Encrypting the information stored on backup tapes is a good way to protect the confidentiality of the data. However, this does not address the issue of pre-existing backup tapes that may contain unencrypted or poorly encrypted data. These tapes may still be accessible by unauthorized parties or subject to theft or loss. Therefore, the organization should also implement a secure disposal or destruction policy for the pre-existing backup tapes, or encrypt them with the same level of protection as the new backup process.

A strategy that is focused solely on implementing security controls without a clear understanding of the organization's specific risks may result in over-engineering or under-engineering security controls. This can lead to unnecessary expense, operational disruption, or a false sense of security.

The components that are in the scope of PCI-DSS are the end devices, wireless access points, WLAN, switches, management console, and firewall. PCI-DSS is a set of standards and requirements that aim to ensure the security of the cardholder data and the payment transactions.
PCI-DSS applies to any entity that stores, processes, or transmits cardholder data, or that provides services or devices that affect the security of the cardholder data. The scope of PCI- DSS includes all the system components that are connected to or support the cardholder data environment, such as the hardware, the software, the network, or the personnel. In this question, the end devices, wireless access points, WLAN, switches, management console, and firewall are all part of the system components that are connected to or support the cardholder data environment, as they are used to process the credit card transactions on the WLAN. Therefore, they are in the scope of PCI-DSS, and they must comply with the PCI-DSS requirements. The entire enterprise network infrastructure and the Internet are not in the scope of PCI-DSS, as they are not directly connected to or support the cardholder data environment, and they are separated from the private segment for credit card processing by the firewall. The border gateway is not a system component, but a term that refers to a device that connects two networks with different protocols, such as a router or a proxy server.

The (ISC)2 Code of Ethics outlines a set of principles that certified professionals, such as CISSPs and other (ISC)2 certification holders, must follow in their professional conduct. The first canon of the (ISC)2 Code of Ethics is:
"Protect society, the common good, necessary public trust and confidence, and the infrastructure." However, the option provided that aligns with the ethical standards and expectations set out in the code is:
B). "Perform all professional activities and duties in accordance with all applicable laws and the highest ethical standards." This statement aligns with the second canon of the (ISC)2 Code of Ethics, which focuses on adhering to laws, regulations, and ethical standards in all professional activities.

Mutual authentication is the process of verifying the identity of both parties in a communication.
The computer system authenticates the user by verifying their credentials, such as username and password, biometrics, or tokens. The user authenticates the computer system by verifying its identity, such as a digital certificate, a trusted third party, or a challenge-response mechanism.