An Intrusion Prevention System (IPS) is the most effective addition when an organization already has a firewall but continues to face repeated external attacks. Security+ SY0-701 states that an IPS operates inline and automatically blocks malicious traffic in real time based on signatures, anomaly behavior, or heuristics.
Whereas a firewall filters traffic by rules, an IPS detects and prevents deeper-level threats such as exploits, malware, and command-and-control attempts.
A UTM (C) includes IPS features, but it is typically used to replace a firewall with an all-in-one appliance.
The question states the organization already has a firewall, so the most efficient addition is a standalone IPS.
A SIEM (A) aggregates and analyzes logs but does not block attacks. A load balancer (B) distributes traffic for performance-not security.
Thus, the best item to stop active inbound attacks is D: IPS.

A cold site is a backup facility that provides basic power, space, and environmental controls but does not include hardware or preconfigured systems. It is the organization's responsibility to ensure the site has adequate storage, servers, and equipment staged or available for rapid procurement.
If the cold site "does not have enough storage and computers," the cause is a failure in capacity planning (A).
CompTIA Security+ SY0-701 highlights the need for organizations to determine:
Required compute capacity
Storage needs
Network bandwidth
Expected recovery workload
Hardware replacement timelines
Load balancing (B) distributes traffic; it has nothing to do with cold-site readiness. Backups (C) store data, not physical resources. Platform diversity (D) refers to using multiple technologies to reduce systemic risk.
The issue is specifically the lack of resources, which directly reflects inadequate capacity planning. Therefore, A is the correct answer.

Cyber insurance is a type of insurance that covers the financial losses and liabilities that result from cyberattacks, such as data breaches, ransomware, denial-of-service, phishing, or malware. Cyber insurance can help a company recover from the costs of restoring data, repairing systems, paying ransoms, compensating customers, or facing legal actions. Cyber insurance is one of the possible strategies that a company can use to address the items listed on the risk register. A riskregister is a document that records the identified risks, their probability, impact, and mitigation strategies for a project or an organization. The four common risk mitigation strategies are:
Accept: The company acknowledges the risk and decides to accept the consequences without taking any action to reduce or eliminate the risk. This strategy is usually chosen when the risk is low or the cost of mitigation is too high.
Transfer: The company transfers the risk to a third party, such as an insurance company, a vendor, or a partner. This strategy is usually chosen when the risk is high or the company lacks the resources or expertise to handle the risk.
Mitigate: The company implements controls or measures to reduce the likelihood or impact of the risk. This strategy is usually chosen when the risk is moderate or the cost of mitigation is reasonable.
Avoid: The company eliminates the risk by changing the scope, plan, or design of the project or the organization. This strategy is usually chosen when the risk is unacceptable or the cost of mitigation is too high.
By purchasing cyber insurance, the company is transferring the risk to the insurance company, which will cover the financial losses and liabilities in case of a cyberattack. Therefore, the correct answer is B.
Transfer. References = CompTIA Security+ Study Guide (SY0-701), Chapter 8: Governance, Risk, and Compliance, page 377. Professor Messer's CompTIA SY0-701 Security+ Training Course, Section 8.1: Risk Management, video: Risk Mitigation Strategies (5:37).

Blackmail is the correct motivation because the attacker is coercing the employee by threatening to release sensitive personal files. The attacker is not simply seeking money directly, so financial gain is not the best description. Revenge would involve retaliation for a perceived grievance, but the scenario describes coercion. Espionage involves stealing information for political, corporate, or strategic advantage, which is not the primary driver here. This is a social engineering and insider-risk scenario because an external attacker pressures an internal employee into performing malicious activity.
Security+ expects candidates to recognize attacker motivations such as financial gain, ideology, espionage, revenge, and blackmail based on the pressure or incentive being used.