@David Uchieng Correct Answer: B. Have the data owner rule on reclassification or a documented exception Explanation (CISSP logic): The clues are "classified Confidential", "the handling standard bars external transfer" and "signed a contract, starting Monday". Domain 2 is built on one chain: the data owner classifies the asset, the classification sets the handling requirements, and everyone else operates inside them. Here a business unit has contracted around that chain, and the standard as written says the transfer cannot happen. Controls do not override classification; only the owner can decide the label was too high or grant a documented, risk-accepted exception. The manager's first job is to put that decision in front of the owner before Monday, because any control applied first is enforcing a transfer nobody authorised. Breakdown: A. Requiring the vendor to sign a confidentiality agreement is the strong distractor because it is what the contract team expects to hear and it will almost certainly be part of the final package. An agreement is a transfer control, and the firm's own standard says this data does not leave at all; paperwork with the vendor does not change what the label permits. B. ✅ Correct. Having the data owner rule on reclassification or a documented exception restores the chain: the owner decides whether the documents are really Confidential, or whether the business case justifies an exception with named conditions. Every control that follows, contract terms, redaction, encryption, offshore restrictions, is then enforcing a decision the accountable party made. C. Redacting client identifiers before any transfer is sound data minimisation and may be exactly what the owner requires as a condition. Done first, it assumes the transfer is going ahead and assumes redaction alone changes the classification, which is the owner's call, not the security team's. D. Encrypting the transfer and the vendor's storage protects data in transit and at rest and will be in any approved design. It secures a movement the handling standard forbids, and the offshore labelling team has to decrypt the documents to do the work, so it answers a threat nobody asked about.

@Shemaiah E Correct Answer: B. Assess the site for natural and physical threats before signing Explanation (CISSP logic): The clues are "a cheaper building beside a river with one power feed", "wants to sign in two weeks" and "no site assessment exists". Domain 3 covers site and facility design, and the first design decision is the site itself: natural hazards, utility resilience, crime, neighbouring occupants and access routes are fixed by location and cannot be engineered away later. The lease is the point of no return, so the architect's first job is to put a site threat and hazard assessment in front of the people about to sign, because every control that follows is only as good as the ground it stands on. Breakdown: A. Requiring a second power feed in the lease terms is the strong distractor because the single feed is a real availability gap and the lease is the moment to fix it. It is one control for one hazard chosen before anyone has listed the hazards, and a second feed does nothing for a server hall under a metre of river water. B. ✅ Correct. Assessing the site for natural and physical threats before signing turns a cheap building into a known quantity: flood return period, power and telecom diversity, neighbours, access and crime. The result tells the business whether to sign, what to put in the lease and what the fit-out must defend against, in that order. C. Designing flood barriers and raised floors into the fit-out is good facility engineering and may well be needed. It is a design answer to a risk nobody has sized, it commits capital to a site not yet chosen, and it treats the river as the only threat when the assessment may find a worse one. D. Transferring the flood and outage risk through insurance is a legitimate risk treatment and will likely be part of the final package. Insurance pays money after the data center is dark; it restores nothing, and an insurer prices the policy on the very assessment the firm has not done.

@Rajdeep Ajmani Correct Answer: B. Agree scope and independence criteria with the customer Explanation (CISSP logic): The clues are "requires an independent penetration test", "the CTO wants the in-house red team to do it" and "sales wants only the customer portal tested". Domain 6 is about assurance, and assurance is only worth what its independence and scope make it worth. The customer asked for independence, which an in-house team cannot provide however skilled it is, and the scope is being set by the people with the most to gain from a narrow one. Before anyone tests anything, the manager has to agree with the customer what "independent" means and what the test must cover, because a report that fails either check will not get the contract renewed. Breakdown: A. Having the in-house red team test now to hit the deadline is the strong distractor because the team knows the platform and the clock is real. It fails the one requirement the customer actually stated: independence of assurance. A report from the people who built and defend the system is self-attestation, and the customer can reject it with 30 days gone. B. ✅ Correct. Agreeing scope and independence criteria with the customer settles the two things that decide whether the report is accepted: who is independent enough to sign it and what it must cover. Everything after that, choosing the firm, scheduling, remediation, is executed against a target the customer has already endorsed. C. Hiring an external firm to test only the customer portal gets the independence right and is probably close to the final answer. The scope was set by sales to be small, not by the customer to be sufficient, so the manager risks paying for a test the customer rejects because it never touched the shared services behind the portal. D. Running a vulnerability scan before any penetration test is good hygiene and often part of the test plan. It is a technical activity that answers none of the open questions, and finding issues early does not make a self-run, narrowly scoped test any more acceptable to the customer.

@Shemaiah E Correct Answer: C. Define a mover process with HR as the authoritative source Explanation (CISSP logic): The clues are "nurses who moved to billing still hold clinical record access", "HR never tells IT about role changes" and "wants an identity governance platform bought this quarter". Domain 5 treats access as a lifecycle: joiner, mover and leaver events must come from an authoritative source, and here the mover event has no source at all. Privilege creep is the symptom; the missing process is the root cause. A tool automates whatever process exists, and a one-time cleanup decays the moment the next nurse changes jobs, so the first move is to define the process and make HR the system of record that drives it. Breakdown: A. Buying the identity governance platform to automate access reviews is the strong distractor because it is funded, the CIO wants it, and it is the right long-term home for mover handling. Automation needs a defined process and an authoritative feed to automate, and neither exists yet, so the platform would schedule reviews of access that nobody has told it should change. B. Revoking clinical access from all billing staff today removes a real exposure to patient records fast. It is a blanket cut made without knowing who still needs dual access, it risks disrupting care and billing workflows, and it does nothing about the next role change, so the same finding returns at the next audit. C. ✅ Correct. Defining a mover process with HR as the authoritative source fixes the control gap the audit actually found: role changes now trigger a review and removal of old entitlements by design. It gives the one-time cleanup a stopping point and gives the governance platform a process worth automating. D. Recertifying every department's access in a one-time review is the assess-before-you-act instinct and it will be needed to clear the backlog. Without a mover process the recertified state begins drifting the day it is signed off, and managers end up approving access they cannot explain.