@Chiru Adapa that’s awesome ! Congratulations we are happy to have you

@Silje Bjørknes welcome!

@David Uchieng Correct Answer: B. Evaluate the component against secure acquisition and supply chain criteria Explanation (CISSP logic): An abandoned library with no disclosure process is a supply chain risk decision disguised as a technical one. CISSP treats third-party software acquisition the same way it treats vendor onboarding: you evaluate the component against defined criteria before it enters the SDLC, not after. The evaluation answers the only question that matters right now, which is whether this dependency is acceptable at all. Every other option assumes the answer is yes. Breakdown: A. Adding it to the SBOM is the strongest distractor because SBOM is exactly the right modern practice for this class of risk. But an SBOM is an inventory control. It tells you that you have an unmaintained library; it does not decide whether you should. It also delivers little value here, since monitoring for disclosed vulnerabilities is nearly useless when nobody is left to disclose them. B. ✅ Correct. Assess the component against acquisition criteria first. That evaluation determines whether you accept, remediate, or reject the dependency. C. Forking is a treatment option chosen before the risk is assessed. It also silently transfers ongoing maintenance and patching liability onto your team, which is a resourcing commitment leadership never agreed to. D. Perimeter compensating controls address exploitation of a flaw you haven't identified in code you haven't evaluated. That's mitigation without analysis. Think like a manager: Free code is not free of obligation. Every dependency you accept is a vendor you onboarded without a contract, so evaluate it like one.

@Geir Johansen ✅ Correct Answer: B. Assess the partner's security posture against connection requirements Explanation (CISSP logic): A signed contract commits the business to the relationship, not to an unconditional network connection. "Security posture is unknown" is the clue: you are being asked to extend your trust boundary to an unmeasured party. Third-party connection due diligence comes before you design the connection. The assessment determines what controls the tunnel actually needs and whether the connection can be permitted at all. Breakdown: A. A screened segment is excellent architecture and the strongest distractor. But it's a design decision made before you know the threat you're isolating. Assessment tells you whether a DMZ termination is sufficient or whether this partner warrants far tighter restrictions. B. ✅ Correct. Assess first. Due diligence on the connecting party defines the requirements every other option is trying to satisfy. C. Full inspection is an operational control applied without knowing what you're inspecting for. It also assumes the connection is already approved, which is the question being skipped. D. Mutual authentication and cipher policy secure the tunnel itself. A perfectly encrypted pipe to a compromised partner delivers threats with excellent confidentiality. Think like a manager: A contract creates an obligation to do business, never an obligation to connect blindly. Assess the party before you build the path.

@Ed Morawski I do want to make some Study Group swag for group leaders and graduates. Hats are just so expensive in a small run. I was thinking a keychain something like this