CISSP Practice Question: A financial firm is integrating an acquired network with inconsistent security configurations…

Correct Answer: C. Conduct a comprehensive risk assessment and prioritize updates based on risk levels and potential impact.

Explanation (CISSP Manager Logic):

A manager must prioritize security efforts based on business risk and resource constraints rather than technical perfection. A risk assessment identifies high-impact vulnerabilities first, ensuring remediation is strategically aligned with the organization's risk appetite and operational goals.

By conducting a risk assessment, you:

• Identify high-impact vulnerabilities requiring immediate attention.
• Justify resource allocation and budget based on quantifiable risk data.
• Ensure integration proceeds without unnecessary business disruption.

While the other options are relevant, they fall short because:

• A: Replacing all hardware is cost-prohibitive and ignores the possibility of remediating existing assets.
• B: A CMDB is a tracking tool that supports management but does not proactively identify or mitigate existing security gaps.
• D: Total isolation can cripple business operations and delay the realization of merger-and-acquisition value.

Think like a manager:

Security must enable the business, not obstruct it. Always use risk-based decision-making to balance security requirements with cost and operational continuity.