Your organization passes its annual SOC 2 Type II audit with no findings. Two months later, a penetration test reveals a critical vulnerability in a customer-facing application that has existed for over a year. The board questions why the audit missed it. What is the BEST explanation? A. The penetration testing firm used more advanced techniques than the SOC 2 auditors B. SOC 2 evaluates control design and operating effectiveness, not technical vulnerability discovery C. The audit scope was improperly defined and should have included application testing D. The auditors failed to meet professional due diligence standards Come back for the answer tomorrow, or study more now!

During a third-party risk assessment, you discover a critical SaaS vendor stores customer data in a jurisdiction that conflicts with your organization's data residency requirements. The vendor scores well on every other security benchmark. The contract renewal deadline is in two weeks. What should you do FIRST? A. Require the vendor to migrate data to a compliant region before renewal B. Engage legal counsel to assess regulatory exposure and contractual options C. Renew the contract with an addendum requiring future data residency compliance D. Begin evaluating alternative vendors that meet data residency requirements Come back for the answer tomorrow, or study more now!

A developer commits API credentials into a public repository and immediately deletes the commit. The security team discovers the credentials are still visible in the repository's commit history. The API provides read access to customer records. What should you do FIRST? A. Purge the commit history to remove the exposed credentials from the repository B. Revoke and rotate the compromised API credentials immediately C. Scan customer records for evidence of unauthorized access using the exposed keys D. Implement pre-commit hooks to prevent future credential exposure in repositories Come back for the answer tomorrow, or study more now!

During an acquisition integration, you discover the target company grants domain administrator privileges to its entire 12-person IT department. They argue the small team requires broad access for operational efficiency. Your organization's policy enforces least privilege. What should you do FIRST? A. Immediately revoke domain admin from all subsidiary IT staff and assign role-based access B. Conduct a privileged access audit to map which admin functions each role actually requires C. Allow current access with enhanced monitoring until integration is complete D. Require the subsidiary to adopt your identity governance platform before network integration Come back for the answer tomorrow, or study more now!

Your organization's risk register is maintained by a single senior analyst who built custom scoring formulas undocumented outside his workstation. He announces his resignation with two weeks notice. The next quarterly risk review is in three weeks. What should you do FIRST? A. Hire a replacement analyst before the departing employee's last day B. Conduct an immediate knowledge transfer to document the scoring methodology C. Postpone the quarterly risk review until a replacement is onboarded D. Assign the risk register to the internal audit team as an interim measure Come back for the answer tomorrow, or study more now!