An insurer will replace its claims system with a small vendor's package in 60 days. The vendor keeps admin access for support and has never shown how it tests its code. No acquisition security requirements exist. What should the security manager do FIRST? A. Require a current penetration test report from the vendor B. Define acquisition security requirements and assess the vendor's development practices C. Put the vendor's admin access behind a privileged access gateway D. Scan the delivered package for vulnerabilities before deployment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Hi all, I’d like to share my exam journey to help those who are currently preparing for it. First of all, I purchased the Peace of Mind (POM) voucher, and I highly recommend it to everyone. During my preparation, I felt mentally exhausted at some point, so I decided to take a step back and consider my approach. One thing that stood out from my exam experience was the number of technical questions, which was significantly higher than I had anticipated. I eventually passed the exam at 100 questions. Interestingly, there were still technical questions, but the overall balance seemed more focused on managerial and scenario-based questions. I also read the OSG cover to cover to identify my knowledge gaps. Although it was helpful, I wouldn't recommend going through the entire book unless you really need to. This is where I spent most of my preparation time without getting the best return on investment. Practice Questions – The Most Important Part of My Preparation Here are the resources I used, All of them added something valuable to my preparation. 1. Quantum Exams 2. Prep IQ Practice Questions (From Udemy) 3. Cissp Study Group & cissp.app 4. DestCert Mobile App A Few Final Tips - Get the Peace of Mind voucher. Knowing you have a second chance takes away a significant amount of psychological pressure during preparation. - Don't spend all your time reading books. Focus on practice questions, understanding the reasoning behind each answer, and identifying your weak areas. - When you finally sit in that exam chair, treat it as your only shot. Trust your instincts when answering scenario-based questions. Don't overthink things, and remember that understanding the mindset behind the questions is just as important as knowing the material. Good luck to everyone preparing for the exam! <3

Hi Everyone, I Passed the CISSP exam on Saturday. I attempted the exam in April 2024 but did not pass. Before now I used the following study materials - Official Study Guide (OSG) 9th edition, Sunflower, Luke Ahmed's How to think like a manager, ISC2 official exam prep and few you tube videos by Andrew Ramdayal. Preparing for this attempt, I joined the CISSP Skool Community where I gave me access to all the CISSP test questions and answers with explanation posted by Vincent and most importantly I joined the daily collaborative learning link where I was privileged to study alongside folks like Ed, Matthew, Ricardo, Pavithra, Aidah. Vishal, David, Babar, Emma and others using numerous question banks. I believed this helped me expand my learning and sharpening my exam mindset. I found this write up for my last minutes study - Cleared For Wealth | Break into defense contracting and build real wealth in IT as posted by Chiru. I really appreciate everyone that has helped me accomplish this milestone, especially to Vincent for running such a wonderful platform.

A bank acquired a fintech and wants both networks joined in 30 days so staff can share systems. The fintech network is flat, runs legacy protocols and was never assessed. What should the security manager do FIRST? A. Deploy a default-deny firewall between the networks B. Assess the fintech network and define trust boundaries C. Segment the fintech network and retire legacy protocols D. Route cross-network traffic through the bank's monitored proxy (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A new cloud provider wants to provide cloud services to consumers in its local region. The company is currently marketing its service models and trying to attract prospective customers. Which of the following SERVICE MODELS can the cloud provider NOT advertise under their service offering? A. Cloud storage drive B. Pre-configured virtual machines to upload source code for the developers C. Ready-to-use virtual machines with no operating system and applications D. Dedicated cloud service made available to companies