10.5. Reflection Checkpoint

Exam Strategy Summary

• Think like a senior security manager. Governance over technical. Root cause over symptom. Sequence matters.
• "First" questions: find the correct process step 1. "Best" questions: find the option that addresses the broadest, most fundamental issue.
• Domains are interconnected. A question describing a DR scenario (D7) with a regulatory notification requirement (D1) and data classification question (D2) is a single integrated scenario.
• When two answers both seem correct: the correct one protects the organization, follows the established sequence, and considers risk management over technical remediation.

Self-Check

• An organization's risk register shows a vendor software vulnerability rated CVSS 9.1. The vendor has not released a patch. The system processes regulated health data. What is the correct sequence of actions — and which domains govern each action?
• A new CISO reviews the security program and finds that policies exist and are reviewed annually, controls are implemented, but there is no formal process to verify controls are operating as intended. Which domain closes this gap, and what specific program element is missing?