@Dj Sahoo ✅ Correct Answer: C. Escalate the risk to senior management for formal risk acceptance CISSP Logic:When risk exceeds the organization’s stated risk appetite, the CISO does not have authority to accept it unilaterally. CISSP governance principles are explicit: only senior leadership or the designated risk owner can formally accept business risk. The CISO’s role is to clearly articulate the risk and ensure the acceptance decision is made at the correct level. Distractors: A. Risk acceptance without authority violates governance and accountability. B. Compensating controls may reduce risk but do not address acceptance above appetite. C. Correct. Risk above appetite must be escalated for executive decision-making. D. Security leaders advise; they do not unilaterally halt business initiatives. Managerial takeaway: Only senior leadership can accept risk that exceeds the organization’s risk appetite.

@Pamela Solomon Correct Answer: B. Preserve existing logs and establish forensic chain of custody CISSP Logic:Once litigation is possible, the priority shifts from operations to evidentiary integrity. Logs are potential legal evidence, and any alteration—centralizing, normalizing, or fixing timestamps—can compromise admissibility. CISSP Domain 7 emphasizes preserving evidence first, maintaining chain of custody, and preventing spoliation before taking corrective or operational actions. Distractors:A. Centralizing logs alters original evidence and risks contaminating forensic integrity.B. Correct. Preserves evidence and protects legal standing before any remediation.C. Time synchronization fixes accuracy going forward but destroys evidentiary value of existing logs.D. Notification may be required later, but only after evidence is properly preserved. Managerial takeaway:When legal exposure exists, evidence preservation comes before visibility, remediation, or optimization.

@Pamela Solomon Correct, it is B. The first step is to perform a risk assessment and present impact analysis to leadership so they can make an informed risk decision. CISSP emphasizes that security managers provide analysis, while business leadership determines whether to accept, delay, or remediate risk.

"a command-and-control domain ranked second in Cloudflare’s global domain popularity rankings." wow! second!