@Kayode Alabi Congratulations!!! I am glad I could help you on your journey. Thanks for posting your resources that you used to pass the exam. Could you tell us how your plan of attack on passing?

@Kayode Alabi thank you!

@Tariq Islam Thank you very much!

@Rajdeep Ajmani A virtual machine cannot function or be advertised as a usable computing resource if it has no operating system installed. In IaaS (Infrastructure as a Service), virtual machines come with at least a base operating system image that the user can configure and build upon. the key word in your question is NOT...."Which of the following SERVICE MODELS can the cloud provider NOT advertise under their service offering?"

IEEE thank you 😂

The correct answer is B. Have the data owner rule on reclassification or a documented exception. Why this is the correct answer: 1. Data Ownership and Accountability: In CISSP and general information security governance, the data owner (not the security manager) is ultimately responsible for the data. They define the classification level and the handling standards. 2. Policy Violation: The current handling standard explicitly bars external transfer. Transferring the files outside the firm without addressing this policy conflict would be a direct violation of corporate governance. Only the data owner has the authority to formally approve an exception to the policy or change the classification of the data. 3. The "FIRST" Action: Before implementing technical or legal controls (like redaction, encryption, or NDAs), you must first establish the legal and regulatory permission to move the data. Options A, C, and D are all excellent security measures that should happen after the data owner grants a formal exception or reclassifies the data. Why other options are incorrect: - A (Sign a confidentiality agreement): A Non-Disclosure Agreement (NDA) or confidentiality agreement is necessary for legal protection, but it does not bypass or override the internal policy that bars external transfers. - C (Redact client identifiers): Redaction is a great data sanitization technique, but doing this first bypasses the governance process. The data owner must still approve the transfer of even redacted data if the blanket policy states no external transfers. - D (Encrypt the transfer and storage): Encryption secures data in transit and at rest, but it does not change the fact that an unauthorized external transfer is occurring under current policy guidelines.

The correct answer is B. Assess the site for natural and physical threats before signing. Why this is the FIRST step: 1. Lack of Data: The prompt explicitly states that no site assessment exists. A security architect cannot effectively recommend design modifications (Choice C), lease terms (Choice A), or insurance policies (Choice D) without first understanding the specific risks (such as 100-year flood plains, seismic activity, or local physical vulnerabilities). 2. The Risk Management Process: In risk management, identification and assessment always precede mitigation, transference, or acceptance. 3. Preventative Action: Performing the assessment within the two-week window before the lease is signed allows the organization to completely avoid the risk if the site is deemed completely unviable, or to accurately price mitigation factors into the lease negotiation. Why other options are incorrect: - A & C: These represent specific technical mitigations. Jumping directly to designing flood barriers or demanding power feeds before assessing the site is premature and may not cover the full scope of vulnerabilities. - D: Risk transference (insurance) is a valid strategy, but it is typically arranged after risks are assessed and quantified, not before.