An insurer will replace its claims system with a small vendor's package in 60 days. The vendor keeps admin access for support and has never shown how it tests its code. No acquisition security requirements exist. What should the security manager do FIRST? A. Require a current penetration test report from the vendor B. Define acquisition security requirements and assess the vendor's development practices C. Put the vendor's admin access behind a privileged access gateway D. Scan the delivered package for vulnerabilities before deployment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A bank acquired a fintech and wants both networks joined in 30 days so staff can share systems. The fintech network is flat, runs legacy protocols and was never assessed. What should the security manager do FIRST? A. Deploy a default-deny firewall between the networks B. Assess the fintech network and define trust boundaries C. Segment the fintech network and retire legacy protocols D. Route cross-network traffic through the bank's monitored proxy (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A law firm signed a contract for an offshore vendor to label 50,000 client documents for AI training, starting Monday. The documents are classified Confidential and the handling standard bars external transfer. What should the security manager do FIRST? A. Require the vendor to sign a confidentiality agreement B. Have the data owner rule on reclassification or a documented exception C. Redact client identifiers before any transfer D. Encrypt the transfer and the vendor's storage (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A retailer's data center lease ends in 90 days. Facilities found a cheaper building beside a river with one power feed and wants to sign in two weeks. No site assessment exists. What should the security architect do FIRST? A. Require a second power feed in the lease terms B. Assess the site for natural and physical threats before signing C. Design flood barriers and raised floors into the fit-out D. Transfer the flood and outage risk through insurance (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A SaaS firm's largest customer requires an independent penetration test before renewing in 30 days. The CTO wants the in-house red team to do it, and sales wants only the customer portal tested. What should the security manager do FIRST? A. Have the in-house red team test now to hit the deadline B. Agree scope and independence criteria with the customer C. Hire an external firm to test only the customer portal D. Run a vulnerability scan before any penetration test (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!