Your organization wants to integrate a third-party pre-trained ML model into an internal application. The vendor provides the model weights but no documentation on the training data sources. As the security lead, what is the MOST appropriate action BEFORE integration? A. Run the model in an isolated sandbox and monitor its behavior B. Require a software bill of materials covering the model and its provenance C. Scan the model file for embedded malware before deployment D. Limit the model's runtime permissions to read-only data access Come back for the answer tomorrow, or study more now!

Your organization deploys an autonomous AI agent that queries multiple internal data repositories to generate executive reports. The development team requests broad read access "so the model can learn what's relevant." As the security architect, what is the MOST appropriate approach? A. Grant read-only access to all repositories and log every query for review B. Provision a non-human identity with least-privilege, task-scoped entitlements C. Route all agent queries through a human-approved request workflow D. Use the developer's service account credentials for traceability Come back for the answer tomorrow, or study more now!

A healthcare organization uses a centralized identity management system for user authentication and authorization. The system supports single sign-on (SSO) and multi-factor authentication (MFA). Recently, the security team identified multiple incidents of unauthorized access attempts. During the investigation, it was discovered that compromised user credentials were being used. Which of the following actions would be MOST effective in mitigating this threat? A) Implement behavioral biometrics for continuous authentication. B) Require password complexity and regular password changes. C) Implement adaptive access controls based on user behavior and risk scoring. D) Conduct a company-wide security awareness training on phishing prevention.

Which of the following is an essential component of a disaster recovery plan related to personnel? A) Intrusion detection system (IDS) B) Employee training and awareness C) Physical access controls to data centres D) Defining roles and responsibilities during a disaster

An e-commerce company collects and processes customer data, including payment card information. The company is expanding its operations to new regions with strict data protection laws. As part of its compliance efforts, the security team is tasked with ensuring proper data classification and implementing appropriate controls. While conducting a data classification audit, the team finds multiple unstructured data repositories containing customer information without clear labeling or access restrictions. Which of the following should the team do FIRST to mitigate this risk? A) Apply automated data discovery tools to identify and classify sensitive information. B) Implement data loss prevention (DLP) solutions to monitor and control data movement. C) Enforce access controls and least privilege principles on all data repositories. D) Develop a comprehensive data classification policy and train employees on data handling procedures.