Exam CISSP topic 1 question 390 discussion

Went with C but I am not fully confident in it. Main thing I pulled out is that it is a financial organization so there are likely strict regulations on the encryption of that data over anything else.

ChatGPT says: In the context of protecting the confidentiality and integrity of information systems, the control that should be prioritized FIRST is: C. Encryption of data in transit and data at rest

This is a classic CISSP test of semantics, imo. The answer that correlates to the question is WAF and HTTPS. You have to pay attention to the solution that fits the exact question.

WAF for integrity and HTTPS for confidentiality

This is because encryption provides an additional layer of protection to sensitive data, making it more difficult for attackers to access or steal. Firewall, WAF, HTTPS, and IPS are also important security controls, but encryption should be prioritized first to ensure the confidentiality and integrity of the organization's information systems.

Encryption only protects confidentiality; hashing protects integrity so it can't be C. D does seem the best answer.

I like D. I think C is too much focussed on the data and not on the systems.

Agree with C