B The CFO has already decided to fund a second cloud region because of a previous outage. However, there is no BIA, the organisation does not know its required RTO/RPO/MTPD, and the actual business impact of downtime has not been formally assessed. A BIA identifies critical business processes, financial and operational impacts, acceptable downtime, recovery priorities, and RTOs and RPOs. Only after these requirements are defined can the organisation determine whether a second region is necessary and sufficient to business requirements. Business requirements drive technical solutions, not the other way around.

B From the scenario given the environment contains: - Clinical devices from six vendors - A flat network - Multiple requests for remote support access - No existing network security requirements The logic is to determine: - Which devices are highest risk - What level of network segmentation is required - How vendors may access systems remotely - Authentication, monitoring, and logging requirements - Whether access should be persistent or on-demand Once these requirements are defined, the organisation can implement the appropriate architecture. Risks -> Security architecture design -> Technical implementation.

C There are no vulnerability disclosure policy exists, internet-facing assets were never inventoried, and Board wants a bug bounty launched quickly. A bug bounty programme requires: 1.Clear rules of engagement and disclosure process. 2.Defined scope (what can and cannot be tested). 3.Asset inventory and ownership. 4.Triage and response procedures. Therefore, it should be Governance → Scope → Assessment → Bug Bounty.

B The scenario explicitly states: - The laptops contain regulated client data. - No sanitisation standard exists. - IT wants to do a quick format. The security manager's first responsibility is to determine what level of sanitisation is required based on the classification and sensitivity of the data. Only after the requirements are defined can an appropriate method be selected (clear, purge, cryptographic erase, destroy, etc.). Data classification → Sanitisation requirements → Sanitisation method → Verification → Disposal You cannot decide whether quick formatting, wiping, crypto-erase, or destruction is appropriate until you know the required level of protection.

B