@Paing Zin Correct Answer: A. Preserve forensic images of affected systems before restoration Explanation (CISSP logic): The scenario tells you containment is already active, so the decision on the table is the wipe. Wiping and reimaging is eradication and recovery, and doing it now would permanently destroy the evidence that pending insurance claims and law enforcement referrals depend on. Evidence preservation is the gating step between containment and recovery: once you image the systems, restoration can proceed without sacrificing the investigation, the claim, or potential prosecution. Breakdown: A. ✅ Correct. Capture forensically sound images first. It is the only option that protects evidence integrity while still enabling the restore the business needs. B. Restoring from backup is where the operations team wants to jump, and it's the right destination. But recovery before preservation converts your best evidence into blank disks. Availability pressure is exactly how evidence gets destroyed. C. Notifying the insurer matters, and policies often require prompt notice, but a phone call can happen in parallel. It's the strong distractor because it invokes a real compliance condition, yet it does not stop the irreversible act about to occur. D. Isolating unaffected segments is genuine containment, but the stem says containment is underway. Choosing D means answering a question the team already handled while the evidence gets wiped behind you. Think like a manager: In incident response, the irreversible step waits. Recovery restores the business; preservation protects the truth, and you can only skip one of them once.

@Chiru Adapa that’s awesome ! Congratulations we are happy to have you

@Silje Bjørknes welcome!

@David Uchieng Correct Answer: B. Evaluate the component against secure acquisition and supply chain criteria Explanation (CISSP logic): An abandoned library with no disclosure process is a supply chain risk decision disguised as a technical one. CISSP treats third-party software acquisition the same way it treats vendor onboarding: you evaluate the component against defined criteria before it enters the SDLC, not after. The evaluation answers the only question that matters right now, which is whether this dependency is acceptable at all. Every other option assumes the answer is yes. Breakdown: A. Adding it to the SBOM is the strongest distractor because SBOM is exactly the right modern practice for this class of risk. But an SBOM is an inventory control. It tells you that you have an unmaintained library; it does not decide whether you should. It also delivers little value here, since monitoring for disclosed vulnerabilities is nearly useless when nobody is left to disclose them. B. ✅ Correct. Assess the component against acquisition criteria first. That evaluation determines whether you accept, remediate, or reject the dependency. C. Forking is a treatment option chosen before the risk is assessed. It also silently transfers ongoing maintenance and patching liability onto your team, which is a resourcing commitment leadership never agreed to. D. Perimeter compensating controls address exploitation of a flaw you haven't identified in code you haven't evaluated. That's mitigation without analysis. Think like a manager: Free code is not free of obligation. Every dependency you accept is a vendor you onboarded without a contract, so evaluate it like one.

@Geir Johansen ✅ Correct Answer: B. Assess the partner's security posture against connection requirements Explanation (CISSP logic): A signed contract commits the business to the relationship, not to an unconditional network connection. "Security posture is unknown" is the clue: you are being asked to extend your trust boundary to an unmeasured party. Third-party connection due diligence comes before you design the connection. The assessment determines what controls the tunnel actually needs and whether the connection can be permitted at all. Breakdown: A. A screened segment is excellent architecture and the strongest distractor. But it's a design decision made before you know the threat you're isolating. Assessment tells you whether a DMZ termination is sufficient or whether this partner warrants far tighter restrictions. B. ✅ Correct. Assess first. Due diligence on the connecting party defines the requirements every other option is trying to satisfy. C. Full inspection is an operational control applied without knowing what you're inspecting for. It also assumes the connection is already approved, which is the question being skipped. D. Mutual authentication and cipher policy secure the tunnel itself. A perfectly encrypted pipe to a compromised partner delivers threats with excellent confidentiality. Think like a manager: A contract creates an obligation to do business, never an obligation to connect blindly. Assess the party before you build the path.