B

A. Migrate it under the bank's default classification ( default classification is not aligned with data classification and retention standards ) B. Inventory and classify the data and assign owners ( first proper inventories, classify and owner assignment is aligned with data governance for mergers & acquisitions). C. Encrypt the shares in place until the exam ends ( without adopting option 'B' first, encryption without classification level assignment is violation of both data governance and protection principles). D. Apply the bank's retention schedule and purge first ( retention and purging without first option 'B' is not security and business friendly decision).

B

A. Replace the custom code with a vetted cryptographic library ( Custom cryptography is generally discouraged because it can contain fundamental design flaws even when unit tests pass). B. Set a cryptographic standard and assess the design against it ( first option to standardize the used crypto and assessment of design for secure payment service). C. Commission a penetration test before launch ( PT identifiy vulnarabilities in real attackers perspective, however, successful penetration test would not prove that the encryption is secure). D. Approve launch with a rewrite planned next quarter ( Not business friendly decision to delay launch instead of resolving the fundamental issue of standardized encryption).

B

B- Do not confuse vulnerability counts with business risk. Establish a validated, business-contextualized risk baseline before prioritizing remediation or reporting risk reduction

A. Disable the 400 accounts and notify the agencies (As the engagement ended, 400 accounts should be disabled to mitigate risk and resolve the audit non conformity). B. Assign an owner and define the contractor access life-cycle ( first assignment of owner and access life cycle is important for IdM governance implementation after A) C. Extend single sign-on with mandatory MFA to contractors ( best practice for access management but after B). D. Schedule quarterly access reviews for contractors ( Access reviews are also best for reducing risk of privileged creep and orphaned account, however, disabling and assignment of ownership is priority).