This situation is an example of smishing, which is a type of phishing that uses text messages (SMS) to entice individuals into providing personal or sensitive information to cybercriminals. The best responses to this situation are to add a smishing exercise to the annual company training and to issue a general email warning to the company. A smishing exercise can help raise awareness and educate employees on how to recognize and avoid smishing attacks. An email warning can alert employees to the fraudulent text message and remind them to verify the identity and legitimacy of any requests for information or money. References = What Is Phishing | Cybersecurity | CompTIA, Phishing - SY0-601 CompTIA Security+ : 1.1 - Professor Messer IT Certification Training Courses

The most important consideration when establishing a data privacy program is defining the organization's role as a controller or processor. These roles, as outlined in privacy regulations such as the General Data Protection Regulation (GDPR), determine the responsibilities regarding the handling of personal data. A controller is responsible for determining the purpose and means of data processing, while a processor acts on behalf of the controller. This distinction is crucial for compliance with data privacy laws.
* Reporting structure for the data privacy officer is important, but it is a secondary consideration compared to legal roles.
* Request process for data subject access is essential for compliance but still depends on the organization's role as controller or processor.
* Physical location of the company can affect jurisdiction, but the role as controller or processor has a broader and more immediate impact.

The correct answer is B. NGFW utilizing application inspection.
A next-generation firewall, or NGFW, can perform deep packet inspection and application-layer inspection.
This allows it to identify the actual application or protocol being used, even when the traffic is running over a nonstandard port.
In this scenario, HTTP traffic is being sent over port 53. Port 53 is normally associated with DNS, so a traditional port-based firewall might allow or misclassify the traffic. An NGFW with application inspection could detect that the traffic is actually HTTP, not DNS, and block it according to policy.
Why the other options are incorrect:
A). WAF utilizing SSL decryption
A web application firewall protects web applications from web-based attacks. SSL decryption helps inspect encrypted HTTPS traffic, but this scenario is about detecting HTTP over an unusual port.
C). UTM utilizing a threat feed
A Unified Threat Management device can provide multiple security functions, and threat feeds can help identify known malicious indicators. However, the key control needed here is application inspection.
D). SD-WAN utilizing IPsec
SD-WAN manages WAN connectivity and routing, while IPsec provides encrypted tunnels. This does not identify or block HTTP being misused over port 53.
Therefore, the best answer is NGFW utilizing application inspection.

A load balancer best supports the availability requirement because it distributes client traffic across available backend resources and can route traffic away from failed or overloaded systems. When properly implemented with multiple servers or redundant service instances, load balancing improves uptime, resilience, and service continuity. A proxy server forwards requests and may provide filtering or caching, but it does not inherently guarantee application availability. A jump server provides controlled administrative access to internal systems, not client-facing service continuity. Geographic restrictions limit access based on location and may actually reduce availability for some users.
Security+ places load balancing under resilient architecture because it helps maintain access when individual systems fail or become saturated.

The correct answer is A. Residual risk.
Residual risk is the risk that remains after safeguards, controls, or mitigation strategies have been applied. In some cases, a risk cannot be fully eliminated or mitigated. The organization must then decide whether to accept, transfer, avoid, or further manage the remaining risk.
This aligns with CompTIA Security+ SY0-701 risk management concepts, especially risk treatment, risk acceptance, risk tolerance, and residual risk.
Why the other options are incorrect:
B . Risk appetite
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. It does not specifically describe a risk that remains after mitigation attempts.
C . Reviewed risk
This is not the best formal risk management term for a risk that cannot be mitigated.
D . Risk register
A risk register is a document or system used to track identified risks, risk owners, likelihood, impact, treatment plans, and status. It does not describe the remaining risk itself.
Therefore, a risk that cannot be fully mitigated is best described as residual risk.