@Sanni Kadiri Correct Answer: B. Assess the fintech network and define trust boundaries Explanation (CISSP logic): The clues are "wants both networks joined in 30 days", "flat, runs legacy protocols" and "was never assessed". Domain 4 secures network architecture by deciding where trust boundaries sit and what may cross them, and a merger is the moment that decision gets made for a network you did not build. Joining an unassessed flat network to the bank imports every unknown on it: unmanaged hosts, cleartext protocols, forgotten remote access, maybe an attacker already inside. The manager's first job is to find out what is there and define the zones and the flows the business actually needs, because every control that follows is only as good as the boundary it enforces. Breakdown: A. Deploying a default-deny firewall between the networks is the strong distractor because it is the right device at the right place and it will almost certainly be in the final design. A default-deny rule set with no defined flows either blocks the integration the business funded or gets opened one exception at a time until it is default-allow with extra steps; the rules come from the assessment, not before it. B. ✅ Correct. Assessing the fintech network and defining trust boundaries turns an unknown into an architecture: which systems staff must reach, which legacy protocols are in play, what must stay isolated and what the interconnect must inspect. The firewall, the segmentation plan and the monitoring design are all outputs of that work, and the 30-day date is met by scoping the first connection to the flows that matter. C. Segmenting the fintech network and retiring legacy protocols is sound engineering and will probably be the remediation plan. It is a design and implementation decision made before anyone has mapped the network, it will not finish inside 30 days, and it fixes the acquired estate without deciding how it should connect to the bank at all.

@David Uchieng Correct Answer: B. Have the data owner rule on reclassification or a documented exception Explanation (CISSP logic): The clues are "classified Confidential", "the handling standard bars external transfer" and "signed a contract, starting Monday". Domain 2 is built on one chain: the data owner classifies the asset, the classification sets the handling requirements, and everyone else operates inside them. Here a business unit has contracted around that chain, and the standard as written says the transfer cannot happen. Controls do not override classification; only the owner can decide the label was too high or grant a documented, risk-accepted exception. The manager's first job is to put that decision in front of the owner before Monday, because any control applied first is enforcing a transfer nobody authorised. Breakdown: A. Requiring the vendor to sign a confidentiality agreement is the strong distractor because it is what the contract team expects to hear and it will almost certainly be part of the final package. An agreement is a transfer control, and the firm's own standard says this data does not leave at all; paperwork with the vendor does not change what the label permits. B. ✅ Correct. Having the data owner rule on reclassification or a documented exception restores the chain: the owner decides whether the documents are really Confidential, or whether the business case justifies an exception with named conditions. Every control that follows, contract terms, redaction, encryption, offshore restrictions, is then enforcing a decision the accountable party made. C. Redacting client identifiers before any transfer is sound data minimisation and may be exactly what the owner requires as a condition. Done first, it assumes the transfer is going ahead and assumes redaction alone changes the classification, which is the owner's call, not the security team's. D. Encrypting the transfer and the vendor's storage protects data in transit and at rest and will be in any approved design. It secures a movement the handling standard forbids, and the offshore labelling team has to decrypt the documents to do the work, so it answers a threat nobody asked about.

@Shemaiah E Correct Answer: B. Assess the site for natural and physical threats before signing Explanation (CISSP logic): The clues are "a cheaper building beside a river with one power feed", "wants to sign in two weeks" and "no site assessment exists". Domain 3 covers site and facility design, and the first design decision is the site itself: natural hazards, utility resilience, crime, neighbouring occupants and access routes are fixed by location and cannot be engineered away later. The lease is the point of no return, so the architect's first job is to put a site threat and hazard assessment in front of the people about to sign, because every control that follows is only as good as the ground it stands on. Breakdown: A. Requiring a second power feed in the lease terms is the strong distractor because the single feed is a real availability gap and the lease is the moment to fix it. It is one control for one hazard chosen before anyone has listed the hazards, and a second feed does nothing for a server hall under a metre of river water. B. ✅ Correct. Assessing the site for natural and physical threats before signing turns a cheap building into a known quantity: flood return period, power and telecom diversity, neighbours, access and crime. The result tells the business whether to sign, what to put in the lease and what the fit-out must defend against, in that order. C. Designing flood barriers and raised floors into the fit-out is good facility engineering and may well be needed. It is a design answer to a risk nobody has sized, it commits capital to a site not yet chosen, and it treats the river as the only threat when the assessment may find a worse one. D. Transferring the flood and outage risk through insurance is a legitimate risk treatment and will likely be part of the final package. Insurance pays money after the data center is dark; it restores nothing, and an insurer prices the policy on the very assessment the firm has not done.

@Rajdeep Ajmani Correct Answer: B. Agree scope and independence criteria with the customer Explanation (CISSP logic): The clues are "requires an independent penetration test", "the CTO wants the in-house red team to do it" and "sales wants only the customer portal tested". Domain 6 is about assurance, and assurance is only worth what its independence and scope make it worth. The customer asked for independence, which an in-house team cannot provide however skilled it is, and the scope is being set by the people with the most to gain from a narrow one. Before anyone tests anything, the manager has to agree with the customer what "independent" means and what the test must cover, because a report that fails either check will not get the contract renewed. Breakdown: A. Having the in-house red team test now to hit the deadline is the strong distractor because the team knows the platform and the clock is real. It fails the one requirement the customer actually stated: independence of assurance. A report from the people who built and defend the system is self-attestation, and the customer can reject it with 30 days gone. B. ✅ Correct. Agreeing scope and independence criteria with the customer settles the two things that decide whether the report is accepted: who is independent enough to sign it and what it must cover. Everything after that, choosing the firm, scheduling, remediation, is executed against a target the customer has already endorsed. C. Hiring an external firm to test only the customer portal gets the independence right and is probably close to the final answer. The scope was set by sales to be small, not by the customer to be sufficient, so the manager risks paying for a test the customer rejects because it never touched the shared services behind the portal. D. Running a vulnerability scan before any penetration test is good hygiene and often part of the test plan. It is a technical activity that answers none of the open questions, and finding issues early does not make a self-run, narrowly scoped test any more acceptable to the customer.