A large enterprise is expanding through the acquisition of a second corporation. Which of the following should be undertaken FIRST before connecting the networks of the newly formed entity?

Question

Options

• AA system and network scan to determine if all of the systems are secure.
• BImplement a firewall/DMZ system between the networks.
• CDevelop a risk analysis for the merged networks.
• DConduct a complete review of the security posture of the acquired corporation.

• A
  3% (1)
• B
  17% (5)
• C
  70% (21)
• D
  10% (3)

Explanation

Developing a risk analysis for the merged networks (C) must come first. Before any technical action is taken - scanning systems, deploying firewalls, or reviewing security postures - management must understand the overall risk landscape of joining two unknown network environments. The risk analysis identifies assets, threats, vulnerabilities, and the potential business impact of connecting the networks. It establishes the foundation for all subsequent decisions. A system/network scan (A) and security posture review (D) are valuable inputs into the risk analysis, not predecessors to it. Implementing a firewall/DMZ (B) is a mitigation action informed by the risk analysis. Risk analysis drives strategy; all technical steps follow from it.

No community discussion yet for this question.