A penetration tester reviews the following router configuration:set-system services ssh root login-allowset-system services web-management https...

The best answer is C. Enabling network segmentation controls . The most obvious security weakness shown in the configuration is the interface address 10.12.14.1/8 , which places the device in an extremely broad network range instead of a tightly bounded segment. From a SecurityX perspective, the strongest improvement is to reduce unnecessary trust exposure by applying segmentation and tighter network boundaries. CompTIA’s official SecurityX objectives explicitly call out “Network architecture: segmentation, microsegmentation, virtual local area networks (VLANs), virtual routing and forwarding (VRF), software-defined networking (SDN)” and also emphasize “Security boundaries: secure zones, access control lists (ACLs), virtual private network (VPN)” under Security Architecture.

Why the other options are not the best choice:

A may improve cryptographic strength, but the configuration already shows SSH and HTTPS , so encrypted management access is already present. B is not the best answer because no unencrypted terminal service such as Telnet is shown in the configuration. D is generally useful operationally, but automatic patching and rebooting is not the main architectural weakness indicated by the config excerpt. The clearest risk visible in the router snippet is inadequate network scoping and boundary control, which points to segmentation as the best improvement.