Whose call is it?

Here’s a question in the style of the CISSP exam. Pick your answer before you read on.

A vulnerability scan finds a high-severity flaw in your company’s main e-commerce site. Fixing it means taking the site offline for 48 hours, and the only available window falls in the busiest sales week of the year. What should the security manager do?

A. Take the site offline and apply the fix right away
B. Explain the risk and the options to the business owner, and let them decide
C. Put compensating controls in place and schedule the fix after the sales week
D. Accept the risk, since the business can’t afford the downtime

Most technically strong candidates pick A or C. A is the instinct of someone who’s spent years fixing things. C feels like a clever compromise, because it protects the site and the sales week at once.

Both are sensible actions. Neither is the best answer.

The best answer is B, because the question is asking whose decision this is. The site belongs to the business, and so does the risk of running it with a known flaw, or of losing two days of sales. The security manager’s job is to make sure the person who owns that risk understands it well enough to choose.

Pick A, C or D and the security manager is making a business decision they don’t own. D is the obvious version of that mistake. C is the same mistake, just harder to spot.

You’ll see this pattern all over the CISSP. Two or three answers describe reasonable things to do, and the best one depends on who should act and when. When you’re stuck between two options, ask whether the decision is yours to make. A surprising number of questions turn on that alone.

It’s also where technical people lose the most points, and it’s a big part of what we teach. John co-authored the first edition of the Official ISC2 CISSP Study Guide, so our Bootcamp is built around how the exam actually thinks, not just what it covers. 93.6% of our mentored MasterClass students pass on their first attempt, and nearly 100% of those who need a second attempt pass on that one.

If you want to practice thinking like the exam before you sit it, our CAT Exam Simulator replicates the actual adaptive format. Questions get harder or easier based on your answers, the same way the real exam works. It’s the closest you can get to the real thing without being in the testing center.

Our next CISSP Bootcamp runs November 30 to December 4.

Any questions? Just reply.

Best,
Rob & John

P.S. Can’t make the bootcamp dates? Our CISSP MasterClass lets you study at your own pace.