A development team adopts a widely used open source library that accelerates delivery of a revenue-critical release. The library has no active maintainer and no published vulnerability disclosure process. What should the security manager recommend FIRST? A. Add the library to the software bill of materials for monitoring B. Evaluate the component against secure acquisition and supply chain criteria C. Fork the library so the organization controls future patching D. Require compensating controls at the application perimeter (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Thank you @Vincent Primiani and everyone in the group.

Hello All, I am so happy to share that I provisionally passed my CISSP exam today :). I want to take this opportunity to thank this community and everyone who were part of the study groups that I was part of. Learned a lot from our discussions, tips and tricks and recommendations that you all shared. I am not sure how I would have passed it today without this community support! You all are awesome :). Completed the test in 100 questions in roughly 2hours and 10mins. Cleared in first attempt (had purchased peace of mind option but now wont have to use it). 11 weeks of preparation. I believe there are many ways/paths/strategies to reach the goal. Below are some of the things that worked for me, maybe you find something that works for you (most of the below ideas I copied from others success stories :)). Learning tips: - Made a broad study plan into 3 phases. Phase 1 and 2 is to complete all 8 domains. Phase 3 is rework and lots of tests. - Each week made a weekly plan of what has to be achieved in the following week. Week starts on Monday and ends on Sunday. Review date is Thursday/Friday to see what is on track and obstacles.  - Took study holiday to catch up on/focused learning sessions. Took 4 days in total (1 each in week 2, 3 and 2 days before the exam day) - After each learning session, took 5-10mins to summarize what was learnt. Without looking. During the session wrote down the key words or headings and then fill it in at the end of the training session. Took quite a few pictures from the training sessions and was a good refresher to go through all the notes and pictures in last few days of the exam. - Learn every day. Take practice questions every day. - Used AI to deep dive and learn about the topic which I could not answer in the mock test. - Took mock tests from different sources/question banks. Taking from one source/question bank can create a bias to getting familiar with the pattern. Idea is to go beyond pattern recognition. - Built a rhythm/routine in the last few days. Repeated the same set of activities. My exam was in the afternoon, so for the last 5 days I did the same routine: Study for 1 hour, followed by morning run for 1 hour, short nap and post lunch full mock test for 2-3 hours! 

I just wanted to say thank you to this group and @Vincent Primiani. It has been a very helpful resource for the content of course, but also for the company and support in kind, like-minded people on the same journey. I wish every one of you nothing but success and hope to reconnect for the next challenge!

I’ve officially passed my CISSP exam! A huge shoutout to this incredible community specially @Vincent Primiani , the cissp.app practice questions, and the insightful live group sessions for pushing me over the finish line. Appreciate all the support here! 🚀🎉