The best answer is A. Ensure the firewall data plane moves to fail-closed mode.
The key requirement is that the company prioritizes confidentiality over availability. In a failure or security event, a fail-closed firewall blocks traffic rather than allowing traffic to continue through an untrusted or degraded state.
This choice protects sensitive business data, even if it temporarily interrupts transactions.
Why the other options are incorrect:
B). Implement a deny-all rule as the last firewall ACL rule.This is a standard best practice, but it does not specifically address behavior during a security event.
C). Prioritize business-critical application traffic through the firewall.This emphasizes availability and performance, not confidentiality.
D). Configure rate limiting between the firewall interfaces.Rate limiting can help with traffic control, but it is not the best match for the stated priority.
From a Security+ standpoint, when confidentiality is more important than uptime, fail closed is the correct choice.

Job rotation is a strategy used in organizations to detect and prevent fraud by periodically assigning employees to different roles within the organization. This approach helps ensure that no single employee has exclusive control over a specific process or set of tasks for an extended period, thereby reducing the opportunity for fraudulent activities to go unnoticed. By rotating roles, organizations can uncover irregularities and discrepancies that might have been concealed by an employee who had prolonged access to sensitive functions. Job rotation also promotes cross-training, which can enhance the organization's overall resilience and flexibility.
References =
* CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.
* CompTIA Security+ SY0-601 Study Guide: Chapter on Risk Management and Compliance.

Cross-site scripting (XSS) is the correct answer because the attack injects HTML content into a web application. XSS occurs when an application accepts untrusted input and renders it in a browser without proper validation, sanitization, or output encoding. Injected tags, scripts, event handlers, or external resource references can cause a victim's browser to execute or load attacker-controlled content. Directory traversal attempts to access unauthorized file paths, usually using patterns like ../.
Buffer overflow abuses memory handling errors. SQL injection targets backend database queries. The given payload is web-content injection, not a database or memory exploit. Security+ expects recognition of XSS from injected HTML or JavaScript in web application output.

Shadow IT refers to software, hardware, cloud services, or applications deployed without approval from the IT or security department. In this scenario, a high school department is using an unvetted simulation program-classic Shadow IT behavior.
Security+ SY0-701 explains that Shadow IT:
* Introduces unknown vulnerabilities
* Bypasses security controls
* Creates compliance risks
* Leads to data exposure
* Interferes with standard configuration management
Espionage (A) involves intelligence gathering, not unauthorized software use. Data exfiltration (B) involves data theft, not unauthorized software deployment. Zero-day (D) refers to unknown vulnerabilities, not unapproved systems.
Thus, Shadow IT is the correct answer.

A Security Information and Event Management (SIEM) solution collects, aggregates, and correlates logs from multiple sources to detect anomalies and generate alerts. SIEMs are essential for security monitoring and incident detection.References: Security+ SY0-701 Course Content, Security+ SY0-601 Book.