@Olena Chumachenko Correct Answer: B. Define sanitization requirements from the data classification held Explanation (CISSP logic): The clues are "back in two weeks", "quick format before shipping", "no sanitization standard exists" and "regulated client data". Asset security runs from classification to disposal: the handling a device gets at end of life is set by the most sensitive data it held, and a quick format leaves that data recoverable, which is data remanence by another name. Nobody has written down what sanitization the regulated data requires, so the format, the destruction and the extension are all being argued without a requirement to meet. Assess before you act: classify what was on the drives, state the sanitization level that classification demands, and the method and the timeline follow. Breakdown: A. A quick format with signed manifests is the strong distractor because it meets the deadline and leaves a paper trail. But a format removes the index, not the data, so the manifests document the handover of 400 drives that still hold regulated client records, and the signature proves custody, not sanitization. B. ✅ Correct. Defining the sanitization requirement from the classification tells the manager whether clearing, purging or destruction is required for these drives, and whether every laptop needs the same treatment. That single decision sets the method, the evidence to keep and whether two weeks is even achievable. C. Physically destroying every drive is the safest outcome for the data and may be exactly what the classification demands. But the laptops belong to the lessor, destroying 400 drives without a requirement behind it breaches the contract and the budget, and it treats a laptop that held nothing sensitive the same as one that held everything. D. Negotiating an extension buys time and shows the manager respects the deadline rather than cutting corners. It still assumes full disk wiping is the right method, which nobody has established, and if the classification calls for destruction the extra weeks are spent on a wipe the regulator will not accept.

@Vishal Kumar Correct Answer: B. Threat model the new flows and set trust boundaries Explanation (CISSP logic): The clues are "quarter-end demo", "inside the application trust zone" and "no threat model exists for the new flows". Secure design starts by understanding what is crossing which boundary: an AI assistant that reads policyholder records is a new path for data to leave the zone, and placing it inside that zone to save time is a design decision made before anyone has asked what could go wrong. Threat modelling names the assets, the entry points and the trust boundaries, and every control that follows, segmentation, encryption or access limits, is chosen to answer a threat it found. Assess before you act: a demo deadline does not change the order. Breakdown: A. Segmenting the assistant into its own zone is the strong distractor because it is the architect's instinct and may well be the end state. But it is a boundary drawn before the threats are known, so it can isolate the wrong thing, block flows the business needs for the demo and still leave the record access path untouched. B. ✅ Correct. A threat model of the new flows shows where policyholder data moves, who and what can reach the assistant, and which boundaries actually matter. The trust boundaries it sets tell the architect whether the assistant belongs inside the zone at all and which of the other three controls are worth building. C. Encrypting every record the assistant can read protects data at rest and is a sound control. The assistant reads records in the clear to answer questions, so encryption does nothing to the flow that is actually new, and bulk encryption adds key management cost without reducing the exposure the demo creates. D. Read-only access is least privilege in action and will probably appear in the final design. It limits what the assistant can change, not what it can disclose, and the risk in this scenario is policyholder data leaving through answers, which a read-only grant permits in full.

@Tayo Olaomi Correct Answer: C. Define the disclosure policy and scope the assets in play Explanation (CISSP logic): The clues are "live before a funding round", "no vulnerability disclosure policy exists" and "internet-facing assets were never inventoried". Security assessment and testing starts with scope and rules of engagement: you cannot invite strangers to attack systems you have not listed, under terms you have not written. The disclosure policy sets what researchers may touch, how findings are reported and how fast the company must respond, and the asset inventory tells you what is actually exposed. Assess before you act: a bounty launched without either is an unmanaged test with a marketing deadline. Breakdown: A. A private bounty on the main application is the strong distractor because it looks cautious, small and fast enough for the 30 days. But it still needs a policy to govern the researchers and a scope to define the target, and limiting it to one app by guesswork leaves every uninventoried system exposed to the same testers with no rules at all. B. An authenticated scan is a legitimate assessment activity and will surface known weaknesses quickly. It tests only what you point it at, so without an inventory it repeats the same blind spot, and it does nothing to set the disclosure terms the board's bounty depends on. C. ✅ Correct. Writing the disclosure policy and scoping the assets gives the program its rules of engagement, its safe harbour for researchers, its response commitments and its target list. Every later step, the private bounty, the scan or an external test, then runs inside a boundary the company chose rather than one it discovers. D. An external penetration test brings independence and a defined report before launch, which a board would welcome. It is a point-in-time assessment that also needs a scope to be worth anything, and it answers a different question from whether the company is ready to run a continuous public program.

@Ronald Zierikzee Correct Answer: D. Assess the reset process and define identity proofing requirements Explanation (CISSP logic): The clues are "phoning the outsourced help desk", "purchased this month" and "no standard defines how callers prove identity". Identity and Access Management starts with identity proofing: an authenticator is only as strong as the process that issues and resets it, and here the reset path is the door the attackers used twice. Nobody has written down what proof a caller must give, so every control on the table is being chosen without a requirement to meet. Assess before you act: map how resets really happen, then set the proofing standard the help desk contract and the tools must satisfy. Breakdown: A. Phishing-resistant MFA is the strong distractor because it is modern, funded and almost certainly part of the end state. But the attackers did not phish anyone, they talked the help desk into a reset, and a stronger authenticator that the same desk can re-enroll or bypass on a phone call leaves the door exactly where it was. B. A manager callback is a sensible out-of-band check and may well appear in the final procedure. It is one control picked before the requirement exists, it fails when the manager is unreachable or is the one being impersonated, and applied to every reset it trades availability for a safeguard nobody has sized. C. Retraining addresses the human weakness and awareness belongs in the program. But staff cannot be trained to follow a standard that does not exist, and with an outsourced desk the obligation has to live in the process and the contract, not in the memory of whoever takes the next call. D. ✅ Correct. Assessing the reset process shows how callers are verified today, where the two attacks got through and what the provider is contractually bound to do. The proofing requirements that come out of it tell you which resets need stronger evidence, and the MFA purchase, the callback and the training are then chosen to meet them.