HR suspects a departing engineer copied source code to a personal drive. The engineer leaves Friday and the CTO wants IT to search the laptop today. What should the security operations manager do FIRST? A. Have IT review the laptop's file history for proof B. Disable the engineer's accounts and seize the laptop now C. Preserve the device and logs under chain of custody with legal D. Report the suspected theft to law enforcement (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A key customer wants a site-to-site link into the plant network in 30 days so its ordering system can read live inventory. The contract is signed and the customer's security posture is unknown. What should the security manager do FIRST? A. Build the tunnel, firewall rules limited to inventory B. Assess the risk and define the connection's requirements C. Require the customer's security assessment report first D. Publish inventory through an isolated extranet segment (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Finance wants a server holding ten years of contracts retired by quarter end to cut costs. No retention schedule exists and two vendor disputes are open. What should the security manager do FIRST? A. Archive everything to cloud storage, then wipe the server B. Confirm retention and legal hold needs with legal and records owners C. Have records owners delete anything older than seven years D. Cryptographically erase the drives after a verified backup (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A manufacturer buys a smaller rival in 30 days. The CEO wants its network joined to the corporate cloud on day one. Its security posture has never been reviewed. What should the security manager do FIRST? A. Connect it behind a restrictive firewall B. Require it to adopt corporate security policies C. Perform security due diligence on its environment D. Extend cyber insurance to cover its systems (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Ransomware hits a file server mid product launch, and the sales VP wants last night's backup restored within the hour. Nobody has invoked the incident response plan. What should the security operations manager do FIRST? A. Restore the server from backup to protect the launch B. Isolate the server and preserve volatile evidence C. Declare the incident and activate the response plan D. Scan neighboring hosts to gauge how far it spread (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!