@Aidah Nakyejwe Correct Answer: C. Present leadership a business case for the assessment budget Explanation (CISSP logic): This question flips the usual pattern on purpose. "Assess first" is the right instinct, but the scenario plants a constraint: leadership resists funding the analysis. Every security program rests on senior management support, and a CISO cannot execute an assessment leadership hasn't authorized or funded. When the blocker is management buy-in, obtaining that buy-in is Step 1. The business case translates security need into business language, which is the CISO's core job. Breakdown: A. The strong distractor, because it's our own mantra used against us. Assessment is the right destination, but conducting one over leadership's objection means running an unfunded, unsanctioned program. Authority precedes activity. B. Benchmarking against a framework proves conformity, not risk alignment. It's also the tempting shortcut for a resistant leadership team: "we match the framework" is compliance logic, and compliance is a snapshot, not a risk decision. C. ✅ Correct. Secure sponsorship and budget first. The business case gives leadership the information to fund the assessment, making everything downstream legitimate. D. Retroactive documentation is accepting the status quo and papering over it. Controls without risk linkage may be over-spent, under-scoped, or pointed at threats that no longer exist, and now that gap has your signature on it. Think like a manager: The CISO doesn't overrule the business; the CISO informs it. When leadership is the obstacle, persuasion is the first control you deploy.

D. IDS seems most continuous

✅ Correct Answer: B. Register the agent as a distinct non-human identity with a defined owner Explanation (CISSP logic): Identity governance comes before access control. The clue is the accountability gap: a departed developer's account has no owner, so every action the agent takes traces back to nobody. Registering the agent as its own identity with a named owner establishes the accountability foundation that rotation, scoping, and logging all depend on. Breakdown: A. Rotation is good hygiene, but rotating credentials on an orphaned account still leaves the agent operating under someone else's identity. Right action, wrong step. B. ✅ Correct. IAAA starts with identification. The agent needs its own registered identity and owner before any access decisions are made. C. The strong distractor. Least privilege matters, but you cannot properly scope permissions for an identity that does not formally exist yet. Ownership precedes design. D. Logging an orphaned account produces records nobody is accountable for reviewing. Monitoring comes last in the sequence, not first. Think like a manager: An AI agent is a new hire, not a hand-me-down. Great discussion this round. If your org deployed an AI agent tomorrow, who would own its identity: the automation team, IAM, or the business sponsor?

@Paing Zin Correct Answer: A. Preserve forensic images of affected systems before restoration Explanation (CISSP logic): The scenario tells you containment is already active, so the decision on the table is the wipe. Wiping and reimaging is eradication and recovery, and doing it now would permanently destroy the evidence that pending insurance claims and law enforcement referrals depend on. Evidence preservation is the gating step between containment and recovery: once you image the systems, restoration can proceed without sacrificing the investigation, the claim, or potential prosecution. Breakdown: A. ✅ Correct. Capture forensically sound images first. It is the only option that protects evidence integrity while still enabling the restore the business needs. B. Restoring from backup is where the operations team wants to jump, and it's the right destination. But recovery before preservation converts your best evidence into blank disks. Availability pressure is exactly how evidence gets destroyed. C. Notifying the insurer matters, and policies often require prompt notice, but a phone call can happen in parallel. It's the strong distractor because it invokes a real compliance condition, yet it does not stop the irreversible act about to occur. D. Isolating unaffected segments is genuine containment, but the stem says containment is underway. Choosing D means answering a question the team already handled while the evidence gets wiped behind you. Think like a manager: In incident response, the irreversible step waits. Recovery restores the business; preservation protects the truth, and you can only skip one of them once.