The scenario indicates that a user downloaded an unofficial patch, applied it, and afterward system files changed-detected by FIM. This strongly suggests the presence of a rootkit, which is designed to deeply embed itself into the operating system, altering core system files, modifying kernels, and hiding its presence.
Rootkits commonly replace or modify OS-level files, which results in changed file hashes-exactly what FIM is detecting. Rootkits often gain privileged, persistent control and are frequently disguised as legitimate updates or patches.
A logic bomb (A) is triggered by an event but does not typically modify OS files. A keylogger (B) captures keystrokes but doesn't modify system files broadly. Ransomware (C) encrypts files, not silently alters system components.
Thus, the best match is D: Rootkit.

An SLA (Service-Level Agreement) defines the expected performance, availability, uptime, response times, and responsibilities between a provider and a client. The requirement in the scenario-"97% uptime"-is a classic example of an SLA metric. Security+ SY0-701 emphasizes that SLAs outline measurable service expectations so the client can assess compliance and performance.
A BPA (A) outlines business partnership terms, not performance uptime. An MOU (B) documents mutual understanding but is not legally binding and does not include uptime metrics. An NDA (C) protects confidentiality, not availability or service guarantees.
Thus, the correct answer is D: SLA.

The correct answer is A. Mobile device management.
Mobile device management, or MDM, is the best solution for managing BYOD devices and protecting company data if a device is lost or stolen. MDM can enforce security policies such as screen locks, device encryption, remote wipe, containerization, application control, device compliance checks, and location tracking.
This is especially important in a BYOD environment because employees own the devices, but the organization still needs to protect corporate data stored or accessed on those devices.
Why the other options are incorrect:
B). Endpoint detection and response
EDR is used to detect, investigate, and respond to endpoint threats such as malware, suspicious behavior, and compromise. It is not the best tool for managing lost or stolen mobile devices.
C). Host-based intrusion detection system
A HIDS monitors activity on a host to detect suspicious behavior. It does not provide the mobile management features needed for BYOD risk reduction.
D). Data loss prevention
DLP helps prevent sensitive data from being leaked or transferred inappropriately, but MDM is the better answer for lost or stolen BYOD devices because it can enforce mobile security controls and perform remote wipe.
Therefore, the best tool is mobile device management.

Whaling is a type of phishing attack that targets high-profile individuals, such as executives, celebrities, or politicians. The attacker impersonates someone with authority or influence and tries to trick the victim into performing an action, such as transferring money, revealing sensitive information, or clicking on a malicious link. Whaling is also called CEO fraud or business email compromise2.
References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 3, page 97.