Attackers twice reset executive passwords by phoning the outsourced help desk. The CIO wants phishing-resistant MFA purchased this month. No standard defines how callers prove identity. What should the security manager do FIRST? A. Deploy phishing-resistant MFA for all executives B. Require manager callback approval for every reset C. Retrain help desk staff on social engineering D. Assess the reset process and define identity proofing requirements (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

HR suspects a departing engineer copied source code to a personal drive. The engineer leaves Friday and the CTO wants IT to search the laptop today. What should the security operations manager do FIRST? A. Have IT review the laptop's file history for proof B. Disable the engineer's accounts and seize the laptop now C. Preserve the device and logs under chain of custody with legal D. Report the suspected theft to law enforcement (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A sales team built a customer portal on a low-code platform without security involvement and wants it live Monday. It holds customer contracts and nobody owns its code or data. What should the security manager do FIRST? A. Schedule a penetration test before Monday B. Move the portal into the corporate development pipeline C. Assess the portal's data, risk and ownership before release D. Require secure coding training for the sales team (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Finance wants a server holding ten years of contracts retired by quarter end to cut costs. No retention schedule exists and two vendor disputes are open. What should the security manager do FIRST? A. Archive everything to cloud storage, then wipe the server B. Confirm retention and legal hold needs with legal and records owners C. Have records owners delete anything older than seven years D. Cryptographically erase the drives after a verified backup (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A logistics firm's new warehouse robotics design puts robots, cameras and the ERP link in one trust zone to hit go-live. Design sign-off is next week. What should the security architect do FIRST? A. Require segmentation between robots, cameras and the ERP link B. Threat model the design against requirements and risk appetite C. Approve it with compensating monitoring until segmentation is funded D. Mandate zero trust device authentication before go-live (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!