An autonomous AI agent needs credentials to query production databases and invoke internal APIs on a recurring schedule. The automation team proposes reusing a departed developer's service account to launch quickly. What should the IAM manager require FIRST? A. Rotate the credentials and transfer the account to the automation team B. Register the agent as a distinct non-human identity with a defined owner C. Scope the account's permissions to only the required datasets D. Enable enhanced logging on all agent-initiated transactions (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

I’ve officially passed my CISSP exam! A huge shoutout to this incredible community specially @Vincent Primiani , the cissp.app practice questions, and the insightful live group sessions for pushing me over the finish line. Appreciate all the support here! 🚀🎉

During active ransomware containment, the operations team wants to immediately wipe and reimage infected servers to restore a critical service. Cyber insurance and law enforcement notifications are pending. What should the incident commander do FIRST? A. Preserve forensic images of affected systems before restoration B. Restore the service from the most recent clean backup C. Notify the cyber insurer to avoid violating policy conditions D. Isolate remaining unaffected segments to prevent spread (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

The CISSP mindset is fundamentally that of a strategic risk manager and trusted advisor, not a hands-on technical firefighter. It requires evaluating every security decision through the dual lenses of business alignment and risk management—prioritizing human life and safety above all else, followed closely by business continuity and asset protection. Rather than aiming for absolute, cost-prohibitive security, a CISSP practitioner seeks to reduce risk to an acceptable level through balanced, cost-effective administrative, physical, and technical controls. This mindset demands a holistic view of the organization, ensuring security policies are proactive rather than reactive, compliance and legal requirements are met, and security functions as an enabler of business goals rather than a bottleneck. Ultimately, thinking like a CISSP means taking accountability for governance, understanding the broader operational impact of security decisions, and constantly advocating for defense-in-depth across the entire enterprise lifecycle.

A development team adopts a widely used open source library that accelerates delivery of a revenue-critical release. The library has no active maintainer and no published vulnerability disclosure process. What should the security manager recommend FIRST? A. Add the library to the software bill of materials for monitoring B. Evaluate the component against secure acquisition and supply chain criteria C. Fork the library so the organization controls future patching D. Require compensating controls at the application perimeter (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!