Allocating fully redundant and geographically distributed standby sites ensures survivability against an environmental catastrophe and supports recovery within 24 hours.
Deploying redundant identity provider solutions ensures continuity of authentication and access control, maintaining security and resilience even if one VPN or site is compromised.

The actions described fall under Operational Security (OPSEC), which is the practice of identifying critical information, analyzing potential adversary intelligence collection, and implementing measures to protect sensitive details from disclosure. In this case, the ISAC report highlights how adversaries may use photos shared on social media as reconnaissance, revealing details about technology or configurations inside secure facilities.
By disabling cameras and location services on corporate devices and blocking access to social media from corporate and guest networks, the CISO is reducing the chance of inadvertent information disclosure. This prevents employees from unintentionally leaking images or metadata that adversaries could exploit.
Adversary emulation (A) involves simulating threat actors' tactics in controlled exercises, which is not what is occurring here. Open-source intelligence (C) is the method adversaries use to gather data, not the defensive practice the CISO is implementing. Social engineering (D) describes manipulative attacks against humans, but this control is preventive, not reactive.
Thus, these measures are clear examples of Operational Security to limit information exposure.

The presence of an unauthorized server (29mail.mycrosoft.info) sending emails on behalf of the company indicates a potential spoofing or phishing attempt. To mitigate this:
* Remove the unnecessary servers from the SPF record (Option C): The Sender Policy Framework (SPF) specifies which mail servers are authorized to send emails on behalf of a domain. Removing unauthorized or unnecessary servers from the SPF record helps prevent spoofed emails from passing SPF checks.
* Change the SPF record to enforce the hard fail parameter (Option D): Setting the SPF policy to a hard fail (-all) ensures that emails from unauthorized servers are rejected, enhancing email security.
Implementing these changes strengthens the domain ' s email authentication mechanisms, reducing the risk of successful phishing or spoofing attacks.
Reference: CompTIA SecurityX CAS-005 Exam Objectives, Domain 3.2: " Given a scenario, analyze requirements to enhance the security of endpoints and servers. "