The best answer is C. Isolation.
The question describes an application that can no longer be patched, meaning the organization must continue operating it while accepting some risk. To reduce exposure, the application should only be used by a limited number of network services. This points to isolation, which means restricting the application's interaction with the rest of the environment to contain risk.
Isolation is commonly used for:
legacy systems
unsupported applications
unpatchable systems
high-risk services that must remain operational
By isolating the application, the organization limits the paths through which it can be attacked and reduces the chance that a compromise will spread to other systems.
Why the other options are incorrect:
A). PatchingThe question clearly states that no additional patches can be applied.
B). SegmentationSegmentation is related and often used as a method to isolate systems, but the question asks for the best description of the mitigation approach overall. Since the application is being restricted because it is risky and unpatchable, isolation is the stronger answer.
D). MonitoringMonitoring helps detect issues but does not directly reduce exposure in the way described.
From the SY0-701 perspective, when a vulnerable or unsupported application must remain in use, the preferred mitigation is often to isolate it from the broader environment. Therefore, C is the best answer.

Input validation is a technique that checks the user input for any malicious or unexpected data before processing it by the web application. Input validation can prevent cross-site scripting (XSS) attacks, which exploit the vulnerability of a web application to execute malicious scripts in the browser of a victim. XSS attacks can compromise the confidentiality, integrity, and availability of the web application and its users.
Input validation can be implemented on both the client-side and the server-side, but server-side validation is more reliable and secure. Input validation can use various methods, such as whitelisting, blacklisting, filtering, escaping, encoding, and sanitizing the input data. References = CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 2, page 70. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 3.2, page 11. Application Security - SY0-601 CompTIA Security+ : 3.2

General curiosity is the most likely motivation in this scenario. A company administrator may have legitimate technical access to databases, but viewing an employee's personal information without a business need is an insider misuse issue. In Security+ terms, insider threats are not always financially motivated or malicious in the traditional sense; they can also involve inappropriate access driven by curiosity, snooping, or poor judgment. Ideological differences usually relate to activism, sabotage, or politically motivated behavior.
Gaining influence would imply using the personal information for leverage or coercion, which is not stated.
Intellectual property refers to proprietary business assets such as designs, code, or trade secrets, not employee personal data. The scenario best fits unauthorized access caused by curiosity.

Upgrading end-of-support operating systemsisone of the most effective ways to reduce the attack surface.
Unsupported OS versionsno longer receive security patches, making them prime targets for attackers.
Removing outdated softwareensures that known vulnerabilities cannot be exploited.
A (honeynet)is used for threat analysis, not reducing the attack surface.
B (Group Policy)helps enforce security policies butdoes not address outdated vulnerabilities.
C (High availability)focuses on uptime, not security risk reduction.
Reference:CompTIA Security+ SY0-701 Official Study Guide, Security Architecture domain.

A site survey is the formal assessment used to determine the optimal number and placement of wireless access points (APs). According to Security+ SY0-701, wireless site surveys evaluate factors such as building layout, RF interference, wall material density, antenna propagation, and signal overlap. The goal is to ensure full wireless coverage while minimizing the number of APs needed, maximizing performance, and reducing dead zones.
During a site survey, technicians analyze:
Signal strength patterns
Interference sources (microwaves, metal shelving, wiring, etc.)
Required coverage zones
Capacity needs (number of users, devices)
Although heat maps (C) visually represent wireless signal distribution, they are a result of a site survey, not the process itself. WPA3 (B) is a security protocol unrelated to determining coverage. A signal locator (A) is not an enterprise-grade planning tool.
Therefore, the correct answer is D: Site survey.