A honeytoken is a form of deception technology in which a fake asset (such as credentials, files, or database records) is planted in a system or network to detect unauthorized access or malicious activity. The fake password stored in a hidden spreadsheet, with monitoring for access, is a classic example of a honeytoken. It is not an interactive system (like a honeypot or honeynet) but rather a marker or tripwire intended to alert the security team to suspicious behavior. This method helps identify attackers and their methods early in the intrusion process.
References:
CompTIA Security+ SY0-701 Official Study Guide, Domain 1.1, "Deception and Disruption Technologies" CompTIA Security+ Exam Objectives: 1.1 CompTIA Glossary: "Honeytoken-A fictitious record or file intended to attract or identify unauthorized access."

The guidance focuses on attack surface reduction by eliminating unnecessary services, closing unused ports, and limiting publicly available information that attackers could leverage. Reducing the attack surface lowers the organization's exposure to threats and potential entry points.
Vulnerability assessments (B) identify weaknesses but do not necessarily involve active reduction measures.
Tabletop exercises (C) simulate incidents, and business impact analysis (D) assesses the effects of disruptions, neither of which match the described activities.
Attack surface reduction is a core principle in Security Operations and penetration testing remediation strategies in SY0-701#6:Chapter 14 CompTIA Security+ Study Guide#.

Content categorization is the best capability because it groups websites into categories such as gambling, sports, social media, malware, adult content, or streaming. A web filtering solution can then block an entire category instead of requiring administrators to manually maintain a static deny list of individual URLs. This is exactly what the CISO needs because new fantasy sports websites can appear frequently. URL scanning checks or analyzes specific URLs, but it does not necessarily solve the category maintenance problem by itself. IPS focuses on detecting or blocking network attacks. DLP prevents sensitive data leakage, not recreational website access. Static denial lists are difficult to maintain and do not adapt well to new sites.

Port 445 is used by the SMB protocol on Windows systems. Large volumes of unexpected traffic on TCP 445 are commonly associated with worms that exploit SMB vulnerabilities (such as WannaCry or NotPetya).
Worms are self-replicating malware that spread rapidly across a network, consuming bandwidth, causing high latency, and often resulting in network outages. This matches the scenario given, where network unavailability and abnormal port 445 traffic are observed.
References:
CompTIA Security+ SY0-701 Official Study Guide, Domain 2.1, "Malware Types: Worms" CompTIA Security+ Exam Objectives: 2.1 CompTIA Glossary: "Worm-A self-replicating malware that spreads across networks, often exploiting vulnerabilities such as those in SMB (TCP 445)."

Automated vulnerability scanningis thefirst step in identifying system weaknesses. These scans systematically check for outdated software, misconfigurations, and known vulnerabilities in a network.
Penetration testing (B)is conducted after vulnerabilities are identified.
Threat hunting (C)focuses on detecting unknown threats, not listing vulnerabilities.
Reference:CompTIA Security+ SY0-701 Official Study Guide, Security Operations domain.