LDAP authentication on the printer (C)would require users toauthenticate before printing, enablingsecure print release. This ensures that documents arenot printed until the authorized user is physically present, which directly addresses the issue of missing confidential documents.
As perCompTIA Security+ SY0-701, Domain 3.1 (Access management), integratingauthentication mechanisms like LDAPimproves physical and document security in shared environments.
Reference: CompTIA Security+ SY0-701 Objectives, Domain 3.1 - "Access management: Authentication mechanisms (e.g., LDAP)."

When encrypting data, two fundamental drivers of cryptographic strength are the algorithm you choose and the key length you use (which affects brute-force feasibility and overall security margin). The Study Guide emphasizes algorithm selection as a best practice: "First, choose your encryption system wisely... Choose an encryption system with an algorithm in the public domain that has been thoroughly vetted by industry experts." It then highlights key selection/size as another central decision: "You must also select your keys in an appropriate manner. Use a key length that balances your security requirements with performance considerations." These two choices directly affect whether encryption meaningfully protects confidentiality. By contrast, obfuscation, masking, and tokenization are different data-protection techniques (often used to reduce exposure or de-identify data) rather than core encryption-strength parameters. Salting is primarily associated with strengthening password hashing (defending against rainbow table attacks), not selecting encryption primitives
/strength for general data encryption. Therefore, the best two considerations in the context of encryption itself are Algorithms and Key length.
References: Encryption best practices-select vetted algorithms and appropriate key length .

A reflected denial of service (RDoS) attack is a type of DDoS attack that uses spoofed source IP addresses to send requests to a third-party server, which then sends responses to the victim server. The attacker exploits the difference in size between the request and the response, which can amplify the amount of traffic sent to the victim server. The attacker also hides their identity by using the victim's IP address as the source. A RDoS attack can target DNS servers by sending forged DNS queries that generate large DNS responses. This can flood the network interface of the DNS server and prevent it from serving legitimate requests from end users. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215-216 1

The best answer is A. Internal self-assessment.
A gap analysis is used to compare the organization's current security, compliance, or control posture against a required standard, framework, or regulatory requirement. If the company wants to do this in the most cost- effective way, an internal self-assessment is the best choice because it allows the organization to review its own policies, procedures, controls, and documentation without the added expense of external testing or specialized attack simulations.
Why the other options are incorrect:
B). Active reconnaissanceActive reconnaissance involves directly interacting with systems to gather information, often as part of security testing or attack emulation. It is not the best option for a compliance- focused gap analysis.
C). Red team penetration testA red team exercise is more advanced and expensive. It simulates real-world attacks to test detection and response capabilities. This is valuable for security maturity, but it is not the most cost-effective method for identifying compliance gaps before an audit.
D). Tabletop exerciseA tabletop exercise is a discussion-based activity used to test incident response plans, communication, and decision-making. It does not primarily identify regulatory compliance gaps.
From a Security+ perspective, self-assessments, audits, and gap analyses are part of governance, risk, and compliance activities. For a low-cost review against regulatory requirements, internal self-assessment is the most appropriate answer.

The correct answer is A. Agent-based.
Agent-based web filtering uses software installed directly on the endpoint. Because the filtering agent runs on the laptop, it can enforce web filtering policies whether the employee is inside the office or working remotely.
This avoids the need to configure additional access back to the corporate network, such as forcing all remote web traffic through an internal proxy or VPN.
Why the other options are incorrect:
B). Centralized proxy
A centralized proxy can provide web filtering, but remote users would typically need to route traffic through the corporate network or proxy service. The question specifically says the organization does not want to configure additional network access.
C). URL scanning
URL scanning checks URLs for malicious or suspicious content, but it is a filtering technique rather than the best deployment type for enforcing web filtering on laptops both inside and outside the office.
D). Content categorization
Content categorization classifies websites by type, such as gambling, social media, malware, or adult content.
However, it does not describe how filtering is enforced for laptops both on and off the corporate network.
Therefore, the best answer is agent-based web filtering.