Allowing only corporate IM solutions is the best control to mitigate the malware risk associated with an IM system, because it can prevent unauthorized or malicious IM applications from accessing the network and infecting the system with malware. Corporate IM solutions can also enforce security policies and standards, such as encryption, authentication, and logging, to protect the IM system from malware attacks. Blocking attachments in IM, blocking external IMtraffic, and encrypting IM traffic are also possible controls to mitigate the malware risk, but they are not as effective as allowing only corporate IM solutions. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.4

IT disaster recovery time objectives (RTOs) are the maximum acceptable time that an IT system can be unavailable after a disaster before it causes unacceptable consequences for the business. IT RTOs should be based on the business-defined criticality of the systems, which reflects how important they are for supporting the business processes and functions. The maximum tolerable loss of data, the nature of the outage, and the maximum tolerable downtime (MTD) are also factors that affect the IT RTOs, but they are not the primary basis for determining them.

The correct answer is B. Multiple overwriting.
When storage media will be reused, the goal is to remove sensitive data while keeping the media physically usable. Multiple overwriting writes new patterns of data over existing data so the previous sensitive information is no longer practically recoverable. ISACA describes overwriting as placing an additional layer of information over existing material, with the purpose of protecting the information while not damaging the hard drive itself.
Option A is not correct because cross-cut shredding physically destroys the media. It may be appropriate when media will be disposed of, but not when the storage device must be reused. Option C is not correct because repartitioning changes the disk structure but does not securely erase the underlying data. Option D is not correct because reformatting may remove file system references but often does not securely eliminate recoverable data.
A useful CISA exam point is this:
For reuse, choose logical sanitization such as overwriting.
For disposal, choose physical destruction, degaussing, or shredding depending on the media type and sensitivity.
ISACA notes that common digital data destruction methods include overwriting, degaussing, and physical destruction. Since degaussing and physical destruction generally make media unsuitable for normal reuse, overwriting is the best answer in this question.
References: ISACA CISA Exam Content Outline, Domain 5; ISACA article on data destruction methods.