTTPS traffic targeting web applications. It can help detect and prevent common attacks such as XSS, SQL injection, and other application-layer threats.
Why the other options are incorrect:
A). NGFWA next-generation firewall provides advanced network security features, but it is not as specifically focused on web application attacks as a WAF.
B). UTMUnified Threat Management combines multiple security features in one platform, but it is not the best answer for preventing a web application attack like XSS.
D). NACNetwork Access Control focuses on controlling which devices can connect to the network. It does not directly prevent XSS.
From the SY0-701 perspective, attacks against web applications are best mitigated by controls specifically designed for application-layer inspection, making WAF the correct answer.

CIS benchmarks are the best choice because they provide recognized secure configuration baselines for operating systems, applications, cloud platforms, network devices, and other infrastructure components. A CISO modernizing legacy systems needs a structured way to evaluate current configurations, identify gaps, prioritize weaknesses, and build a risk-based remediation plan. Angry IP Scanner can help discover live hosts, but it does not provide security baselines or modernization guidance. The OWASP Web Security Testing Guide focuses on web application testing, not broad legacy infrastructure. Metasploit is a penetration testing framework and is not the right tool for defining modernization scope. Security+ emphasizes secure baselines, hardening standards, and benchmark-driven configuration review for reducing risk.

The correct answer is C. Agree on data classification labels with stakeholders.
Before moving proprietary company data to a public cloud storage service, the organization must first determine how the data should be classified. Data classification identifies the sensitivity, ownership, regulatory requirements, and handling requirements of the data. Examples of classification labels may include public, internal, confidential, restricted, private, regulated, or proprietary.
This aligns with CompTIA Security+ SY0-701 concepts related to protecting data, cloud security considerations, and governance. A security engineer cannot properly evaluate cloud risks, encryption needs, access controls, retention rules, compliance requirements, or contractual protections until the organization agrees on what type of data is being moved and how sensitive it is.
Why the other options are incorrect:
A). Create an architecture diagram of cloud storage solutions.
This is useful later, but it should not be the first step. The architecture depends on the data classification and security requirements.
B). Migrate sample data to the cloud to run security tests.
This is premature and risky. Data should not be moved to the cloud before classification, risk analysis, access control requirements, and compliance requirements are understood.
D). Make a backup of the data on cloud-neutral storage.
Backups are important, but they do not address the first security concern: understanding the sensitivity and handling requirements of the proprietary data.
Therefore, the best first action is to agree on data classification labels with stakeholders.