A Chief Information Officer wants to ensure that network devices cannot connect to the public...

The correct answer is B. Air-gapped.

An air-gapped architecture physically or logically isolates systems from other networks, including the public internet and internal local networks. Because the devices cannot directly connect to the internet or local network, updates must be transferred manually, often using removable or portable media.

This aligns with CompTIA Security+ SY0-701 security architecture concepts involving segmentation, isolation, high-security environments, and protection of sensitive or critical systems.

Why the other options are incorrect:

A. Microservices

Microservices is an application architecture where software is broken into smaller independent services. It does not describe network isolation.

C. Software-defined networking

Software-defined networking separates the control plane from the data plane and allows centralized network management. It does not inherently require devices to be disconnected from the internet or local network.

D. Serverless

Serverless is a cloud computing model where the cloud provider manages the underlying infrastructure. It does not describe isolated firmware update architecture.

Therefore, the best answer is air-gapped.